News for hackers. Stuff that matters.
Re:When hiring developers, have the candidate read existing ... by buf on Saturday April 16, 2022 @03:22AM (#31050351)
I've never been put in the situation where an engineer shared something alarming from a proprietary code base, but hypothetically if someone brought with them the code for how to hack superuser privs for an old company, that would be an ethics violation and I would pass.
Re:When hiring developers, have the candidate read existing ... by deepsun on Saturday April 16, 2022 @03:37AM (#31050439)
Well it does not matter if it's alarming or not. They are in violation of their signed NDAs with their previous employer.

Also, if they don't work there anymore, they should've deleted all the code (if they had it) and surrendered/cleared up all the laptops.

But I like your idea, anyway I give big kudos to candidates with their own pet projects.

Re:When hiring developers, have the candidate read existing ... by pg_1234 on Saturday April 16, 2022 @03:43AM (#31050469)
Almost every employer will violate their employee's rights without a second thought in ways they consider "unimportant but necessary to the business" ... as long as that continues it should be a 2-way street.
Re:When hiring developers, have the candidate read existing ... by hnfong on Saturday April 16, 2022 @05:01AM (#31050844)
The point is not necessarily whether it's morally wrong to violate a contractual agreement when the other party is likely to do so.

It's that the interview process proposed by the G[...]P may force the candidate to do things that may be illegal to pass the interview. The candidate is of course responsible for their own choices, but the point is that as an interviewer, if you force your candidates to do this, you might short list those who have a tendency to violate contract terms.

This might work out for some, but I'd say it's a fair point to bring up.

Re:When hiring developers, have the candidate read existing ... by leaflets2 on Saturday April 16, 2022 @05:35PM (#31056300)
> you might short list those who have a tendency to violate contract terms.

An asshole filter https://siderea.dreamwidth.org/1209794.html (maybe you've read already?)

Re:When hiring developers, have the candidate read existing ... by hnfong on Monday April 18, 2022 @12:41PM (#31073101)
I'm familiar with the general concept but never read that specific article. Fun reading though, thanks!
Re:When hiring developers, have the candidate read existing ... by deepsun on Saturday April 16, 2022 @07:47AM (#31051571)
Mmm, no?

I'm an employer right now in my small company. Don't see any reason to screw up my employees, on the contrary, I see it's much better to work in a friendly environment. There's no such "unimportant but necessary to the business" things.

Re:When hiring developers, have the candidate read existing ... by jhfgjhfgjhg on Saturday April 16, 2022 @05:48AM (#31051052)
"Almost every employer will violate their employee's rights without a second thought"

What's your source?

"unimportant but necessary to the business"

What examples?

Re:When hiring developers, have the candidate read existing ... by irrational on Saturday April 16, 2022 @04:21AM (#31050637)
How are they sharing their code? At my company things are locked down so tightly that I can’t move code off of company computers. I would have to look at the code on one computer and type it into a computer of my own. Unless people are doing interviews on their company computer or the company is careless with their code, I’m not sure how someone would even share their work code.
Re:When hiring developers, have the candidate read existing ... by wingerlang on Saturday April 16, 2022 @04:27AM (#31050666)
Not sure how locked your computer is but everywhere I've ever worked, it's been trivial. Email the source file, zip it and upload somewhere, pastebin temporary, airdrop it, usb sticks.
Re:When hiring developers, have the candidate read existing ... by comprev on Saturday April 16, 2022 @05:20AM (#31050928)
My client is in the financial industry and have to use their equipment as a remote contractor.

The win10 laptop is locked down tight, including removable drives disabled, DNS forced through corporate servers, SSH blocked outside network, etc. I wouldn't be surprised if all activity was somehow centrally logged for compliance too.

I had to request permission to whitelist my VPN account to access Github.com. Even with VPN disabled the laptop still uses corporate DNS.

The security policy is designed to prevent theft.

Of course there _are_ ways to circumvent these protections but you'd be in a world of legal trouble if caught.

Re:When hiring developers, have the candidate read existing ... by maribozu on Saturday April 16, 2022 @09:35AM (#31052203)
Working in the financial industry as well, not as a contractor but within the organisation itself.

To add to the above (everything is quite the same in my case): pasting medium chunks of data to external websites is restricted on the system level, same for uploading documents/images; emails to non-corporate addresses are scanned.

Re:When hiring developers, have the candidate read existing ... by swinglock on Saturday April 16, 2022 @05:23AM (#31050944)
You would do that? Now I'm beginning to consider if I should be asking candidates to bring some intellectual property owned by their current/previous employer as a filter.
Re:When hiring developers, have the candidate read existing ... by wingerlang on Saturday April 16, 2022 @05:54AM (#31051080)
I am not saying I would do that (I wouldn't). I am just not sure how a computer can be locked down so tightly that it is impossible to send text from it to another computer.
Re:When hiring developers, have the candidate read existing ... by maribozu on Saturday April 16, 2022 @09:46AM (#31052271)
Posted a comment in the above tread. To add to that everything one sends to print is being monitored. That leaves a room for leakage but it also makes the leakage tracing relatively easy, unless you have stolen other employee's ID (which is required to print), but do we really want to go that far for a job interview?

There are, of course, ways, but some organisations make the overhead way too big to bother.

I personally know of a case where the 'core team' of a major payments processing system was running development being completely isolated from the internet due to security reasons. Need to check stackoverflow - sure - have a walk to the cabin where you have a dedicated machine connected to web for that. Oops, and no copy-paste, sorry.

Re:When hiring developers, have the candidate read existing ... by itronitron on Sunday April 17, 2022 @02:38AM (#31058990)
I could just print out and bring a patent.
Re:When hiring developers, have the candidate read existing ... by irrational on Saturday April 16, 2022 @10:46AM (#31052740)
All of those things you mentioned? Blocked. As an example, if I even plug any sort of device like a usb stick or an external drive to my machine, the computer locks up and security is on the phone with my manager within seconds.
Re:When hiring developers, have the candidate read existing ... by wingerlang on Saturday April 16, 2022 @11:15AM (#31052961)
Interesting, seems like my companies have been pretty relaxed then.