Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Inspected My Take-Home Interview Project. It Was a Whole Operation

citizendot.github.io

Post reply on HN
Print view View original

131–135 of 135 posts

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#131

Post by yuye »

SoftTalker wrote: post #86
CM30 wrote: post #64

Hmm, did anyone else have issues loading the screenshots here? I had to open most of them in a new tab to see them. Regardless, that's a pretty sneaky scam, and definitely something that caught out a ton of would be candidates in the past. What's more, the Visual Studio Code project mentioned in the article sounds even more horrifying. Like, the tool seriously lets you run custom code whenever someone opens your proj…

It's like Microsoft forgot about all the malware that was promulgated by Word and Excel macros that would run automatically when you opened a document.

You mean the same company that allowed CDs/DVDs/USB drives to automatically run binaries by simply adding autorun.inf?

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#132

Post by CITIZENDOT »

ErroneousBosh wrote: post #116

I don't understand why you'd just clone a random repo that someone tells you to like that. If you want to hire me, I do not want to see your code until I see money from you. I do not want your code on my computer until there is a contract and quite a lot of money in my account. Even then, I'd prefer you to keep your code on your computers, which I will connect to. For a "take-home interview"? You want me to work for…

i wish world is so fair

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#133

Post by CITIZENDOT »

zeratax wrote: post #113
zombot wrote: post #100

The post title really buries the lede. > You don’t even have to run a git command, just opening this directory in VSCode is enough to get infected. The old adage that Microslop and Security in the same sentence is a contradiction in terms still applies, now with a vengeance. Never open 3rd-party stuff with VSCode.

Okay but this is just not true here. VSCode always first asks you if you trust the author of this code and if not gives you the option to open the directory in restricted mode

> VSCode always first asks you if you trust the author of this code

until we do that, VSCode doesn't let us interact with the codebase, so we end up clicking that trust as soon as we open the directory and move on.

When VSCode detects launch commands in ".vscode", It should be rather explicit about running it, like "Trusting this workspace runs the following command on your behalf"

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#135

Post by CITIZENDOT »

CM30 wrote: post #64

Hmm, did anyone else have issues loading the screenshots here? I had to open most of them in a new tab to see them. Regardless, that's a pretty sneaky scam, and definitely something that caught out a ton of would be candidates in the past. What's more, the Visual Studio Code project mentioned in the article sounds even more horrifying. Like, the tool seriously lets you run custom code whenever someone opens your proj…

updated my website to use jsdeliver CDN for article images. thanks for pointing out.
Post reply on HN