6 ms·

My email is filled with junk from cybersecurity "experts" telling me that my open source project is "very compromised" and that they will gladly reveal to me wh

My email is filled with junk from cybersecurity "experts" telling me that my open source project is "very compromised" and that they will gladly reveal to me what the issue is, if I commit to paying them a bug bounty. I get at least a few every week. I hate them, but I feel like we are well past the point where in any place where there is money to be made, the majority of cold outreach will be from semi-personalized AI agents. You just have to accept that most of the time your get contacted by someone, it is likely not a human.

dheera 4mo ago
Reminds me of all the recruiters who reach out to me saying they're working on filling some engineer position but never say the company name, and when asked, they want to have a call. Stop wasting my time, STATE THE COMPANY UPFRONT AND AT THE TOP, preferably in the subject line
- noitpmeder 4mo ago
  They can't, otherwise a significant fraction of the people they reach out to would just skip the head hunter and contact the company directly. Same reason these same head hunters will usually strip any direct-contact details out of your resume before sending on to companies -- they don't want those companies running around them and contacting the candidate directly. IMO, these people are all grifters and uses-car-salesman. Their goal is to get as many people as possible to use them to change jobs so they get bonuses. They provide little-to-no value add in the actual process and will actively try to shovel you toward shitty companies and dead-end roles, despite how well they dress them up. You are ~20-50%~ cheaper (typical is 30% IIRC) in the first year of your employment if you are a direct hire instead of going through a recruiter, from a hiring manager's perspective. If you switch jobs often this compounds to make your offer chances lower as well if you're going through a head hunter (I've been part of these discussions from hiring side).
  - tayo42 4mo ago
    That makes no sense becasue contacting the company directly is usually just a communication blackhole
    - noitpmeder 4mo ago
      Not if you're a valuable candidate. An example (I have intimate experience with) is the finance/hft space in NYC -- if you're employed at a competitive player in this space in trading/quant/engineering you will almost certainly be given a phone interview w/o question at every other competitor when you reach out. If you don't trust the 'contact us' forms on their website it's dead simple to search e.g. LinkedIn to find their own in-house recruiters and reach out directly. Again, if you're a new grad? Definitely higher chance of your contact going right into the trash. But the target hires are still getting called back within a day.
      - PaulHoule 4mo ago
        There is a certain amount of job interviewing that people do to gather intelligence. I've went to numerous job interviews where I was trying to find out what was going on and not particularly interested in changing jobs. Companies sure do interview people for the same reason.
      - nikanj 4mo ago
        Not everyone is Linus Torvalds, and companies generally want to hire mid-level players too - they’re just somehow unable to even email them back
      - deleted 4mo ago
        [deleted]
  - mrkstu 4mo ago
    Depends- my current position was via a staffing firm that was engaged directly by my new company to fill the position, since they had an existing trust relationship. But they indeed were comfortable revealing the hiring company early in the process due to that trust level…
  - satvikpendem 4mo ago
    Not exactly. Recruiters often can guarantee an interview with the hiring manager while if you submitted your resume to the company directly, you'll just get lost in the sea of resumes so not much point going around them. I also always give them a PDF resume and I'm pretty sure they don't edit them as sometimes during a video interview the employer pulls up my resume as a screen share to go through it and it's always been the exact one I've had with all my personal contact details. It's simply not worth it for either the employer and interviewee to go around the recruiter because they act as a filter for both sides initially.
    - noitpmeder 4mo ago
      Definitely could be selection bias, but every time I have seen a copy of a resume a head hunter has forwarded a potential employer it has _always_ had the recruiting firm's letterhead plastered above my content, and my email removed.
      - toomuchtodo 4mo ago
        n=1, I have been in tech for 25+ years, and a recruiter has always been my preferred entry into an org when I don't have a network connection. Our incentives are aligned; I want the work, they get paid if I get hired and stay. Their sales commission depends on me succeeding. Without a recruiter, a company is trying to hire the best candidate at the lowest comp offered possible. The greater rate at which workers change jobs for better comp, the more likely comp is to go up (this is why companies pulled remote work and are trying to create geographic stickiness for jobs in the US, to slow wage gains and reduce labor mobility). I would suggest reconsidering your view on recruiters. Some suck, some are worth their weight in gold. If the job turns out to be suboptimal, do your best to find out before you take the role, or live your life in a way you can bail for the next job without much hassle. When you have success with recruiters, connect and keep in touch with them. A career is long, and its good to have options, as you never know when you'll need them. Optimize for optionality in this context.
      - petesergeant 4mo ago
        Source: I've been a programmer for 25 years, and ran a recruitment company for 8. This happens, but it's unusual. It's normally only really something you'd bother with as a recruiter if you were doing CV marketing, that is, reaching out to people who aren't your clients saying "this is the kind of person I could get you!". They're not really meant to do it, but recruitment regulations aren't strongly enforced in most of the Anglosphere. To fill a role with one of your clients, they've signed T&Cs that mean they can't really cut you out, and assuming they don't hate you they also don't want to lose you as a recruiter. Fucking candidates absolutely will try and occasionally cut you out of the process -- usually out of incorrectly thinking it will help them land the job because the employer won't have to pay a commission. There are many shitty recruiters, but finding a good one will absolutely help you find good roles, and can do all sorts of useful things like make sure you're asking for enough money, get feedback that you wouldn't directly get as a candidate, harass the hiring manager about your application on your behalf, and engage in a dialogue with the hiring manager about your application that virtually no hiring manager would be willing to do directly with you.
  - LightBug1 4mo ago
    Or they don't have a job opening at all and are just looking to bolster the database. I remember the annual cycle back in the day. During quieter times of the year, I'd suddenly get a tonne of calls from various recruiters with a job (no company name) ... almost as if they'd been told, "ok, no one's hiring or placing right now, no point you sitting there on your arse while I pay you. So pick up the phone and get some qualified leads"
  - dheera 4mo ago
    I can't get interested in a job without knowing who the people behind it are, and what the actual mission of the company is. Recruiters say things like "autonomous robotics systems" For what? Weapons? Hell no. Doing dangerous industrial jobs humans shouldn't be doing? Hell yes.
  - rgbrgb 4mo ago
    fwiw my experience building a small tech talent agency / recruiting shop disagrees with this. Cold application pipelines are overwhelmed by gen AI applications and many of the (very qualified) candidates we place report getting totally ghosted on all cold applications - even when we’re able to get them several interviews a week with companies in our network. Seems like companies still value a curated pipeline. 15-20% of first year salary (numbers we see these days) appears to be worth saving the company time interviewing unscreened candidates. Recruiting can be a real time suck and a bad hire can be catastrophic.
- celdon25 4mo ago
  That stopped being super frustrating for me about a year ago. Wishing it were the other way though…
- lousclues 4mo ago
  It seems like all paths with recruiters lead to the phone call. I really wish some of them had an email only option.
  - gmueckl 4mo ago
    Email only is not a good option for them. They need candidates that aren't at least a total embarrassment when presented to their clients, so the phone call really is a first screening interview.
  - philipallstar 4mo ago
    > I really wish some of them had an email only option. But why? If they need to convince someone you're a good hire, they will want to talk to you.
    - lousclues 4mo ago
      I don't mind having a phone call, it's the multiple layers of screening interviews with ill prepared questions that feels like a giant waste of time. I'd rather answer all those questions in an email and have the phone call as a formality. I do recognize the need to confirm that the person writing is indeed the person you are speaking to but I should at least be able to get a straight answer on salary and comp before I pick up the phone.
      - SilasX 4mo ago
        This. I don't mind having a phone call, but I do mind wasting time on it by repeating everything that they could have learned about me before the call and running into sanity checks (e.g. salary expectations) that they could have done beforehand. At that point, it's just laziness by the recruiter and comes off as an attempt to pressure me it doing something they couldn't justify rationally.
      - philipallstar 4mo ago
        Fair enough - knowing a rough expected comp range is a time-saver.
- morgoths_bane 4mo ago
  We all know the company is going to be Amazon lol.
- ajkjk 4mo ago
  I message them back and inform them I am reporting their message as spam. Seems to get a reaction.
- Cthulhu_ 4mo ago
  This is not in the recruiter's interest though, because you may just go past them and apply to the company directly, so they miss out on their revenue. I love picking apart a recruiter's emails, in a handful of cases I see the advert and I'm like "Oh yeah I used to work there". Go and React in a telecom company in NL near where I live? Yeah I set that up. No I don't want to go back, not unless they hire an actual team.
  - dsr_ 4mo ago
    Every recruiter I have dealt with (on the hiring side) has had a provision in the contract: if they have a documented exchange with a candidate whom we hire during or within (a month, two months...) of the contract end, the recruiter is deemed to have done the work. Contrarily, if we have a documented exchange with a candidate before the recruiter does, the recruiter is not owed anything. So: the recruiter has an incentive to mention the hiring company as soon as they get a response from you. If they don't do that, they are either bad at writing contracts or don't actually have authority to recruit. Mostly the second: you would not be surprised at the number of cold emails I get saying that they represent a candidate (or a pool of candidates) who are exactly right for the position that we filled last month.
    - ChrisMarshallNY 4mo ago
      That's like domain brokers that contact you, saying they have a certain domain, and would you be interested? They don't actually have the domain. If you respond, they reserve it, immediately, so you can't get it. A fun thing to do, is respond, then block them.
  - WorldMaker 4mo ago
    My favorite was the game of trying to figure out if multiple recruiters were trying to forward me to the exact same job/hiring company and trying to get them to stop stepping on each other's toes and try to a pick a "winner" recruiter for that specific role. It's a weird thing to miss, but this layoff cycle so far I haven't seen any recent recruiter emails at all, which seems strange on multiple levels.
- at-fates-hands 4mo ago
  The easy way to get around this is by telling the recruiter you've been actively applying with companies inside your state and for remote contract work and you don't want to be submitted twice. They'll send over the company name right away.
- cruffle_duffle 4mo ago
  Paste the job description into your friendly LLM and let it attempt to find the company for you and then contact the company itself. Those recruiter spams generally just copy and paste the companies own JD so the LLM can usually figure out the source company.
- astura 4mo ago
  The recruiter won't tell you the company bc they don't want you to just bypass them and apply directly yourself. They don't make commission that way.
chrismorgan 4mo ago
Whether it helps or not—the typical contact like this hasn’t been a human for decades now. What I’m seeing these days is materially almost identical to what went out ten years ago. Basic form letter with a cover sentence or paragraph of either no relevance, or a tenuous but normally ill-researched claim at relevance.
- miroljub 4mo ago
  [dead]
- bflesch 4mo ago
  [flagged]
  - zamadatix 4mo ago
    No space em dash = a real person who has been bulldozed by LLMs using it with spaces.
    - noitpmeder 4mo ago
      I've had to configure a few editors to stop turning my natural '<space>--<space>' into endashes...
      - Rendello 4mo ago
        I hate any editor changing anything without permission (especially ones that insert the closing paren/bracket). I used to love Linux's compose keys, though, where I could just press `<win>--.` to get an en dash and `<win>---` to get an em. Most of the compose combinations were guessable, like `<win>a'` for á, `<win>co` for ©. MacOS has a great keyboard locale switcher, but the lack of real compose keys limits things. Most characters you can press and hold and get some accented versions, but it's very slow if you're typing in French or something in the EN layout. It also has a built-in character picker, which is really nice but even more slow.
cyanydeez 4mo ago
this is what a pi based LLM is great for; give it it's own email address, then say something like "I'm intrigued, please talk to my security expert, CC'd" and cc the pi.
- 21asdffdsa12 4mo ago
  bots talking to bots- thats all there is
  - cyanydeez 4mo ago
    HEY MAN; tokemaxxing is what will save the world; we just need solar tokens in space.
maxrumpf 4mo ago
are you a maintainer on npm?
- andrewzeno 4mo ago
  lol thankfully no. My GitHub is in bio
ivanjermakov 4mo ago
Reason #176 to not be an open source maintainer.
sourcecodeplz 4mo ago
Then you have your own agent read your emails to flag these and... the circle begins

dheera 4mo ago

Reminds me of all the recruiters who reach out to me saying they're working on filling some engineer position but never say the company name, and when asked, they want to have a call. Stop wasting my time, STATE THE COMPANY UPFRONT AND AT THE TOP, preferably in the subject line

noitpmeder 4mo ago
They can't, otherwise a significant fraction of the people they reach out to would just skip the head hunter and contact the company directly. Same reason these same head hunters will usually strip any direct-contact details out of your resume before sending on to companies -- they don't want those companies running around them and contacting the candidate directly. IMO, these people are all grifters and uses-car-salesman. Their goal is to get as many people as possible to use them to change jobs so they get bonuses. They provide little-to-no value add in the actual process and will actively try to shovel you toward shitty companies and dead-end roles, despite how well they dress them up. You are ~20-50%~ cheaper (typical is 30% IIRC) in the first year of your employment if you are a direct hire instead of going through a recruiter, from a hiring manager's perspective. If you switch jobs often this compounds to make your offer chances lower as well if you're going through a head hunter (I've been part of these discussions from hiring side).
- tayo42 4mo ago
  That makes no sense becasue contacting the company directly is usually just a communication blackhole
  - noitpmeder 4mo ago
    Not if you're a valuable candidate. An example (I have intimate experience with) is the finance/hft space in NYC -- if you're employed at a competitive player in this space in trading/quant/engineering you will almost certainly be given a phone interview w/o question at every other competitor when you reach out. If you don't trust the 'contact us' forms on their website it's dead simple to search e.g. LinkedIn to find their own in-house recruiters and reach out directly. Again, if you're a new grad? Definitely higher chance of your contact going right into the trash. But the target hires are still getting called back within a day.
    - PaulHoule 4mo ago
      There is a certain amount of job interviewing that people do to gather intelligence. I've went to numerous job interviews where I was trying to find out what was going on and not particularly interested in changing jobs. Companies sure do interview people for the same reason.
    - nikanj 4mo ago
      Not everyone is Linus Torvalds, and companies generally want to hire mid-level players too - they’re just somehow unable to even email them back
    - deleted 4mo ago
      [deleted]
- mrkstu 4mo ago
  Depends- my current position was via a staffing firm that was engaged directly by my new company to fill the position, since they had an existing trust relationship. But they indeed were comfortable revealing the hiring company early in the process due to that trust level…
- satvikpendem 4mo ago
  Not exactly. Recruiters often can guarantee an interview with the hiring manager while if you submitted your resume to the company directly, you'll just get lost in the sea of resumes so not much point going around them. I also always give them a PDF resume and I'm pretty sure they don't edit them as sometimes during a video interview the employer pulls up my resume as a screen share to go through it and it's always been the exact one I've had with all my personal contact details. It's simply not worth it for either the employer and interviewee to go around the recruiter because they act as a filter for both sides initially.
  - noitpmeder 4mo ago
    Definitely could be selection bias, but every time I have seen a copy of a resume a head hunter has forwarded a potential employer it has _always_ had the recruiting firm's letterhead plastered above my content, and my email removed.
    - toomuchtodo 4mo ago
      n=1, I have been in tech for 25+ years, and a recruiter has always been my preferred entry into an org when I don't have a network connection. Our incentives are aligned; I want the work, they get paid if I get hired and stay. Their sales commission depends on me succeeding. Without a recruiter, a company is trying to hire the best candidate at the lowest comp offered possible. The greater rate at which workers change jobs for better comp, the more likely comp is to go up (this is why companies pulled remote work and are trying to create geographic stickiness for jobs in the US, to slow wage gains and reduce labor mobility). I would suggest reconsidering your view on recruiters. Some suck, some are worth their weight in gold. If the job turns out to be suboptimal, do your best to find out before you take the role, or live your life in a way you can bail for the next job without much hassle. When you have success with recruiters, connect and keep in touch with them. A career is long, and its good to have options, as you never know when you'll need them. Optimize for optionality in this context.
    - petesergeant 4mo ago
      Source: I've been a programmer for 25 years, and ran a recruitment company for 8. This happens, but it's unusual. It's normally only really something you'd bother with as a recruiter if you were doing CV marketing, that is, reaching out to people who aren't your clients saying "this is the kind of person I could get you!". They're not really meant to do it, but recruitment regulations aren't strongly enforced in most of the Anglosphere. To fill a role with one of your clients, they've signed T&Cs that mean they can't really cut you out, and assuming they don't hate you they also don't want to lose you as a recruiter. Fucking candidates absolutely will try and occasionally cut you out of the process -- usually out of incorrectly thinking it will help them land the job because the employer won't have to pay a commission. There are many shitty recruiters, but finding a good one will absolutely help you find good roles, and can do all sorts of useful things like make sure you're asking for enough money, get feedback that you wouldn't directly get as a candidate, harass the hiring manager about your application on your behalf, and engage in a dialogue with the hiring manager about your application that virtually no hiring manager would be willing to do directly with you.
- LightBug1 4mo ago
  Or they don't have a job opening at all and are just looking to bolster the database. I remember the annual cycle back in the day. During quieter times of the year, I'd suddenly get a tonne of calls from various recruiters with a job (no company name) ... almost as if they'd been told, "ok, no one's hiring or placing right now, no point you sitting there on your arse while I pay you. So pick up the phone and get some qualified leads"
- dheera 4mo ago
  I can't get interested in a job without knowing who the people behind it are, and what the actual mission of the company is. Recruiters say things like "autonomous robotics systems" For what? Weapons? Hell no. Doing dangerous industrial jobs humans shouldn't be doing? Hell yes.
- rgbrgb 4mo ago
  fwiw my experience building a small tech talent agency / recruiting shop disagrees with this. Cold application pipelines are overwhelmed by gen AI applications and many of the (very qualified) candidates we place report getting totally ghosted on all cold applications - even when we’re able to get them several interviews a week with companies in our network. Seems like companies still value a curated pipeline. 15-20% of first year salary (numbers we see these days) appears to be worth saving the company time interviewing unscreened candidates. Recruiting can be a real time suck and a bad hire can be catastrophic.
celdon25 4mo ago
That stopped being super frustrating for me about a year ago. Wishing it were the other way though…
lousclues 4mo ago
It seems like all paths with recruiters lead to the phone call. I really wish some of them had an email only option.
- gmueckl 4mo ago
  Email only is not a good option for them. They need candidates that aren't at least a total embarrassment when presented to their clients, so the phone call really is a first screening interview.
- philipallstar 4mo ago
  > I really wish some of them had an email only option. But why? If they need to convince someone you're a good hire, they will want to talk to you.
  - lousclues 4mo ago
    I don't mind having a phone call, it's the multiple layers of screening interviews with ill prepared questions that feels like a giant waste of time. I'd rather answer all those questions in an email and have the phone call as a formality. I do recognize the need to confirm that the person writing is indeed the person you are speaking to but I should at least be able to get a straight answer on salary and comp before I pick up the phone.
    - SilasX 4mo ago
      This. I don't mind having a phone call, but I do mind wasting time on it by repeating everything that they could have learned about me before the call and running into sanity checks (e.g. salary expectations) that they could have done beforehand. At that point, it's just laziness by the recruiter and comes off as an attempt to pressure me it doing something they couldn't justify rationally.
    - philipallstar 4mo ago
      Fair enough - knowing a rough expected comp range is a time-saver.
morgoths_bane 4mo ago
We all know the company is going to be Amazon lol.
ajkjk 4mo ago
I message them back and inform them I am reporting their message as spam. Seems to get a reaction.
Cthulhu_ 4mo ago
This is not in the recruiter's interest though, because you may just go past them and apply to the company directly, so they miss out on their revenue. I love picking apart a recruiter's emails, in a handful of cases I see the advert and I'm like "Oh yeah I used to work there". Go and React in a telecom company in NL near where I live? Yeah I set that up. No I don't want to go back, not unless they hire an actual team.
- dsr_ 4mo ago
  Every recruiter I have dealt with (on the hiring side) has had a provision in the contract: if they have a documented exchange with a candidate whom we hire during or within (a month, two months...) of the contract end, the recruiter is deemed to have done the work. Contrarily, if we have a documented exchange with a candidate before the recruiter does, the recruiter is not owed anything. So: the recruiter has an incentive to mention the hiring company as soon as they get a response from you. If they don't do that, they are either bad at writing contracts or don't actually have authority to recruit. Mostly the second: you would not be surprised at the number of cold emails I get saying that they represent a candidate (or a pool of candidates) who are exactly right for the position that we filled last month.
  - ChrisMarshallNY 4mo ago
    That's like domain brokers that contact you, saying they have a certain domain, and would you be interested? They don't actually have the domain. If you respond, they reserve it, immediately, so you can't get it. A fun thing to do, is respond, then block them.
- WorldMaker 4mo ago
  My favorite was the game of trying to figure out if multiple recruiters were trying to forward me to the exact same job/hiring company and trying to get them to stop stepping on each other's toes and try to a pick a "winner" recruiter for that specific role. It's a weird thing to miss, but this layoff cycle so far I haven't seen any recent recruiter emails at all, which seems strange on multiple levels.
at-fates-hands 4mo ago
The easy way to get around this is by telling the recruiter you've been actively applying with companies inside your state and for remote contract work and you don't want to be submitted twice. They'll send over the company name right away.
cruffle_duffle 4mo ago
Paste the job description into your friendly LLM and let it attempt to find the company for you and then contact the company itself. Those recruiter spams generally just copy and paste the companies own JD so the LLM can usually figure out the source company.
astura 4mo ago
The recruiter won't tell you the company bc they don't want you to just bypass them and apply directly yourself. They don't make commission that way.

chrismorgan 4mo ago

Whether it helps or not—the typical contact like this hasn’t been a human for decades now. What I’m seeing these days is materially almost identical to what went out ten years ago. Basic form letter with a cover sentence or paragraph of either no relevance, or a tenuous but normally ill-researched claim at relevance.

miroljub 4mo ago
[dead]
bflesch 4mo ago
[flagged]
- zamadatix 4mo ago
  No space em dash = a real person who has been bulldozed by LLMs using it with spaces.
  - noitpmeder 4mo ago
    I've had to configure a few editors to stop turning my natural '<space>--<space>' into endashes...
    - Rendello 4mo ago
      I hate any editor changing anything without permission (especially ones that insert the closing paren/bracket). I used to love Linux's compose keys, though, where I could just press `<win>--.` to get an en dash and `<win>---` to get an em. Most of the compose combinations were guessable, like `<win>a'` for á, `<win>co` for ©. MacOS has a great keyboard locale switcher, but the lack of real compose keys limits things. Most characters you can press and hold and get some accented versions, but it's very slow if you're typing in French or something in the EN layout. It also has a built-in character picker, which is really nice but even more slow.

cyanydeez 4mo ago

this is what a pi based LLM is great for; give it it's own email address, then say something like "I'm intrigued, please talk to my security expert, CC'd" and cc the pi.

21asdffdsa12 4mo ago
bots talking to bots- thats all there is
- cyanydeez 4mo ago
  HEY MAN; tokemaxxing is what will save the world; we just need solar tokens in space.

maxrumpf 4mo ago

are you a maintainer on npm?

andrewzeno 4mo ago
lol thankfully no. My GitHub is in bio

ivanjermakov 4mo ago

Reason #176 to not be an open source maintainer.

sourcecodeplz 4mo ago

Then you have your own agent read your emails to flag these and... the circle begins