5 ms·

I once interviewed an intern candidate who bragged about getting into an argument with Bram on the mailing lists over a possible vulnerability. Bram insisted it

I once interviewed an intern candidate who bragged about getting into an argument with Bram on the mailing lists over a possible vulnerability. Bram insisted it was not important, and this young gun insisted it was. We didn't hire the guy. It's interesting seeing these memorials for Bram, from what people say he was the polar opposite of this kid in a good way.

sitzkrieg 3y ago
at least they cared enough to stick to their guns i guess
- dudus 3y ago
  Indeed, not 100% clear but it felt like GP was criticizing the kid. The kid enters a security related conversation and Bram not only listens but engages in the conversation. Seems like you missed on a great hire.
  - cweagans 3y ago
    Bram listened to and engaged in most conversations, I think. He was very approachable.
  - MSFT_Edging 3y ago
    The young guy was fairly skilled at technical stuff, but his story about arguing with Bram was an insight into his interpersonal skills. It wasn't what lost him the spot though. I personally liked him but he didn't really perform on the nuts and bolts challenges we present to candidates. They're not particularly difficult challenges, just things to see how a candidate approaches a problem. I don't remember what exactly was disconcerting about his approach but I feel like he took a lot of short cuts via google searching and didn't exactly understand what he was doing. This was years ago back when we did in-person interviews though, so my memory isn't 100% on it. We have a lot of extremely intelligent people with small egos at my company and cockyness like that doesn't really fit super well with our group.
- twobitshifter 3y ago
  The article talks about modesty and meeting in the middle, but I get the impression that the younger dev didn’t want to budge or understand the other point being made by Bram.
  - prmoustache 3y ago
    I haven't followed that but that is having an opinion. Sometimes you can only agree on disagreeing.
anon7331 3y ago
Was this kid arguing about the automatic encrypt/decrypt file capability and Bram's unwillingness to use a cryptographically secure algorithm? It was a long, long thread that got heated. I was with Bram though! It was never meant to be secure in a cryptographic sense...
- coldtea 3y ago
  "Never meant to be cryptographically secure" should never go together with "encrypt/decrypt file capability". This can even mean someone's loss of life in the right (meaning wrong) regime, or property (e.g. storing bitcoin info there). It's like advertising a "self-driving technology" when your car needs human supervision to not crash and kill you or someone you fall into.
  - anon7331 3y ago
    I am not sure it's so black and white with encryption. It depends on your threat model. Keeping it secure from an angry ex-girlfriend is one thing, but keeping it secure from a three letter agency is another. The mistake you are referring to is someone that assumes "encrypted" means three letter agency safe, which is a pretty terrible way to leverage encryption. In that case, it's exactly like hopping in a Tesla and assuming auto pilot will take you home without your supervision.
    - H8crilA 3y ago
      This would make sense if only it wasn't faster to run AES_GCM or some other AEAD, than whatever they did there.
    - coldtea 3y ago
      >The mistake you are referring to is someone that assumes "encrypted" means three letter agency safe, which is a pretty terrible way to leverage encryption. That's not a mistake, that's table stakes. People reading that X offers "encryption", should assume its cryptographically safe to the standards of the day, and be given that. Not just some "safe from your spouse, ...maybe..." glorified rot13. Else, just don't offer it. It's not Vim's place to offer "file encryption" anyway, especially if they can't keep that promise. It's fine not to offer it. And it doesn't have to be a "three letter agency" that's the threat. The "angry ex-girlfriend" could might as well be a programmer. Or have a script-kiddie nephew. Or know a person or two who can use off-the-shelf tools to decrypt it. And the file might have things like a person's bank account passwords.

sitzkrieg 3y ago

at least they cared enough to stick to their guns i guess

dudus 3y ago
Indeed, not 100% clear but it felt like GP was criticizing the kid. The kid enters a security related conversation and Bram not only listens but engages in the conversation. Seems like you missed on a great hire.
- cweagans 3y ago
  Bram listened to and engaged in most conversations, I think. He was very approachable.
- MSFT_Edging 3y ago
  The young guy was fairly skilled at technical stuff, but his story about arguing with Bram was an insight into his interpersonal skills. It wasn't what lost him the spot though. I personally liked him but he didn't really perform on the nuts and bolts challenges we present to candidates. They're not particularly difficult challenges, just things to see how a candidate approaches a problem. I don't remember what exactly was disconcerting about his approach but I feel like he took a lot of short cuts via google searching and didn't exactly understand what he was doing. This was years ago back when we did in-person interviews though, so my memory isn't 100% on it. We have a lot of extremely intelligent people with small egos at my company and cockyness like that doesn't really fit super well with our group.
twobitshifter 3y ago
The article talks about modesty and meeting in the middle, but I get the impression that the younger dev didn’t want to budge or understand the other point being made by Bram.
- prmoustache 3y ago
  I haven't followed that but that is having an opinion. Sometimes you can only agree on disagreeing.

anon7331 3y ago

Was this kid arguing about the automatic encrypt/decrypt file capability and Bram's unwillingness to use a cryptographically secure algorithm? It was a long, long thread that got heated. I was with Bram though! It was never meant to be secure in a cryptographic sense...

coldtea 3y ago
"Never meant to be cryptographically secure" should never go together with "encrypt/decrypt file capability". This can even mean someone's loss of life in the right (meaning wrong) regime, or property (e.g. storing bitcoin info there). It's like advertising a "self-driving technology" when your car needs human supervision to not crash and kill you or someone you fall into.
- anon7331 3y ago
  I am not sure it's so black and white with encryption. It depends on your threat model. Keeping it secure from an angry ex-girlfriend is one thing, but keeping it secure from a three letter agency is another. The mistake you are referring to is someone that assumes "encrypted" means three letter agency safe, which is a pretty terrible way to leverage encryption. In that case, it's exactly like hopping in a Tesla and assuming auto pilot will take you home without your supervision.
  - H8crilA 3y ago
    This would make sense if only it wasn't faster to run AES_GCM or some other AEAD, than whatever they did there.
  - coldtea 3y ago
    >The mistake you are referring to is someone that assumes "encrypted" means three letter agency safe, which is a pretty terrible way to leverage encryption. That's not a mistake, that's table stakes. People reading that X offers "encryption", should assume its cryptographically safe to the standards of the day, and be given that. Not just some "safe from your spouse, ...maybe..." glorified rot13. Else, just don't offer it. It's not Vim's place to offer "file encryption" anyway, especially if they can't keep that promise. It's fine not to offer it. And it doesn't have to be a "three letter agency" that's the threat. The "angry ex-girlfriend" could might as well be a programmer. Or have a script-kiddie nephew. Or know a person or two who can use off-the-shelf tools to decrypt it. And the file might have things like a person's bank account passwords.