Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I was asked to crack a program in a job interview

erenyagdiran.github.io

Post reply on HN
Print view View original

121–130 of 309 posts

Re: I was asked to crack a program in a job interview

#121

Post by mandlar »

akx wrote: post #62
Swizec wrote: post #20

Earlier quoted context omitted.

Nope, according to wikipedia on ";" > Modern style guides recommend no space before them and one space after. And that's really interesting about French. Personally I think a colon surrounded by spaces looks funny, but then again, I've never learned a language where that wasn't the correct way. edit: my French girlfriend says French puts spaces on both sides of all punctuation except commas and periods. Like this ! W…

The spaces-before-questionmarks-and-exclamation-marks is one of the "tells" I use to figure out a writer is French. More often than not it's a dead giveaway...

Funny story, I'm a native English speaker but I've been studying French for the past few years. I now constantly and subconsciously add spaces before punctuation like French grammar.

Re: I was asked to crack a program in a job interview

#122

Post by fsniper »

claar wrote: post #118
fsniper wrote: post #94

Earlier quoted context omitted.

Well, email is the primary threat distribution medium right now. So If a security engineer do not show scepticism about an unsigned, unencrypted email from an unverified source, I get picky. Looking from probability perspective, yes you are right, this is a low threat vector. Also I consider working root in a vm an issue because security 101 lesson 1 is "avoid privileged accounts as much as possible". Why not work in…

"Security 101" isn't all that relevant when you actually understand the threat vectors. If you can't create a clean, isolated, snapshot'd VM for this sort of playing, you have no business applying for this sort of job.

You are absolutely right.

But what about screw up vectors or being careless stack up in this?

People are sloppy. It's easy to do mistakes and loose everything. Working with crackme binaries needs more attention.

Re: I was asked to crack a program in a job interview

#123

Post by davidgerard »

kstenerud wrote: post #104
vault11th wrote: post #86

Earlier quoted context omitted.

Nobody puts a gun to applicant's head and forces him to take a test, so... Business is not for people to have jobs but to make profit.

The point is that you'll only get applicants up to a certain level. Once an applicant has enough skill and knows it, and also values his time, he'll take one look at your 14 hour challenge and laugh. So in the end you're only hurting yourself because you'll mostly get naive and easily manipulated people who are fine for the lower ranks but absolute poison once they move up. That's if they don't wise up and leave firs…

The test I describe should take an hour or two - it's a test of "can you actually do these things your CV claims you can?" Which is nontrivial, but I enjoyed taking it (fix a broken thing!) and feel fine about giving it to others.

Re: I was asked to crack a program in a job interview

#124

Post by icebraining »

joezydeco wrote: post #3

That's some impressive work. But then... "The company send me another crack me for round 2 :) That's also interesting.." That wasn't enough to get the job?

Hopefully not, I did a few similar crack-mes after reading just a couple of tutorials for dummies on the matter. On the Hack x Crack (awesome Spanish magazine from the early 2000s) forums, these were just the level 1 :)

(I never did pass level 2)

Re: I was asked to crack a program in a job interview

#125

Post by davidgerard »

fsniper wrote: post #120
davidgerard wrote: post #96

Earlier quoted context omitted.

In this case, being able to Google how to fix a slightly-misconfigured Apache and Tomcat counts as passing the test with flying colours. Becoming a Google-Certified [whatever] Engineer at the drop of a hat is something we regard as a serious positive in a sysadmin. Open book tests are never easy.

Someone still calling sysadmins instead of devops in HackerNews is a rare thing. :) I know many so called sysadmins who could not pass this test in a reasonable time. Sometimes people without even basic script-fu or networking knowledge are considered sysadmins. And this drives me crazy.

Yeah. I'm thinking of Joel Spolsky's 199/200 who are just the same bozos cycling through interviews until someone hires them by accident ...

"devops" is fighting words in our team. Damn, if I could get our devs who'd like "devops" on their CV to give a hoot about the "-ops" half of that buzzword ... when a dev shows awareness of ops issues with their shiny new thing, I make a point of mentioning their name positively to the dev manager. "X knows their stuff. Give them more good stuff."

Re: I was asked to crack a program in a job interview

#126

Post by michaelchisari »

davidgerard wrote: post #110
michaelchisari wrote: post #107

Earlier quoted context omitted.

> Real-life tests are THE best thing to send job candidates I agree, but only if you're allowed to use references/google/etc and given a reasonable amount of time to accomplish it. I've had a "real-life" test where I wasn't allowed to verify or look up information, or where I'm giving a very short time to execute, and I've always thought those were absurd. The idea that you would ever have to do something like this i…

Yeah, this is an open-book test. Of course, there's tests like user:B5Geek's, where the candidate gets a PC with a slightly-unplugged network cable and has to realise this fact.

Yeah, but B5Geek's is a pretty entry-level thing. I've encountered whiteboard tests where you have to recreate an algorithm that someone spent their PhD thesis creating. It seems like a good way to find "geniuses", but it just isn't practical.

In a lot of ways, it's a matter of identity crisis for software developers. We're all, industry included, not quite sure whether we're mechanics, carpenters, architects or scientists.

Re: I was asked to crack a program in a job interview

#127

Post by davidgerard »

michaelchisari wrote: post #126
davidgerard wrote: post #110

Earlier quoted context omitted.

Yeah, this is an open-book test. Of course, there's tests like user:B5Geek's, where the candidate gets a PC with a slightly-unplugged network cable and has to realise this fact.

Yeah, but B5Geek's is a pretty entry-level thing. I've encountered whiteboard tests where you have to recreate an algorithm that someone spent their PhD thesis creating. It seems like a good way to find "geniuses", but it just isn't practical. In a lot of ways, it's a matter of identity crisis for software developers. We're all, industry included, not quite sure whether we're mechanics, carpenters, architects or scie…

True. Testing for sysadmins is easier: you're after a way of thinking. So a competence test ("can you do what you claimed?") with a freeform "keep notes on your thinking along the way" is quite informative. You still need to interview, of course.

I confess I don't know how I'd apply this to developers. They pass fizzbuzz, OK - what do you do next?

Re: I was asked to crack a program in a job interview

#128

Post by icebraining »

fsniper wrote: post #71

The post started very well but with the first screen shot, my mind started tingling: What the heck a security engineer is doing in a root shell? An unknown binary sent via an email is run in a root shell. There is also no mention of email source tracking. Hey you are a security engineer you know about weakness of smtp right? Even if this is a virtual machine, I would really reconsider employment of him or sit down an…

First, you don't know if he downloaded the file from this machine. It could even be networkless.

Second, instead of a VM, it could be a livecd with no permanent storage attached. That's what I'd do if I had to debug potentially malicious binaries.

It's fine to ask, but it's wrong to assume.

Re: I was asked to crack a program in a job interview

#129

Post by fsniper »

davidgerard wrote: post #125
fsniper wrote: post #120

Earlier quoted context omitted.

Someone still calling sysadmins instead of devops in HackerNews is a rare thing. :) I know many so called sysadmins who could not pass this test in a reasonable time. Sometimes people without even basic script-fu or networking knowledge are considered sysadmins. And this drives me crazy.

Yeah. I'm thinking of Joel Spolsky's 199/200 who are just the same bozos cycling through interviews until someone hires them by accident ... "devops" is fighting words in our team. Damn, if I could get our devs who'd like "devops" on their CV to give a hoot about the "-ops" half of that buzzword ... when a dev shows awareness of ops issues with their shiny new thing, I make a point of mentioning their name positively…

:) When devs are in the loop it always comes to "working in localhost" debate. I like to say developers are working or living in their isolated bubble. And whenever their code comes out of that bubble and reach the real world ops are on fire.

Always the ops guys are in fault.

I think every developer should be given sysadmin 101 and 102 lessons.

Re: I was asked to crack a program in a job interview

#130

Post by shuzchen »

psychometry wrote: post #81
davidgerard wrote: post #46

Real-life tests are THE best thing to send job candidates. It scales well (you don't have to spend personal hours on them) and you get real information. This applies even to sysadmins. We have a favourite: set up a VM with a slightly-broken application in a slightly-broken Apache and Tomcat, and get them to ssh in and document the process of fixing it. Even people who aren't a full bottle on Tomcat will give useful i…

It's an effective strategy from the employer's side, but what about the applicant who is asked to spend hours on some test for every job he/she applies for? Are you paying these applicants for the time they spend jumping through these hoops? And if your "technical grilling" fails to identify strong candidates, you're obviously asking the wrong questions or, at the very least, not asking the right ones.

For the most part I don't complain if asked for an hour (or less) worth of work. I mean, I probably spend more time researching the company, working on the cover letter, replying to communications, and scheduling follow-ups. I'd much rather spend an hour at home with resources I know, than an hour in a room with a whiteboard.
Post reply on HN