9 ms·
There's a surprising amount of insecure code in the wild; and naive engineers who are willingly ignorant in their security practices. I'd assume that Parler's
by gwbas1c 6y ago
There's a surprising amount of insecure code in the wild; and naive engineers who are willingly ignorant in their security practices.
I'd assume that Parler's engineers motivations had more to do with politics than providing a secure platform for protecting dissidents under duress.
(Or, if we look at the history of a recent major war, the mediocre engineers working for the other side thought they were the good guys.)
- vsareto 6y ago>and naive engineers who are willingly ignorant in their security practices. Fairly sure we could replace algorithm and data structure whiteboard interviews with security interviews and we'd all be better off
- austincheney 6y agoI am certain most software engineers would abysmally fail the Security+ exam, which is the entry level for security practice. But a far more expedient process is to just give candidates an essay exam to see if they are functionally literate in their profession.
- whatiscomputer 6y agoCan you outline what you might expect in an essay exam for a software engineer position? Would it take the form of a standard interview question: "Write a few paragraphs on what happens when you press a key on the keyboard" Or would it use the medium to ask a question less appropriate in an oral interview process? Genuinely curious what you envision with this format.
- austincheney 6y agoThe goal is to assess a candidate’s ability to communicate technical matters quickly with structure, organization, and planning. Secondary considerations include the ability to follow simple instructions, command of written language, and accurate descriptions of technical subjects.
- spiralx 6y agoMy go to question for interviewing candidates is "What trends do you see in web development now or you see being important in the next few years?". There's no right answer there, I'm just looking for something relevant that shows they've got some knowledge of the field outside of being able to bash out code to order. For juniors I don't really expect much while seniors should at least be able to talk a bit about a couple of things, but having interviewed prospective head of development candidates I was amazed that two out of four just tanked on the question, one just couldn't answer at all. Candidates who know there are things they don't know about I don't mind, but candidates who are unaware of these things at all are typically uninterested in broadening their knowledge, and not someone I'd like on my team.
- Cthulhu_ 6y agoI'm all in favor of getting rid of the leetcode interviews, but it's not an either-or one, coding competency is still the primary concern, security a secondary one. And I don't think an individual developer would have prevented this; this is an issue with the general security and monitoring policies at Parler. I mean how could they create millions of admin accounts and extract 70 TB of data without any alarm bells, flood control and circuit breakers engaging?
- tehbeard 6y agoI saw a tweet regarding it that the IP rate limiting fell over due to X-forwarded-for header not being correctly handled allowing the bypass of that circuit breaker.
- notyourwork 6y agoWhen I interview candidates and their solution encounters an unexpected condition I typically park the original question to temporarily discuss how to handle this exception. This and more generally their thoughts on how to handle other types of unexpected scenarios is an important part of delivering real world solutions. I'm shocked by the amount of engineers that don't have any thoughts on this topic.
- MattGaiser 6y agoIt is an important part of delivering real world solutions. How often is it a part of being hired to deliver real world solutions?
- notyourwork 6y agoI'm not sure I understand the question. In my mind, if you cannot reason through how to handle non-expected things in your code, I'm going to think twice about hiring you. Code being able to account for erroneous situations is as important as your golden path because as we know software should be predictable but regularly is not. Especially so in the world of micro-services where so many integration paths are changing and in flux. Are you suggesting we should only interview candidates to code the happy case and not consider how they will reason through what to do when the input isn't what they expected or a dependency fails to produce results?
- mey 6y agoReplace fizz buzz with spotting SQL injection issues.
- mike00632 6y agoThere is plenty of use for coders who can't spot SQL injection issues. I can't think of much use for a coder who can't do fizzbuzz.
- dieortin 6y agoIf you’re referring to world war 2, axis engineers were in no way “mediocre”.
- bryanrasmussen 6y agoit seems unlikely anyone would be describing WW 2 as recent.
- Yetanfou 6y agoBut it is, as is WW I. The latter ended 102 years ago and set in motion many of the technological developments which define our current world, WW II refined these to a level which is recognisable and often still useable today. Electronic warfare, programmable computers, jet-powered aircraft, nuclear weapons - all of these were used in WW II. Modern computers are faster, modern jets are more reliable and more fuel efficient, modern nuclear weapons are more compact and modern electronic warfare has kept up with the development of computers and electronics but as wars go WW I and WW II were the first - and possibly last [1] - "modern" large wars. [1] - modern weaponry makes large-scale land war difficult to survive, e.g. the average survival time of a main battlefield tank is counted in minutes.
- jsilence 6y agoOn a tangent: This hacking of parler might be the reason a more recent WW does not come into fruiton.
- pp19dd 6y agoSystems can be complicated and even the smallest detail can be dangerously revealing to a scrutinizing eye. "Allied intelligence noticed each captured tank had a unique serial number. With careful observation, the Allies were able to determine the serial numbers had a pattern denoting the order of tank production. Using this data, the Allies created a mathematical model to determine the rate of German tank production. They used it to estimate that the Germans produced 255 tanks per month between the summer of 1940 and the fall of 1942." One source of many: https://www.wired.com/2010/10/how-the-allies-used-math-against-german-tanks/ https://www.wired.com/2010/10/how-the-allies-used-math-again... This information was used to estimate force size and thus counter it, and it turns out this method was surprisingly accurate.
- deleted 6y ago[deleted]
- rob74 6y agoTo be fair, it's probably hard for a network like Parler to attract top talent. I mean, they explicitly advertised themselves as the "free speech social network" (i.e. "all hate speech welcome, we won't censor anyone except maybe Trump parody accounts") - would you want to work for such a company, or have it on your resume in the future?
- RHSeeger 6y ago> would you want to work for such a company, or have it on your resume in the future And even if you did want to work for such a company, the impact on your resume in the future along might be enough to deter you.
- thu2111 6y agoJack Dorsey: "We are the free speech wing of the free speech party" Mark Zuckerberg: "Trump says Facebook is against him, liberals say we helped Trump. Both sides are upset about ideas and content they don’t like. That’s what running a platform for all ideas looks like.” Matt Cutts: "We don't condone the practice of googlebombing, or any other action that seeks to affect the integrity of our search results, but we're also reluctant to alter our results by hand in order to prevent such items from showing up"
- NikolaeVarius 6y agoYes? I wouldn't work for Parler, but I fail to see how the phrase "free speech social network" should elicit some negative emotion. Parler sucks because they are a haven to right wing extremists, not because of their marketing. Its like being angry at Signal because their encryption allows terrorists communicate securely.
- _alex_ 6y ago"Cool, I found a package for this"
- kwertyoowiyop 6y agoScariest comment so far!
- 0x4d464d48 6y agoHello fellow follower of the cult of cargo!
- swat535 6y agoOr how about a system where pretty much the entire thing is built upon packages? Even for the most minute things like left-padding..
- notyourday 6y ago> I'd assume that Parler's engineers motivations had more to do with politics than providing a secure platform for protecting dissidents under duress. If one is to look at the LinkedIn for the tech leadership of Parler it would not be a stretch to say that they are way outside of their depth technologically speaking.
- jrobn 6y agoBingo. They most likely didn’t care. It was all a means to an end. I would be combing this data to see if any active users that were inciting a call to violence are employees or contractors of say: Epoch Times, Members of Congress or their staff, members of law enforcement (especially capital police), select corporations or donors.
- themaninthedark 6y agoI would also be checking to see if they were employees or contractors of NY Times, CNN, known agents of China/Russia/Iran. There are too many groups that are enjoying seeing the division of the American people.