5 ms·

A naughty CV hack

72 points by jlangenauer 17y ago

tptacek 17y ago
First, I'd get annoyed if I found you tried to bug a CV you sent me. I'd definitely tell you not to send something like that to my clients. Second, I think that while HTML resumes are a fine thing to post on your website, they are a terrible format for sending to a prospective employer. You are virtually guaranteed that it will be mangled behind comprehension by the time an interviewer gets it. Don't send HTML resumes. Don't send DOC files. Send PDFs. Hiring managers expect to have to read PDFs, they will print reliably, and they won't launch MS Office when someone clicks on them. PDF. It's the way to go.
- viraptor 17y ago
  > [...] HTML resumes [...] You are virtually guaranteed that it will be mangled Do you mean it will be changed by other people, or...? I'm not sure who are you expecting to mangle it and why.
  - tptacek 17y ago
    No, I don't mean on purpose.
  - callahad 17y ago
    Mail clients and Internet Explorer are both perfectly capable CV-mangling engines.
    - viraptor 17y ago
      Ah... I thought he meant HTML file attached to the email, not a "HTML email".
      - tptacek 17y ago
        I meant HTML files attached to the email. They print badly. They don't display reliably. Use PDF.
        pyre 17y ago
        Even if you use vanilla HTML and/or test cross-browser display?
        pmjordan 17y ago
        Yes. I've seen way too many mangled CVs. Stick to PDFs unless the company in question requests a specific format. Beware of agencies deliberately changing your CV regardless of format (see my other comment).
        Silhouette 17y ago
        There are exactly no mainstream browsers that print even fairly basic HTML pages reliably, IME. Typically, the scaling and positioning of page elements ranges from poor to seriously clipped/unreadable once you get beyond the most trivial formatting.
- jlangenauer 17y ago
  I recommend PDFs too. That way it stops pesky and unethical recruiters from "adjusting" your CV without your knowledge.
  - snprbob86 17y ago
    How does that stop them? Most 3rd party readers have basic editing capabilities and any unethical recruiter could trivially afford (or unethically obtain) Acrobat Pro.
    - jlangenauer 17y ago
      It just makes it more difficult. Everyone has Microsoft Word, but not everyone has Acrobat Pro, or the other 3rd party tools. If you're really paranoid, you could digitally sign your PDF, but that seems like overkill.
      - LiveTheDream 17y ago
        Right, it's just deterrence. No amount of signing is going to stop a determined and evil recruiter from just retyping your CV with their buzzwords added. Can't imagine that actually happening, but I am reminded of the employer looking for "pink box testing" experience...
        pmjordan 17y ago
        Can't imagine that actually happening You've been leading a sheltered life. The majority of CVs we received via a recruitment agency at Kuju (game developer) had been changed by the agency, and I'm not just talking about removing the contact details. Some CVs were so mangled that I'm pretty sure they were a copy & paste job from a PDF into MS Word. My piece of advice: if you ever have an agency apply for jobs on your behalf, insist on seeing the final version of your CV before they send it. They probably mean well, but they frequently end up misrepresenting you because they just don't understand your job. Yes, this also applies to agencies specialised on the tech sector.
      - 17y ago
- tbrownaw 17y ago
  I usually get asked to help screen resumes for applicants to the department I'm in... every single one has either been a .doc attachment (pretty much all of the contractor positions) or pasted into a html email (pretty much all of the permanent positions). I don't believe I've ever seen one in PDF (except when I was looking for work after college... they asked me to re-send it as a .doc).
  - tptacek 17y ago
    And I'm a hiring manager who just checked 121 resumes in his mail spool, ~65% of which were in PDF. But sure, I guess there's someone out there who's never seen a PDF resume.
    - DannoHung 17y ago
      What industry are you in and how do you get most of your resumes? Might have something to do with it.
    - pyre 17y ago
      Your evidence is anecdotal. Don't assume that every company everywhere in every industry deals with the same things that you do.
      - loup-vaillant 17y ago
        As is tbrownaw's evidence. Maybe there are relevant statistics somewhere?
        pyre 17y ago
        The comment: > But sure, I guess there's someone out there who's never seen a PDF resume. Seems to imply that he feels that his experience is the same for 99% of the rest of the world, and that tbrownaw's evidence is in the minority. The problem is that both of them only have anecdotal evidence, so neither can claim to have 'the big picture,' though tptacek seems to infer that he does ("But sure, I guess there's someone out there" implies that this 'someone' is all alone/the only person).
- juliusdavies 17y ago
  tptacek, would you consider that a 'bug' even if you noticed it and carefully traced it? I think I'd assume the guy previously referred to a CSS file but now included it inline and forgot to remove the old <link type='text/css'>. Maybe I'd be suspicious if python responded with headers that said, "hi this is a python web server!". But linking to an empty CSS (or getting a 404 !) would not ever raise my suspicions. That's part of its beauty! Hmm, on 2nd thought, getting the server to send a 404 while tracking the resume's travels is even more elegant. I'd only be annoyed if in the interview he bragged about bugging the resume!!!
  - bluesmoon 17y ago
    it's easy to track 404s. They show up in your access logs. You can just post-process the logs.
    - piranha 17y ago
      You can return 404 with python as well.
      - bluesmoon 17y ago
        but what's the point? you'll be taking up a whole bunch of CPU cycles on every request when you can just use a fraction of the total once a day.
  - Semiapies 17y ago
    Why wouldn't it be a "bug"? That's what they call such things in spam emails.
- snprbob86 17y ago
  Most big resume processing systems mangle them anyway. I have referred friends during my time at both Google and Microsoft. Both companies ask you to paste a plain text version of the resumes.
- chmike 17y ago
  http://blogcritics.org/politics/article/how-to-make-your-tinfoil-hat/ http://blogcritics.org/politics/article/how-to-make-your-tin...
- pvg 17y ago
  First, don't send bugs. It's not going to tell you anything worthwhile when people don't detect it and it's just going to annoy people who do. Second, send resumes in the format expected by the recipient. This is still occasionally a .doc file. PDF covers most bases but not always. I think, statistically, nobody ever failed to get a job because they failed to produce an HTML resume. Send what the person on the other end is easily going to read. Consider figuring that out your first interview question.
- ableal 17y ago
  > PDF. It's the way to go. Seems 5 out of 10 malware writers agree ;-) http://www.theregister.co.uk/2010/03/09/adobe_reader_attacks/ http://www.theregister.co.uk/2010/03/09/adobe_reader_attacks... OK, I also prefer PDF, and I know the problem is the Adobe Reader (and the scripting added back in 2003 or so). I try to stick to the OSS readers. But I would think that web-bugs are also possible in modern PDFs (with web links and js). No ?
chaosmachine 17y ago
New startup idea: Google Analytics for Resumes.
- beilabs 17y ago
  http://www.trackmycv.com/ http://www.trackmycv.com/
- johns 17y ago
  StackOverflow Careers gives you metrics on views, search hits, inquiries, etc.
ryanpetrich 17y ago
He's worried about embedded viruses in .doc files but has no qualms about adding tracking code to .html!?
- ars 17y ago
  Do you seriously think those are at all similar?
jawn 17y ago
While not as useful as this trick, I've setup analytics on my external facing resume site, and it's been interesting to see the results. It's been great for finding out how recruiters use google to search for resumes, and to find out where open positions are in my area of expertise.
pbhjpbhj 17y ago
Can't you trigger an "onload" type event in a PDF or simply attempt to load a hidden image into your page from a tracking URL.
- bluesmoon 17y ago
  it will ask the user for confirmation before attempting to reach out to the web
jedberg 17y ago
Was anyone else really thrown off by the strange choices in bold and italic?
- qeorge 17y ago
  Yes. At first I thought he was italicizing each mention of a programming language, which is a nice idea. Then python was bold and not italic, and I lost the thread.
spudlyo 17y ago
In the past I've just sent a link to my resume and looked at my access logs. This has worked for me, but the printed results are often cringe worthy.
dnsworks 17y ago
This is also a fairly common way to track people down. I used something similar, with an HTML email, to find an SEO shuyster who had defrauded a friend. It helped prove he was in the country (despite his claims). It gave us a good reason to try and setup a sting where instead of meeting a potential customer, he was greeted by a process server. Also a good reason why to never read HTML emails.
- rbanffy 17y ago
  I remember the time when bugged or, worse, malware-carrying emails were impossible. I even wrote an article on e-mail viruses circa 96. Thanks, Microsoft, for making this too possible (by bundling HTML and scriptable Word processing into mail viewers)...
deleted 17y ago
[deleted]

72 points by jlangenauer 17y ago

First, I'd get annoyed if I found you tried to bug a CV you sent me. I'd definitely tell you not to send something like that to my clients. Second, I think that while HTML resumes are a fine thing to post on your website, they are a terrible format for sending to a prospective employer. You are virtually guaranteed that it will be mangled behind comprehension by the time an interviewer gets it. Don't send HTML resumes. Don't send DOC files. Send PDFs. Hiring managers expect to have to read PDFs, they will print reliably, and they won't launch MS Office when someone clicks on them. PDF. It's the way to go.

viraptor 17y ago
> [...] HTML resumes [...] You are virtually guaranteed that it will be mangled Do you mean it will be changed by other people, or...? I'm not sure who are you expecting to mangle it and why.
- tptacek 17y ago
  No, I don't mean on purpose.
- callahad 17y ago
  Mail clients and Internet Explorer are both perfectly capable CV-mangling engines.
  - viraptor 17y ago
    Ah... I thought he meant HTML file attached to the email, not a "HTML email".
    - tptacek 17y ago
      I meant HTML files attached to the email. They print badly. They don't display reliably. Use PDF.
      - pyre 17y ago
        Even if you use vanilla HTML and/or test cross-browser display?
        pmjordan 17y ago
        Yes. I've seen way too many mangled CVs. Stick to PDFs unless the company in question requests a specific format. Beware of agencies deliberately changing your CV regardless of format (see my other comment).
        Silhouette 17y ago
        There are exactly no mainstream browsers that print even fairly basic HTML pages reliably, IME. Typically, the scaling and positioning of page elements ranges from poor to seriously clipped/unreadable once you get beyond the most trivial formatting.
jlangenauer 17y ago
I recommend PDFs too. That way it stops pesky and unethical recruiters from "adjusting" your CV without your knowledge.
- snprbob86 17y ago
  How does that stop them? Most 3rd party readers have basic editing capabilities and any unethical recruiter could trivially afford (or unethically obtain) Acrobat Pro.
  - jlangenauer 17y ago
    It just makes it more difficult. Everyone has Microsoft Word, but not everyone has Acrobat Pro, or the other 3rd party tools. If you're really paranoid, you could digitally sign your PDF, but that seems like overkill.
    - LiveTheDream 17y ago
      Right, it's just deterrence. No amount of signing is going to stop a determined and evil recruiter from just retyping your CV with their buzzwords added. Can't imagine that actually happening, but I am reminded of the employer looking for "pink box testing" experience...
      - pmjordan 17y ago
        Can't imagine that actually happening You've been leading a sheltered life. The majority of CVs we received via a recruitment agency at Kuju (game developer) had been changed by the agency, and I'm not just talking about removing the contact details. Some CVs were so mangled that I'm pretty sure they were a copy & paste job from a PDF into MS Word. My piece of advice: if you ever have an agency apply for jobs on your behalf, insist on seeing the final version of your CV before they send it. They probably mean well, but they frequently end up misrepresenting you because they just don't understand your job. Yes, this also applies to agencies specialised on the tech sector.
    - 17y ago
tbrownaw 17y ago
I usually get asked to help screen resumes for applicants to the department I'm in... every single one has either been a .doc attachment (pretty much all of the contractor positions) or pasted into a html email (pretty much all of the permanent positions). I don't believe I've ever seen one in PDF (except when I was looking for work after college... they asked me to re-send it as a .doc).
- tptacek 17y ago
  And I'm a hiring manager who just checked 121 resumes in his mail spool, ~65% of which were in PDF. But sure, I guess there's someone out there who's never seen a PDF resume.
  - DannoHung 17y ago
    What industry are you in and how do you get most of your resumes? Might have something to do with it.
  - pyre 17y ago
    Your evidence is anecdotal. Don't assume that every company everywhere in every industry deals with the same things that you do.
    - loup-vaillant 17y ago
      As is tbrownaw's evidence. Maybe there are relevant statistics somewhere?
      - pyre 17y ago
        The comment: > But sure, I guess there's someone out there who's never seen a PDF resume. Seems to imply that he feels that his experience is the same for 99% of the rest of the world, and that tbrownaw's evidence is in the minority. The problem is that both of them only have anecdotal evidence, so neither can claim to have 'the big picture,' though tptacek seems to infer that he does ("But sure, I guess there's someone out there" implies that this 'someone' is all alone/the only person).
juliusdavies 17y ago
tptacek, would you consider that a 'bug' even if you noticed it and carefully traced it? I think I'd assume the guy previously referred to a CSS file but now included it inline and forgot to remove the old <link type='text/css'>. Maybe I'd be suspicious if python responded with headers that said, "hi this is a python web server!". But linking to an empty CSS (or getting a 404 !) would not ever raise my suspicions. That's part of its beauty! Hmm, on 2nd thought, getting the server to send a 404 while tracking the resume's travels is even more elegant. I'd only be annoyed if in the interview he bragged about bugging the resume!!!
- bluesmoon 17y ago
  it's easy to track 404s. They show up in your access logs. You can just post-process the logs.
  - piranha 17y ago
    You can return 404 with python as well.
    - bluesmoon 17y ago
      but what's the point? you'll be taking up a whole bunch of CPU cycles on every request when you can just use a fraction of the total once a day.
- Semiapies 17y ago
  Why wouldn't it be a "bug"? That's what they call such things in spam emails.
snprbob86 17y ago
Most big resume processing systems mangle them anyway. I have referred friends during my time at both Google and Microsoft. Both companies ask you to paste a plain text version of the resumes.
chmike 17y ago
http://blogcritics.org/politics/article/how-to-make-your-tinfoil-hat/ http://blogcritics.org/politics/article/how-to-make-your-tin...
pvg 17y ago
First, don't send bugs. It's not going to tell you anything worthwhile when people don't detect it and it's just going to annoy people who do. Second, send resumes in the format expected by the recipient. This is still occasionally a .doc file. PDF covers most bases but not always. I think, statistically, nobody ever failed to get a job because they failed to produce an HTML resume. Send what the person on the other end is easily going to read. Consider figuring that out your first interview question.
ableal 17y ago
> PDF. It's the way to go. Seems 5 out of 10 malware writers agree ;-) http://www.theregister.co.uk/2010/03/09/adobe_reader_attacks/ http://www.theregister.co.uk/2010/03/09/adobe_reader_attacks... OK, I also prefer PDF, and I know the problem is the Adobe Reader (and the scripting added back in 2003 or so). I try to stick to the OSS readers. But I would think that web-bugs are also possible in modern PDFs (with web links and js). No ?

chaosmachine 17y ago

New startup idea: Google Analytics for Resumes.

beilabs 17y ago
http://www.trackmycv.com/ http://www.trackmycv.com/
johns 17y ago
StackOverflow Careers gives you metrics on views, search hits, inquiries, etc.

ryanpetrich 17y ago

He's worried about embedded viruses in .doc files but has no qualms about adding tracking code to .html!?

ars 17y ago
Do you seriously think those are at all similar?

jawn 17y ago

While not as useful as this trick, I've setup analytics on my external facing resume site, and it's been interesting to see the results. It's been great for finding out how recruiters use google to search for resumes, and to find out where open positions are in my area of expertise.

pbhjpbhj 17y ago

Can't you trigger an "onload" type event in a PDF or simply attempt to load a hidden image into your page from a tracking URL.

bluesmoon 17y ago
it will ask the user for confirmation before attempting to reach out to the web

jedberg 17y ago

Was anyone else really thrown off by the strange choices in bold and italic?

qeorge 17y ago
Yes. At first I thought he was italicizing each mention of a programming language, which is a nice idea. Then python was bold and not italic, and I lost the thread.

spudlyo 17y ago

In the past I've just sent a link to my resume and looked at my access logs. This has worked for me, but the printed results are often cringe worthy.

dnsworks 17y ago

This is also a fairly common way to track people down. I used something similar, with an HTML email, to find an SEO shuyster who had defrauded a friend. It helped prove he was in the country (despite his claims). It gave us a good reason to try and setup a sting where instead of meeting a potential customer, he was greeted by a process server. Also a good reason why to never read HTML emails.

rbanffy 17y ago
I remember the time when bugged or, worse, malware-carrying emails were impossible. I even wrote an article on e-mail viruses circa 96. Thanks, Microsoft, for making this too possible (by bundling HTML and scriptable Word processing into mail viewers)...

deleted 17y ago

[deleted]