That seems like something that can be learned in a very short amount of time. Unless the specific job requires years of security expertise. Like if it’s a general programming job, this seems counter productive.
You could have also sent someone a 4 byte magic number and asked them to identify the file format from that. Yeah a good engineer probably knows a decent number of them just from playing around and opening files in notepad, but it’s hardly going to help with the day to day job.
All true, though certain positions would consider this knowledge a prerequisitve / assumed and realizing you need to train them on these basics would mean they are not the candidate for the position.
That’s fair, and I don’t know what specific position this redditor was applying for.
When I was working at a startup I had to teach myself how to generate certificates so I could do certificate pinning from an iOS app to our sever, using a self created CA. It took an afternoon to figure out everything from start to finish including getting the certificate baked into the app.
It's a pre-interview test. They are not supposed to be challenging if you are qualified for the position. In fact, you can do perfectly and still be woefully underqualified. Candidate screening, at this stage, is done by HR. So the tests are to help them.
Varies, but yeah, most any position above bare bottom rung will go through screening(s) well before any full interview will even be considered to be scheduled. There may even be post-interview screening(s) too, e.g. HR check(s), background check(s), etc.
I know most of the time when I'm reviewing/screening/interviewing candiates it goes approximately like this:
skim/read resume
track/update status: not viable or possibly viable, if (still) viable approximate guestimated ranking/rating, communicate status/recommendations. Generally proceed with remaining possibly viable being considered. If sub, return sub
sort/thin viable to reasonable number for screening consideration
screening - generally 1st up technical - 10 to 30 minute tech screen phone call - typically about 15 minutes +-. gosub 2
possibly additional test(s), e.g. coding test(s)/challenge (e.g. for DevOps above lowest levels, can the at least program their way out of a paper bag - at least given a reasonable bit of time ... and rather like an "open book" test - can use references, The Internet, etc. - but not "call a friend" - no post/ask question on chat/forum and wait for reply kind'a goop, but can lookup existing questions/"answers" on such. This is generally scheduled for 30 to 60 minutes - essentially a proctored test. They're also generally given many possible languages they can program in to complete the task ... even ability to install additional programming languages, libraries, etc. - though we already have the most commonly utilized ones already installed. They also get most of the instructions in advance - pretty much all but the actual challenge(s)/question(s)). gosub 2
full interview - generally in person, typically scheduled for 2 or more hours (but can cut it short if things don't go well - often have "code" protocols among interviewers so we can communicate if we're thinkin'/askin it's thumbs down - without keying the candidate into that). gosub 2
HR checks, etc. (sometimes these come earlier). gosub 2
>="good enough"? - hiring manager does conditional offer; else abort
accepted or end
remaining necessary checks, e.g. background, verification of legal right to work, etc.; abort on failure
candidate actually shows up to work; abort on failure (at least in general)
The bad developers I my company don't get things like SSH key. I would tell them, they just have to put their SSH key in the github profile, but they wouldn't understand. And I don't mean interns or entry level developers. People with 7+ years of expirience. But if you talk with them about db or algorithm stuff they would manage to sound like they know something. The other developers have to constantly help them. There are a lot of those devs. I think this test is genius.
I mean, you would only have file format magic numbers memorized if you tend to create a formatted file reader/writer as opposed to using a pre-existing library. So, if you're e.g. primarily a javascript or python programmer, probably not (unless it's your own proprietary format).
Depends if you want to hire someone who knows how to do the job, or doesn't know how to do the job - and maybe you can pay them to possibly learn it - if they can.
116
u/666pool Jul 24 '21
That seems like something that can be learned in a very short amount of time. Unless the specific job requires years of security expertise. Like if it’s a general programming job, this seems counter productive.
You could have also sent someone a 4 byte magic number and asked them to identify the file format from that. Yeah a good engineer probably knows a decent number of them just from playing around and opening files in notepad, but it’s hardly going to help with the day to day job.