7 ms·

>and naive engineers who are willingly ignorant in their security practices. Fairly sure we could replace algorithm and data structure whiteboard interviews wi

>and naive engineers who are willingly ignorant in their security practices. Fairly sure we could replace algorithm and data structure whiteboard interviews with security interviews and we'd all be better off

austincheney 6y ago
I am certain most software engineers would abysmally fail the Security+ exam, which is the entry level for security practice. But a far more expedient process is to just give candidates an essay exam to see if they are functionally literate in their profession.
- whatiscomputer 6y ago
  Can you outline what you might expect in an essay exam for a software engineer position? Would it take the form of a standard interview question: "Write a few paragraphs on what happens when you press a key on the keyboard" Or would it use the medium to ask a question less appropriate in an oral interview process? Genuinely curious what you envision with this format.
  - austincheney 6y ago
    The goal is to assess a candidate’s ability to communicate technical matters quickly with structure, organization, and planning. Secondary considerations include the ability to follow simple instructions, command of written language, and accurate descriptions of technical subjects.
- spiralx 6y ago
  My go to question for interviewing candidates is "What trends do you see in web development now or you see being important in the next few years?". There's no right answer there, I'm just looking for something relevant that shows they've got some knowledge of the field outside of being able to bash out code to order. For juniors I don't really expect much while seniors should at least be able to talk a bit about a couple of things, but having interviewed prospective head of development candidates I was amazed that two out of four just tanked on the question, one just couldn't answer at all. Candidates who know there are things they don't know about I don't mind, but candidates who are unaware of these things at all are typically uninterested in broadening their knowledge, and not someone I'd like on my team.
Cthulhu_ 6y ago
I'm all in favor of getting rid of the leetcode interviews, but it's not an either-or one, coding competency is still the primary concern, security a secondary one. And I don't think an individual developer would have prevented this; this is an issue with the general security and monitoring policies at Parler. I mean how could they create millions of admin accounts and extract 70 TB of data without any alarm bells, flood control and circuit breakers engaging?
- tehbeard 6y ago
  I saw a tweet regarding it that the IP rate limiting fell over due to X-forwarded-for header not being correctly handled allowing the bypass of that circuit breaker.
- notyourwork 6y ago
  When I interview candidates and their solution encounters an unexpected condition I typically park the original question to temporarily discuss how to handle this exception. This and more generally their thoughts on how to handle other types of unexpected scenarios is an important part of delivering real world solutions. I'm shocked by the amount of engineers that don't have any thoughts on this topic.
  - MattGaiser 6y ago
    It is an important part of delivering real world solutions. How often is it a part of being hired to deliver real world solutions?
    - notyourwork 6y ago
      I'm not sure I understand the question. In my mind, if you cannot reason through how to handle non-expected things in your code, I'm going to think twice about hiring you. Code being able to account for erroneous situations is as important as your golden path because as we know software should be predictable but regularly is not. Especially so in the world of micro-services where so many integration paths are changing and in flux. Are you suggesting we should only interview candidates to code the happy case and not consider how they will reason through what to do when the input isn't what they expected or a dependency fails to produce results?
mey 6y ago
Replace fizz buzz with spotting SQL injection issues.
- mike00632 6y ago
  There is plenty of use for coders who can't spot SQL injection issues. I can't think of much use for a coder who can't do fizzbuzz.
  - gwbas1c 6y ago
    How? Sql injection is so basic, that if you can't spot it, you probably can't do fizzbuzz.
    - mike00632 6y ago
      It more likely means that you just aren't familiar with SQL.

austincheney 6y ago

I am certain most software engineers would abysmally fail the Security+ exam, which is the entry level for security practice. But a far more expedient process is to just give candidates an essay exam to see if they are functionally literate in their profession.

whatiscomputer 6y ago
Can you outline what you might expect in an essay exam for a software engineer position? Would it take the form of a standard interview question: "Write a few paragraphs on what happens when you press a key on the keyboard" Or would it use the medium to ask a question less appropriate in an oral interview process? Genuinely curious what you envision with this format.
- austincheney 6y ago
  The goal is to assess a candidate’s ability to communicate technical matters quickly with structure, organization, and planning. Secondary considerations include the ability to follow simple instructions, command of written language, and accurate descriptions of technical subjects.
spiralx 6y ago
My go to question for interviewing candidates is "What trends do you see in web development now or you see being important in the next few years?". There's no right answer there, I'm just looking for something relevant that shows they've got some knowledge of the field outside of being able to bash out code to order. For juniors I don't really expect much while seniors should at least be able to talk a bit about a couple of things, but having interviewed prospective head of development candidates I was amazed that two out of four just tanked on the question, one just couldn't answer at all. Candidates who know there are things they don't know about I don't mind, but candidates who are unaware of these things at all are typically uninterested in broadening their knowledge, and not someone I'd like on my team.

Cthulhu_ 6y ago

I'm all in favor of getting rid of the leetcode interviews, but it's not an either-or one, coding competency is still the primary concern, security a secondary one. And I don't think an individual developer would have prevented this; this is an issue with the general security and monitoring policies at Parler. I mean how could they create millions of admin accounts and extract 70 TB of data without any alarm bells, flood control and circuit breakers engaging?

tehbeard 6y ago
I saw a tweet regarding it that the IP rate limiting fell over due to X-forwarded-for header not being correctly handled allowing the bypass of that circuit breaker.
notyourwork 6y ago
When I interview candidates and their solution encounters an unexpected condition I typically park the original question to temporarily discuss how to handle this exception. This and more generally their thoughts on how to handle other types of unexpected scenarios is an important part of delivering real world solutions. I'm shocked by the amount of engineers that don't have any thoughts on this topic.
- MattGaiser 6y ago
  It is an important part of delivering real world solutions. How often is it a part of being hired to deliver real world solutions?
  - notyourwork 6y ago
    I'm not sure I understand the question. In my mind, if you cannot reason through how to handle non-expected things in your code, I'm going to think twice about hiring you. Code being able to account for erroneous situations is as important as your golden path because as we know software should be predictable but regularly is not. Especially so in the world of micro-services where so many integration paths are changing and in flux. Are you suggesting we should only interview candidates to code the happy case and not consider how they will reason through what to do when the input isn't what they expected or a dependency fails to produce results?

mey 6y ago

Replace fizz buzz with spotting SQL injection issues.

mike00632 6y ago
There is plenty of use for coders who can't spot SQL injection issues. I can't think of much use for a coder who can't do fizzbuzz.
- gwbas1c 6y ago
  How? Sql injection is so basic, that if you can't spot it, you probably can't do fizzbuzz.
  - mike00632 6y ago
    It more likely means that you just aren't familiar with SQL.