I'll be honest with you, I've conducted some attrocious interviews. It's taken me a long time, and a LOT of interviews, to get to the point where I feel like I'

I'll be honest with you, I've conducted some attrocious interviews. It's taken me a long time, and a LOT of interviews, to get to the point where I feel like I'm not horribly butchering them most of the time. I found that I really like the "pick one problem/question and go deep and/or wide" approach. The above example I can go anywhere from compilers (Q: "What's the smallest function a compiler could legally output given this code?" (I love this one :P)) to C (Q: "How is 'buf' allocated?") to static analysis (Q: "How would I statically find all instances of this pattern?") to exploits (Q: "How would I exploit this vulnerability?") to mitigations (Q: "Given a stack overflow, what can I do to make it harder to exploit for the attacker?"), etc. etc. etc.