5 ms·
I don't buy it. Most private companies would require a face-to-face meeting when you start. Even if you're fully remote, the expectation would be that at some
by yongjik 3y ago
I don't buy it. Most private companies would require a face-to-face meeting when you start. Even if you're fully remote, the expectation would be that at some point you would meet your coworkers at meetspace, most likely before you get to commit anything substantial. The ones that are worth penetrating will almost certainly require a background check.
And then, once you're in, you cannot just commit to your target project willy-nilly, as your manager and your manager's manager will have other priorities. A for-profit company's frequently dysfunctional management would actually work as deterrent here: you don't just need to justify your code, you will have to justify why you were working on it in the first place.
- ThePowerOfFuet 3y agohttps://rigor-mortis.nmrc.org/@simplenomad/112184869681420177 https://rigor-mortis.nmrc.org/@simplenomad/11218486968142017...
- deleted 3y ago[deleted]
- xyst 3y agoface to face, background checks. they are all superficial. A smooth talker can get you to relax your guard. Identity can be faked, especially if you have a nation state backing you.
- breadwinner 3y agoToday no one knows what Jia Tan looks like. That means Jia Tan come back as Gary Smith and work on the next exploit. If we knew what he looked like, we could have at least prevented him from coming back.
- not2b 3y agoJia Tan might be more than one person.
- breadwinner 3y agoRequiring him/her to show their face might have prevented that.
- saagarjha 3y agoWhy? Just have one person show up and everyone else funnel the work through their account.
- kelseydh 3y agoOn open source projects you can vet people based on whether you can personally identify them as real people. Moving forward be suspicious of anonymity for core contributions.
- not2b 3y agoDebian does things that way, their developers have to get their key signed by other developers, and a DD who signs someone's key is supposed to check ID. But there's no similar protection for their upstream.
- xcrunner529 3y agoAnd using a freaking VPN for everything. Definitely more vetting is needed.
- TeMPOraL 3y agoThat's still one named person the police can go after, a good starting point for investigation into the criminal network. Also, that's still one named person that no one would like to end up being, so that alone acts as a deterrent.
- bigiain 3y agoHow much would you bet against the NSA having a team full of leetcode and interview experts, who's job is to apply at tech companies and perform excellently through the hiring process, so that the offensive team at NSA can infiltrate and work remotely without ever needing to meet there new "coworkers"? I suspect a "professional job seeker" with the resources of the NSA behind them and who lands 1st and subsequent interviews dozens of times a year - would be _way_ better at landing interviews and jumping through stupid recruiting hoops that even the best senior or "10x engineers", who probably only interview a dozen or two times in their entire career.