sarciszewski

(Switching back to my old account because rate limits.)

I wouldn't ever use something like FizzBuzz to assess a candidate. It would be more of "here's a mostly finished sample application with a corresponding SQL file, add this feature (e.g. a search bar for a blog) and fix any (intentionally introduced) security bugs you find".

They would be evaluated based on how successfully they complete the main task, and if they have an eye for finding/patching vulnerabilities, that's a bonus that can be used as a secondary selector if a lot of candidates pass. If no one does, it won't be used against them.

That's how I'd approach it, personally. Something specific to the kind of work we're doing, but abstract enough to be approachable without a lot of insider knowledge.

> All true but my observation is that the companies that put candidates through multi-day-out-of-town interview processes can afford to miss out on the candidates that can't do it.

All companies can afford to waste less money than they need too.

I really appreciate the level-headed discussion in this thread so far, especially the comment I'm replying to.

It's a stark contrast to the CFRG mailing list. (At least, so far, no one has tried to derail discussion here with "hey check out my custom cipher it's soooo secure but you need to compress the data before encrypting it or else you can observe a repeated structure out of it".)

I like 25519's school of thought. If you use the smallest possible value for a given performance/security goal, there's less room for conspiracy theory (provided the person making the theory understands what's even going on).

Person: "I'm starving and barely able to get by working for Yelp in SF."

Yelp: "You're fired." (Good luck paying rent without a job.)

Yelp CEO: "The cost of living is too high here, so we're going to instead move offices to Arizona and pay the same wage."

Does this mean that Yelp is going to...

    a. Help all of its employees move to AZ where they can enjoy
       a lower cost of living?
    b. Fire all of its employees and hire replacements in AZ?
    c. Something else?

Because if they're going with option B, wow.

The cost of living in SF is one of the reasons I refuse to ever move there for work, but it seems like a scapegoat in this case. Why not just pay your employees a livable wage to begin with?

How would transforming it before sending it over the wire help here?