6 ms·

> I think we were looking for a subset of the population that ordinary software development teams look for. I think that's actually why your experience might b

> I think we were looking for a subset of the population that ordinary software development teams look for. I think that's actually why your experience might be less representative, but I'm open to being corrected. Security is generally considered harder than regular development, at least to the extent that it would typically be hard to get a security job without security experience. From what I understand, your model was to take programmers with no security experience and train them on security. The effectiveness of this doesn't surprise me at all, because it's fundamentally a different problem than taking someone who's bad at programming and teaching them to program better. I have absolutely no problem with hiring someone who's a good VB programmer and teaching them to do web programming. What people generally dispute is whether you can hire someone who's a bad programmer in general and "train" them to be a good programmer.

rhizome 10y ago
This perspective depends on mentorship quality being constant across all of these programmers.
- calinet6 10y ago
  Then mentorship and teaching need to be taught also.
  - rhizome 10y ago
    In the startup world? I'm not holding my breath.
    - calinet6 10y ago
      Yep, you'll have to do more work than just breathing. :-P
S4M 10y ago
> I have absolutely no problem with hiring someone who's a good VB programmer and teaching them to do web programming. What people generally dispute is whether you can hire someone who's a bad programmer in general and "train" them to be a good programmer. How do you know if a programmer who is in a field you are not familiar with is good or not?
- morgante 10y ago
  You can ask someone to show you some code they've written and teach you about it. Concepts transcend language and field: if you understand what you're doing and why you're doing it when writing a VB program, I have high confidence that with a bit of time you'll also learn to understand how and why to write other kinds of programs effectively as well.
  - tptacek 10y ago
    Why does it have to be this complicated? Explain some of their existing code? Why not just give them a representative programming problem that your team has already solved, and ask them to code up their ideal solution? That's called "work sample hiring", and it's the gold standard for candidate evaluation. It boggles my mind that everyone doesn't do this.
    - morgante 10y ago
      Frankly, your statements are extremely conflicting. Pure work sample hiring is in direct contradiction with hiring trainable people. I do not expect a VB programmer to be able to code up a single-page React app during an interview, even though building a React app would be a representative problem. Do you? So which one is it? Hire exclusively through work samples, or hire trainable people? I mean this seriously: how do you reconcile these two? You're a strong proponent of work sample hiring but also of training—do you expect people to come in and do a security audit for their interview, even when one of your hiring goals is to hire people with no security experience? I would personally much rather hire someone who is a strong overall programmer (but might very well not be able to code a JavaScript app in an interview) over someone who knows a little JavaScript (so they can do a simple problem) but has relatively shallow abilities. > That's called "work sample hiring", and it's the gold standard for candidate evaluation. Having a discussion about someone's existing work is, in fact, another gold standard of hiring and is quite similar to having someone do the work on the job. It's not quite as good as having someone execute work, but it's the next best thing—especially when you're trying to hire people who don't have direct domain experience.

rhizome 10y ago

This perspective depends on mentorship quality being constant across all of these programmers.

calinet6 10y ago
Then mentorship and teaching need to be taught also.
- rhizome 10y ago
  In the startup world? I'm not holding my breath.
  - calinet6 10y ago
    Yep, you'll have to do more work than just breathing. :-P

S4M 10y ago

> I have absolutely no problem with hiring someone who's a good VB programmer and teaching them to do web programming. What people generally dispute is whether you can hire someone who's a bad programmer in general and "train" them to be a good programmer. How do you know if a programmer who is in a field you are not familiar with is good or not?

morgante 10y ago
You can ask someone to show you some code they've written and teach you about it. Concepts transcend language and field: if you understand what you're doing and why you're doing it when writing a VB program, I have high confidence that with a bit of time you'll also learn to understand how and why to write other kinds of programs effectively as well.
- tptacek 10y ago
  Why does it have to be this complicated? Explain some of their existing code? Why not just give them a representative programming problem that your team has already solved, and ask them to code up their ideal solution? That's called "work sample hiring", and it's the gold standard for candidate evaluation. It boggles my mind that everyone doesn't do this.
  - morgante 10y ago
    Frankly, your statements are extremely conflicting. Pure work sample hiring is in direct contradiction with hiring trainable people. I do not expect a VB programmer to be able to code up a single-page React app during an interview, even though building a React app would be a representative problem. Do you? So which one is it? Hire exclusively through work samples, or hire trainable people? I mean this seriously: how do you reconcile these two? You're a strong proponent of work sample hiring but also of training—do you expect people to come in and do a security audit for their interview, even when one of your hiring goals is to hire people with no security experience? I would personally much rather hire someone who is a strong overall programmer (but might very well not be able to code a JavaScript app in an interview) over someone who knows a little JavaScript (so they can do a simple problem) but has relatively shallow abilities. > That's called "work sample hiring", and it's the gold standard for candidate evaluation. Having a discussion about someone's existing work is, in fact, another gold standard of hiring and is quite similar to having someone do the work on the job. It's not quite as good as having someone execute work, but it's the next best thing—especially when you're trying to hire people who don't have direct domain experience.