Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I almost got hacked by a 'job interview'

blog.daviddodda.com

Post reply on HN
Print view View original

81–90 of 534 posts

Re: I almost got hacked by a 'job interview'

#81

Post by lukebechtel »

DavidDodda wrote: post #68
nubg wrote: post #9

This article was written by an LLM. I get that the author might be self-conscious about his English writing skills, but I would still much rather read the original prompt that the author put into ChatGPT, instead of the slop that came out. The story - if true - is very interesting of course. Big bummer therefore that the author decided to sloppify it. David, could you share as a response to this comment the original…

thanks for the feedback. just fyi - this went though 11 different versions before reaching this point. so I am not able to share the full chat because i used Claude with google docs integration. but hears the google doc i started with https://docs.google.com/document/d/1of_uWXw-CppnFtWoehIrr1ir... this and the following prompt ``` 'help me turn this into a blog post. keep things interesting, also make sure you take a…

Thank you for sharing

Re: I almost got hacked by a 'job interview'

#82

Post by perching_aix »

labrador wrote: post #71

As a retired graybeard, it's weird to me that people run unsecured JavaScript on Nodejs all day without a second thought. Powershell scripts have to be signed or explicitly trusted. But JavaScript on Node... nada.

Why? It's no different than any other code. That's the whole point - the cover story is that it's a take-home coding test with some sample code provided.

Re: I almost got hacked by a 'job interview'

#83

Post by ludicrousdispla »

atropoles wrote: post #27

I had someone who was targeting junior developers posting on Who Wants to Be Hired threads here on Hacker news. They reached out saying they liked my projects and had something I might be interested in, then set up an interview where they tried to get me to install malware.

even some of the submissions on 'who is hiring?' can be sketchy

Re: I almost got hacked by a 'job interview'

#84

Post by firefoxd »

DavidDodda wrote: post #68
nubg wrote: post #9

This article was written by an LLM. I get that the author might be self-conscious about his English writing skills, but I would still much rather read the original prompt that the author put into ChatGPT, instead of the slop that came out. The story - if true - is very interesting of course. Big bummer therefore that the author decided to sloppify it. David, could you share as a response to this comment the original…

thanks for the feedback. just fyi - this went though 11 different versions before reaching this point. so I am not able to share the full chat because i used Claude with google docs integration. but hears the google doc i started with https://docs.google.com/document/d/1of_uWXw-CppnFtWoehIrr1ir... this and the following prompt ``` 'help me turn this into a blog post. keep things interesting, also make sure you take a…

I can assure you, the original prompt was pretty well written and would have been received well. Don't let LLMs easy of use distract you from your own ability to write and get a point across.

Re: I almost got hacked by a 'job interview'

#86

Post by flerchin »

devy wrote: post #66
Aurornis wrote: post #51

Earlier quoted context omitted.

Create an account and let it age. Seasoned accounts are a positive heuristic in many domains, not just LinkedIn. For example, I some times use web.archive.org to check a company's domain to see how far back they've been on the web. Even here on HN, young accounts (green text) are more likely to be griefing, trolling, or spreading misinformation at a higher rate than someone who has been here for years.

> Seasoned accounts are a positive heuristic in many domains, not just LinkedIn. Yep. This is how the 3 major credit bureaus is the United States to verify your identity. Your residence history and your presences on the distributed Internet is the HARDES to fake.

But account takeover gives all these bona fides.

Re: I almost got hacked by a 'job interview'

#87

Post by tempodox »

ryandrake wrote: post #6

> The scary part? This attack vector is perfect for developers. We download and run code all day long. GitHub repos, npm packages, coding challenges. Most of us don't sandbox every single thing. Embedded into this story about being attacked is (hopefully) a serious lesson for all programmers (not just OP) about pulling down random dependencies/code and just yolo'ing them into their own codebases. How do you know your…

Everybody considers themselves protected by the golden rule: Bad things only ever happen to other people.

Re: I almost got hacked by a 'job interview'

#88

Post by yieldcrv »

ryandrake wrote: post #6

> The scary part? This attack vector is perfect for developers. We download and run code all day long. GitHub repos, npm packages, coding challenges. Most of us don't sandbox every single thing. Embedded into this story about being attacked is (hopefully) a serious lesson for all programmers (not just OP) about pulling down random dependencies/code and just yolo'ing them into their own codebases. How do you know your…

> Most of us don't sandbox every single thing.

And I do sandbox everything, but its complicated

Many of these projects are set to compile only on the latest OS' which makes sandboxing even more difficult and impossible on VM, which is actually the red flag

So I sandbox but I don't get to the place of being able to run it

so they can just assume I'm incompetent and I can avoid having my computer and crypto messed up

Re: I almost got hacked by a 'job interview'

#89

Post by flatline »

DavidDodda wrote: post #68
nubg wrote: post #9

This article was written by an LLM. I get that the author might be self-conscious about his English writing skills, but I would still much rather read the original prompt that the author put into ChatGPT, instead of the slop that came out. The story - if true - is very interesting of course. Big bummer therefore that the author decided to sloppify it. David, could you share as a response to this comment the original…

thanks for the feedback. just fyi - this went though 11 different versions before reaching this point. so I am not able to share the full chat because i used Claude with google docs integration. but hears the google doc i started with https://docs.google.com/document/d/1of_uWXw-CppnFtWoehIrr1ir... this and the following prompt ``` 'help me turn this into a blog post. keep things interesting, also make sure you take a…

The content was good for me up till “The Operation.” Typical of AI output in my experience - some solid parts then verbose, monotonous text that fits one of a handful of genai patterns. “Sloppified” is a good term, once I realize I’m in the middle of this type of content it pulls me out of the narrative and makes me question the authenticity of the whole piece, which is too bad. Thanks for your transparency here and the prompt, I think this approach will prove beneficial as we barrel ahead with widespread AI content.

Re: I almost got hacked by a 'job interview'

#90

Post by croes »

ryandrake wrote: post #6

> The scary part? This attack vector is perfect for developers. We download and run code all day long. GitHub repos, npm packages, coding challenges. Most of us don't sandbox every single thing. Embedded into this story about being attacked is (hopefully) a serious lesson for all programmers (not just OP) about pulling down random dependencies/code and just yolo'ing them into their own codebases. How do you know your…

Is it even possible to look at all dependencies and their dependencies and their dependencies…?
Post reply on HN