Pretty funny that tech makes candidates jump through all sorts of automated, inhumane loops to even advance to talking to a real human in the hiring process.
I remember in the mid-90s going to an interview in Manhattan - pre-Internet. Someone met me and led me to a table and said, "Here's where you're going to take your test." I said, "I don't take tests." She said "Everyone that comes in takes the test". I said, "Well, that's no longer true because I came in and I'm leaving without taking the test"
While I love the "edgy-ness" of this, I remember doing something like this around 2013 in Manhattan and kind of enjoyed it. They had me go into a room, and gave me a paper with an open ended question: it was something along the lines of, write as much detail as I could about what happens when a user visits a URL in a web browser. E.g. explain as much as I know about TCP, HTTP requests, web servers, etc. I think I touched on how Cookies worked as well.
No AI, no leet code, just old fashioned gauging someone's experience and communication skills.
I'm fine with technical interviews that are "test-like", with questions and answers and discussion and with an engineer who is my technical equal. But this was not that.
The more inhumane the screener the worse the job in my experience.
Had one recently that waived me thru and then sent me straight to talking to senior management/stakeholders/etc but literally no one on the team itself.
Couldn’t get a straight answer as to what team does, what role is for, real day to day I’d be walking.
Only clear thing was scale of architectural mess stemming from a political mess… and not a lot of interest in changing it.
They wanted a seasoned tech body to throw into the grinder 12-15hr days to replace the last one. No thanks.
Back in 1989 that was a rare skill. Many of the engineers who had experience were working on government projects. I mean TCP barely had congestion control at that point, it was very early days.
I forget. I used to use emacs but very superficially; when I started the job a literal greybeard UNIX admin shook his head and took me under his wing to teach me vim, which I used for a long time before switching back to emacs (and learning the elisp underpinnings of it)
"Usually we don't hire people from high school, but you had Common Lisp in your CV, so the engineers said to take you anyway." 2010, still simpler times.
I have never had the opportunity to ask this as an interview question. I'm secretly hoping that the first time I do so, somebody will lead off with "So, let's skip past the discussion of free will that might occur when considering how the user decides to visit the website, and instead start at the motor cortex..."
I'd also love a deep dive into the keyboard microcontroller that ends with the key press leaving over USB , and never even considers the main CPU.
Honestly, even the facetious answers to this have the potential to be incredibly interesting. Reality just has a ton of depth.
I honestly don't know what's so wrong about taking a test for a job, unless the job already requires some kind of certifications/licenses. I, personally, wish my doctors and lawyers have passed some tests.
> I honestly don't know what's so wrong about taking a test for a job, unless the job already requires some kind of certifications/licenses.
You already have a degree from some university, and you already worked in software development for quite some time. So it's very annoying to do some test over and over again for every job application.
They don’t take a test for every client. But they do get regularly monitored for their competency and instead of being fired when they fail, they have their professional license revoked.
Maybe IT professionals should be held to the same rigour. There’s a lot of deadweight in the profession that get paid too much and moan too loudly despite having a cushty job in a field they’re barely competent in.
> You already have a degree from some university, and you already worked in software development for quite some time. So it's very annoying to do some test over and over again for every job application.
Ok, but there's no uniform grading in school or employment. We all know people who managed to get through university without learning anything and manage to hold a job in software development without knowing or doing anything. It'd be nice if a degree and a job history guaranteed competence, but it doesn't.
Lots of professions can bring a portfolio and/or a sample of their work, but most software developers can't because the work is often propriatary and a trade secret, and anyway would need a lot of specific setup to operate.
I've only taken test tests for government jobs, and they were laughably outdated; approximately nobody knew how much space was on a 5 1/4" floppy in 1998 when I took the test, but they were asking about 8" floppies, and I assume they still are, because the test had to go through some process and doing a new test would be expensive. But yeah, I expect a company to validate that I can both describe solutions to problems and turn that description into code.
Hey, one day the fate of the company is going to hinge on getting an accurate estimate of how many ping pong balls can fit into a 747, and they'll be glad that they asked the right brainteasers.
I had one recently that was like.. I'd be better at this test if I knew less / was less experienced.
An hour to implement a toy version of a component which, the last time I did it "in real life" blew everyone away that I had a prototype ready in 1 day. That real life prototype went through weeks and weeks of iteration before it was even useful, and everyone was happy with that. But yeah that's something to time box to 1 hour in an interview environment.
So turns into an exercise of - which of the 100 pitfalls/nuances do they want me to pretend don't exist in order to complete it in 1 hour. Opinions vary!
There were multiple questions of this form.
One could pass this test blindly as a new grad not knowing the 100 pitfalls of actually building one in real life.
It's also for liability. If someone comes in with the intention of suing them, they can point to the test and have objective evidence that the rejection was not based on race or gender. It also allows them to gather data after the employee gets established and succeeds or fails.
Also in the mid 90s, you actually had to be smart to work in this field. There was no stack overflow or reddit to search. And CS programs were nascent.
Companies certainly have taken it too far, but I don't blame them for some usage of standard tests.
> Why would you refuse that, when applying to a job?
Not the OP, but from a certain point on (I'd say 3-5 years into one's career, I'd say maybe even earlier) school-type tests become quite ridiculous, as in real-life programming/development has nothing to do with how people are graded in school.
If by "nothing to do with" you mean "uncorrelated", then this is very trivial and empirically untrue. There are a lot of tests that correlate with peer and manager-rated performance in software development (and many other roles).
Even the dumbest most ad hoc unrelated tests will have nonzero correlations, and the well-studied principled ones much more so.
The better argument is that tests are high effort and can feel demeaning. But it's not productive to pretend they don't work.
This has not been my experience. Granted, I’ve never worked for a FAANG-like company, but in my 20 years of writing code for a living I’ve seen a lot more unknown unknowns in my day-to-day work compared to what school had prepared me to handle.
Security aside, this is the real (and very sad) take away here. People are so desperate for an organic interview that they end up neglecting common sense. Employers will complain to no end about not finding qualified candidates or dealing with scam candidates, but they're ultimately responsible for perpetuating this predicament to begin with. They're constantly stretching what they can greedily get out of you; whether it's during the hiring phase or while being employed.
I remember doing 6 hours of interviews once for a company, getting to the final stage and they wouldn't budge on $5,000 for a figure they initially accepted but reneged because the manager hiring me would be paid less than me. It was so petty. I turned it down back then, but I'm not sure I would in this market. I'd probably take it and job search while I'm working there like this guy did at Binance.
LinkedIn is a wasteland. Guarantee Microsoft leadership forgets it exists or that they own it. The sooner we stop giving it misplaced respect the sooner it can be replaced by something better.
Agreed, LinkedIn makes it very easy to spoof your credentials. There was a fake profile posing as a recruiter from my company trying to phish people for a long time, we reported it 100x and nothing happened. Finally ran into a guy at a party who worked for LinkedIn and convinced him to flag it internally, lol
What do you all do to detect if a recruiter or company reaching out to you is real or not? So much is remote now, and somebody could ai-generate a fake company and linkedin presence to make their scams more effective
Blame the lowest guy on the totem pole and not his garbage leadership with a terrible approach to securing the company's vaults. Wow. This industry eats its own or throws them under the bus -- anything but criticize its terrible leaders. What a shitshow.
Zoom exploits could have done this without downloads. I don't interview on a computer with sensitive data, it's usually a throwaway. I sometimes get judged for doing the interview on a Chromebook or an old Mac and I hope that interviewers understand why I choose to do it this way.
Doing ANYTHING on a work issued laptop outside of your role is such a dumb idea for a litany of obvious reasons that I'm genuinely shocked people do it. Let alone participate in interviews for other companies on it.
But if he'd done the interview on his personal laptop then he would have had his personal crypto wallet drained instead, seems like he came out ahead this way.
We are talking about highly educated people who work in software development (i.e. can assumed to have some minimum viable knowledge about computers), and not about the dumbest imaginable users.
There’re plenty of dumb people with a PhD. I’ve done three semesters of calculus and advanced physics for my BSc in engineering. Looking back, there wasn’t all that much to develop my critical thinking. Like, you can solve the problems and still say the stupidest shit.
It wasn’t until my PhD when I took an elective in Argumentation theory that I learned about constructing a good argument. And I only learned about fallacies somewhere on the internet.
> Don't be too proud of this technological terror you've constructed.
-Darth Vader.
Being able to make React components does not require you to be smarter than the average person.
You also have multiple types of intelligence. I worked with a brilliant intern once. The kid was over 100k in student loan debt and didn’t know the loans can’t get discharged.
It's an anecdote, but one of my coworkers has Steam installed on his MacBook (of all computers). He is a data scientist. Technically, we're only allowed to install software from an approved list maintained by the IT security team. They clearly aren't enforcing that policy, though.
It is one thing to do personal things on a work laptop, it is another all together to give your children free reign. Are there no penal measures taken to deter this anymore?
Working in a financial institution, I was surprised they could do all this. Our work laptops are so locked down (sometimes maybe too locked down) that we'd never be able to download a random .exe
I think Binance needs to start having IT Security like a bank as well.
Usually it starts with a locked down laptop, then request after request, you get more rights, even admin on the laptop because otherwise you can't do anything as a software developer.
Banks, at least in the U.S., are highly regulated and this would be very abnormal and subject to regulatory non-compliance, especially when the bank crosses into “big bank” territory. This stuff is regularly audited internally and externally.
Our (state) agency uses separate computer accounts for regular use and admin use. The admin account has neither network nor email access in order to prevent using the admin account on a regular basis. With state government agencies continually attacked with ransomware, we aren't as bondage and discipline as banks (which I have done before) or DOE (which was very severely extremely locked down and I was not connected to classified stuffs).
I have not needed admin credentials for regular development purposes since VB6 (which I was using until 2013). VB6 and ActiveX dlls required read/write access to the registry all the time.
Even if you do need admin for a developer laptop, that has no bearing on the PAW you use to authorize deployments and otherwise interact with production systems. Assuming your employer is even a quarter competent (i.e., not Binance).
It does boggle my mind as well. I’ve only ever worked in high security industries as a developer, and I’ve never had admin access unless I was on hardware deployment. Limited user accounts, Firewall blocks, Active Directory audits, and full file system and network log audits are the name of the game where I have been. Anything external gets flagged quickly by automation and anything severe gets an immediate phone call. Falling for a pen tester phishing more than once, getting your laptop stolen, and so on can get you on the poor performer list. It just seems obvious for critical domains.
> I think Binance needs to start having IT Security like a bank as well.
I don't disagree but note that apparently a bank in France, Credit Mutuel (and it's Fortuneo online arm), just got robbed of hundreds of millions of EUR: hackers who have beforehand created accounts on Kraken (a cryptocurrencies exchange) and who then wired millions to different accounts, bought cryptocurrencies, and withdraw the crypto.
But the hack was really stealing hundreds of millions from the bank.
Banks were never "safe" from fraud or theft, even before cryptocurrency existed. The key point was that customer accounts were segregated, and any customer losses were fully insured.
I've worked for a couple companies whose stance on me having a linux work laptop was "fine, but you have to support yourself".
So despite it being a "company" computer I personally installed the blank SSD and installed Arch on it and did not install any company spyware.
I was perfectly comfortable also having Steam installed so I could entertain myself on the plane on business trips. I knew everything installed and spyware wasn't on the list.
When I work at companies that have MDM set up on my computer, I don't do that.
Sure, but that's not really going to protect you. Could easily be that you are the interviewer and the interviewee asks you to click on sketchy link, or it could easily just be a call with a fake supplier or sales representative. It maybe makes it a little bit harder, but there's still many ways for social engineering to land something on work computers.
Yes, but are the companies clear enough and paying enough so that people would never use their work computers for personal matters?
I have a personal desktop because I grew up with video games and a desktop was always a personal investment. I never had a personal laptop, I cannot justify the cost (not a trivial expense, even if my work title is extremely fancy it does not pay on par), so if I would be traveling I would have to take the only laptop I have with me - the work laptop. Well, I managed to never use it, I don't take it with me, but there is a lot of effort in that.
In such a company I would give employees 2 laptops and 2 phones, one set for work only, one set for personal use only, then I would fire on the spot anyone mixing the usage. That would be a start in a longer journey of protecting the company.
Some workers can't afford personal laptops. There was a layoff announced today where company told workers to keep their company issued computers. Imagine that.
Often this is solely fault of employers not paying their workers enough.
I would like to see stats on ownership of private computer. In my circle of friends it’s getting rare, only gamers keep theirs. Smartphones have gotten so insanely expensive, who wants to buy a private computer additionally…
It is crazy that this Engineer A fell for this malware ad (how do people still fall for these & how does Google still get away with serving malware like that):
It is kind of weird that they mention it though, if they replaced the devices and rotated credentials? Just to later mention that an "internal AI tool" was used to steal that Engineer As credentials again?
And also, what are those "obfuscation techniques"? It looks very straight forward, replacing the pyenv, there's nothing much obfuscated in it? Except for putting it in a different folder.
For people who were newly nervous about clicking an unfamiliar link, this is a blog post describing the initial intrusion - the attackers paid for an ad on Google Search mimicking the homebrew website, which tells you to install it through a script. It's something you might have copied directly into the terminal before.
The lawsuits are coming, and the systems have logs. There is no incentive to lie about technical details that will come out in discovery in due course.
Don't forget that logs can be faked unless they are obtained directly by law enforcement forensic teams. In the case of Binance EU, their parent company is an offshore entity outside the direct reach of US and EU authorities. Consequently, anything Binance says or presents will most probably be taken as-is by western courts.
Another important note is that Binance has a strong incentive to cover up certain details, given that the company itself is anything but transparent. They also control CoinMarketCap, where they promote only projects that serve their own interests, while rejecting legitimate projects due to Binance's conflicts of interest. Several public reports and data document these practices.
People from big companies I talk to all the time are now pulling into h I secops teams to literally assed whether a candidate is safe. It's getting very expensive.
I actually got contacted by North Koreans posing as Japanese VC looking to partner in the Nordics. I have an agent that scans my emails and does the inverse filtering, suggests when I should take a look. This is because I get insane amount of cold inbound. But it also flags suspicious emails and uses network tools to find out info about the sender. It flagged that one as a NK account (I later confirmed it was already flagged on the watch list in various reddit channels). Everyone should be arming themselves with email filtering agents now. What I’m worried about is grandmas and grandpas and general ppl that are behind the tech curve.
It’s not the pc. It will be over the phone. They will call, use TTS with voice cloning to impersonate someone in their family, 5 seconds is all you need. Do a bank transfer to this address. Or click on this link we send you now over sms. You do a million of those.
you can transform voice in real time into latents, reshape the latents for a different voice and regeneratre.
the latents in question are for the voice encoder/decoder which tends to be part of the TTS system. you do need to make use of some part of a TTS neural networks for this (they condition on text, in your case you need to condition on the latents themselves in real time). it doens't take much to post-train this ability.
Depends on who the grandma is and how patient they are. If you were somehow connected to a network that could be accessed to transfer billions of dollars, your grandma or your partners grandma or someone you trust IRL might be a potential target. Or if not them, then someone they trust.
I just have Codex hooked up to the email client plugin and an hourly scheduled task. Then I have a prompt for selecting the ones I should read and flagging the suspicious ones. The prompt is combined with memory since Codex now understands what is important to me. For suspicious research I have my own skills with a bunch of "usual" tools, dig, whois, openssl client, curl, virustotal, and web research across reddit and a few other sites.
You meet the other side now and then. In my days at the aerospace company, we got an applicant from Russia with really good credentials from the Moscow Institute of Mathematical Sciences. They were really good in person, too. But the decision was "they had to be a plant".
I used to go to parties at Hacker Dojo in the early days of AI. Google wasn't into AI yet and Hacker Dojo had classes, often attended by Google people. (I learned way too much about support vector machines, in a class taught by a guy from BlackRock.)
There were a lot of very good looking Chinese women at the parties who were very interested in what people were working on. They were very bright, understood the subject, and had business cards from small companies no one had heard of. Then one day they all disappeared and were not seen again. I regret not asking one how she liked working for the Third Department.
It's just a cherry on top of the existing hiring process in the IT. It wouldn't surprised that it will make things even worse - companies will be more scared to talk to anyone and good candidates will be scared to reply
What surprises me most about the Binance hacking story is that Binance employees seem to have used their work laptops for some "programming test" (whose purpose was - as we now know - spreading malware).
I mean: if you even consider leaving your current company, you better leave no traces of your plan on your work laptop: you either use a private laptop or, even better, some burner laptop/computer that you reset afterwards.
A lot of people are focusing on how irresponsible the engineer was about using the work computer. That's obviously an issue but the bigger failure mode to me is the Engineer C's container deployment token.
That's a huge red-flag. In a company of this size, the deployments should be via CI only. CI isn't just to increase the speed and reliability of deployments but also to provide a clean room to build the software! Even if it's a token that was copied and pasted temporarily, the systems in place should not have to require this type of 1. copy 2. paste 3. remember-to-delete the token from my PC.
Also, Binance should be paying for intrusion testing. Better to pay a trusted company to do this kind of thing instead of letting North Korea show you how it's done. I don't think this exact exploit path would have been found but I bet the intrusion testing would have figured out another way to use Engineer C's token.
Not just that! The EIP-7702 delegation to make the wallet into a smart contract bypassed all of the controls that they had in place on the signer. It's wild that they didn't have a system in place to stop it from signing that transaction type.
From my rough understanding, this seems like the main exploit. It seems like the machine with access to the wallet key was presented with a crazy EIP-7702 transaction and signed it (which effectively owned its wallet in a single transaction)[1]. Without knowing their security model, it seems like biggest trust boundary should be between that signing machine and everything else.
[1] The fact that the needed to sign 50 of these transactions to solve a race condition seems like an implementation detail
In Ethereum it would be implemented by overriding your account with a smart contract, the approval of which is exactly what they signed here (only it wasn't a multisig smart contract, it was something malicious).
If they did and didn't account for a simple scenario like this happening and built in roadblocks and friction to prevent it from happening? Then it would stand to reason their entire EIS team should be fired.
The fact nobody thought of this is pretty staggering.
What if I plant a hook on the engineer’s laptop that will slightly modify their commits in such a way that eventually I smuggle malicious code over? First, exfiltrate the code over to me, learn from previous commits, start poisoning. Stamped by the CI, no less. In the days of slop PRs thousands of lines each shouldn’t be even too hard.
The point is that at some point you do need to open the door and let the code in.
100% this. I can deploy to our sandbox environment directly, but only our CI/CD has the permissions to build/deploy to our master environment. And the stuff I work on is 1000x less impactful than $billions in crypto!
I don't even leave deploy tokens on my laptop for personal side projects. It isn't difficult to setup CI deploys, if nothing else the extra upfront cost let's me be lazy and have a consistent deploy pipeline.
The article says that a software engineer interviewed with the North Koreans and the NKs then gained access to engineer A's machine (which had the deployment token) and then finally passed that token to run on engineer C's machine (who apparently did deployments). They knew of the team makeup from their first (caught) attempt.
That unlettered (npi) engineer who downloaded and ran the interview software on his or her machine is what the human weak link here. Let's call them Engineer F. Seems like this person was specifically selected from the dev team.
I've had this happen a few times getting interview requests from Indian recruiting firms. It sounded familiar. You go through a screening, then get passed onto the "code challenge" part. You have to download a GitHub file and then work on it, check it back in and push it so they can examine what you did.
Twice I scanned the file after downloading it to a sandbox and twice it found malware that would've been installed.
While this is by far the worst case of this happening, I've read at least a half dozen other accounts of recruiting companies attempting to install malware through the same process. I'm not saying the person should have known, but it's scary this is becoming more and more common.
This person definitely should have known. You don't download and run arbitrary binaries outside of a VM. At this point you don't even compile code from an untrusted source. This is the power user equivalent of falling for a phishing email.
One of my favorite stories from a security talk was the speaker recounting the surrealism of (while doing a forensic investigation of a security incident) watching the attacker read your internal documentation to try to figure out how the hell anything works mid-attack, and running into all the same pitfalls as your new employees.
Yes. The situation improves considerably if, when making server changes or retrieving data, programmers are required to enter a code generated from a hardware TOTP token isolated from both PCs and smartphones.
Every service provider system should be designed with the assumption that programmers' PCs and smartphones may be compromised.
265 comments
[ 0.19 ms ] story [ 49.0 ms ] threadAnd now you get results like this.
No AI, no leet code, just old fashioned gauging someone's experience and communication skills.
Had one recently that waived me thru and then sent me straight to talking to senior management/stakeholders/etc but literally no one on the team itself.
Couldn’t get a straight answer as to what team does, what role is for, real day to day I’d be walking.
Only clear thing was scale of architectural mess stemming from a political mess… and not a lot of interest in changing it.
They wanted a seasoned tech body to throw into the grinder 12-15hr days to replace the last one. No thanks.
Them: "Do you know TCP/IP?". Me: "Yes". Them: "you're hired"
Job at the Westinghouse instrumenting nuclear power plants. Simpler times then.
“What does ifconfig do? What does it mean to mount a disk? What editor do you use? You’re hired.”
None of that culture fit nonsense.
I'd also love a deep dive into the keyboard microcontroller that ends with the key press leaving over USB , and never even considers the main CPU.
Honestly, even the facetious answers to this have the potential to be incredibly interesting. Reality just has a ton of depth.
You already have a degree from some university, and you already worked in software development for quite some time. So it's very annoying to do some test over and over again for every job application.
Yep. Now substitute doctors/lawyers/accountants/civil engineers into the equation and see how you feel about it.
Maybe IT professionals should be held to the same rigour. There’s a lot of deadweight in the profession that get paid too much and moan too loudly despite having a cushty job in a field they’re barely competent in.
Ok, but there's no uniform grading in school or employment. We all know people who managed to get through university without learning anything and manage to hold a job in software development without knowing or doing anything. It'd be nice if a degree and a job history guaranteed competence, but it doesn't.
Lots of professions can bring a portfolio and/or a sample of their work, but most software developers can't because the work is often propriatary and a trade secret, and anyway would need a lot of specific setup to operate.
I've only taken test tests for government jobs, and they were laughably outdated; approximately nobody knew how much space was on a 5 1/4" floppy in 1998 when I took the test, but they were asking about 8" floppies, and I assume they still are, because the test had to go through some process and doing a new test would be expensive. But yeah, I expect a company to validate that I can both describe solutions to problems and turn that description into code.
At worst it’s the biggest hardos on the team writing a bunch of brain teasers and gotchas as a hazing ritual.
An hour to implement a toy version of a component which, the last time I did it "in real life" blew everyone away that I had a prototype ready in 1 day. That real life prototype went through weeks and weeks of iteration before it was even useful, and everyone was happy with that. But yeah that's something to time box to 1 hour in an interview environment.
So turns into an exercise of - which of the 100 pitfalls/nuances do they want me to pretend don't exist in order to complete it in 1 hour. Opinions vary!
There were multiple questions of this form.
One could pass this test blindly as a new grad not knowing the 100 pitfalls of actually building one in real life.
Also in the mid 90s, you actually had to be smart to work in this field. There was no stack overflow or reddit to search. And CS programs were nascent.
Companies certainly have taken it too far, but I don't blame them for some usage of standard tests.
If you cannot explain why a successful candidate was chosen without bias, then you shouldn’t be interviewing candidates to begin with.
But it is always worth keeping a copy of your interview notes just in case the candidate asks for feedback.
Not the OP, but from a certain point on (I'd say 3-5 years into one's career, I'd say maybe even earlier) school-type tests become quite ridiculous, as in real-life programming/development has nothing to do with how people are graded in school.
If by "nothing to do with" you mean "uncorrelated", then this is very trivial and empirically untrue. There are a lot of tests that correlate with peer and manager-rated performance in software development (and many other roles).
Even the dumbest most ad hoc unrelated tests will have nonzero correlations, and the well-studied principled ones much more so.
The better argument is that tests are high effort and can feel demeaning. But it's not productive to pretend they don't work.
I remember doing 6 hours of interviews once for a company, getting to the final stage and they wouldn't budge on $5,000 for a figure they initially accepted but reneged because the manager hiring me would be paid less than me. It was so petty. I turned it down back then, but I'm not sure I would in this market. I'd probably take it and job search while I'm working there like this guy did at Binance.
I even create a 1 man company for my consulting services and I receive ads about how people at my company saved me a spot on an online game.
LinkedIn is partially responsible for their neglect here.
There are tools available to stop AI screen recording tools, fake candidate tools yet many companies keep getting hit..
They did, in their sentence "the incident report said".
At several companies I’ve seen folks run torrents to watch movies at work.
Once I was on a Zoom call, and I noticed music production software on my colleagues computer.
When I pointed it out, they responded with something like “ Ohh, my kids make music.”
Neat, I guess.
We are talking about highly educated people who work in software development (i.e. can assumed to have some minimum viable knowledge about computers), and not about the dumbest imaginable users.
That's a bit of charity isn't it? Lot's of people in tech that really not that clever even if they are smart. Also, people in HR aren't as tech savvy.
Do I need to go on?
It wasn’t until my PhD when I took an elective in Argumentation theory that I learned about constructing a good argument. And I only learned about fallacies somewhere on the internet.
* I have a PhD in STEM.
-Darth Vader.
Being able to make React components does not require you to be smarter than the average person.
You also have multiple types of intelligence. I worked with a brilliant intern once. The kid was over 100k in student loan debt and didn’t know the loans can’t get discharged.
> dumbest imaginable users.
They are often one and the same.
"Need some new software" = "Download it from some random website"
"Software won't run" = "Turn off AV and get it everything permission"
"Still won't run" = "run as root"
No, 'people who work in software development' != 'highly educated people' and those both != 'understand how computers work'.
Plenty of software engineeers (and doctors, lawyers, scientists...) are geniuses in their field but have zero common sense.
It is one thing to do personal things on a work laptop, it is another all together to give your children free reign. Are there no penal measures taken to deter this anymore?
I think Binance needs to start having IT Security like a bank as well.
I have not needed admin credentials for regular development purposes since VB6 (which I was using until 2013). VB6 and ActiveX dlls required read/write access to the registry all the time.
I don't disagree but note that apparently a bank in France, Credit Mutuel (and it's Fortuneo online arm), just got robbed of hundreds of millions of EUR: hackers who have beforehand created accounts on Kraken (a cryptocurrencies exchange) and who then wired millions to different accounts, bought cryptocurrencies, and withdraw the crypto.
But the hack was really stealing hundreds of millions from the bank.
So not even banks are safe now.
I don't know how people are ok using their personal accounts on work-laptops full of spyware.
So despite it being a "company" computer I personally installed the blank SSD and installed Arch on it and did not install any company spyware.
I was perfectly comfortable also having Steam installed so I could entertain myself on the plane on business trips. I knew everything installed and spyware wasn't on the list.
When I work at companies that have MDM set up on my computer, I don't do that.
I have a personal desktop because I grew up with video games and a desktop was always a personal investment. I never had a personal laptop, I cannot justify the cost (not a trivial expense, even if my work title is extremely fancy it does not pay on par), so if I would be traveling I would have to take the only laptop I have with me - the work laptop. Well, I managed to never use it, I don't take it with me, but there is a lot of effort in that.
In such a company I would give employees 2 laptops and 2 phones, one set for work only, one set for personal use only, then I would fire on the spot anyone mixing the usage. That would be a start in a longer journey of protecting the company.
I also refuse to install Intune or similar on my personal hardware. Keep work and personal like oil and water!
Often this is solely fault of employers not paying their workers enough.
https://isc.sans.edu/diary/32942
It is kind of weird that they mention it though, if they replaced the devices and rotated credentials? Just to later mention that an "internal AI tool" was used to steal that Engineer As credentials again?
And also, what are those "obfuscation techniques"? It looks very straight forward, replacing the pyenv, there's nothing much obfuscated in it? Except for putting it in a different folder.
They have a massive incentive to invent a story to cover up the incident. I'm not saying it's a cover-up, but the motive is definitely there.
North Korea has denied responsibility, whereas they usually own up to their actions.
Take all of these stories with a truck of salt.
Google any of these names: Sam Bankman-Fried, Jordan Belfort, Elizabeth Holmes, Kenneth Lay, Bernie Madoff or Jeffrey Skilling.
Man, you're going to have fun reading about what they did!
Another important note is that Binance has a strong incentive to cover up certain details, given that the company itself is anything but transparent. They also control CoinMarketCap, where they promote only projects that serve their own interests, while rejecting legitimate projects due to Binance's conflicts of interest. Several public reports and data document these practices.
It's one of the reason ojcp exists.
you can transform voice in real time into latents, reshape the latents for a different voice and regeneratre.
the latents in question are for the voice encoder/decoder which tends to be part of the TTS system. you do need to make use of some part of a TTS neural networks for this (they condition on text, in your case you need to condition on the latents themselves in real time). it doens't take much to post-train this ability.
I used to go to parties at Hacker Dojo in the early days of AI. Google wasn't into AI yet and Hacker Dojo had classes, often attended by Google people. (I learned way too much about support vector machines, in a class taught by a guy from BlackRock.) There were a lot of very good looking Chinese women at the parties who were very interested in what people were working on. They were very bright, understood the subject, and had business cards from small companies no one had heard of. Then one day they all disappeared and were not seen again. I regret not asking one how she liked working for the Third Department.
I mean: if you even consider leaving your current company, you better leave no traces of your plan on your work laptop: you either use a private laptop or, even better, some burner laptop/computer that you reset afterwards.
That's a huge red-flag. In a company of this size, the deployments should be via CI only. CI isn't just to increase the speed and reliability of deployments but also to provide a clean room to build the software! Even if it's a token that was copied and pasted temporarily, the systems in place should not have to require this type of 1. copy 2. paste 3. remember-to-delete the token from my PC.
Also, Binance should be paying for intrusion testing. Better to pay a trusted company to do this kind of thing instead of letting North Korea show you how it's done. I don't think this exact exploit path would have been found but I bet the intrusion testing would have figured out another way to use Engineer C's token.
[1] The fact that the needed to sign 50 of these transactions to solve a race condition seems like an implementation detail
The fact nobody thought of this is pretty staggering.
lol that's the worst control I've ever heard.
The point is that at some point you do need to open the door and let the code in.
That unlettered (npi) engineer who downloaded and ran the interview software on his or her machine is what the human weak link here. Let's call them Engineer F. Seems like this person was specifically selected from the dev team.
Twice I scanned the file after downloading it to a sandbox and twice it found malware that would've been installed.
While this is by far the worst case of this happening, I've read at least a half dozen other accounts of recruiting companies attempting to install malware through the same process. I'm not saying the person should have known, but it's scary this is becoming more and more common.
This person definitely should have known. You don't download and run arbitrary binaries outside of a VM. At this point you don't even compile code from an untrusted source. This is the power user equivalent of falling for a phishing email.
Every service provider system should be designed with the assumption that programmers' PCs and smartphones may be compromised.
but enterprises usually prefer the latter, I guess it's more convenient since it bypasses the bureaucratic processes?