10 ms·

I'm a US military officer working in an IT career field, and we're all required to maintain some of these certifications. As in we literally can't have a privil

I'm a US military officer working in an IT career field, and we're all required to maintain some of these certifications. As in we literally can't have a privileged account to touch our own LAN unless a third-party entity like CompTIA, (ISC)2, ISACA, Cisco, or SANS deems us fit. The whole ecosystem and culture around this is just ridiculous. Despite entering this career field with undergraduate and graduate degrees in CS from serious universities, the first (and only) question that people asked me was, "what certs do you have?" People go around talking about which "cert" they want next, and which ones are the hardest to get. People list all their "certs" in their email signatures after their name. People really measure their worth, and the worth of others, by these things. So I've played the game by reading the exam guides and taking the tests (the military pays the $300-$1,500 testing fees for us in most cases, at least) and got "my certs." Now I'm a CISSP, CISM, CEH, and CCNA. The content of the exams isn't all bad; it's certainly different from academic CS and more applicable to managing IT. But these are just multiple-choice tests that one can easily pass with superficial knowledge obtained from a 100-page exam guide. Someone asked if CISSP was the hardest test I've ever taken... no... my final exams for Theory of Computation and Advanced Algorithms were... Anyway, I've come to find out that most people don't even read the exam guides to learn what little material they contain. The typical approach, apparently, is to acquire a "dump," which is the bank of actual questions, and then repeatedly take "practice exams" so that they've already seen (and memorized) all of the questions that they might encounter during the actual exam. So, blatant cheating. I think this is very well known throughout the military IT community, and probably among the certification vendors too, but everyone turns a blind eye to it. If we stopped it, then most of our staff wouldn't be allowed to work on the LAN (see above), and then how would we get anything done? If the certification vendors stopped it, then the money would dry up as fewer people would take their exams.

lordnacho 5y ago
Same goes for financial industry regulatory exams. Very little actual learning, a lot of remembering stupid stuff. It's no wonder people want to cheat. I've also done network stuff, it's quite a lot more technical. But in the end it's still a silly thing to do multiple choice for. Debugging a network is a skill that's hard to boil down to that kind of exam, though to be fair they do show you how in the courses.
- warner25 5y ago
  I will say that CCNA (taken in 2019) was the most legitimate of these exams. There were a handful of "simulator" questions that involved actually typing some commands into a Cisco IOS switch or router to change the configuration as appropriate. So that required a deeper understanding and forced test-takers to demonstrate what they might need to do on the job as a network technician. However, CCNA also seemed to be one of the exams for which it was easiest to find a "dump" including "practice simulators" taken straight from the real exam.
  - lordnacho 5y ago
    Yeah I actually used the CCNA simulators for a lot of things early on before things clicked. It's just very hard to examine for in a way that isn't easy to cheat and demonstrates real understanding. After all in the real world every problem has its own quirks.
    - DnDGrognard 5y ago
      I did the college CNNA courses and one test was to fix a broken network (using real hardware). There is no substitute for hands on with real hardware.
  - detaro 5y ago
    Yes, the Cisco certs seem to have a relatively good reputation. I think the higher ones even involve (or at least did) stages where the test-taker spends half a day setting something up, then an instructor breaks it and they have to fix it again. On the other hand, people there complain about the recertification requirements - it's quite a bit of effort to repeat every few years, so unless you're strictly required by an employer or customer to maintain them many let it lapse.
buro9 5y ago
In my experience hiring and then seeing how people perform over time I've roughly concluded that during screening / interviewing absence of a degree is not a negative signal (can be positive), but presence of certifications has consistently been a strong negative signal. I know there are a few areas in which they are seemingly unavoidable, i.e. government, military, financial. But if I see certifications on a profile I am interested in and I believe we have a role that matches what the person is looking to do, then I will use the more unscripted part of the interview to go to first principles and test the foundations of CompSci understanding with far fewer buzzwords.
- renewiltord 5y ago
  Too true. If I see MSCE on the bloody thing, it’s to the bin or I’m going to waste my next fifteen minutes
  - tonyedgecombe 5y ago
    I did an MCSE in the nineties. It helped me round out my knowledge of the Microsoft products I was working with at the time. It also helped me to dig out of a career rut I was stuck in. This was before all the bootcamps arrived but even then I wouldn't completely dismiss it.
    - dagw 5y ago
      Yea, back in the 90s MCSE was a better investment and was actually a good way to get hired. I know lots of successful IT people today who got their first 'real' IT job thanks to earning their MCSE. Today I don't think they have the same value.
    - zomglings 5y ago
      It's not about whether you did the certification or not. The question is, do you put it on your resume?
      - tonyedgecombe 5y ago
hcazz 5y ago
That's antithetical to how the computer security industry should work -- arbitrary certifications don't guarantee compliance or security, at best they suggest it. To me, this feels like the same problem as OKRs in an organization. When your goal for success is a high score on the exams for a job rather than the ability to do the job, folks will optimize for the high score on the exam. Setting hard goals that determine success will determine where folks spend their time. Along those same lines, I don't see this as a problem for third party entities like CompTIA/(ISC)2/ISACA/Cisco/Etc to fix, but rather poor management and expectations of employees. OKRs and certificates aren't bad, they just need to measure the objective value to the organization as opposed to arbitrary standards (such as you must have X certificate to work here, or increasing pay based on certs earned). Those tests mentioned above can be useful litmus tests for folks in the recruiting space to sort through candidates, especially if they have a large number of applicants, but I worry that it excludes folks that could otherwise be very good at the job/role.
- jokethrowaway 5y ago
  I agree completely and I think we should move to a project based way of learning. Stupid example: You build a rocket, fly it, write how you did it. That demonstrates a certain understanding of physics as If I want to require an understanding of basic physics I can require people to have done a project which satisfy that requirement. I've been doing something similar for hiring junior engineers and how well they perform creating a project is the single most important factor to forecast their work performance. No leetcode required.
  - grendelt 5y ago
    Assessing that is tough and often doesn't scale well though.
- thrower123 5y ago
  > That's antithetical to how the computer security industry should work -- arbitrary certifications don't guarantee compliance or security, at best they suggest it. On the other hand, it is how computer security often does work. I can't count the number of times I've had to go through a listing of false-positive flags from some braindead OWASP checklist penetration/vulnerability tester.
plafl 5y ago
I find amusing the fractal nature of the universe: we say that some problems are complex (i.e NP-Hard) because no matter the algorithm you design I can devise a problem instance that will take exponential time for your algorithm (informal explanation). Clearly designing metrics for human is even worse: no matter the metric, people will find a way not only to make it hard to measure, but to make the metric fail. Which takes me to the following strengthening of the Turing test: A true AI will not only pass the Turing test, it will do so by cheating.
- HPsquared 5y ago
  Ironically, cheating on exams gives the cheater a form of "artificial intelligence".
- enedil 5y ago
  I know you stated that's it's informal explanation, but please don't conflate nondeterministic-polynomial with non-polynomial.
  - plafl 5y ago
    I have a proof that NP(Non Deterministic Polynomial)-Hard = Non Polynomial, but it's too long for a HN comment
    - emteycz 5y ago
      A link is never too long for a HN comment
      - tzs 5y ago
        If you don't care about IE and Edge compatibility a link can be too long for an HN comment.
        emteycz 5y ago
        Well then I'd recommend using a URL shortener
1vuio0pswjnm7 5y ago
Where do the dumps come from. Are test takers contributing to dumps from memory after they finish the exam. People were doing that with the patent bar, which also reuses some questions. Now test takers have to agree to confidentiality requirements.
- warner25 5y ago
  Good question. These certification exams all include a non-disclosure or confidentiality agreement. In any case, I don't think this could be the result of test-takers recalling questions from memory. We're talking about seeing 100-150 questions, and spending only a minute or so with each one, and many questions involve reading a short paragraph. The "dumps" have the questions and answers verbatim. I think it must be the work of unscrupulous employees at the certification vendors or some of the testing centers.
- wyclif 5y ago
  Are test takers contributing to dumps from memory after they finish the exam? I'm guessing no, because what could be the incentive to doing that unless there's money involved? Why would someone who passed the test and gained the cert want to dilute the value of the cert they just earned by making it easier for people further down the pyramid to pass the test?
  - robobob5000 5y ago
    there is absolutely money involved. The amount of people that has to get these certs is absolutely massive. There is a lot of money to be made in selling dumps
- panzagl 5y ago
  As far as I can tell these dumps come from the cert org itself- I needed a CompTIA cert and all of their official materials come with access to a bunch of practice tests.
  - warner25 5y ago
    There's a big difference between the legitimate practice tests that come with an exam guide and a "test dump." Practice tests are examples to give people a feel for the style and scope of the test, and which areas they might need to learn more about. A "test dump" lets people memorize pairs of actual (not example) questions and answers, so they can pass with no knowledge of the underlying concepts or how to apply them.
spullara 5y ago
Certifications for me have always been a negative signal for people that we might hire for startups. I have no idea how that affects folks that want to work for well established companies. It seems like below CIO it might be required for most enterprise IT organizations.
- skinkestek 5y ago
  I work as a consultant. I'm certified on some GCP stuff. Work pays us to study, take the exam and even pays a bonus if we pass. Am I smarter as a result of that exam? No. But I'm easier to sell. Some clients ask directly for certifications, others ask leading questions to our sales people I think. Would i put my certifications on every variation of my CV for any job I apply for? Probably no. While I'm at it: Someone else here writes about instantly rejecting people because of shibbolets like certifications. I'm fairly smart, well liked by colleagues and very well liked by customers. However I have been dumped in screening I don't know how many times, dumped during interviews etc for something nobody told me but now seems to be gone. Well everyone who didn't take me seriously: Thanks! I'm now a consultant working somewhere else with someone who pays better. And I am very motivated to give your competitors an edge ;-)
- ocdtrekkie 5y ago
  None of my certifications I got were required, I was hired into the enterprise IT field with no formal training. But I will say the process of studying for and taking certifications was wildly beneficial to my job. In my case, I took community college courses aligned to these programs (mostly to keep me on track) and often was able to apply things I was getting from class directly to work. I would say the certifications fill in a lot of gaps, and do give you a good baseline. It's definitely going to be a "you get out what you put in" thing though. Folks trying to rote-memorize dumps aren't going to get anything out of it. Personally, I used practice tests to evaluate and tell me where I needed to go back and study more, and then jumped back into the material in those places.
vsareto 5y ago
The thing that always bugged me was that Offensive Security certifications basically have no official recognition within that system despite being difficult relative to the others (it's often on job posts for contractors though)
soco 5y ago
I didn't see any certification bearer selling themselves as "experts", rather as a way to tell they know the basics - a way to compensate for lack of basic experience. On the other hand, with only little experience in a domain (let's say one project) there's no way you'd cover an entire curriculum, that's why for me a short experience is roughly equivalent to a certification exam. And even if you memorized a dump, that's a dump of answers to real world questions which you know now by heart, which is exactly the point of the exam. This goes for basic-level certifications. The "advanced" certifications are a different story - they must be doubled anyway with long time practical experience, so for those I see little value in cheating: if you tell me you're an advanced XYZ yet can't back that up with year(s) of project experience, sorry dear you took the exam (be it for good or from a dump) for exactly naught.
op00to 5y ago
Why do vendors insist on multiple choice? Red Hat solved this problems by making a Red Hat certifications practical exams. You can’t cram from brain dumps if you actually need to understand the content.
- austincheney 5y ago
  Multiple choice isn’t necessarily an indicator of poor quality. Most IQ tests, those administered by psychiatric supervision, are multiple choice intentionally looking for deviation and alignment through repetition and measured variation provided a long enough test. One of the cert exams I took, only one of them, looked for the exact same thing as a means to identify and fail crammers.
- xwolfi 5y ago
  Agreed, but it's also going to face even more resistance. I was ok spending all this time on something I knew I could pass quick, but practical ? Damn if you want to do a real test, get into a job with a 3 months probation and your rent on the line and contribute to something that makes money and you're done. All these certs stuff they re like uni, you know all they prove is very theoretical and you must have too some genius colleagues who can code amazing things but somehow never deliver and some messy dude who iteratively build the money printing software that pays for all this theory. So, no better test than the client for me.
  - op00to 5y ago
    I see “good certs” done by a truthful person shows me that a person can complete something, and they have the shared vocabulary to start understanding how that cert knowledge fits into their actual job. Im always surprised at the lack of follow through I see at so many levels.
teekert 5y ago
Arguably, practicing a lot of questions that one may encounter during the exam may be a good way of acquiring knowledge?
- deleted 5y ago
  [deleted]
- sciurus 5y ago
  It can if you go deeper and understand the why behind the answer. The problem is that it's possible to memorize what the right answer is without understanding the material at all.
- ajuc 5y ago
  It's the same problem test driven development faces. Some things can be inferred from a list of test cases (exam answers). But some things require deeper insight that no amount of test cases can provide without spending time actually thinking about the big picture. http://ravimohan.blogspot.com/2007/04/learning-from-sudoku-solvers.html http://ravimohan.blogspot.com/2007/04/learning-from-sudoku-s...
austincheney 5y ago
So completely stereotypical of developers on HN: hate certifications and simultaneously praise a CS bachelors as a divine certification. I am also a military signal officer and a corporate software developer for one of the largest companies. My experience is CS degrees are the clearest signal of predictable success only if you are hiring for Java, C++, or something super archaic like COBOL or Ada. Otherwise a CS degree is a signal of compatibility far more than competence, but many employers are willing to pay a premium for that. Actual certifications, things like Security+, which the military requires everywhere or the CISSP which they praise, is a signal of two competing qualities. They can be a measure of technical experience but mostly they are a signal of only academic preparation. Really they aren’t any different than the SAT in either function or real world meaning. This is double true in that the clueless/worthless will hold them up on a pedestal as a shining example of their self worth like some form of vanity. People are willing to cheat on the SAT for the same reasons. What I find most ironic though is that the stereotypical HN CS graduate, worshipping their degree and hating on certs, praise their SAT scores as a cert. EDIT: Why is this flagged?
- dang 5y ago
  Users flagged it. We can only guess why users flag things, but perhaps it was because you broke this guideline repeatedly: "Please don't sneer, including at the rest of the community." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
irrational 5y ago
> The typical approach, apparently, is to acquire a "dump," which is the bank of actual questions, and then repeatedly take "practice exams" so that they've already seen (and memorized) all of the questions that they might encounter during the actual exam. So, blatant cheating. Interestingly, when I decided to get a ham license, the method you describe as cheating is precisely how every single person and resource recommended preparing for the exam. I find it fascinating that certs are seen as so important in the military. I work for a Fortune 500 company and we care nothing for certifications. We don’t even really care about education (unless you are applying for an internship or first job out of college). Real life work experience is all that matters. When I look at a resume and see a bunch of certificates listed, it makes me suspicious that they are trying to disguise lack of ability with multiple choice tests. But, that mostly comes back to not having any faith in certificates.
- grendelt 5y ago
  Yeah, but the difference I believe is the FCC publishes the entire question pools to prevent third parties from selling a "dump". Ideally the pools are far larger than the questions you'd receive on the actual exam so trying to memorize the right answers is actually harder than engaging with the material. These test providers could do the same thing. They should expand their test pools to be extremely large by tweaking the values in each question so that one Q becomes 10. Prior to the federal government publishing question pools (I believe FAA does too), testing groups would send in folks to sit for the exam, memorize the questions then run outside and record what they saw. Do that enough times and the question pools emerged in their records and then they grew a big business selling that "dump". I can't imagine managing large question pools manually, but with digital tools it's become trivial in edtech circles. Why these test providers don't end it is beyond me. (Probably because the federal "cert" game status quo is plenty lucrative.)
- vsareto 5y ago
  You could have legit indicators of ability on your resume and you'll get a technical interview anyway. People are being just as suspicious of certs as they are prior experience. No one really trusts resumes at all, so it makes cert trustworthiness kind of moot.
xwolfi 5y ago
I disagree it's cheating though. Cheating is clearly defined by the exam condition, which are stupid (one time test rather than result evaluation but heh, it s a compromise). We had this debate between dev in my company because the execs want to see everyone certified for the cloud provider they spent millions choosing without asking us, fine. So myself I did it the hard way, spent 20 hours studying for this things, preparing for the exam, building little things to make sure I got it, to a point I feel really a lot less noob on the thing and actually start buying into it. I passed with flying color and it took me a quarter of the alloted time at the exam, fine. But I have colleagues who just asked me what bank was the closest to what I saw at the exam, tried and only studied where they failed, some barely passed, some barely failed, and I insist each time it s better to have a holistic theoretical understanding rather than just a quick practice run but are they worst colleagues ? Some have kids, some are my managers, some are so humiliated to have to be revalidated as competent, they just cant enjoy it. They dont cheat, they do the absolute minimum to get a grade and move on. And I challenge you to tell you never did that in your entire studying life. I remember a class of compilation theory when I was 19 that I studied the 5 hours before, and forgot 5 hours later to get a 45% grade that still passed my year and fine. Did I cheat? Hell no, but I was lazy and did the bare tolerable minimum. But, should we certify people in IT like that, I think your manager and your team and your clients already know what you're worth, so I agree it s pointless.
- 908B64B197 5y ago
  > We had this debate between dev in my company because the execs want to see everyone certified for the cloud provider they spent millions choosing without asking us, fine. I've heard of something similar. One of the employee suggested that he didn't need the cert. This really didn't sit well with management. Then he explained why: his previous job was on the team building said cloud product they decided to use. That was the reason he got hired. Useless to say he didn't work there long.
  - xwolfi 5y ago
    Ah that's cool :D Me all I could say was "but I spent years deploying in aws when you chose another one when everyone told you not to and nobody s using it because nobody needs it, not because we're not certified". I was met with "you need to get the cert by end of the year", which I got the next week, my eyes rolled the entire time. At least I got to impress people... like I say my colleagues all the time, the best bosses are those who care about useless metrics because they're easy to meet and you dont have to actually deliver anything of value to get praise and raise...
IHLayman 5y ago
For a different perspective on certifications, I just got my CKA cert from the Linux Foundation, and that test is legit: all simulation, no multiple choice. They use a full test cluster, backed by killer.sh, and every question involves some legitimate shell skills in addition to knowing k8s backwards and forwards. I was so impressed by the level of work that was put into the testing. May go back and get the other two certs if company will pay for it and it makes sense.
apexalpha 5y ago
I was also told to get CISSP for my current job. It consisted of a week-long class of a guy explaining "American Exam Culture" to us Europeans and practicing exam questions. Then made the exam, bunch of multiple-choice questions where you could guess most of them. Learned basically nothing and now they e-mail me asking for $35 or else I won't be allowed to call myself CISSP anymore, lol. These things are a racket. Mostly for the companies making the test but below them there's also the whole ecosystem of business trainings, people selling "exam guides", private tutoring and what not. It's very close to a pyramid scheme. That being said, my trainings from SANS where useful but wildly expensive. The most fun were trainings by Offensive Security such as OSCP. Good luck passing that one with just a few exam trainings.
pbhjpbhj 5y ago
Warning: tangentially related rant! > The typical approach, apparently, is to acquire a "dump," which is the bank of actual questions, and then repeatedly take "practice exams" so that they've already seen (and memorized) all of the questions that they might encounter during the actual exam. So, blatant cheating. Children I know in UK high schools (12-18) are being "educated" solely in this manner that you describe as cheating. I don't think you're wrong. Basically, the "teacher" gives them past exam questions to do right from the very start of a 5 year course. They never get any reference books (nor online equivalents), they're not taught the subject matter, only taught how to answer the exam questions. It's diabolical but what passes for state education at the moment. To clarify, I have no problem with practising on past exam questions but you need to actually educate people before you ask them to answer questions on the material.
- mtoddsmith 5y ago
  That happens in the US as well. Its because they use the test scores as a measurement which weigh heavily in decision making regarding teacher retention and promotion. Some teachers hand out the answer sheet 15min prior to a test for the kids to review.
- dhosek 5y ago
  There's a common pattern where in low-performing schools, the kids test above average at the lower levels and then fall off a cliff. This is exactly why: young kids (K-2) are great at memorizing. But if the only skill they learn is memorizing, their ability to extend this as they progress fails. It was startling how much the kids I encountered when I taught math (to high school kids and to college kids who were essentially taking junior high/high school math classes) still relied on memorization and pattern matching. I did what I could to break them of the habits but there's only so much you can do, especially in the post-secondary context where you get 45 hours of instruction time (less time for exams) in the course of a semester.
pjungwir 5y ago
I earned my Network+ cert last year for a DoD contracting gig. It was kind of nice to learn a few more port numbers, but wow: hours and hours of drilling cable standards and telco protocols from the 1990s, fiber optic connectors, servers to authenticate users dialing into a modem pool, and their official steps to troubleshoot a problem. This was for web development work, but it was basically the only cert they'd accept unless I wanted to learn SAP. And it was all just flash card knowledge. I still couldn't set up a RADIUS server. In school I was very idealistic about learning: prioritizing understanding over grades---even a bit to my detriment. But forcing me to do pointless learning sure brought out my cynic. In one Sherlock Holmes story, Watson is appalled to learn that Holmes still thinks the sun revolves around the Earth. But Holmes resents this new fact. It clutters up his well-organized memory with useless trivia. He tells Watson he can't wait to forget it as soon as possible. I'm as eager as Holmes to forget all I learned. It kind of shakes my identity to see myself thinking that way. And it turns out the cert is only good for 3 years. Then I need to do it all over again. Or write 20 blog posts about networking and get them approved (for a fee I believe). I wonder if this explains some of the dumb tech blogs I see. Like others here, I've always felt certs were a more negative signal than positive. Mine is on my resume for now, but I'm a little embarrassed by it---how crazy is that?
- commandlinefan 5y ago
  > certs were a more negative signal than positive Which represents a real conundrum for job-seekers: you never know if you're talking to somebody who think certs are required, or somebody who thinks that lack of certs is required.
- acheron 5y ago
  If you're going to continue the government contracting route, know that government agencies (not just DoD) love certs. Have never done Network+ but I did another similar one that allowed a short (maybe 1-2 hour) refresher course to renew after the 3 years, and I didn't have to go through the whole test again.
markus_zhang 5y ago
Apparently you get a whole army sitting on that certificate culture and feed of from wherever the $$$ comes from. Can't get rid of them.
quadrifoliate 5y ago
How are pay and benefits in the cert-worshipping world? It would be an interesting exercise grinding out the alphabet soup of certs as an alternative to endless algorithm practice.
- warner25 5y ago
  In the US military, among both uniformed service members and federal civilians, it's still more about seniority, institutional knowledge, and security clearances than certifications (with actual skills being even less important). The pay and benefits are good (much better than average for a given location with similar education and years of experience) if you make a career of it, but you won't start as an O-4 or GS-13 after just passing a bunch of certification exams. Highly paid contractors are typically former military because of their institutional knowledge and security clearances. The numbers that I see for "Big Tech" software engineers seem to be in a whole different universe, though. Better to keep practicing for your algorithm interviews.
musicale 5y ago
I figured those certifications were largely useless, but I guess they aren't.
carnitas 5y ago
Thanks for your comment. I thought I was the only person that thought the focus on certs in defense / mil is ridiculous

lordnacho 5y ago

Same goes for financial industry regulatory exams. Very little actual learning, a lot of remembering stupid stuff. It's no wonder people want to cheat. I've also done network stuff, it's quite a lot more technical. But in the end it's still a silly thing to do multiple choice for. Debugging a network is a skill that's hard to boil down to that kind of exam, though to be fair they do show you how in the courses.

warner25 5y ago
I will say that CCNA (taken in 2019) was the most legitimate of these exams. There were a handful of "simulator" questions that involved actually typing some commands into a Cisco IOS switch or router to change the configuration as appropriate. So that required a deeper understanding and forced test-takers to demonstrate what they might need to do on the job as a network technician. However, CCNA also seemed to be one of the exams for which it was easiest to find a "dump" including "practice simulators" taken straight from the real exam.
- lordnacho 5y ago
  Yeah I actually used the CCNA simulators for a lot of things early on before things clicked. It's just very hard to examine for in a way that isn't easy to cheat and demonstrates real understanding. After all in the real world every problem has its own quirks.
  - DnDGrognard 5y ago
    I did the college CNNA courses and one test was to fix a broken network (using real hardware). There is no substitute for hands on with real hardware.
- detaro 5y ago
  Yes, the Cisco certs seem to have a relatively good reputation. I think the higher ones even involve (or at least did) stages where the test-taker spends half a day setting something up, then an instructor breaks it and they have to fix it again. On the other hand, people there complain about the recertification requirements - it's quite a bit of effort to repeat every few years, so unless you're strictly required by an employer or customer to maintain them many let it lapse.

buro9 5y ago

In my experience hiring and then seeing how people perform over time I've roughly concluded that during screening / interviewing absence of a degree is not a negative signal (can be positive), but presence of certifications has consistently been a strong negative signal. I know there are a few areas in which they are seemingly unavoidable, i.e. government, military, financial. But if I see certifications on a profile I am interested in and I believe we have a role that matches what the person is looking to do, then I will use the more unscripted part of the interview to go to first principles and test the foundations of CompSci understanding with far fewer buzzwords.

renewiltord 5y ago
Too true. If I see MSCE on the bloody thing, it’s to the bin or I’m going to waste my next fifteen minutes
- tonyedgecombe 5y ago
  I did an MCSE in the nineties. It helped me round out my knowledge of the Microsoft products I was working with at the time. It also helped me to dig out of a career rut I was stuck in. This was before all the bootcamps arrived but even then I wouldn't completely dismiss it.
  - dagw 5y ago
    Yea, back in the 90s MCSE was a better investment and was actually a good way to get hired. I know lots of successful IT people today who got their first 'real' IT job thanks to earning their MCSE. Today I don't think they have the same value.
  - zomglings 5y ago
    It's not about whether you did the certification or not. The question is, do you put it on your resume?
    - tonyedgecombe 5y ago

hcazz 5y ago

That's antithetical to how the computer security industry should work -- arbitrary certifications don't guarantee compliance or security, at best they suggest it. To me, this feels like the same problem as OKRs in an organization. When your goal for success is a high score on the exams for a job rather than the ability to do the job, folks will optimize for the high score on the exam. Setting hard goals that determine success will determine where folks spend their time. Along those same lines, I don't see this as a problem for third party entities like CompTIA/(ISC)2/ISACA/Cisco/Etc to fix, but rather poor management and expectations of employees. OKRs and certificates aren't bad, they just need to measure the objective value to the organization as opposed to arbitrary standards (such as you must have X certificate to work here, or increasing pay based on certs earned). Those tests mentioned above can be useful litmus tests for folks in the recruiting space to sort through candidates, especially if they have a large number of applicants, but I worry that it excludes folks that could otherwise be very good at the job/role.

jokethrowaway 5y ago
I agree completely and I think we should move to a project based way of learning. Stupid example: You build a rocket, fly it, write how you did it. That demonstrates a certain understanding of physics as If I want to require an understanding of basic physics I can require people to have done a project which satisfy that requirement. I've been doing something similar for hiring junior engineers and how well they perform creating a project is the single most important factor to forecast their work performance. No leetcode required.
- grendelt 5y ago
  Assessing that is tough and often doesn't scale well though.
thrower123 5y ago
> That's antithetical to how the computer security industry should work -- arbitrary certifications don't guarantee compliance or security, at best they suggest it. On the other hand, it is how computer security often does work. I can't count the number of times I've had to go through a listing of false-positive flags from some braindead OWASP checklist penetration/vulnerability tester.

plafl 5y ago

I find amusing the fractal nature of the universe: we say that some problems are complex (i.e NP-Hard) because no matter the algorithm you design I can devise a problem instance that will take exponential time for your algorithm (informal explanation). Clearly designing metrics for human is even worse: no matter the metric, people will find a way not only to make it hard to measure, but to make the metric fail. Which takes me to the following strengthening of the Turing test: A true AI will not only pass the Turing test, it will do so by cheating.

HPsquared 5y ago
Ironically, cheating on exams gives the cheater a form of "artificial intelligence".
enedil 5y ago
I know you stated that's it's informal explanation, but please don't conflate nondeterministic-polynomial with non-polynomial.
- plafl 5y ago
  I have a proof that NP(Non Deterministic Polynomial)-Hard = Non Polynomial, but it's too long for a HN comment
  - emteycz 5y ago
    A link is never too long for a HN comment
    - tzs 5y ago
      If you don't care about IE and Edge compatibility a link can be too long for an HN comment.
      - emteycz 5y ago
        Well then I'd recommend using a URL shortener

1vuio0pswjnm7 5y ago

Where do the dumps come from. Are test takers contributing to dumps from memory after they finish the exam. People were doing that with the patent bar, which also reuses some questions. Now test takers have to agree to confidentiality requirements.

warner25 5y ago
Good question. These certification exams all include a non-disclosure or confidentiality agreement. In any case, I don't think this could be the result of test-takers recalling questions from memory. We're talking about seeing 100-150 questions, and spending only a minute or so with each one, and many questions involve reading a short paragraph. The "dumps" have the questions and answers verbatim. I think it must be the work of unscrupulous employees at the certification vendors or some of the testing centers.
wyclif 5y ago
Are test takers contributing to dumps from memory after they finish the exam? I'm guessing no, because what could be the incentive to doing that unless there's money involved? Why would someone who passed the test and gained the cert want to dilute the value of the cert they just earned by making it easier for people further down the pyramid to pass the test?
- robobob5000 5y ago
  there is absolutely money involved. The amount of people that has to get these certs is absolutely massive. There is a lot of money to be made in selling dumps
panzagl 5y ago
As far as I can tell these dumps come from the cert org itself- I needed a CompTIA cert and all of their official materials come with access to a bunch of practice tests.
- warner25 5y ago
  There's a big difference between the legitimate practice tests that come with an exam guide and a "test dump." Practice tests are examples to give people a feel for the style and scope of the test, and which areas they might need to learn more about. A "test dump" lets people memorize pairs of actual (not example) questions and answers, so they can pass with no knowledge of the underlying concepts or how to apply them.

spullara 5y ago

Certifications for me have always been a negative signal for people that we might hire for startups. I have no idea how that affects folks that want to work for well established companies. It seems like below CIO it might be required for most enterprise IT organizations.

skinkestek 5y ago
I work as a consultant. I'm certified on some GCP stuff. Work pays us to study, take the exam and even pays a bonus if we pass. Am I smarter as a result of that exam? No. But I'm easier to sell. Some clients ask directly for certifications, others ask leading questions to our sales people I think. Would i put my certifications on every variation of my CV for any job I apply for? Probably no. While I'm at it: Someone else here writes about instantly rejecting people because of shibbolets like certifications. I'm fairly smart, well liked by colleagues and very well liked by customers. However I have been dumped in screening I don't know how many times, dumped during interviews etc for something nobody told me but now seems to be gone. Well everyone who didn't take me seriously: Thanks! I'm now a consultant working somewhere else with someone who pays better. And I am very motivated to give your competitors an edge ;-)
ocdtrekkie 5y ago
None of my certifications I got were required, I was hired into the enterprise IT field with no formal training. But I will say the process of studying for and taking certifications was wildly beneficial to my job. In my case, I took community college courses aligned to these programs (mostly to keep me on track) and often was able to apply things I was getting from class directly to work. I would say the certifications fill in a lot of gaps, and do give you a good baseline. It's definitely going to be a "you get out what you put in" thing though. Folks trying to rote-memorize dumps aren't going to get anything out of it. Personally, I used practice tests to evaluate and tell me where I needed to go back and study more, and then jumped back into the material in those places.

vsareto 5y ago

The thing that always bugged me was that Offensive Security certifications basically have no official recognition within that system despite being difficult relative to the others (it's often on job posts for contractors though)

soco 5y ago

I didn't see any certification bearer selling themselves as "experts", rather as a way to tell they know the basics - a way to compensate for lack of basic experience. On the other hand, with only little experience in a domain (let's say one project) there's no way you'd cover an entire curriculum, that's why for me a short experience is roughly equivalent to a certification exam. And even if you memorized a dump, that's a dump of answers to real world questions which you know now by heart, which is exactly the point of the exam. This goes for basic-level certifications. The "advanced" certifications are a different story - they must be doubled anyway with long time practical experience, so for those I see little value in cheating: if you tell me you're an advanced XYZ yet can't back that up with year(s) of project experience, sorry dear you took the exam (be it for good or from a dump) for exactly naught.

op00to 5y ago

Why do vendors insist on multiple choice? Red Hat solved this problems by making a Red Hat certifications practical exams. You can’t cram from brain dumps if you actually need to understand the content.

austincheney 5y ago
Multiple choice isn’t necessarily an indicator of poor quality. Most IQ tests, those administered by psychiatric supervision, are multiple choice intentionally looking for deviation and alignment through repetition and measured variation provided a long enough test. One of the cert exams I took, only one of them, looked for the exact same thing as a means to identify and fail crammers.
xwolfi 5y ago
Agreed, but it's also going to face even more resistance. I was ok spending all this time on something I knew I could pass quick, but practical ? Damn if you want to do a real test, get into a job with a 3 months probation and your rent on the line and contribute to something that makes money and you're done. All these certs stuff they re like uni, you know all they prove is very theoretical and you must have too some genius colleagues who can code amazing things but somehow never deliver and some messy dude who iteratively build the money printing software that pays for all this theory. So, no better test than the client for me.
- op00to 5y ago
  I see “good certs” done by a truthful person shows me that a person can complete something, and they have the shared vocabulary to start understanding how that cert knowledge fits into their actual job. Im always surprised at the lack of follow through I see at so many levels.

teekert 5y ago

Arguably, practicing a lot of questions that one may encounter during the exam may be a good way of acquiring knowledge?

deleted 5y ago
[deleted]
sciurus 5y ago
It can if you go deeper and understand the why behind the answer. The problem is that it's possible to memorize what the right answer is without understanding the material at all.
ajuc 5y ago
It's the same problem test driven development faces. Some things can be inferred from a list of test cases (exam answers). But some things require deeper insight that no amount of test cases can provide without spending time actually thinking about the big picture. http://ravimohan.blogspot.com/2007/04/learning-from-sudoku-solvers.html http://ravimohan.blogspot.com/2007/04/learning-from-sudoku-s...

austincheney 5y ago

So completely stereotypical of developers on HN: hate certifications and simultaneously praise a CS bachelors as a divine certification. I am also a military signal officer and a corporate software developer for one of the largest companies. My experience is CS degrees are the clearest signal of predictable success only if you are hiring for Java, C++, or something super archaic like COBOL or Ada. Otherwise a CS degree is a signal of compatibility far more than competence, but many employers are willing to pay a premium for that. Actual certifications, things like Security+, which the military requires everywhere or the CISSP which they praise, is a signal of two competing qualities. They can be a measure of technical experience but mostly they are a signal of only academic preparation. Really they aren’t any different than the SAT in either function or real world meaning. This is double true in that the clueless/worthless will hold them up on a pedestal as a shining example of their self worth like some form of vanity. People are willing to cheat on the SAT for the same reasons. What I find most ironic though is that the stereotypical HN CS graduate, worshipping their degree and hating on certs, praise their SAT scores as a cert. EDIT: Why is this flagged?

dang 5y ago
Users flagged it. We can only guess why users flag things, but perhaps it was because you broke this guideline repeatedly: "Please don't sneer, including at the rest of the community." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

irrational 5y ago

> The typical approach, apparently, is to acquire a "dump," which is the bank of actual questions, and then repeatedly take "practice exams" so that they've already seen (and memorized) all of the questions that they might encounter during the actual exam. So, blatant cheating. Interestingly, when I decided to get a ham license, the method you describe as cheating is precisely how every single person and resource recommended preparing for the exam. I find it fascinating that certs are seen as so important in the military. I work for a Fortune 500 company and we care nothing for certifications. We don’t even really care about education (unless you are applying for an internship or first job out of college). Real life work experience is all that matters. When I look at a resume and see a bunch of certificates listed, it makes me suspicious that they are trying to disguise lack of ability with multiple choice tests. But, that mostly comes back to not having any faith in certificates.

grendelt 5y ago
Yeah, but the difference I believe is the FCC publishes the entire question pools to prevent third parties from selling a "dump". Ideally the pools are far larger than the questions you'd receive on the actual exam so trying to memorize the right answers is actually harder than engaging with the material. These test providers could do the same thing. They should expand their test pools to be extremely large by tweaking the values in each question so that one Q becomes 10. Prior to the federal government publishing question pools (I believe FAA does too), testing groups would send in folks to sit for the exam, memorize the questions then run outside and record what they saw. Do that enough times and the question pools emerged in their records and then they grew a big business selling that "dump". I can't imagine managing large question pools manually, but with digital tools it's become trivial in edtech circles. Why these test providers don't end it is beyond me. (Probably because the federal "cert" game status quo is plenty lucrative.)
vsareto 5y ago
You could have legit indicators of ability on your resume and you'll get a technical interview anyway. People are being just as suspicious of certs as they are prior experience. No one really trusts resumes at all, so it makes cert trustworthiness kind of moot.

xwolfi 5y ago

I disagree it's cheating though. Cheating is clearly defined by the exam condition, which are stupid (one time test rather than result evaluation but heh, it s a compromise). We had this debate between dev in my company because the execs want to see everyone certified for the cloud provider they spent millions choosing without asking us, fine. So myself I did it the hard way, spent 20 hours studying for this things, preparing for the exam, building little things to make sure I got it, to a point I feel really a lot less noob on the thing and actually start buying into it. I passed with flying color and it took me a quarter of the alloted time at the exam, fine. But I have colleagues who just asked me what bank was the closest to what I saw at the exam, tried and only studied where they failed, some barely passed, some barely failed, and I insist each time it s better to have a holistic theoretical understanding rather than just a quick practice run but are they worst colleagues ? Some have kids, some are my managers, some are so humiliated to have to be revalidated as competent, they just cant enjoy it. They dont cheat, they do the absolute minimum to get a grade and move on. And I challenge you to tell you never did that in your entire studying life. I remember a class of compilation theory when I was 19 that I studied the 5 hours before, and forgot 5 hours later to get a 45% grade that still passed my year and fine. Did I cheat? Hell no, but I was lazy and did the bare tolerable minimum. But, should we certify people in IT like that, I think your manager and your team and your clients already know what you're worth, so I agree it s pointless.

908B64B197 5y ago
> We had this debate between dev in my company because the execs want to see everyone certified for the cloud provider they spent millions choosing without asking us, fine. I've heard of something similar. One of the employee suggested that he didn't need the cert. This really didn't sit well with management. Then he explained why: his previous job was on the team building said cloud product they decided to use. That was the reason he got hired. Useless to say he didn't work there long.
- xwolfi 5y ago
  Ah that's cool :D Me all I could say was "but I spent years deploying in aws when you chose another one when everyone told you not to and nobody s using it because nobody needs it, not because we're not certified". I was met with "you need to get the cert by end of the year", which I got the next week, my eyes rolled the entire time. At least I got to impress people... like I say my colleagues all the time, the best bosses are those who care about useless metrics because they're easy to meet and you dont have to actually deliver anything of value to get praise and raise...

IHLayman 5y ago

For a different perspective on certifications, I just got my CKA cert from the Linux Foundation, and that test is legit: all simulation, no multiple choice. They use a full test cluster, backed by killer.sh, and every question involves some legitimate shell skills in addition to knowing k8s backwards and forwards. I was so impressed by the level of work that was put into the testing. May go back and get the other two certs if company will pay for it and it makes sense.

apexalpha 5y ago

I was also told to get CISSP for my current job. It consisted of a week-long class of a guy explaining "American Exam Culture" to us Europeans and practicing exam questions. Then made the exam, bunch of multiple-choice questions where you could guess most of them. Learned basically nothing and now they e-mail me asking for $35 or else I won't be allowed to call myself CISSP anymore, lol. These things are a racket. Mostly for the companies making the test but below them there's also the whole ecosystem of business trainings, people selling "exam guides", private tutoring and what not. It's very close to a pyramid scheme. That being said, my trainings from SANS where useful but wildly expensive. The most fun were trainings by Offensive Security such as OSCP. Good luck passing that one with just a few exam trainings.

pbhjpbhj 5y ago

Warning: tangentially related rant! > The typical approach, apparently, is to acquire a "dump," which is the bank of actual questions, and then repeatedly take "practice exams" so that they've already seen (and memorized) all of the questions that they might encounter during the actual exam. So, blatant cheating. Children I know in UK high schools (12-18) are being "educated" solely in this manner that you describe as cheating. I don't think you're wrong. Basically, the "teacher" gives them past exam questions to do right from the very start of a 5 year course. They never get any reference books (nor online equivalents), they're not taught the subject matter, only taught how to answer the exam questions. It's diabolical but what passes for state education at the moment. To clarify, I have no problem with practising on past exam questions but you need to actually educate people before you ask them to answer questions on the material.

mtoddsmith 5y ago
That happens in the US as well. Its because they use the test scores as a measurement which weigh heavily in decision making regarding teacher retention and promotion. Some teachers hand out the answer sheet 15min prior to a test for the kids to review.
dhosek 5y ago
There's a common pattern where in low-performing schools, the kids test above average at the lower levels and then fall off a cliff. This is exactly why: young kids (K-2) are great at memorizing. But if the only skill they learn is memorizing, their ability to extend this as they progress fails. It was startling how much the kids I encountered when I taught math (to high school kids and to college kids who were essentially taking junior high/high school math classes) still relied on memorization and pattern matching. I did what I could to break them of the habits but there's only so much you can do, especially in the post-secondary context where you get 45 hours of instruction time (less time for exams) in the course of a semester.

pjungwir 5y ago

I earned my Network+ cert last year for a DoD contracting gig. It was kind of nice to learn a few more port numbers, but wow: hours and hours of drilling cable standards and telco protocols from the 1990s, fiber optic connectors, servers to authenticate users dialing into a modem pool, and their official steps to troubleshoot a problem. This was for web development work, but it was basically the only cert they'd accept unless I wanted to learn SAP. And it was all just flash card knowledge. I still couldn't set up a RADIUS server. In school I was very idealistic about learning: prioritizing understanding over grades---even a bit to my detriment. But forcing me to do pointless learning sure brought out my cynic. In one Sherlock Holmes story, Watson is appalled to learn that Holmes still thinks the sun revolves around the Earth. But Holmes resents this new fact. It clutters up his well-organized memory with useless trivia. He tells Watson he can't wait to forget it as soon as possible. I'm as eager as Holmes to forget all I learned. It kind of shakes my identity to see myself thinking that way. And it turns out the cert is only good for 3 years. Then I need to do it all over again. Or write 20 blog posts about networking and get them approved (for a fee I believe). I wonder if this explains some of the dumb tech blogs I see. Like others here, I've always felt certs were a more negative signal than positive. Mine is on my resume for now, but I'm a little embarrassed by it---how crazy is that?

commandlinefan 5y ago
> certs were a more negative signal than positive Which represents a real conundrum for job-seekers: you never know if you're talking to somebody who think certs are required, or somebody who thinks that lack of certs is required.
acheron 5y ago
If you're going to continue the government contracting route, know that government agencies (not just DoD) love certs. Have never done Network+ but I did another similar one that allowed a short (maybe 1-2 hour) refresher course to renew after the 3 years, and I didn't have to go through the whole test again.

markus_zhang 5y ago

Apparently you get a whole army sitting on that certificate culture and feed of from wherever the $$$ comes from. Can't get rid of them.

quadrifoliate 5y ago

How are pay and benefits in the cert-worshipping world? It would be an interesting exercise grinding out the alphabet soup of certs as an alternative to endless algorithm practice.

warner25 5y ago
In the US military, among both uniformed service members and federal civilians, it's still more about seniority, institutional knowledge, and security clearances than certifications (with actual skills being even less important). The pay and benefits are good (much better than average for a given location with similar education and years of experience) if you make a career of it, but you won't start as an O-4 or GS-13 after just passing a bunch of certification exams. Highly paid contractors are typically former military because of their institutional knowledge and security clearances. The numbers that I see for "Big Tech" software engineers seem to be in a whole different universe, though. Better to keep practicing for your algorithm interviews.

musicale 5y ago

I figured those certifications were largely useless, but I guess they aren't.

carnitas 5y ago

Thanks for your comment. I thought I was the only person that thought the focus on certs in defense / mil is ridiculous