Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I almost got hacked by a 'job interview'

blog.daviddodda.com

Post reply on HN
Print view View original

271–280 of 534 posts

Re: I almost got hacked by a 'job interview'

#271

Post by koito17 »

The take-home assignments I've recently done, thankfully, were open-ended, and you were also evaluated based on how you architect the software, repository, etc. However, take-home assignments requiring one to download an existing project seem a lot more dangerous now.

> This attack vector is perfect for developers. We download and run code all day long. GitHub repos, npm packages, coding challenges. Most of us don't sandbox every single thing.

Even if it reflects badly on myself, one of the first things I do with take-home assignments is set up a development environment with Nix, together with the minimum infrastructure for sandboxed builds and tests. The reason I do this is to ensure the interviewer and I have identical toolchains and get as close to reproducible builds as possible.

This creates pain points for certain tools with nasty behavior. For instance, if a Next.js project uses `next/fonts`, then *at build time* the Next.js CLI will attempt issuing network requests to the Google Fonts CDN. This makes sandboxed builds fail.

On Linux, the Nix sandbox performs builds in an empty filesystem, with isolated mount / network / PID namespaces, etc. And, of course, network access is disallowed -- that's why Next.js is annoying to get working with Nix (Next.js CLI has many "features" that trigger network requests *at build time*, and when they fail, the whole build fails).

> Always sandbox unknown code. Docker containers, VMs, whatever. Never run it on your main machine.

Glad to see this as the first point in the article's conclusion. If you have not tried sandboxed builds before, then you may be surprised at the sheer amount of tools that do nasty things like send telemetry, drop artifacts in $HOME (looking at you, Go and Maven), etc.

Re: I almost got hacked by a 'job interview'

#272

Post by awesome_dude »

cddotdotslash wrote: post #252
Wowfunhappy wrote: post #233

This article is so interesting, but I can’t shake the feeling it was written by AI. The writing style has that feel for me. Maybe that shouldn’t bother me? Like, maybe the author would never have had time to write this otherwise, and I would never have learned about his experience. But I can't help wishing he'd just written about it himself. Maybe that's unreasonable--I shouldn't expect people to do extra work for fr…

It’s incredibly annoying to read. So many super short sentences with the “not just X. Also Y” format. Little hooks like “The attack vector?” “Not fancy security tools. Not expensive antivirus software. Just asking my coding assistant…” I actually feel like AI articles are becoming easier to spot. Maybe we’re all just collectively noticing the patterns.

FTR I sometimes use AI to make my writing more "professional" because I rite narsty like

I've recently had to say "My CV has been cleaned up with AI, but there are no hallucinations/misrepresentations within it"

Re: I almost got hacked by a 'job interview'

#273

Post by rdtsc »

Wowfunhappy wrote: post #233

This article is so interesting, but I can’t shake the feeling it was written by AI. The writing style has that feel for me. Maybe that shouldn’t bother me? Like, maybe the author would never have had time to write this otherwise, and I would never have learned about his experience. But I can't help wishing he'd just written about it himself. Maybe that's unreasonable--I shouldn't expect people to do extra work for fr…

> This article is so incredibly interesting, but I can’t shake the feeling it was written by AI. The writing style has all the telltale signs.

The sadder realization is that after enough AI slop around, real people will start talking like AI. This will just become the new standard communication style.

Re: I almost got hacked by a 'job interview'

#274

Post by joomla199 »

Wowfunhappy wrote: post #233

This article is so interesting, but I can’t shake the feeling it was written by AI. The writing style has that feel for me. Maybe that shouldn’t bother me? Like, maybe the author would never have had time to write this otherwise, and I would never have learned about his experience. But I can't help wishing he'd just written about it himself. Maybe that's unreasonable--I shouldn't expect people to do extra work for fr…

I had the same feeling, but also the feeling that it was written for AI, as in marketing. That’s probably not the case, but it looks suspicious because this person only found this issue using AI and would’ve otherwise missed it, and then made a blog post saying so (which arguably makes one look incompetent, whether that’s justifiable or not, and makes AI look like the hero).

Re: I almost got hacked by a 'job interview'

#275

Post by verteu »

teiferer wrote: post #212

> A fake coding interview from a "legitimate" blockchain company. You seriously expect serious actors in that space? No more questions.

YC funded a similar "blockchain real estate" company: https://www.ycombinator.com/companies/lofty

(I admit I can't see how the blockchain adds any real value to their offering.)

Re: I almost got hacked by a 'job interview'

#276

Post by awesome_dude »

devy wrote: post #16

The pseudonym "Mykola Yanchii" on LinkedIn [1] doesn't look real at all. Click "More" button -> "About this profile", RED FLAGS ALL OVER. -> Joined May 2025 -> Contact information Updated less than 6 months ago -> Profile photo Updated less than 6 months ago Funny things, this profile has the LinkedIn Verified Checkmark and was verified by Persona ?!?! -> This might be a red flag for Persona service itself as it migh…

> -> Joined May 2025 -> Contact information Updated less than 6 months ago -> Profile photo Updated less than 6 months ago

It's a red flag to be a new entrant on a platform.

FTR Wikipedia/Stak Overflow have also encountered this problem (with no real solution in sight) and new market entrants (new products) struggle with traction because they're "new" and untested, which is why marketing is such a big thing, and one of the biggest upfront costs for companies entering a market

Re: I almost got hacked by a 'job interview'

#277

Post by aftergibson »

Wowfunhappy wrote: post #233

This article is so interesting, but I can’t shake the feeling it was written by AI. The writing style has that feel for me. Maybe that shouldn’t bother me? Like, maybe the author would never have had time to write this otherwise, and I would never have learned about his experience. But I can't help wishing he'd just written about it himself. Maybe that's unreasonable--I shouldn't expect people to do extra work for fr…

I read this comment first then attempted to read this article but whether it's this inception or it's genuinely AI-ish, I'm now struggling to read this article.

The funny thing is, for years I've had this SEO-farm bullshit content-farm filter and the AI impact for me has been, an increasing mistrust of anything written by humans or not. I don't even care if this was AI written, if it's good, great! However, the... 'genuine-ness' of it or lack of it, is an issue. It doesn't connect with me anymore and I feel/connect to any of it.

Weird times.

Re: I almost got hacked by a 'job interview'

#279

Post by g-b-r »

DavidDodda wrote: post #249
Wowfunhappy wrote: post #233

This article is so interesting, but I can’t shake the feeling it was written by AI. The writing style has that feel for me. Maybe that shouldn’t bother me? Like, maybe the author would never have had time to write this otherwise, and I would never have learned about his experience. But I can't help wishing he'd just written about it himself. Maybe that's unreasonable--I shouldn't expect people to do extra work for fr…

that was the case. you can find the base write up and the prompt used in one of my comments on this post. i did not have much time to work on this at all, being in the middle of a product launch at my work, and a bunch of other 'life' stuff. thanks for understanding.

Next time maybe just post the base write up and the prompt? What value does the llm transformation add, other than wasting every reader's time (while saving yours)?

Re: I almost got hacked by a 'job interview'

#280

Post by awesome_dude »

cortesoft wrote: post #165
devy wrote: post #66

Earlier quoted context omitted.

> Seasoned accounts are a positive heuristic in many domains, not just LinkedIn. Yep. This is how the 3 major credit bureaus is the United States to verify your identity. Your residence history and your presences on the distributed Internet is the HARDES to fake.

> Your residence history and your presences on the distributed Internet is the HARDEST to fake. Only if you don’t plan ahead. I can’t remember which book/movie/show it was from, but there was a character who spent decades building identities by registering for credit cards, signing up for services, signing leases, posting to social media, etc so that they could sell them in the future. Seems like it would be trivial…

Sounds a bit like the practice of shelf companies, where people create companies, give them a basic history with the tax department, etc, purely for the purpose of selling them to people who need a company with such a history to .. hide things

https://en.wikipedia.org/wiki/Shelf_corporation

Post reply on HN