4 ms·

If only this were hyperbole. I once interviewed with a startup whose process was: 1. Pass TripleByte (already puts you in top whatever percentage of SWEs) 2.

If only this were hyperbole. I once interviewed with a startup whose process was: 1. Pass TripleByte (already puts you in top whatever percentage of SWEs) 2. Meet with 4 members of the company for an hour each, and if they all like you: 3. Create a 15 minute presentation on some code you worked on. It can be code from a current or past job, but that will probably reflect poorly on you, so go build something so you can create a 15 minute presentation on it. 4. Deliver the presentation during lunch to anyone at the company who joins the meeting. Also, join the meeting via some pseudo video game in the browser that you’ve never heard of and probably won’t exist in 2 years (about 8 people joined the meeting, most of which I never met). 5. Meet with the cofounder for an hour, and if they like you enough: 6. You have the privilege of working for them for a week “trial” to make sure it’s really a good fit. You can still be rejected at this point, though if I made it this far only to be rejected, I’d have killed myself, so the fact that I’m writing this now should tell you I did not make it past #4. For those curious, #4, my presentation was about how I reverse engineered the Robinhood API, spoofed requests to get around their “security”, and used two levels of caching (Redis and a typical relational DB) to subvert rate limiting/IP blacklisting. I don’t know anybody who has done something as remarkable, especially in their spare time, for fun. BUT, I apparently said or did something they didn’t like so all that is moot. If carpenters had to go through what we go through… Jesus Christ himself could come back to Earth, apply at the Google of construction firms, and be rejected because of the gap on his resume. Ooo, sorry, that gap is a huge red flag. What’s that, you were murdered by Romans and it’s not your fault? Ehhh…. I don’t want to risk making a bad hire. Thank you so much for your interest though, we will surely keep you in mind for future opportunities.

smashed 3y ago
> For those curious, #4, my presentation was about how I reverse engineered the Robinhood API, spoofed requests to get around their “security” This was probably against their TOS and even if not, trying to bypass security measures, no matter how weak, is unethical behavior, and possibly illegal. That would be a red flag in an hiring scenario since you were essentially bragging about breaking the law. Unless Robinhood had a bug bounty/responsible disclosure kind of program and you were fully acting within its limit, but your comment did not sound like it.
- u32480932048 3y ago
  If an interviewer whined about Wall Street TOS, I'd pull my application on the spot.
  - gymbeaux 3y ago
    I think some companies just want to look for a reason to disqualify a candidate to make their decision process easier. If you have two roughly equal candidates, pick the one whose side project did NOT violate some random company’s TOS. I kind of get it. It’s incredibly lazy and arguably just as unethical as violating some random company’s TOS, but I get it.
- D13Fd 3y ago
  Yeah. This sounds like the presentation requirement (ridiculous as it is) worked to filter someone based on unethical behavior.
  - gymbeaux 3y ago
    To quote another commenter, “If an interviewer whined about Wall Street TOS, I'd pull my application on the spot.” But yes, that might be why I didn’t make it past that step. My internet connection also dropped in the middle of it (AT&T Fiber, connected via Ethernet), and I had to give the presentation again, that might have been why- though they explicitly said that wasn’t why, but… you never know.
- gymbeaux 3y ago
  It's not "security" in the hacking sense. Perhaps that was a poor word choice. So when you hit an API, the server can reject your request for any reason, typically a malformed request. Maybe a header it's expecting is missing, or the API key is invalid, something like that. With Robinhood's API, you can't simply provide your bearer token and hit the endpoint. There are MANY headers it is expecting, and if any are missing or incorrect, you'll get a 4xx response. Otherwise, breaking ToS is akin to jaywalking and anybody who sees a side project like this, and their takeaway is "wow they broke ToS" doesn't deserve to be hiring software engineers, and certainly doesn't deserve to be putting them through the ringer such that the first bar to pass is literally Triplebyte (RIP Triplebyte).
jacknews 3y ago
Jesus Christ himself could come back to Earth ... Ooo, sorry, that gap is a huge red flag. lol
hacker_newz 3y ago
> used two levels of caching (Redis and a typical relational DB) to subvert rate limiting/IP blacklisting How do those subvert rate limiting / blacklisting?
- gymbeaux 3y ago
  The Robinhood API is of course the API for stock broker Robinhood. Their API, last I used it, probably could have been optimized to provide data in fewer API requests, but aside from that, there are many pieces of data that change constantly, like the current price of a stock. There are pieces of data that change occasionally, like the next earnings report date for a company. Then there are pieces of data that should never change, like a company's CUSIP (essentially the primary key in a database of stocks). When you create an app that relies on data from another API, there is usually a "setup" where all the data your app requires is brought in from the API. I was getting rate-limited during this process (downloading all my watchlists and current holdings, as well as my orders/transactions, metadata about the companies such as the next earnings date, and so forth). By using Redis and MySQL, I minimized the number of calls the app has to make directly to the Robinhood API. For things like the next earnings date, which changes typically once per 90 days or so, I have Redis store the result of that endpoint from Robinhood for some number of days, probably not 90, but not 1. For things like the current price of a stock, Redis might store that for a minute or two, so that my app can "spam" for the latest prices (maybe I have a refresh button in the app) without triggering a 401 or 403 from the Robinhood API. TLDR: Since rate limiting prevents my app from pulling all the data it needs at one time - it has to throttle requests - I don't want to have to wait a couple of minutes each time the app is started because it needs to download data from Robinhood, much of which probably hasn't changed since the last time I started the app.
  - dsr_ 3y ago
    > Then there are pieces of data that should never change, like a company's CUSIP (essentially the primary key in a database of stocks). I hate to break it to you, but tickers and CUSIPs do change. The world of 'corporate actions' turns out to be a catchbasin requiring human intervention.

smashed 3y ago

> For those curious, #4, my presentation was about how I reverse engineered the Robinhood API, spoofed requests to get around their “security” This was probably against their TOS and even if not, trying to bypass security measures, no matter how weak, is unethical behavior, and possibly illegal. That would be a red flag in an hiring scenario since you were essentially bragging about breaking the law. Unless Robinhood had a bug bounty/responsible disclosure kind of program and you were fully acting within its limit, but your comment did not sound like it.

u32480932048 3y ago
If an interviewer whined about Wall Street TOS, I'd pull my application on the spot.
- gymbeaux 3y ago
  I think some companies just want to look for a reason to disqualify a candidate to make their decision process easier. If you have two roughly equal candidates, pick the one whose side project did NOT violate some random company’s TOS. I kind of get it. It’s incredibly lazy and arguably just as unethical as violating some random company’s TOS, but I get it.
D13Fd 3y ago
Yeah. This sounds like the presentation requirement (ridiculous as it is) worked to filter someone based on unethical behavior.
- gymbeaux 3y ago
  To quote another commenter, “If an interviewer whined about Wall Street TOS, I'd pull my application on the spot.” But yes, that might be why I didn’t make it past that step. My internet connection also dropped in the middle of it (AT&T Fiber, connected via Ethernet), and I had to give the presentation again, that might have been why- though they explicitly said that wasn’t why, but… you never know.
gymbeaux 3y ago
It's not "security" in the hacking sense. Perhaps that was a poor word choice. So when you hit an API, the server can reject your request for any reason, typically a malformed request. Maybe a header it's expecting is missing, or the API key is invalid, something like that. With Robinhood's API, you can't simply provide your bearer token and hit the endpoint. There are MANY headers it is expecting, and if any are missing or incorrect, you'll get a 4xx response. Otherwise, breaking ToS is akin to jaywalking and anybody who sees a side project like this, and their takeaway is "wow they broke ToS" doesn't deserve to be hiring software engineers, and certainly doesn't deserve to be putting them through the ringer such that the first bar to pass is literally Triplebyte (RIP Triplebyte).

jacknews 3y ago

Jesus Christ himself could come back to Earth ... Ooo, sorry, that gap is a huge red flag. lol

hacker_newz 3y ago

> used two levels of caching (Redis and a typical relational DB) to subvert rate limiting/IP blacklisting How do those subvert rate limiting / blacklisting?

gymbeaux 3y ago
The Robinhood API is of course the API for stock broker Robinhood. Their API, last I used it, probably could have been optimized to provide data in fewer API requests, but aside from that, there are many pieces of data that change constantly, like the current price of a stock. There are pieces of data that change occasionally, like the next earnings report date for a company. Then there are pieces of data that should never change, like a company's CUSIP (essentially the primary key in a database of stocks). When you create an app that relies on data from another API, there is usually a "setup" where all the data your app requires is brought in from the API. I was getting rate-limited during this process (downloading all my watchlists and current holdings, as well as my orders/transactions, metadata about the companies such as the next earnings date, and so forth). By using Redis and MySQL, I minimized the number of calls the app has to make directly to the Robinhood API. For things like the next earnings date, which changes typically once per 90 days or so, I have Redis store the result of that endpoint from Robinhood for some number of days, probably not 90, but not 1. For things like the current price of a stock, Redis might store that for a minute or two, so that my app can "spam" for the latest prices (maybe I have a refresh button in the app) without triggering a 401 or 403 from the Robinhood API. TLDR: Since rate limiting prevents my app from pulling all the data it needs at one time - it has to throttle requests - I don't want to have to wait a couple of minutes each time the app is started because it needs to download data from Robinhood, much of which probably hasn't changed since the last time I started the app.
- dsr_ 3y ago
  > Then there are pieces of data that should never change, like a company's CUSIP (essentially the primary key in a database of stocks). I hate to break it to you, but tickers and CUSIPs do change. The world of 'corporate actions' turns out to be a catchbasin requiring human intervention.