18 ms·
Code to flood Kellogg with bogus job applications after strikers sacked
- kotaKat 5y agoJust because you don't agree with a political position doesn't mean you should be willingly violating the CFAA and encouraging others to do so.
- pg_1234 5y agoThat's how you start getting crooked laws changed.
- jimbob45 5y agoSeems like bullshit. I know there are some pieces of software that can bypass CAPTCHA at a low success rate but certainly not at a high enough rate to be a bother, especially when the CAPTCHA settings are turned up (e.g. multiple challenges in a row).
- klondike_ 5y agoPeople usually use human powered CAPTCHA solving services nowadays
- paranorman 5y agoExactly, deathbycaptcha is one I’ve seen in action more than 5 years ago. This stuff has been human powered for way longer than that.
- bstar77 5y agoApparently I'm barely human enough to get through those Captchas.
- mrkentutbabi 5y agohow does this work? do they capture the screen and forward the captcha to some service in India?
- flotzam 5y agoHere's an example of a captcha-solving API: https://anti-captcha.com/apidoc/methods/createTask https://anti-captcha.com/apidoc/methods/createTask They have a browser extension too, I guess it detects the displayed captcha and submits it to the API
- mrkentutbabi 5y agoWow, just wow. This is amazing.
- flotzam 5y agoGotta love adversarial interoperability, productionized
- deleted 5y ago[deleted]
- gruez 5y agofor recaptcha it's even simpler. Because of how it's implemented, all you have to do is send the captcha solving service the site key, and it returns a solved token.
- michaelt 5y agoI once heard someone (perhaps jokingly) suggest forwarding the captchas to users of some website you control - e.g. a free porn website where you have to solve a captcha every 10 images.
- schleck8 5y agoRecaptchas yield a code when completed succesfully, which can be transfered to a different machine to instantly solve it i think. Finally repercussions for the sites not updating their recaptcha versions and annoying everyone with v2
- the_only_law 5y agoJust ran through their job site sign up. Didn’t encounter a captcha or email verification to get to a job application form. I did encounter a password field bad enough that password management software generated passwords aren’t allowed but “Password12345” is.
- michaelt 5y agoI can believe the developer found the job application form didn't have a CAPTCHA or IP rate limit at the time. Presumably it will soon gain one, if it hasn't already.
- sdfaksdfjalj 5y agoThey're using SAP SuccessFactors saas. I'm not sure about the features that platform has, but other easy ways to block the spam would be email verification, shadowban with silent captcha, or turning up cloudflare anti-bot to maximum.
- mumphster 5y agoYou can solve 1k captchas for $1 at 80% success, they're trivial to bypass
- HPsquared 5y agoIt does raise questions about how industrial disputes may unfold online. If picketing IRL factories is allowed, what would the law be on DDOS of an online business by union members?
- deleted 5y ago[deleted]
- josephcsible 5y agoThis isn't equivalent to picketing. It's more like sabotage.
- kesselvon 5y agoFlooding your public website form isn't a crime in the same way prank calling a customer service line isn't a crime.
- gruez 5y agoActually it is a crime (even though prank calling isn't a crime) because of the CFAA.
- Miner49er 5y agoPretty much anything done on a computer could be a crime because of the CFAA. It is extremely broad.
- nulbyte 5y agoA recent case at the Supreme Court has limited this, and it seems applicable here, on the face of it. https://www.eff.org/deeplinks/2021/06/supreme-court-overturns-overbroad-interpretation-cfaa-protecting-security https://www.eff.org/deeplinks/2021/06/supreme-court-overturn... > the Court adopted a “gates-up-or-down” approach: either you are entitled to access the information or you are not. To me, it sounds like you are entitled to submit a job application or you are not. I don't see how a charge under the CFAA for submitting an application would stick, when they are inviting the public to submit applications.
- Minor49er 5y agoMost job postings online are made through an applicant tracking system (ATS). Many of these also handle application submissions as well. These systems typically let the HR department filter through results that they don't want. Unless the striker is adding enough variety in the applications and when they are submitted, I think it would be pretty easy to match and discard the bogus ones.
- moolcool 5y ago"Unless the striker is adding enough variety in the applications and when they are submitted, I think it would be pretty easy to match and discard the bogus ones" That wouldn't be so hard to do, would it?
- spsful 5y agoNot at all. Many of the people from Reddit are specifically applying using local zip codes, local addresses, and local area code phone numbers. Kellogg is going to have a massive headache trying to sort through these imo. Edit: One thing I didn't think of was application source IP address. It's possible the ATS records that info when an app is submitted, so they could possibly delete bogus records that way but I'm no ATS expert and this is literally just my own conjecture.
- egwynn 5y agoYes IP, and also User Agent doesn’t look like it’d be hard to filter against using the posted code.
- sumtechguy 5y agoAlso they could just pull the listing then go to some temp agencies (for example manpower, randstad) and say 'i would like to hire 10 people that have these qualifications'. I know a couple of people who do not even look at company websites and deal only with companies like this for these kind of jobs. They are perfectly fine being forever temp.
- literallyaduck 5y agoJust stop using their products and don't hire anyone who started working there after the labor dispute happened. Get big companies to sign a pledge like a code of conduct that says they won't do business with scabs or companies using scabs. Use collective bargaining to hold their feet to the fire.
- nrmitchi 5y ago> don't hire anyone who started working there after the labor dispute happened. I kind of see the point that you're trying to make, but I'm sure you understand that not everyone is in the same position to pick and choose jobs that the majority of HN find themselves in. Often when someone takes a job, it's because they need a job in order to live. It's pretty shitty of you to suggest that that individual should be barred from future employment because they had to take a job that was available, even if the reason it was available is disagreeable.
- wayoutthere 5y agoScab jobs are a negotiating tactic; they’re very temporary and that should be known. This strike will eventually be over and they’ll fire the scabs immediately (and the scabs will be blacklisted). Taking one of those jobs does nothing to advance a person’s position and in fact will probably leave them worse off.
- nrmitchi 5y ago> Taking one of those jobs does nothing to advance a person’s position I don't believe that anyone taking these positions are doing it in order to advance their career. > will probably leave them worse off Worse than homeless, starving, and possibly dead?
- ryandrake 5y agoYou could say the same thing about the whole spectrum of ethically questionable jobs. I think we can all agree that there is at least some point on that spectrum where "Well, I needed a job" is an unacceptable excuse. We're currently living in one of those rare times where there are a lot of non-questionable jobs going unfilled, and employers are a little uncomfortable with the number of job vacancies. So, if you have to take a job, there are currently plenty out there that keep your hands clean of strike-busting.
- mrkentutbabi 5y agoThe person took it down after reading about Computer Fraud and Abuse Act lol.
- jareklupinski 5y agohttps://github.com/Heroin-Bob/Kellogg-Time-Waster-3000 https://github.com/Heroin-Bob/Kellogg-Time-Waster-3000 shows a 404 but https://github.com/SeanDaBlack/KelloggBot https://github.com/SeanDaBlack/KelloggBot looks like its still up for now yea... why would they use their real name haha
- yjftsjthsd-h 5y ago> why would they use their real name The obvious reading is that they legitimately saw no problem initially and then realized later that it was legally questionable and yanked it.
- lordlimecat 5y agoI rather suspect that anyone reading about this-- whether computer literate or not-- will suspect in the back of their minds that this thing is not legal. Turns out those hunches are pretty reliable, who woulda thunk it.
- mrkentutbabi 5y agoYup. And seems he took down his github photo too? Lol
- maerF0x0 5y agohosting/providing code isn't illegal, right? it's the invocation of it that would be, right?
- aaron695 5y agoGiving away guns isn't illegal. But giving them away and telling people to use against someone is.
- josephcsible 5y agoThis is the kind of thing that the CFAA is supposed to be for. If a fired employee broke into the office and welded the HR department's door shut, they'd end up in prison, and what these people are doing is just as bad.
- wayoutthere 5y agoIf this is illegal, the law is wrong. This has become the case in enough places that the law is losing relevance in our lives.
- josephcsible 5y agoWhy do you think it should be legal to sabotage your employer's systems in response to a labor dispute?
- wayoutthere 5y agoBecause they are sabotaging labor’s ability to negotiate fairly. Turnabout is fair game.
- josephcsible 5y agoIf you try to buy a car, but you and the seller fail to reach a deal, is it okay for you to let the air out of their tires, since they sabotaged your ability to negotiate fairly?
- wayoutthere 5y agoBuying a certain car at a certain price isn’t a requirement to feeding your family. Making enough money to buy food is.
- gruez 5y ago>Buying a certain car at a certain price isn’t a requirement to feeding your family It isn't? In many parts of the US a car is needed to hold a job, or to even get to the grocery store (which might be miles away). Moreover, grocery stores do provide the means to "feed your family". Does that mean looting/vandalizing them is fair game after failing to "negotiate" with them?
- tacobelllover99 5y agocyber terrorism nice
- edmcnulty101 5y agoIt's actually well written, rather pretty code. https://github.com/SeanDaBlack/KelloggBot/blob/main/req.py https://github.com/SeanDaBlack/KelloggBot/blob/main/req.py Edit: The code is not PERFECT as MANY people have picked it apart below. But if I had to work with this code on a daily basis I would certainly not mind. If you ever need a code review just post your code on hacker news and say it's well written....
- gruez 5y agoIt is? It looks pretty middle of the road to me. obvious issues: 1. undescriptive variable names (eg. data2) 2. inconsistent formatting 3. copy pasted fragments everywhere
- edmcnulty101 5y ago> undescriptive variable names - Have you seen Carmack or Torvalds code? > inconsistent formatting - Needs more explanation? It's python, consistent formatting is enforced > copy pasted fragments everywhere - Nothing wrong with that AT ALL if you understand how it works. It's literally the fundamental premise of Github Co-pilot.
- howdydoo 5y agoI mean sure, it's not perfect. It might not get you through a FAANG interview, but it would get you through a Kellogg interview.
- Kye 5y agoI wouldn't survive the interview because I would have to answer "Why do you want to work here?" with "To fund adult art commissions of Tony the Tiger."
- varelse 5y agoI think a more commercially successful venture would be an adult cinematic franchise set in the Dark Frankenberry/Count Chocula universe as they save breakfast (and morning sex) from nefarious threats like the Frosted Lucky Charms Elf and the evil Quisp.
- moolcool 5y agoHN is funny. In some threads they romanticize the image of the mischievous and disruptive hacker, but then when they actually encounter a mischievous and disruptive hacker the comments are all "This is illegal, you know"
- dang 5y agoWho is "they"? You're talking about different people. HN is not a person - it can't have human qualities like being hypocritical about something. That would be like calling a room hypocritical because people in it disagree.
- moolcool 5y agoSure, but it's doubtless that there are prevailing attitudes, and also doubtless those attitudes are allowed change over time. Because of the voting system you can even measure that change. I would also argue that a voting mechanism can distill that room into a single amplified voice, even if there's some disagreement within the room. As an example: You could post a Dawkins quote on /r/atheism at noon and you'll probably get some upvotes and some comments. If you post the same quote at midnight (when most of those who interacted on the original post are asleep), you'll probably get a similar proportion of upvotes and similar comments, but from entirely different individuals. Meanwhile, you could expect the inverse outcomes making the same post at different times on /r/christianity. What I'm asserting here is that any popular community with comments ranked by upvotes and downvotes inevitably ends up speaking with a singular editorial voice regardless of who happens to be online that day. And (here comes the hot take) in the case of HN, that voice has, for better or worse, lost a lot of its hard-edge over time in my opinion.
- dang 5y agoIMO you're falling prey to the tendency to anthropomorphize these things. That's powerful and common and unavoidable. Where it becomes a moderation issue is when people start posting their images of the community in a snarky or sneering or defensive way, in order to immediately knock them down. (This is what you did above with your "they".) In comments like that, people are simply battling with their own imagination. Such comments are reliably uninformative and go against what we're trying for on this forum (https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html), so please don't post like that here. (On the other hand, if you actually want to do a rigorous analysis of the data I'd be happy to help. We'd never publish vote data but I don't see why that would be necessary anyhow.)
- aNoob7000 5y agoI think unions should change the way they work and focus on helping people find other jobs. Trying to get a company to meet your demands about increased wages and benefits seems futile in a world where competition is local and global. For example, if a tech union offered networking opportunities, resume-building help, internships, and access to companies looking for employees, I would join.
- SuoDuanDao 5y agoI agree, it's also very difficult to do one's best by the customer when there's such an adversarial relationship inside the company structure. I think Unions work better when they're more like guilds, where the primary focus ins perpetuating best practises and serving the public, with fair wages for work done being a natural consequence of the best workers being union members.
- bee_rider 5y agoUnions would work better if they were more like guilds, in the sense that guilds and professional societies serve an entirely different type of worker, with jobs that are in higher demand and have more training requirements. So yes if unions had to do a very different, much easier job, they'd probably do great.
- user-the-name 5y agoThat is grossly ignorant of the history and purpose of unions, and what they have achieved.
- SuoDuanDao 5y agoYou're right, it's entirely informed by what I see unions doing in my workplace today.
- user-the-name 5y agoYes, that would indeed be very ignorant if that is the sum total of your knowledge.
- deleted 5y ago[deleted]
- champagnois 5y agoA business parted ways with some staff who were refusing to work under the contract that was offered. The business is now looking for new staff. I'm strongly against the idea of using weaponized computer code to disrupt their hiring operations and flooding. Sounds like it is probably illegal. I guess I am new to Ycombinator, is this type of thread the norm here? Seems pretty sketchy and I would say this is probably the lowest quality thread I've seen on this entire network this week.
- dookahku 5y agoJust ask for your money back from hn
- champagnois 5y agoThe value of this board is an extension of the quality of comments and discussion. We need to hold each other and ourselves to a high standard. The community guidelines are an attempt at saying please be decent so as to foster a more desirable community. Think about it. That is why you are here and not reddit. >>Be kind. Don't be snarky. Have curious conversation; don't cross-examine. Please don't fulminate. Please don't sneer, including at the rest of the community. >>Comments should get more thoughtful and substantive, not less, as a topic gets more divisive. >>Eschew flamebait. Avoid unrelated controversies and generic tangents.
- Jcowell 5y agoTo me this submission exemplifies the hacker in hacker news. This isn’t White Hacker News or Black Hacker News. It’s important we discuss events like this as they happen. It would be ridiculous not to.
- hello_marmalade 5y agoThat’s pretty heavily oversimplifying the issue. There were some pretty serious accusations levied against Kellog’s.
- champagnois 5y ago
- mullingitover 5y agoIt'll be trivial for any competent administrator to filter the bogus applications based on the non-unique IPs they were submitted from. Further, user agent is probably going to be identical. Finally, the time they were submitted is going to be another way of filtering them out. Addressing these flaws would make the resume jamming far more effective. This is not advice, just observation.
- Shuang1 5y agoThis is a bad idea, it's probably illegal to do this kind of thing.
- RickJWagner 5y agoWhy be part of a mob? I don't feel strongly either way on this one. I'm not going to do something damaging just because I could.