3 ms·

Also, many people like me don't even have LinkedIn profiles. The "pick up your work computer in person" idea sounds like a much more reliable method to me.

smohare 1y ago
[dead]
abrookewood 1y ago
But it is so late in the process to catch them - hours wasted by so many people.
- miffy900 1y ago
  True, but at that point it's still not too late to prevent paying money that will ultimately end up in the NK government hands.
- asteroidburger 1y ago
  If it was the norm, the fake worker problem would go away, and the hours would not be wasted.
Roark66 1y ago
Yeah, pick up your computer in person will not work if you live 2d travel away. If my remote job told me to pick up the computer in person after 8h of interviews and tests I'd be seriously pissed off. If they advertised it in the beginning I'd not have applied. In my country (Poland) courier companies offer this service of "id checking and contract signing". You can have a courier deliver a contract, check the recipient's photo ID and confirm their identity, have the person sign the contract, return it and the courier takes it back. If there is no such service available there is only one way to prevent this from happening, proper screening of candidates. In my 20+ years of working for Fortune 500 companies in positions not far from the top only 1 - a Japanese one actually screened my educational background and called my references and past employers to verify. If employees worry they will loose some really good candidates that have no documentable background ask them to do some other security check. Do a video call from the main street of their home town. Or some other thing randomly selected from a set of 5. If the role is really important hire someone to visit the remote worker in their home and deliver that laptop in person. But don't expect them to travel to pick it up.
- raverbashing 1y ago
  If I was in the US I'd be investing in "verification centers" right now
  - AbstractH24 1y ago
    I think of the network of testing centers used for various certifications as a model and even something that could be repurposed. If I recall, certain government jobs already need something like that you can get at the post office?
  - okdood64 1y ago
    So notary publics?
- pllbnk 1y ago
  Sounds reasonable to me that the companies that hire to work remotely would like to have some live meet-ups once in a while. For the most part I wouldn't see a problem traveling to an employer's office for a week or so to start.
  - fhd2 1y ago
    For working parents, it's pretty tricky. I ran a few remote organisations, and while there were usually decision makers that wanted mandatory meetups, I always tried to make it as optional as possible, and to eliminate the need for those where feasible. In the age of vibe coding and North Korean fake workers, I'd probably go another way though. Trusting your remote workers used to be easier from my perspective.
    - Roark66 1y ago
      You know the saying "trust but verify" :-) As mentioned before I think we need robust verification in place for things like new hire identity, but you mentioned an additional thing "vibe coding". The most obvious response to this is to have merge checks that run a bunch of tests on important stuff, and peer review. My current place of work has rolled out both copilot and gemini coding assistants to everyone and so far I've not seen the expected flood of lower quality code or code clearly written by AI and not even being understood by the submitter. We're talking ~80 devs in 3 timezones just in my project. This is very encouraging.
red_admiral 1y ago
I'm guessing many people working in security don't have LinkedIn profiles. It's not like you want to advertise a stint in Fort Meade, and then a list of people someone might contact to get access to you, or pull some social engineering. Or advertise your TS/SCI in your profile. There's more and more places where the less visible presence online you have, the more you're a good fit for the position.
- saagarjha 1y ago
  Perhaps I don't know the people who aren't advertising it but I see plenty of people advertising their time in natsec or their clearances
  - red_admiral 1y ago
    > Perhaps I don't know the people who aren't advertising it Not picking on you, but that's kind of a tautology :)
dmurray 1y ago
Surely North Korea could arrange people to do this, too. They already have people on the ground in the US e.g. to open bank accounts, and they only need this for candidates that actually get the job, not every interview. You might say the people who interviewed the candidate should be there when he picks up his laptop. But this is already an extremely remote-friendly company, the interviewers might never be in the office. He's going to pick it up from the IT department in the basement and at best they will take a photograph of his face.

smohare 1y ago

[dead]

abrookewood 1y ago

But it is so late in the process to catch them - hours wasted by so many people.

miffy900 1y ago
True, but at that point it's still not too late to prevent paying money that will ultimately end up in the NK government hands.
asteroidburger 1y ago
If it was the norm, the fake worker problem would go away, and the hours would not be wasted.

Roark66 1y ago

Yeah, pick up your computer in person will not work if you live 2d travel away. If my remote job told me to pick up the computer in person after 8h of interviews and tests I'd be seriously pissed off. If they advertised it in the beginning I'd not have applied. In my country (Poland) courier companies offer this service of "id checking and contract signing". You can have a courier deliver a contract, check the recipient's photo ID and confirm their identity, have the person sign the contract, return it and the courier takes it back. If there is no such service available there is only one way to prevent this from happening, proper screening of candidates. In my 20+ years of working for Fortune 500 companies in positions not far from the top only 1 - a Japanese one actually screened my educational background and called my references and past employers to verify. If employees worry they will loose some really good candidates that have no documentable background ask them to do some other security check. Do a video call from the main street of their home town. Or some other thing randomly selected from a set of 5. If the role is really important hire someone to visit the remote worker in their home and deliver that laptop in person. But don't expect them to travel to pick it up.

raverbashing 1y ago
If I was in the US I'd be investing in "verification centers" right now
- AbstractH24 1y ago
  I think of the network of testing centers used for various certifications as a model and even something that could be repurposed. If I recall, certain government jobs already need something like that you can get at the post office?
- okdood64 1y ago
  So notary publics?
pllbnk 1y ago
Sounds reasonable to me that the companies that hire to work remotely would like to have some live meet-ups once in a while. For the most part I wouldn't see a problem traveling to an employer's office for a week or so to start.
- fhd2 1y ago
  For working parents, it's pretty tricky. I ran a few remote organisations, and while there were usually decision makers that wanted mandatory meetups, I always tried to make it as optional as possible, and to eliminate the need for those where feasible. In the age of vibe coding and North Korean fake workers, I'd probably go another way though. Trusting your remote workers used to be easier from my perspective.
  - Roark66 1y ago
    You know the saying "trust but verify" :-) As mentioned before I think we need robust verification in place for things like new hire identity, but you mentioned an additional thing "vibe coding". The most obvious response to this is to have merge checks that run a bunch of tests on important stuff, and peer review. My current place of work has rolled out both copilot and gemini coding assistants to everyone and so far I've not seen the expected flood of lower quality code or code clearly written by AI and not even being understood by the submitter. We're talking ~80 devs in 3 timezones just in my project. This is very encouraging.

red_admiral 1y ago

I'm guessing many people working in security don't have LinkedIn profiles. It's not like you want to advertise a stint in Fort Meade, and then a list of people someone might contact to get access to you, or pull some social engineering. Or advertise your TS/SCI in your profile. There's more and more places where the less visible presence online you have, the more you're a good fit for the position.

saagarjha 1y ago
Perhaps I don't know the people who aren't advertising it but I see plenty of people advertising their time in natsec or their clearances
- red_admiral 1y ago
  > Perhaps I don't know the people who aren't advertising it Not picking on you, but that's kind of a tautology :)

dmurray 1y ago

Surely North Korea could arrange people to do this, too. They already have people on the ground in the US e.g. to open bank accounts, and they only need this for candidates that actually get the job, not every interview. You might say the people who interviewed the candidate should be there when he picks up his laptop. But this is already an extremely remote-friendly company, the interviewers might never be in the office. He's going to pick it up from the IT department in the basement and at best they will take a photograph of his face.