4 ms·

Regarding whether or not it's too easy...that's something we wondered about. We decided we wanted a relatively straightforward initial screen rather than an co

Regarding whether or not it's too easy...that's something we wondered about. We decided we wanted a relatively straightforward initial screen rather than an complex brainteaser. So I would by no means liken this to the Greplin Challenge, but we're trying to accomplish something different. We're hoping to eliminate the crappy applicants so we can spend more time on the good ones.

jayphelps 16y ago
After I initially overreacted about it's simplicity, I saw the point more clearly. In fact, the more I think about it the more I loved it. (from your business's standpoint) Whenever I've been apart of interviewing candidates, ≈70% of the time was wasted on applicants who fluffed their resumé, got an interview, and were obviously not what they claimed to be. This would probably significantly reduce that overhead and at the same time attract people who enjoy coding vs. do it just to pay the bills.
- ericwaller 16y ago
  That was roughly our thought process (I'm another seatgeeker btw). We wanted to come up with something that would be pretty quick to solve if you know what you're doing, but at the same time, demonstrates that you've got a pretty good understanding of a bunch of the moving parts of web development.
  - pavel_lishin 16y ago
    I interviewed with a pretty big company awhile back, and they told me that 50% of the people they talked to couldn't pass a basic phone screen - the technical portion of which basically consisted of making sure I knew what the modulo operator was, what it did, and some practical applications thereof. How were y'all's percentages in that regard? How many applicants flat-out couldn't write code to save their life?
dwwoelfel 16y ago
I think that you may have erred on the side of too easy. I have very little web development experience, but I was able to solve it in a few minutes. I didn't even use any developer tools.
- dwwoelfel 16y ago
  Edit: I didn't realize that there was a second part. Maybe it wasn't too easy after all.
  - deleted 16y ago
    [deleted]
temphn 16y ago
Not a web developer, but a scientist who plays around with it a little bit. Here is what I tried: 1) Viewed source. Didn't see any obvious comments. 2) Looked at .css files. Nothing obvious there, though there are styles for form/etc classes and elements that aren't used in the page. 3) Tried creating some forms with input and label elements in the markup in Firebug to see if CSS labeling on buttons showed anything. Just showed "Submit Query". 4) Looked at session headers in Firebug/Safari and saw something along the lines of < HTTP/1.1 403 Forbidden < Server: nginx < Date: Tue, 26 Oct 2010 09:10:58 GMT < Content-Type: text/html; charset=utf-8 < Connection: keep-alive < Status: 403 Forbidden < X-Runtime: 0.001014 < Content-Length: 1552 < Set-Cookie: sg.session=%7B%22csrf.token%22%3A%228KSf5VQhEB6DRoS0Z9PWW6ugXnH4e132LzBH8E76dE4%3D%22%7D; path=/ 5) Noticed 'csrf.token' and googled to figure out it was a cross site request forgery prevention token, which seems sort of related. Tried to mess around with this in Python and sort of got somewhere with this >>>urllib.unquote("%7B%22csrf.token%22%3A%22R5wuQON8nVfha%2F7WRCXTvVMo7rZzu41dFPOVZ2V0MMw%3D%22%7D") '{"csrf.token":"R5wuQON8nVfha/7WRCXTvVMo7rZzu41dFPOVZ2V0MMw="}' Then tried re-encoding: >>> urllib.quote(eval(urllib.unquote("%7B%22csrf.token%22%3A%22R5wuQON8nVfha%2F7WRCXTvVMo7rZzu41dFPOVZ2V0MMw%3D%22%7D")).values()[0]) 'R5wuQON8nVfha/7WRCXTvVMo7rZzu41dFPOVZ2V0MMw%3D' and then doing an HTTP POST with curl curl -v -d "csrf.token=R5wuQON8nVfha/7WRCXTvVMo7rZzu41dFPOVZ2V0MMw%3D" apply.seatgeek.com But no dice. Is this totally the wrong direction? Is this puzzle really that obvious to any real web developer worthy of the name, and if so where did you earn your spurs/what books/sites did you read?
- mcknz 16y ago
  Not totally -- you're looking at the right things. As people have been saying there are kind of two parts to it. The first part has a lot more to do with the page content than the technical specifics.
- Ixiaus 16y ago
  No worries, I'm certainly not "getting" the riddle myself. I tried md5sum'ing the response body and base64 encoding it and replacing the cookie's csrf.token value with that, which didn't work (I did notice, however, that the server is accepting whatever you put in the cookie without re/over writing it). I tried POSTing and PUTing with data values like "csrf=valuefromcookie" and (this may seem stupid) "browser=seatgeek". I hand crafted a request using cURL. I also discovered their VHOST settings aren't quite right either because when you POST to https://apply.seatgeek.com https://apply.seatgeek.com it takes you straight to the homepage (instead of redirecting you to the http://apply.seatgeek.com http://apply.seatgeek.com page). Either way, kudos to those that got it in 15 minutes - I wasted far too much time chasing my tail on this one.

jayphelps 16y ago

After I initially overreacted about it's simplicity, I saw the point more clearly. In fact, the more I think about it the more I loved it. (from your business's standpoint) Whenever I've been apart of interviewing candidates, ≈70% of the time was wasted on applicants who fluffed their resumé, got an interview, and were obviously not what they claimed to be. This would probably significantly reduce that overhead and at the same time attract people who enjoy coding vs. do it just to pay the bills.

ericwaller 16y ago
That was roughly our thought process (I'm another seatgeeker btw). We wanted to come up with something that would be pretty quick to solve if you know what you're doing, but at the same time, demonstrates that you've got a pretty good understanding of a bunch of the moving parts of web development.
- pavel_lishin 16y ago
  I interviewed with a pretty big company awhile back, and they told me that 50% of the people they talked to couldn't pass a basic phone screen - the technical portion of which basically consisted of making sure I knew what the modulo operator was, what it did, and some practical applications thereof. How were y'all's percentages in that regard? How many applicants flat-out couldn't write code to save their life?

dwwoelfel 16y ago

I think that you may have erred on the side of too easy. I have very little web development experience, but I was able to solve it in a few minutes. I didn't even use any developer tools.

dwwoelfel 16y ago
Edit: I didn't realize that there was a second part. Maybe it wasn't too easy after all.
- deleted 16y ago
  [deleted]

temphn 16y ago

Not a web developer, but a scientist who plays around with it a little bit. Here is what I tried: 1) Viewed source. Didn't see any obvious comments. 2) Looked at .css files. Nothing obvious there, though there are styles for form/etc classes and elements that aren't used in the page. 3) Tried creating some forms with input and label elements in the markup in Firebug to see if CSS labeling on buttons showed anything. Just showed "Submit Query". 4) Looked at session headers in Firebug/Safari and saw something along the lines of < HTTP/1.1 403 Forbidden < Server: nginx < Date: Tue, 26 Oct 2010 09:10:58 GMT < Content-Type: text/html; charset=utf-8 < Connection: keep-alive < Status: 403 Forbidden < X-Runtime: 0.001014 < Content-Length: 1552 < Set-Cookie: sg.session=%7B%22csrf.token%22%3A%228KSf5VQhEB6DRoS0Z9PWW6ugXnH4e132LzBH8E76dE4%3D%22%7D; path=/ 5) Noticed 'csrf.token' and googled to figure out it was a cross site request forgery prevention token, which seems sort of related. Tried to mess around with this in Python and sort of got somewhere with this >>>urllib.unquote("%7B%22csrf.token%22%3A%22R5wuQON8nVfha%2F7WRCXTvVMo7rZzu41dFPOVZ2V0MMw%3D%22%7D") '{"csrf.token":"R5wuQON8nVfha/7WRCXTvVMo7rZzu41dFPOVZ2V0MMw="}' Then tried re-encoding: >>> urllib.quote(eval(urllib.unquote("%7B%22csrf.token%22%3A%22R5wuQON8nVfha%2F7WRCXTvVMo7rZzu41dFPOVZ2V0MMw%3D%22%7D")).values()[0]) 'R5wuQON8nVfha/7WRCXTvVMo7rZzu41dFPOVZ2V0MMw%3D' and then doing an HTTP POST with curl curl -v -d "csrf.token=R5wuQON8nVfha/7WRCXTvVMo7rZzu41dFPOVZ2V0MMw%3D" apply.seatgeek.com But no dice. Is this totally the wrong direction? Is this puzzle really that obvious to any real web developer worthy of the name, and if so where did you earn your spurs/what books/sites did you read?

mcknz 16y ago
Not totally -- you're looking at the right things. As people have been saying there are kind of two parts to it. The first part has a lot more to do with the page content than the technical specifics.
Ixiaus 16y ago
No worries, I'm certainly not "getting" the riddle myself. I tried md5sum'ing the response body and base64 encoding it and replacing the cookie's csrf.token value with that, which didn't work (I did notice, however, that the server is accepting whatever you put in the cookie without re/over writing it). I tried POSTing and PUTing with data values like "csrf=valuefromcookie" and (this may seem stupid) "browser=seatgeek". I hand crafted a request using cURL. I also discovered their VHOST settings aren't quite right either because when you POST to https://apply.seatgeek.com https://apply.seatgeek.com it takes you straight to the homepage (instead of redirecting you to the http://apply.seatgeek.com http://apply.seatgeek.com page). Either way, kudos to those that got it in 15 minutes - I wasted far too much time chasing my tail on this one.