The 4 case examples in the article are absolutely slackers. Not mentioning a 6 figure cloud inefficiency, or knowingly shipping bugs, or leaving 100's of diffs

The 4 case examples in the article are absolutely slackers. Not mentioning a 6 figure cloud inefficiency, or knowingly shipping bugs, or leaving 100's of diffs for compiler warnings and not publishing them. You're right about not being able to tell a genuinely mediocre developer from an intentionally mediocre one... unless they tell on themselves like the above did. >Do you stop talking to a colleague because they have never found a security vulnerability and fixed it? This feels like a reach? Obviously not, I'm perfectly cordial to everyone I work with. If they find a security vulnerability, and don't fix or even bother reporting it then I'll obviously think less of them and probably not give them a referral. But I'd never hold it against someone for not identifying one or accidentally shipping one.