Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How not to hire a North Korean plant posing as a techie

theregister.com

Post reply on HN
Print view View original

71–80 of 134 posts

Re: How not to hire a North Korean plant posing as a techie

#71

Post by AnimalMuppet »

Run_DOS_Run wrote: post #66

>Evading in-person meetings or requests for drug tests. I am surprised about the request for drug tests. Is this common in the US? Except for high-security jobs, which are never possible remotely anyway, I have never heard of a client or employer asking for a drug test. If I got a request for a drug test, I would quit immediately. Even if I am sure it is negative, my private life is my business. Any attempt to contro…

High security jobs. Jobs in finance. Anything involving driving or operating machinery. Maybe customer-facing jobs. Basically anywhere where, if you're stoned, you could cause damage to the company.

Re: How not to hire a North Korean plant posing as a techie

#72

Post by figassis »

flerchin wrote: post #33
some_random wrote: post #30

Earlier quoted context omitted.

I don't know where you're seeing that, what advice here would make it hard or impossible to hire real remote freelancers other than maybe the in person meetings?

No RDP, no VPNs, verified working locations. Typically freelancers work from wherever they want, on any random starbucks wifi.

Regarding RDP, the issue might be the same as no SSH into machines where you can break out of. Best practice for devs is to work locally and submit PRs? For non tech workers, I don't see the need to RDP anywhere since applications today are mostly cloud based, and others are license based, you'd need a license for the employee to use, say, autodesk tools, so they can install locally. No RDP is good advice either way.

For VPNs, I think they mean non company provided VPNs. So if they're needed, the company should provide them. I can se a scenario where your ISP throttling your traffic or you want to secure traffic and your employer has no VPN. Idk how I'd solve this one.

Verified working locations: I work usually from home or my office, but when I travel, it's usually not a secret where I am, I don't actively try to hide it, it's visible during zoom calls, etc. It's about the level of trust you build with your employer. I have stopped by HQ once or twice while on vacation but that is not required. Overall don't have shady patterns?

But...I am certain companies are not reasonable and some will conflate RDP with any remote thing. Others have no idea how to setup vpn infra, and others simply can't fathom that a remote employee can/should travel while working. So they will have policies that will make remote workers ineligible for hiring.

Re: How not to hire a North Korean plant posing as a techie

#73

Post by etimberg »

ornornor wrote: post #68
Run_DOS_Run wrote: post #66

>Evading in-person meetings or requests for drug tests. I am surprised about the request for drug tests. Is this common in the US? Except for high-security jobs, which are never possible remotely anyway, I have never heard of a client or employer asking for a drug test. If I got a request for a drug test, I would quit immediately. Even if I am sure it is negative, my private life is my business. Any attempt to contro…

My first “real” job demanded a background check where they could “interview my neighbors to get a sense of my character” and other egregious things. I tried many times to get in touch with the background check provider’s (backcheck in Canada) privacy team, never ever got to a human or anyone to return my voicemails. The employer was completely incredulous I would refuse to submit to the background check and thought I…

What kind of job was this for? because interviewing neighbours is something that sounds like part of a top secret clearance not a private company background check

Re: How not to hire a North Korean plant posing as a techie

#74

Post by Der_Einzige »

seanmcdirmid wrote: post #67
Run_DOS_Run wrote: post #66

>Evading in-person meetings or requests for drug tests. I am surprised about the request for drug tests. Is this common in the US? Except for high-security jobs, which are never possible remotely anyway, I have never heard of a client or employer asking for a drug test. If I got a request for a drug test, I would quit immediately. Even if I am sure it is negative, my private life is my business. Any attempt to contro…

Intel had me do a drug test just for an internship that I was almost going to take in 1996 or 97. I'm not sure if they still do that, I haven't had a drug test since getting my Chinese work visa (which required a drug and Aids test).

No drug tests at Intel for SWE blue badges circa 2015-2017.

Re: How not to hire a North Korean plant posing as a techie

#75

Post by Modified3019 »

Run_DOS_Run wrote: post #66

>Evading in-person meetings or requests for drug tests. I am surprised about the request for drug tests. Is this common in the US? Except for high-security jobs, which are never possible remotely anyway, I have never heard of a client or employer asking for a drug test. If I got a request for a drug test, I would quit immediately. Even if I am sure it is negative, my private life is my business. Any attempt to contro…

In the US it’s fairly common policy to have when the employee could present a liability issue, such as driving a company provided vehicle, or operating heavy/dangerous equipment. Drug tests are a “cover our ass” measure and also make getting rid of “that fucking guy” easier.

In practice it varies heavily on how it’s implemented, generally a company isn’t really keen to spend the money and time on that shit until after they’ve been burned by incidents.

- Could be once on hiring, then only if you really fuck up. This is what my company does.

- Could be “random” testing that just so happens to “randomly” catch the obvious fuckwit who walked in after driving to work while probably blitzed and now wants to hop in a sprayer.

- Could be genuinely random testing.

I work in Agriculture, and my company provides me a work pickup truck (funny enough, my ATV in the back is my actual “work” vehicle if you consider time spent driving) along with fuel, which I can make reasonable personal use of. The tradeoff is they demand the ability to get notified of tickets/points added on my license, and if I start repeatedly getting speeding tickets and ignore the “hey, stop that shit” talk they give me, they’ll ultimately rescind the free vehicle they’ve provided me. Getting a DUI would very likely result in immediate termination. Which I consider fair enough

If I worked a desk job and don’t have a situation where altered states of mind would present a massive danger to myself, others, and company equipment, then yeah drug tests can fuck right off.

Re: How not to hire a North Korean plant posing as a techie

#76

Post by vkou »

AnimalMuppet wrote: post #71
Run_DOS_Run wrote: post #66

>Evading in-person meetings or requests for drug tests. I am surprised about the request for drug tests. Is this common in the US? Except for high-security jobs, which are never possible remotely anyway, I have never heard of a client or employer asking for a drug test. If I got a request for a drug test, I would quit immediately. Even if I am sure it is negative, my private life is my business. Any attempt to contro…

High security jobs. Jobs in finance. Anything involving driving or operating machinery. Maybe customer-facing jobs. Basically anywhere where, if you're stoned, you could cause damage to the company.

> Basically anywhere where, if you're stoned, you could cause damage to the company.

Does the C-suite also get regular, supervised piss-in-a-cup tests, or do they actually not have as much impact on the success of the firm as they claim to?

Re: How not to hire a North Korean plant posing as a techie

#77

Post by vkou »

RIMR wrote: post #55
Tabular-Iceberg wrote: post #36

Wouldn’t throwing tantrums and threatening to violate NDAs over petty cash just undermine their entire spying operation?

It sounds to me like the US released a report about NK espionage operations, and then people "thought" (as the article phrases it) that NK operatives were everywhere, and now we have this article that just seems to tie the most obnoxious freelancer behavior to NK espionage, without any actual evidence.

We're just repeating an old page from an old playbook.

> Back in 1937 Comrade Stalin pointed out that as long as the Soviet Union existed amid capitalist encirclement we would have wreckers, spies, saboteurs and murderers sent to our home front by foreign states. [1]

Just change the names and the years and the professions around, and we'll be good to go. The actual existence, non-existence, or prevalence of spies, saboteurs and wreckers is second fiddle to the perception thereof. :)

[1] https://soviethistory.msu.edu/1947-2/xenophobia/xenophobia-t...

Re: How not to hire a North Korean plant posing as a techie

#78

Post by r2_pilot »

alexjplant wrote: post #63
zikduruqe wrote: post #48

Earlier quoted context omitted.

This. If there is a government contract involved, even if you are not working directly on it, you will have to pee in a cup. But getting around that is stupid easy and simple, it is laughable.

> This. If there is a government contract involved, even if you are not working directly on it, you will have to pee in a cup. This is not correct. When I held a clearance (which I don't anymore and won't again) the Department of Defense never made me take a drug test. I did, however, work for a publicly-traded government contractor that made me take one both times that they hired me as a matter of course. I worked f…

Not that this helps you now, but I believe if the reagent test fails, they immediately GCMS the sample to both determine the quantitative amount of substance in question, as well as rule out false positives, so you probably would have been fine (for the diphenhydramine at least).

Re: How not to hire a North Korean plant posing as a techie

#79

Post by nerpderp82 »

seanmcdirmid wrote: post #67
Run_DOS_Run wrote: post #66

>Evading in-person meetings or requests for drug tests. I am surprised about the request for drug tests. Is this common in the US? Except for high-security jobs, which are never possible remotely anyway, I have never heard of a client or employer asking for a drug test. If I got a request for a drug test, I would quit immediately. Even if I am sure it is negative, my private life is my business. Any attempt to contro…

Intel had me do a drug test just for an internship that I was almost going to take in 1996 or 97. I'm not sure if they still do that, I haven't had a drug test since getting my Chinese work visa (which required a drug and Aids test).

I was a contractor for Motorola and had to take a drug test, I have never consumed so much water in my life.

Re: How not to hire a North Korean plant posing as a techie

#80

Post by maximinus_thrax »

Run_DOS_Run wrote: post #66

>Evading in-person meetings or requests for drug tests. I am surprised about the request for drug tests. Is this common in the US? Except for high-security jobs, which are never possible remotely anyway, I have never heard of a client or employer asking for a drug test. If I got a request for a drug test, I would quit immediately. Even if I am sure it is negative, my private life is my business. Any attempt to contro…

> Except for high-security jobs, which are never possible remotely anyway, I have never heard of a client or employer asking for a drug test.

Some companies have contracts with the Federal Government and even if you won't be working on those projects or won't have to get the security clearance, there are certain clauses in the contracts which requires the company to not have employees drink at work, to drug test employees and other stuff like that.

I once was asked to do a drug test as the offer was contingent on the drug test to clear because of this kind of contract. I rejected the offer from other reasons, but the recruiter told me we can schedule the drug test weeks in advance, to make sure 'everything is out of your system, just in case'. It was a urine test, and I got the feeling that the company was trying to make sure the test was going to clear regardless of my lifestyle outside of work, no questions asked.

Also, the recruiter told me it was a one-time thing for me and other 'general purpose' employees, but persons directly involved in the whole security clearance government stuff were subject to random testing.

Post reply on HN