Being given a technical test for an unsolicited job interview to me would raise some flags. No way I'm doing that before we talk, you came to me remember?
I almost got hacked by a 'job interview'
61–70 of 534 posts
Re: I almost got hacked by a 'job interview'
#62> The scary part? This attack vector is perfect for developers. We download and run code all day long. GitHub repos, npm packages, coding challenges. Most of us don't sandbox every single thing. Embedded into this story about being attacked is (hopefully) a serious lesson for all programmers (not just OP) about pulling down random dependencies/code and just yolo'ing them into their own codebases. How do you know your…
I go to the repo and get a feel for how popular, how recent, and how active the project is. I then lock it and I only update dependencies annually or if I need to address a specific issue. Risk gets managed, not eliminated. There is no one "correct" approach as risk is a sliding scale that depends on your project's risk appetite.
Popular, recent and active are each easily gameable no?
Re: I almost got hacked by a 'job interview'
#63Earlier quoted context omitted.
I go to the repo and get a feel for how popular, how recent, and how active the project is. I then lock it and I only update dependencies annually or if I need to address a specific issue. Risk gets managed, not eliminated. There is no one "correct" approach as risk is a sliding scale that depends on your project's risk appetite.
Popular, recent and active are each easily gameable no?
Of course. A malware-infected dependency has motivation to pay for GitHub stars and fake repo activity. I would never trust any metric that measures public "user activity". It can all be bought by bad actors.
Re: I almost got hacked by a 'job interview'
#64I had someone who was targeting junior developers posting on Who Wants to Be Hired threads here on Hacker news. They reached out saying they liked my projects and had something I might be interested in, then set up an interview where they tried to get me to install malware.
Name and shame. It's the only way to help others.
I will say that it was good enough that with some improvement I could see that it might be very successful against people like me who are new to the software job market. A combination of being unfamiliar with what is normal for that kind of situation and a strong desire for things to go well is quite dangerous.
Also goes to show that anywhere there is desperation there will be people preying on it.
Re: I almost got hacked by a 'job interview'
#65I've been posting on HN's "who wants to be hired" and "freelancer" posts, and for the last couple months all I've got have been suspiciously similar emails from randoms asking me to schedule an online interview for a great "opportunity". They never state exactly what that "opportunity" is about. After some hours of not participating on it they will write again - have got three of them, from different gmail emails, all of them following the same script.
Re: I almost got hacked by a 'job interview'
#66Earlier quoted context omitted.
How am I supposed to become a real, trustable person on LinkedIn if I'm not already there?
Create an account and let it age. Seasoned accounts are a positive heuristic in many domains, not just LinkedIn. For example, I some times use web.archive.org to check a company's domain to see how far back they've been on the web. Even here on HN, young accounts (green text) are more likely to be griefing, trolling, or spreading misinformation at a higher rate than someone who has been here for years.
> Seasoned accounts are a positive heuristic in many domains, not just LinkedIn.
Yep. This is how the 3 major credit bureaus is the United States to verify your identity. Your residence history and your presences on the distributed Internet is the HARDES to fake.
Re: I almost got hacked by a 'job interview'
#67I got so tired of python venvs and craziness that I ended up moving my whole dev environment into docker containers. Guess I've accidentally protected myself against some of these attacks.
Re: I almost got hacked by a 'job interview'
#68This article was written by an LLM. I get that the author might be self-conscious about his English writing skills, but I would still much rather read the original prompt that the author put into ChatGPT, instead of the slop that came out. The story - if true - is very interesting of course. Big bummer therefore that the author decided to sloppify it. David, could you share as a response to this comment the original…
thanks for the feedback. just fyi - this went though 11 different versions before reaching this point.
so I am not able to share the full chat because i used Claude with google docs integration. but hears the google doc i started with
https://docs.google.com/document/d/1of_uWXw-CppnFtWoehIrr1ir...
this and the following prompt
``` 'help me turn this into a blog post.
keep things interesting, also make sure you take a look at the images in the google doc' ```
with this system prompt
``` % INSTRUCTIONS - You are an AI Bot that is very good at mimicking an author writing style. - Your goal is to write content with the tone that is described below. - Do not go outside the tone instructions below - Do not use hashtags or emojis
% Description of the authors tone:
1. *Pace*: The examples generally have a brisk pace, quickly moving from one idea to the next without lingering too long on any single point.
2. *Mood*: The mood is often energetic and motivational, with a sense of urgency and excitement.
3. *Tone*: The tone is assertive and confident, often with a hint of humor or sarcasm. There's a strong sense of opinion and authority.
4. *Style*: The style is conversational and informal, using direct language and often incorporating lists or bullet points for emphasis.
5. *Voice*: The voice is distinctive and personal, often reflecting the author's personality and perspective with a touch of wit.
6. *Formality*: The formality is low, with a casual and approachable manner that feels like a conversation with a friend.
7. *Imagery*: Imagery is used sparingly but effectively, often through vivid metaphors or analogies that create strong mental pictures.
8. *Diction*: The diction is straightforward and accessible, with a mix of colloquial expressions and precise language to convey ideas clearly.
9. *Syntax*: The syntax is varied, with a mix of short, punchy sentences and longer, more complex structures to maintain interest and rhythm.
10. *Rhythm*: The rhythm is dynamic, with a lively beat that keeps the reader engaged and propels the narrative forward.
11. *Perspective*: The perspective is often first-person, providing a personal touch and direct connection with the audience.
12. *Tension*: Tension is present in the form of suspense or conflict, often through challenges or obstacles that need to be overcome.
13. *Clarity*: The clarity is high, with ideas presented in a straightforward manner that is easy to understand.
14. *Consistency*: The consistency is strong, maintaining a uniform style and tone throughout each piece.
15. *Emotion*: Emotion is expressed with intensity, often through passionate or enthusiastic language.
16. *Humor*: Humor is present, often through witty remarks or playful language that adds a light-hearted touch.
17. *Irony*: Irony is occasionally used to highlight contradictions or to add a layer of complexity to the narrative.
18. *Symbolism*: Symbolism is used subtly, often through metaphors or analogies that convey deeper meanings.
19. *Complexity*: The complexity is moderate, with ideas presented in a way that is engaging but not overly intricate.
20. *Cohesion*: The cohesion is strong, with different parts of the writing working together harmoniously to support the overall message.```
Re: I almost got hacked by a 'job interview'
#69Earlier quoted context omitted.
I go to the repo and get a feel for how popular, how recent, and how active the project is. I then lock it and I only update dependencies annually or if I need to address a specific issue. Risk gets managed, not eliminated. There is no one "correct" approach as risk is a sliding scale that depends on your project's risk appetite.
Popular, recent and active are each easily gameable no?
Yup, for sure. But part of risk management is considering how likely a failure mode might be and if it's really worth paying to mitigate. Developers are really good at imagining failure modes, but often not so good at estimating their likelihood/cost.
I have no "hard rules" on how to appraise a dependency. In addition to the above, I also like to skim the issue tracker, skim code for a moment to get a feel for quality, skim the docs, etc. I think that being able to quickly skim a project and get a feel for quality, as well as knowing when to dig deeper and how deep to dig are what makes someone a seasoned developer.
And beware of anyone who has opinions on right vs. wrong without knowing anything about your project and it's risk appetite. There's a whole range between "I'm making a microwave website" and "I'm making software that operates MRIs."
Re: I almost got hacked by a 'job interview'
#70Earlier quoted context omitted.
Interesting, I didn't know there is such thing on Li! Is this done by past employers?
You just verify that you have access to an email address that belongs to a company (@example.com) by entering a six digit code they send to your work email. This in theory verifies that you work there, but obviously nothing else like your actual position at the company. From an attacker standpoint, if an attacker gains access to any email address with @example.com, they could pretend to be the CEO of example.com even…
This is a optional/invite only feature. LinkedIn doesn't provide that work email validation feature for all employers on their platform. Why did I know that? Because my past startup was requesting LinkedIn to enable that so that we can enable that feature but they said it's an invite only feature. Internally, I think they are only invite those employers who has certain amount of employees and/or revenues to turn it on.
Apple / Google developer program uses Dun&Bradstreet to verify company and developer identities. That's another way. But LinkedIn doesn't have that feature (yet).