Schneier on Security

jedb • August 1, 2023 11:00 AM

Eventually the humans will figure out that the applicant doesn’t actually have the required skills.

The flaw in this view, and perhaps Andrew’s to a lesser degree, is the assumption that the skills listed as “requirements” in the job posting are actually required. In my experience: at medium-to-large companies, the people who are trying to hire employees often don’t quite know where that stuff comes from. Probably someone in the Human Resource department trying to feel useful. Like, we ask them to find us a senior programmer who knows the Rust language, and they think “senior, well, that’s gotta be about 20 years of experience, right?”. And then, as wiredog hints at, our ad then asks for “20+ years” of experience in a language that’s existed for 8, when we hadn’t even specified a number. (Anyone who thinks this is some clever trap to disqualify liars is vastly overestimating the amount of intelligence involved.)

When I was scheduled by a manager to help them interview a candidate, I generally just got a resumé. I didn’t see the listing, I don’t know whether the manager did, and it never came up in the interview. Nor did I care about the specific numbers, or the listed skills that didn’t seem relevant. People—especially “HR” people, I suspect—over-emphasize the importance of applicants knowing about the exact stuff we’re working with. One company even used an in-house language, and new hires always figured it out pretty quickly.

I recall two particularly useful at-home exercises we’d mail applicants between the phone and in-person interviews. One: critique this software interface, being a page or two of function definitions with brief “Javadoc-style” comments. Two: here’s a multi-threaded program that fails because it’s missing synchronization; fix it. For the second one, people might be surprised how often we got code that didn’t compile, or that immediately crashed when run. (I always thought that was something one could bang out in an hour, if not 10 minutes, but the manager always told applicants it would take about a day. And it was rare to get a program with no significant flaws—or, for the critiquing example, feedback that would let one transform it into a good interface.)

jedb • August 1, 2023 11:56 AM

Also, the idea that a resumé represents reality has long been the butt of jokes. I don’t know how common lying is, or how serious Steve is, but there’s probably a pretty good chance of getting away with it. At least for long enough to get hired. Not that “fake it till you make it” is only for job applicants—entire Silicon Valley companies seem to have followed that “advice”.

Anyway, for your amusement…

[Alex Papadimoulis – Hacking the Workplace: How to Make the Most with the Least – Notacon 8 / 2011] @ 22:21

Tailor your resumé to exactly the job description. In fact, copy-paste the job description into Word, or whatever, and then just take bullet points and make it as that. Make yourself look like the perfect candidate. Um, your expertise? Let’s put it this way. If you’ve heard of what the technology means—maybe I know “SOA” is Service-Oriented Architecture—you are now an expert at it. As am I; that’s what expertise is, right?

Um, the other thing about working at places—I mean, what is really work, after all? Have you bought some— have you heard of the place? One might arguably say that you’ve worked there. And when you do that, try to pick a place that they’ll never catch that you never actually worked there. Uh, places that went out of business, gold mine. ‘Cause you cannot call to verify that. This is important stuff, right?

[The Simpsons – S04E07 / 9F05 – Marge Gets a Job] @ 7:06

Marge: Well, Lisa, I finished my resumé. (paper reads “Marge Simpson / Resume / Homemaker: 1980 to present”)
Lisa: Uh, I think it needs a little padding.
…
Marge: chauffer, seamstress… curator of large mammals? … Oh, I see.
Lisa: Mom, they expect you to lie a little.
Marge: Worked for the Carter administration‽
Lisa: Well, you voted for him, twice.
…
Smithers (reading resumé in front of Marge): Mm-hmm… uh-huh… oh, I though Muddy Waters wrote that song. … Let me be the first to say “Kadibu kazini.”
Marge: What?
Smithers: “Welcome aboard.” I guess my Swahili’s not as good as yours.

[Seinfeld – S08E06 – The Fatigues] @ 1:22

George: Steinbrenner wants everyone in the front office to give a lecture in their area of business expertise.
Jerry: Well, what makes them think you’re a risk management expert?
George: I guesss it’s on my resumé.

jedb • August 1, 2023 1:04 PM

jones, this is still how search engines, including Google, are gamed—except now via CSS or Javascript instead of direct HTML tags.

Haven’t you ever gotten a link to some “experts” or “answers” site, or a news article, only to see a paywall instead of the promised text snippet? You might see that text if you turn off stylesheets and/or Javascript.

(In some cases, I think sites are serving entirely different pages to search engines, based on user-agent strings or IP addresses, because that text just isn’t there. In other cases, the text is there and not even hidden—but, in context, is clearly auto-generated bullshit in an entire web of bullshit pages.)