13

I'm working on hiring some more senior level engineers, and a recruiter just sent me over a resume for the person. In there is the url of a website they built for reference. Naturally, I went straight there, poked around, and then did my best to try to break it.

It didn't take very long. Not only was I able to trigger some fatal errors, but I know they were fatal errors because PHP on his server is apparently configured to have display_errors On (a big no-no for security reasons in any production environment).

I haven't even talked to the guy yet, and I already find myself dubious. I consider attention to detail and awareness of security issues to be paramount (especially in senior level engineers), and these issues seem like big red flags for both of those. Am I over-reacting? Is it worth the time to interview him anyway? Everyone makes mistakes after all. I just know that if it was me, I would check any example code I provide with a fine-tooth comb before putting a reference to it on my resume. Thoughts?

Edit it to clarify: the job is specifically a software engineer/web developer. If given the job, the candidate will be building websites for us. I would be hiring him to specifically handle the kinds of responsibilities that he messed up in his demo.

  • 5
    Is this a site provided by a hosting service? It may limit what security a developer can implement. Seems like you have questions to ask during the next interview. – user8365 Jun 22 '17 at 21:11
  • 8
    I'm curious if anyone would suggest interviewing him and asking him directly about these issues. How he answers/handles them will tell you a lot. – cheshire Jun 22 '17 at 21:11
  • Hosted by siteground.com. Managed by cpanel. Although, display_errors can be set at runtime. – Conor Mancone Jun 22 '17 at 22:31
  • 1
    You say the position is for an engineer, but not what kind. Is it software engineer position? Because I would have much higher expectations for a website built by a software engineer than a mechanical engineer. Will this person be working on websites for you? – Seth R Jun 23 '17 at 3:47
  • Yes: the job is for a software engineer who will be building websites for us. – Conor Mancone Jun 23 '17 at 10:00
6

I'd just move on - if a candidate for a senior level position is presenting a buggy demo like that, they'd have been better off not doing it. I've canned a potential vendor just recently for the same reason.

Hosting service limitations on configuration isn't really an excuse - the errors shouldn't happen (a demo site should be simple enough to be fully tested) and, again, someone going for a senior level position should be able to pay for a VPS or even an Amazon instance to take control of their server.

Just to clarify - I don't expect senior level developers to provide a demo - but if they did, I would expect they would put some care and attention into it. If they can't do that for their own demonstration, where they don't have to deal with deadlines and other developers, why would they be any better in a working environment.

Presumably you have other candidates you can spend time on.

  • Not defending or anything, but just because your title is/was Senior doesn't mean your salary is also Senior. In many less well-off countries, even a simple web host can be quite expensive relative to your income. Especially if it is just for personal demo purposes. Same for hosting it yourself, since you'd pay for the outbound bandwidth (and possibly a static IP). – Juha Untinen Jun 22 '17 at 23:02
  • 1
    @JuhaUntinen - true (though is $10 a month for a developer really all that expensive anywhere), but the main point should be: don't provide a demo if you can't provide a good demo – HorusKol Jun 22 '17 at 23:03
11

A few questions to ask yourself:

  • What would you have thought of the candidate had they not provided the website and only their resume?
  • What responsibilities will you be hiring for?
  • How much time/effort do you believe the candidate put into the website and what was their ultimate goal with the site?

A tendency when interviewing is an expectation of the candidate to have the same "deep" experience as you, thinking of experience as a T - a broad base but some deeper levels.

If you are interviewing where these types of mistakes specifically will be relevant I would weigh that much more highly than if they are tangentially related at best. It's entirely possible these fall into the areas the candidate is less familiar with - or they could be just careless.

I tend to think it's likely the candidate put up a website they spent minimal time working on, assuming no one will go through the level of inspection you did.

Is it worth the time to interview him anyway?

You can always setup a short phone interview where you ask the candidate about these issues. Their responses will almost assuredly determine a concrete answer to whether you want to move forward.

Given you haven't immediately vetoed them, it seems you have enough interest still in meeting with them to make this worth it.

  • 1
    I do love the phone thing part : it's quick, and it should be enough to sort the question. Far better than any internet advice could make. – gazzz0x2z Jun 23 '17 at 9:44
  • That's great input that I will keep in mind for the future: thanks! This time though (although I wasn't clear in the original question), I would be hiring him to specifically handle the kinds of responsibilities that he messed up in his demo. – Conor Mancone Jun 23 '17 at 16:02
  • And don't forget...software without bugs pretty much doesn't exist. – Draco18s Jun 23 '17 at 18:07
5

You don't specifically say what type of engineer you are hiring for, but since you mention your expectations for them understanding security issues, I'm going to assume this is for a software engineer position.

If a software engineer puts a URL on their resume, I would assume they intend for that website to be a good representation of their skills. It must be something they are proud of and want to show off. Since web development falls into the realm of software development, even if the position isn't specifically for a web developer, I would take their inclusion of the URL as a declaration from them saying "hey, look, I'm good at this". The fact that the website had such serious flaws immediately calls into question any other skills they claim to be good at (what you describe aren't minor problems. They are things any software engineer should know to avoid, either by fixing them, or not putting up the website in first place). It tells me this person either doesn't know what they don't know, or they don't have enough awareness to figure out that presenting yourself with a skill you don't actually have is a bad idea. Either way, it's a red flag.

As to whether you call them in for an interview, that is debatable. They would definitely lose priority with me, but if they have enough other things going for them and the job won't have them building websites, it might be ok. But I would ask them about the website, and vet them more closely on their other technical skills (including security). Remember, by including the URL they implicitly told you they think they are good at building websites, and they clearly aren't. So I would be wary on what else they exaggerated on.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.