8 ms·

They used their leet "OSINT" skillz to ask the most basic of questions and background checks that nearly any traditional interview process would immediately unc

They used their leet "OSINT" skillz to ask the most basic of questions and background checks that nearly any traditional interview process would immediately uncover, then think it's so novel it's worthy of a blog post. On the surface it seems the "security" industry is lacking in the most basic of security processes when hiring. I don't think I've ever worked anywhere that could accidentally hire a North Korean without uncovering it somewhere in the hiring process, and all my jobs have been especially uninteresting. What bothers me more is there are talented people sitting on unemployment right now that can't find a job, yet fake people are getting hired left and right. Something in the industry as a whole is quite broken.

corytheboyd 1y ago
> yet fake people are getting hired left and right. Hate to be that person, but what are you reading that makes you think this is true? Agree that the article is pretty dumb though, especially the OSINT and Crypto “don’t trust, verify” comments. Feels like content marketing that didn’t really hit.
- ta1243 1y ago
  They're getting interviews left and right https://www.theregister.com/2025/04/29/north_korea_worker_interview_questions/ https://www.theregister.com/2025/04/29/north_korea_worker_in... According to Crowdstrike (the company that wiped out most of global technology last year) at least > My favorite interview question, because we've interviewed quite a few of these folks, is something to the effect of 'How fat is Kim Jong Un?' They terminate the call instantly
  - jwilber 1y ago
    Hired left and right != interviewed left and right != interviewed quite a few at Crowdstrike. Maybe you’re contributing to the narrative with the posts like above. It’ll certainly drive engagement.
  - ductsurprise 1y ago
    > My favorite interview question, because we've interviewed quite a few of these folks, is something to the effect of 'How fat is Kim Jong Un?' They terminate the call instantly I'm sure there were a lot of false positives with that question. If I was not reading HN and a few other sources I would likely hang up the phone too. Thinking that it couldn't be a real job,... some phishing scam or hoax, asking ridiculous questions like that. Depending on the job, it is quite likely the real talent would not be able to take the interview seriously after hearing suck a question. Seriously weird times...
    - psygn89 1y ago
      That's actually hilarious. Edit: Oops, accidentally responded to you instead of original quote.
  - eunos 1y ago
    > How fat is Kim Jong Un Ha if I got asked that during an interview, I'd think either I went to the wrong interview or the interview is a red flag.
    - deleted 1y ago
      [deleted]
    - tough 1y ago
      In crypto has become a known joke to ask that before hiring bc NK state actors really are focsuesd on it and hacking companies etc.
- sanktanglia 1y ago
  I mean the article did point out that there were some official emails for other companies mixed in with the info for this user suggesting they or others have gotten hired and official emails at other companies
- unsupp0rted 1y ago
  There's always that guy on X who posts about having n remote jobs at the same, waiting to be fired from each so that he can replace its slot with another. Then next year it's a different guy, same schtick.
  - mingus88 1y ago
    I’ve also seen some claim that they will do that and simply sub-contract the work out to cheaper labor If the employer is satisfied with the employees output, who is being harmed?
    - ted_dunning 1y ago
      A company that is indemnifying their customers for security lapses perhaps? Or a company that is handling HIPAA, GDPR or other sensitive data and is certifying that they are following policies around employee training, data sovereignty and document handling?
- cj 1y ago
  80% of our recruiter's time is spent trying to figure out which candidates are real and which are fake. It's really, really bad. We post a role, get 500 applicants, and nearly all of them are not legitimate. They all look amazing, really great resume, impressive LinkedIn, etc... but when you dig a little deeper, it's not that hard to find a bunch of red flags (LinkedIn profile create < 3 months ago, VOIP number, using VPN to submit job application, etc). You really have to know what signs to look for. They're very convincing fakes. We're extremely vigilant about this issue as a company, yet we've had people get through 2 or 3 rounds before someone realized something was off (some people are really, really good at faking it). I feel bad for small companies trying to hire. For us, it got to the point where we literally couldn't open a role unless we had a full time recruiter to sift through all the international candidates pretending to live in the US. Edit: We've been dealing with this for a couple years now, and there still isn't a great solution. Unfortunately the only surefire "solutions" we can think of are also things that would make the interview process less enjoyable for real candidates, which sucks. (One idea was to ask candidates to show us photo ID during the video interview, but something about making a candidate do that just doesn't feel good - although we have tried it, and it has effectively stopped a few fake people from getting through)
  - tough 1y ago
    maybe leave the photo id ask for when there's suspicion only is fine
    - DiggyJohnson 1y ago
      Why has asking for photo ID become politicized. ID for voting and job interviews seems like some of the most reasonable usage for an official ID.
      - mingus88 1y ago
        The reason it is political for voting is that the rules needed to get a qualified ID are often impossible (or hard enough to suppress voting) for many legit voters. These rules have become weaponized in a culture war, such as the requirement that an ID match the name on the birth record, meaning women whose last names changed during marriage require additional paperwork, often crossing state lines and in person visits. Bingo, disenfranchised a large population of women. Personally I think voting should be mandatory as some countries have done, and verification should be easy. Obviously you need documentation to work, and it’s fair to gather that documentation as early in the process as is reasonable (as in when an application is submitted)
- hibikir 1y ago
  As the last interviewer in a loop, I have caught fake candidates. This means they are getting through earlier rounds in my own employer, and makes me think I don't have a 100% success rate.
- throwaway48476 1y ago
  People tend to only interact either the process when they're looking for work, so rarely. The north Koreans do it everyday and optimize the process. It's like captchas where the bots have surpassed human skill.
- anarticle 1y ago
  I did see two fakes hired at my old company, a 20 something "senior eng" who couldn't use git or python, and shockingly a VP who managed to fake it for nearly a year. He was unceremoniously fired on a Friday, but he was still paid lol. I worked at an adtech company, he would give talks with powerpoints talking about internet of things which was absolutely wild. (We never sold or touched a single piece of hardware.)
klodolph 1y ago
The fake people are sometimes backed by entire teams (the article alludes to this). It’s easier to do well in your job when you’re supported by a team of people, maintaining the fiction that you’re one person. This isn’t happening left and right. It’s an attack against specific industries, like crypto and finance. It’s one part of a broader pattern of attacks.
- danielvf 1y ago
  It used to be only against specific industries, but now it's evolving. Now they have groups just going after remote IT jobs regardless of industry.
  - nradov 1y ago
    Beyond just the salary, once they have access to the corporate network they can execute other attacks to steal from company accounts and infiltrate connected business partners. Most organizations still have very weak protection against insider threats.
- kelseyfrog 1y ago
  If this harms the crypto industry even a little I'm not sure I'd feel even a twinge of sympathy. Is there anything I can do to assist NK in these affairs?
  - klodolph 1y ago
    “These people (crypto industry) are bad people so it is justified to ignore the rule of law when hurting them” is a classic bad take. What you can do is regulate crypto into oblivion and make people feel bad about working in crypto. If you assist NK, then you’re hurting crypto but you’re funding NK operations (e.g. NK soldiers assisting Russia against Ukraine).
    - kelseyfrog 1y ago
      If I don't assist NK then I'm tacitly assisting the crypto industry. We're in trolley problem territory now.
sam-cop-vimes 1y ago
This sounds unnecessarily dismissive. It was a quick and interesting read, and there are some useful data points for every company that is hiring to improve their processes.
- bravoetch 1y ago
  Given the stakes, it was an inexpensive way to remain calibrated against this kind of attack. Sharing the information is also great. People seem to be expecting cyber-thriller level heist antics here, when it's often much simpler.
deleted 1y ago
[deleted]
bri3d 1y ago
> On the surface it seems the "security" industry is lacking in the most basic of security processes when hiring. They found this person at the top of the funnel, before they even started the process, and then chose to go through with it out of curiosity / for advertising. I personally think it's silly (I don't think the advertising or learning about some comically basic TTP like "interview coaching" was worth their team's time) but it's not a lack of basic process in this case. I will say that hiring for remote jobs has gotten to be a gigantic time waste lately. Even though even moderate background checking can filter these candidates out, it's quite time consuming and with the rise of generative AI, these type of candidates (whether state-sponsored malicious actors or overemployment shops) are appearing in every industry and every role constantly by the hundreds. I disagree completely with other posts claiming only crypto and finance are being targeted; while it's hard to confirm and the North Korean operation specifically may be more tailored, fake candidates are rampant throughout the tech industry now.
- bko 1y ago
  I think its useful to test as to what questions they are and aren't prepared for. In the future you won't necessarily know they were an imposter, so it's good to devise and test certain captcha like questions to tease out the fake from the real candidates.
- ryandrake 1y ago
  > I will say that hiring for remote jobs has gotten to be a gigantic time waste lately. Not sure why this would be any different for remote jobs. All job interview processes (remote and in-office) I've ever done have had an in-person step, and that should be enough to filter these fake candidates, no? Are companies really doing 100% remote interviews, as in: you sign the offer letter without even meeting a single person in person?? Also, the in-person step is usually at the end, which means yes, you can waste a lot of time phone- and Zoom-chatting with fake candidates, but that is equally true for in-office vs. remote roles. Nobody starts with the in-person, on-site interview.
  - squigz 1y ago
    All interview processes I've went through have indeed been 100% remote. When considering this, you should keep in mind the amount of developers that aren't earning top 1% incomes or being offered stock in companies. Things are probably a lot more casual than you may be used to.
tinktank 1y ago
Why the condescending negativity? What would you they rather have done instead?
duxup 1y ago
I know some folks good folks who work in the security industry. It seems like there's a very WIDE range of quality people / companies, and an awful lot of compete FRAUDS. For whatever reason "security" seems to have attracted a lot of carpetbaggers. The good folks are very sensitive about it.
- donnachangstein 1y ago
  Absolutely! It's probably 90/10. Nothing gives someone away as a poser as much as bragging about OSINT as if it's some sort of tradecraft meanwhile they're executing the same skills your average wine aunt does stalking her ex-boyfriend on Facebook.
z3t4 1y ago
> Something in the industry as a whole is quite broken. The problem is that it's very difficult to assess how good someone is in their job. The solution is to promote the best engineers into management so they can vet the candidates.
- nradov 1y ago
  The best engineers don't necessarily make good resource managers. Often it's the opposite. But good managers and recruiters will involve engineers early in the hiring process.
rvz 1y ago
> What bothers me more is there are talented people sitting on unemployment right now that can't find a job, yet fake people are getting hired left and right. Something in the industry as a whole is quite broken. It IS "broken" by design as employers just don't want to go through the effort into finding great candidates (even if they are truly exceptional) and now it is even easier for candidates to cheat it thanks to AI. The ones claiming to "fix" it aren't fixing anything and are making it worse for both the interviewer and the candidate and are just extracting money from the process. The reality is, there is no fix.
- zdragnar 1y ago
  Even at small startups, posting engineering jobs will get you hundreds of applications a day. There's simply no way for employers to fairly go through them. LinkedIn et al make everything worse by making the application process so easy. If you're a small company, the fix is to outsource the top of your funnel to a recruiting company you trust. If you're a medium or large company, the fix is to require on-site work.
  - ryandrake 1y ago
    This isn't really a new problem. I remember back during a previous tech downturn, the small-ish (~200 people) no-name company I worked for also got hundreds of applications a day. Yes, today, fake candidates and AI make it worse, but fundamentally the "huge number of people in the top of the funnel" problem has been a thing for a long time.
    - zdragnar 1y ago
      I was mostly replying to this bit: > employers just don't want to go through the effort into finding great candidate The notion that employers can put in the effort to give every candidate a totally fair shot so they can find the best ones is, I think, wrong, let alone the notion that they could but choose not to. At my last company, we would have needed more people doing application reviews and interviews than we actually had employees if we wanted to do that. Hell, I remember in college applying for a stock job at the local liquor store. When I went to hand in the application, I was told to put it on the pile- a stack of filled out applications thicker than several of my textbooks put together, suspiciously placed at the edge of a desk right next to a trash can.
libraryatnight 1y ago
Dude you ain't kidding. Security is all SaaS sales now and chasing corporate buzzwords, it's not security they're selling, it's insurance and the ability to outsource blame when you get popped. Get a new CISO? You'll probably be buying the software from the last company he worked with and spending the next 3 years installing it all over just in time for them to declare mission accomplished you are secure and move on to the next square in the C-suite game of Life these dudes play. Then there's the people beneath them who want to be them mucking up the system playing get to the c-suite and not 'secure the company' or 'build good things' Oh and if you've gone public your core business is probably on auto pilot with some gremlins keeping it running while your execs placate shareholders with layoffs and introducing AI. People who actually want to do things, help people, and understand why the work needs done and is worth doing (the work that is anyway) are burnt the fuck out.
- ta1243 1y ago
  It took me worryingly long in my career (like 20 years) to realise that the CTO doesn't care if the technology solutions work, or if they're cost effective. What he cares about is not being interrupted on the golf course. If you have a system that is down for 12 hours 3 times a year, it's fine - as long as a lot of other companies are also down. If you have one that's down for 2 hours once every 3 years, but you're the only one affected, that's terrible. Not because you're "losing sales", but because you can't bemoan a common supplier, point to "it's a global problem", and then get taken for a nice apology lunch by the account manager when your bill goes up 10% next year.
data4lyfe 1y ago
You really have to just ask dumb interview questions. Testing them on answering questions while putting their hand over their face or their hands covering their eyes now. It's really dumbi-fied our interview processes (see https://datastream.substack.com/p/my-foolproof-interview-questions https://datastream.substack.com/p/my-foolproof-interview-que...)
mvdtnz 1y ago
You need to keep in mind that only the dumbest people on Earth remain in the crypto space in 2025.
hn_throwaway_99 1y ago
Couldn't agree more. While I might not be as harsh against the blog post author, they made it seem like they were doing some high-level reconnaissance work, and at the end of the day the thing that made the NK candidate "unravel" was questions like "tell me about some restaurants in your town". All this goes to show is that, for many companies, their hiring process for offshore employees is so sad that basic human interactions that would easily uncover blatant attempts like this are skipped.
thephyber 1y ago
> there are talented people sitting on unemployment right now that can't find a job, yet fake people are getting hired left and right. Something in the industry as a whole is quite broken. An entire country has dedicated significant resources to getting some of their hackers hired. Those talented people you mention are likely trying to get hired by themselves. It’s not an industry problem so much as a coordinated attack.
tlhorsu 1y ago
The whole situation makes me as a job seeker even more paranoid. I had an initial interview scheduled over video but I had a power outage and had no choice but to use my phone. It's the dumbest coincidence ever and hasn't happened again, and if it makes me look suspicious, so be it. For some reason none of my phone cameras worked with Google Meet because Google engineering sucks and the interviewer kept asking me questions why my camera was off. I answered honestly that I had a power outage and this was my only device I had available on such short notice, that Google Meet wasn't working, etc. I even talked to the hiring manager half an hour over schedule since we clicked so well, submitted my code exam but was rejected without any explanation. Because I got no explanation the potential reasons for my rejection rolled over in my head. I finished the exam to the best of my ability - was my ability just not good enough? If I went to e.g. the library or something to hunt for a station with webcams in time would I have not come off so suspect? Since then I've gotten no other interview offers elsewhere and feel like a moron for blowing my one chance last month over such a stupid coincidence, if it really was the case they rejected me for thinking I was some kind of corporate spy. It really was the definition of "too good to be true." I will now pay way more attention to how I appear to the interviewer from now on, and carry extra devices/webcams in case the worst happens.
Funes- 1y ago
>Something in the industry as a whole is quite broken. More like the whole system...
creer 1y ago
It's a marketing blog post. I guess they feel like this gives them "street cred" for being a security firm "targeted" by a north korean and how they "strategically interacted with" that person. It's not about the employment pipeline or basic vetting.

corytheboyd 1y ago

> yet fake people are getting hired left and right. Hate to be that person, but what are you reading that makes you think this is true? Agree that the article is pretty dumb though, especially the OSINT and Crypto “don’t trust, verify” comments. Feels like content marketing that didn’t really hit.

ta1243 1y ago
They're getting interviews left and right https://www.theregister.com/2025/04/29/north_korea_worker_interview_questions/ https://www.theregister.com/2025/04/29/north_korea_worker_in... According to Crowdstrike (the company that wiped out most of global technology last year) at least > My favorite interview question, because we've interviewed quite a few of these folks, is something to the effect of 'How fat is Kim Jong Un?' They terminate the call instantly
- jwilber 1y ago
  Hired left and right != interviewed left and right != interviewed quite a few at Crowdstrike. Maybe you’re contributing to the narrative with the posts like above. It’ll certainly drive engagement.
- ductsurprise 1y ago
  > My favorite interview question, because we've interviewed quite a few of these folks, is something to the effect of 'How fat is Kim Jong Un?' They terminate the call instantly I'm sure there were a lot of false positives with that question. If I was not reading HN and a few other sources I would likely hang up the phone too. Thinking that it couldn't be a real job,... some phishing scam or hoax, asking ridiculous questions like that. Depending on the job, it is quite likely the real talent would not be able to take the interview seriously after hearing suck a question. Seriously weird times...
  - psygn89 1y ago
    That's actually hilarious. Edit: Oops, accidentally responded to you instead of original quote.
- eunos 1y ago
  > How fat is Kim Jong Un Ha if I got asked that during an interview, I'd think either I went to the wrong interview or the interview is a red flag.
  - deleted 1y ago
    [deleted]
  - tough 1y ago
    In crypto has become a known joke to ask that before hiring bc NK state actors really are focsuesd on it and hacking companies etc.
sanktanglia 1y ago
I mean the article did point out that there were some official emails for other companies mixed in with the info for this user suggesting they or others have gotten hired and official emails at other companies
unsupp0rted 1y ago
There's always that guy on X who posts about having n remote jobs at the same, waiting to be fired from each so that he can replace its slot with another. Then next year it's a different guy, same schtick.
- mingus88 1y ago
  I’ve also seen some claim that they will do that and simply sub-contract the work out to cheaper labor If the employer is satisfied with the employees output, who is being harmed?
  - ted_dunning 1y ago
    A company that is indemnifying their customers for security lapses perhaps? Or a company that is handling HIPAA, GDPR or other sensitive data and is certifying that they are following policies around employee training, data sovereignty and document handling?
cj 1y ago
80% of our recruiter's time is spent trying to figure out which candidates are real and which are fake. It's really, really bad. We post a role, get 500 applicants, and nearly all of them are not legitimate. They all look amazing, really great resume, impressive LinkedIn, etc... but when you dig a little deeper, it's not that hard to find a bunch of red flags (LinkedIn profile create < 3 months ago, VOIP number, using VPN to submit job application, etc). You really have to know what signs to look for. They're very convincing fakes. We're extremely vigilant about this issue as a company, yet we've had people get through 2 or 3 rounds before someone realized something was off (some people are really, really good at faking it). I feel bad for small companies trying to hire. For us, it got to the point where we literally couldn't open a role unless we had a full time recruiter to sift through all the international candidates pretending to live in the US. Edit: We've been dealing with this for a couple years now, and there still isn't a great solution. Unfortunately the only surefire "solutions" we can think of are also things that would make the interview process less enjoyable for real candidates, which sucks. (One idea was to ask candidates to show us photo ID during the video interview, but something about making a candidate do that just doesn't feel good - although we have tried it, and it has effectively stopped a few fake people from getting through)
- tough 1y ago
  maybe leave the photo id ask for when there's suspicion only is fine
  - DiggyJohnson 1y ago
    Why has asking for photo ID become politicized. ID for voting and job interviews seems like some of the most reasonable usage for an official ID.
    - mingus88 1y ago
      The reason it is political for voting is that the rules needed to get a qualified ID are often impossible (or hard enough to suppress voting) for many legit voters. These rules have become weaponized in a culture war, such as the requirement that an ID match the name on the birth record, meaning women whose last names changed during marriage require additional paperwork, often crossing state lines and in person visits. Bingo, disenfranchised a large population of women. Personally I think voting should be mandatory as some countries have done, and verification should be easy. Obviously you need documentation to work, and it’s fair to gather that documentation as early in the process as is reasonable (as in when an application is submitted)
hibikir 1y ago
As the last interviewer in a loop, I have caught fake candidates. This means they are getting through earlier rounds in my own employer, and makes me think I don't have a 100% success rate.
throwaway48476 1y ago
People tend to only interact either the process when they're looking for work, so rarely. The north Koreans do it everyday and optimize the process. It's like captchas where the bots have surpassed human skill.
anarticle 1y ago
I did see two fakes hired at my old company, a 20 something "senior eng" who couldn't use git or python, and shockingly a VP who managed to fake it for nearly a year. He was unceremoniously fired on a Friday, but he was still paid lol. I worked at an adtech company, he would give talks with powerpoints talking about internet of things which was absolutely wild. (We never sold or touched a single piece of hardware.)

klodolph 1y ago

The fake people are sometimes backed by entire teams (the article alludes to this). It’s easier to do well in your job when you’re supported by a team of people, maintaining the fiction that you’re one person. This isn’t happening left and right. It’s an attack against specific industries, like crypto and finance. It’s one part of a broader pattern of attacks.

danielvf 1y ago
It used to be only against specific industries, but now it's evolving. Now they have groups just going after remote IT jobs regardless of industry.
- nradov 1y ago
  Beyond just the salary, once they have access to the corporate network they can execute other attacks to steal from company accounts and infiltrate connected business partners. Most organizations still have very weak protection against insider threats.
kelseyfrog 1y ago
If this harms the crypto industry even a little I'm not sure I'd feel even a twinge of sympathy. Is there anything I can do to assist NK in these affairs?
- klodolph 1y ago
  “These people (crypto industry) are bad people so it is justified to ignore the rule of law when hurting them” is a classic bad take. What you can do is regulate crypto into oblivion and make people feel bad about working in crypto. If you assist NK, then you’re hurting crypto but you’re funding NK operations (e.g. NK soldiers assisting Russia against Ukraine).
  - kelseyfrog 1y ago
    If I don't assist NK then I'm tacitly assisting the crypto industry. We're in trolley problem territory now.

sam-cop-vimes 1y ago

This sounds unnecessarily dismissive. It was a quick and interesting read, and there are some useful data points for every company that is hiring to improve their processes.

bravoetch 1y ago
Given the stakes, it was an inexpensive way to remain calibrated against this kind of attack. Sharing the information is also great. People seem to be expecting cyber-thriller level heist antics here, when it's often much simpler.

deleted 1y ago

[deleted]

bri3d 1y ago

> On the surface it seems the "security" industry is lacking in the most basic of security processes when hiring. They found this person at the top of the funnel, before they even started the process, and then chose to go through with it out of curiosity / for advertising. I personally think it's silly (I don't think the advertising or learning about some comically basic TTP like "interview coaching" was worth their team's time) but it's not a lack of basic process in this case. I will say that hiring for remote jobs has gotten to be a gigantic time waste lately. Even though even moderate background checking can filter these candidates out, it's quite time consuming and with the rise of generative AI, these type of candidates (whether state-sponsored malicious actors or overemployment shops) are appearing in every industry and every role constantly by the hundreds. I disagree completely with other posts claiming only crypto and finance are being targeted; while it's hard to confirm and the North Korean operation specifically may be more tailored, fake candidates are rampant throughout the tech industry now.

bko 1y ago
I think its useful to test as to what questions they are and aren't prepared for. In the future you won't necessarily know they were an imposter, so it's good to devise and test certain captcha like questions to tease out the fake from the real candidates.
ryandrake 1y ago
> I will say that hiring for remote jobs has gotten to be a gigantic time waste lately. Not sure why this would be any different for remote jobs. All job interview processes (remote and in-office) I've ever done have had an in-person step, and that should be enough to filter these fake candidates, no? Are companies really doing 100% remote interviews, as in: you sign the offer letter without even meeting a single person in person?? Also, the in-person step is usually at the end, which means yes, you can waste a lot of time phone- and Zoom-chatting with fake candidates, but that is equally true for in-office vs. remote roles. Nobody starts with the in-person, on-site interview.
- squigz 1y ago
  All interview processes I've went through have indeed been 100% remote. When considering this, you should keep in mind the amount of developers that aren't earning top 1% incomes or being offered stock in companies. Things are probably a lot more casual than you may be used to.

tinktank 1y ago

Why the condescending negativity? What would you they rather have done instead?

duxup 1y ago

I know some folks good folks who work in the security industry. It seems like there's a very WIDE range of quality people / companies, and an awful lot of compete FRAUDS. For whatever reason "security" seems to have attracted a lot of carpetbaggers. The good folks are very sensitive about it.

donnachangstein 1y ago
Absolutely! It's probably 90/10. Nothing gives someone away as a poser as much as bragging about OSINT as if it's some sort of tradecraft meanwhile they're executing the same skills your average wine aunt does stalking her ex-boyfriend on Facebook.

z3t4 1y ago

> Something in the industry as a whole is quite broken. The problem is that it's very difficult to assess how good someone is in their job. The solution is to promote the best engineers into management so they can vet the candidates.

nradov 1y ago
The best engineers don't necessarily make good resource managers. Often it's the opposite. But good managers and recruiters will involve engineers early in the hiring process.

rvz 1y ago

> What bothers me more is there are talented people sitting on unemployment right now that can't find a job, yet fake people are getting hired left and right. Something in the industry as a whole is quite broken. It IS "broken" by design as employers just don't want to go through the effort into finding great candidates (even if they are truly exceptional) and now it is even easier for candidates to cheat it thanks to AI. The ones claiming to "fix" it aren't fixing anything and are making it worse for both the interviewer and the candidate and are just extracting money from the process. The reality is, there is no fix.

zdragnar 1y ago
Even at small startups, posting engineering jobs will get you hundreds of applications a day. There's simply no way for employers to fairly go through them. LinkedIn et al make everything worse by making the application process so easy. If you're a small company, the fix is to outsource the top of your funnel to a recruiting company you trust. If you're a medium or large company, the fix is to require on-site work.
- ryandrake 1y ago
  This isn't really a new problem. I remember back during a previous tech downturn, the small-ish (~200 people) no-name company I worked for also got hundreds of applications a day. Yes, today, fake candidates and AI make it worse, but fundamentally the "huge number of people in the top of the funnel" problem has been a thing for a long time.
  - zdragnar 1y ago
    I was mostly replying to this bit: > employers just don't want to go through the effort into finding great candidate The notion that employers can put in the effort to give every candidate a totally fair shot so they can find the best ones is, I think, wrong, let alone the notion that they could but choose not to. At my last company, we would have needed more people doing application reviews and interviews than we actually had employees if we wanted to do that. Hell, I remember in college applying for a stock job at the local liquor store. When I went to hand in the application, I was told to put it on the pile- a stack of filled out applications thicker than several of my textbooks put together, suspiciously placed at the edge of a desk right next to a trash can.

libraryatnight 1y ago

Dude you ain't kidding. Security is all SaaS sales now and chasing corporate buzzwords, it's not security they're selling, it's insurance and the ability to outsource blame when you get popped. Get a new CISO? You'll probably be buying the software from the last company he worked with and spending the next 3 years installing it all over just in time for them to declare mission accomplished you are secure and move on to the next square in the C-suite game of Life these dudes play. Then there's the people beneath them who want to be them mucking up the system playing get to the c-suite and not 'secure the company' or 'build good things' Oh and if you've gone public your core business is probably on auto pilot with some gremlins keeping it running while your execs placate shareholders with layoffs and introducing AI. People who actually want to do things, help people, and understand why the work needs done and is worth doing (the work that is anyway) are burnt the fuck out.

ta1243 1y ago
It took me worryingly long in my career (like 20 years) to realise that the CTO doesn't care if the technology solutions work, or if they're cost effective. What he cares about is not being interrupted on the golf course. If you have a system that is down for 12 hours 3 times a year, it's fine - as long as a lot of other companies are also down. If you have one that's down for 2 hours once every 3 years, but you're the only one affected, that's terrible. Not because you're "losing sales", but because you can't bemoan a common supplier, point to "it's a global problem", and then get taken for a nice apology lunch by the account manager when your bill goes up 10% next year.

data4lyfe 1y ago

You really have to just ask dumb interview questions. Testing them on answering questions while putting their hand over their face or their hands covering their eyes now. It's really dumbi-fied our interview processes (see https://datastream.substack.com/p/my-foolproof-interview-questions https://datastream.substack.com/p/my-foolproof-interview-que...)

mvdtnz 1y ago

You need to keep in mind that only the dumbest people on Earth remain in the crypto space in 2025.

hn_throwaway_99 1y ago

Couldn't agree more. While I might not be as harsh against the blog post author, they made it seem like they were doing some high-level reconnaissance work, and at the end of the day the thing that made the NK candidate "unravel" was questions like "tell me about some restaurants in your town". All this goes to show is that, for many companies, their hiring process for offshore employees is so sad that basic human interactions that would easily uncover blatant attempts like this are skipped.

thephyber 1y ago

> there are talented people sitting on unemployment right now that can't find a job, yet fake people are getting hired left and right. Something in the industry as a whole is quite broken. An entire country has dedicated significant resources to getting some of their hackers hired. Those talented people you mention are likely trying to get hired by themselves. It’s not an industry problem so much as a coordinated attack.

tlhorsu 1y ago

The whole situation makes me as a job seeker even more paranoid. I had an initial interview scheduled over video but I had a power outage and had no choice but to use my phone. It's the dumbest coincidence ever and hasn't happened again, and if it makes me look suspicious, so be it. For some reason none of my phone cameras worked with Google Meet because Google engineering sucks and the interviewer kept asking me questions why my camera was off. I answered honestly that I had a power outage and this was my only device I had available on such short notice, that Google Meet wasn't working, etc. I even talked to the hiring manager half an hour over schedule since we clicked so well, submitted my code exam but was rejected without any explanation. Because I got no explanation the potential reasons for my rejection rolled over in my head. I finished the exam to the best of my ability - was my ability just not good enough? If I went to e.g. the library or something to hunt for a station with webcams in time would I have not come off so suspect? Since then I've gotten no other interview offers elsewhere and feel like a moron for blowing my one chance last month over such a stupid coincidence, if it really was the case they rejected me for thinking I was some kind of corporate spy. It really was the definition of "too good to be true." I will now pay way more attention to how I appear to the interviewer from now on, and carry extra devices/webcams in case the worst happens.

Funes- 1y ago

>Something in the industry as a whole is quite broken. More like the whole system...

creer 1y ago

It's a marketing blog post. I guess they feel like this gives them "street cred" for being a security firm "targeted" by a north korean and how they "strategically interacted with" that person. It's not about the employment pipeline or basic vetting.