Non-hiring Practices - <AUTHOR> http://blog.diiq.org/post/35463248560/today-im-thinking-about-hiring-practices-no-i <comment><USER3> _It is not merely rude but evil that anyone accepts a status quo of ignoring the unhired._

+1000000

I have not often been in the job market, but every time I have, I've been stunned by this practice: Run an ad, get a bunch of resumes, ignore many of them.

#1 Get this, all prospective employers: If you have time to run an ad, YOU HAVE TIME TO ACKNOWLEDGE EVERY RESPONSE. The typical response I usually get: "But we got so many resumes, we didn't have time to acknowledge all of them." WRONG. Acknowledging resumes is your job. Just like doing x, y, and z is my job. Your do your job. Period.

#2 Get this, all prospective employers: You may give your employees money but they give you something far more valuable: their time. You can always make more money, but they will never get those 8 hours of their life back. They could have spent that priceless non-recoverable part of their life doing many other things, but they gave it up to you. So show a little respect.

Bottom line: Employment (and the process of establishing it) is a two way street. So treat it that way.

<comment><USER4> I love 37Signals - their products and their content, but this is the biggest issue I have with them - ignoring applicants.

I've never shared the story of my efforts in applying to 37Signals, but this seems like a great time :)

About 6 months ago, 37Signals advertised for a dedicated Conversion guy/gal:

[http://37signals.com/svn/posts/3175-were-hiring-help-us- sign...](http://37signals.com/svn/posts/3175-were-hiring-help-us- significantly-improve-conversion-and-retention)

This was very exciting for me. I'd been a long-time 37Signals customer and over the last couple years had been studying and practicing with optimizing the customer life-cycle (conversion, onboarding, retention, etc) with my various contracting clients.

I've been more of a backend and devops engineer for much of my career, but I always loved when I'd get to simplify or add enhancements to a site and see the traffic and engagement go up. It had become my side-passion and I devoured all the books and articles I could find on the subject.

So I spent several days looking over the 37Signals product marketing and coming up with a strong pitch. The Basecamp landing page was full of classic mistakes and seemed like the lowest hanging fruit to address, so that's what I picked to overhaul.

Here's my initial pitch: <http://yconvert.com/>

I kept thinking about the problem and I realized that the mockup I sent of a new Basecamp landing page was still pretty weak, so I spent some more time revamping it and sent this 2 days later:

<http://yconvert.com/redux.html>

I still kept thinking about how it could be improved, so I also addressed the Basecamp funnel flow and sent this another 2 days later:

<http://yconvert.com/basecamp_funnel.html> via this link-baity tweet: <https://twitter.com/nanobeep/status/212543236374409216>

During this process, I watched my logs carefully and geo-located every IP that hit my application. Sure enough, the guys I wanted to see it had seen it. They also saw every update. They also tried some of my suggestions on the Basecamp landing page. And they also ended an online discussion with a puppy pic (if you reviewed my pitches, you'll know why that is significant).

Now, I'm not bitter about being ignored and I don't necessarily think it's evil or anything. I totally understand that folks get busy and things fall through the cracks - but companies should realize that it's often your customers and fans that apply for your jobs.

When I'm hiring for something, I'll admit that if I get an application where the person _obviously_ cut-and-pasted a generic cover letter with no thought for the actual job, I may ignore the applicant unless they follow-up. However, if someone puts obvious significant effort into applying personally to my job - I would _never_ ignore them. It's just really bad form.

I'm still a 37Signals fan, and I realize that as only one data point, I could just be that one guy they forgot to reply to. But if it's a more common problem, I do hope they change their hiring process to treat their applicants with more kindness and respect.

\---

P.S. I also have to mention that during this process I emailed Patrick McKenzie for advice and he responded immediately with some great and timely counsel. He encouraged me to be persistent and be as engaging as possible, and I applied that the best I could. He's a scholar and a gentleman.

<comment><USER5> I apologize for not getting back to you. That's not cool in general and triple uncool when you've out this much effort into it. I will make sure we write back to all applicants in the future to let them know when we've made a decision (this does some time take a while though, we've taken 4-6 weeks in the past to make a decision, but it will be done).

<comment><USER4> Thanks David. No worries - I figured it was probably just an oversight and moved on. Still a fan - thanks for the reply.

</comment></comment></comment></comment><comment><USER6> Such an important issue. A few years ago, I applied to McKinsey & Co as a resident. I had a pleasant time interviewing and got to the final round. I asked many questions as I was a physician and had no prior background in business but I was really interested and thought this was my calling in life. Their average response time via email was 57 minutes during recruitment. I just checked my old emails.

After my final round, I waited patiently ... and then waited some more. I emailed my recruiter, my "buddy" and my interviewers. I really was interested in working there but I had to make a decision on other jobs. I told them that and they said someone will contact me. 6 weeks later, after I had already taken another job, a recruiter called me saying that I didn't get the job because I did not make their "bar" and a partner will call me with feedback. 3 years later and still no call.

I guess I should be happy that they did eventually contact me but it left a very bitter taste.

Fast forward to two months ago. I was in the position of finding a consulting company to help our hospital system with financial issues. 3 large hospitals. Multimillion dollar contract. McKinsey & Co.'s name came up a few times but my bad experience is what made me eventually recommend another company. One that I got rejected from after the first round but made me feel good. They gave me feedback and didn't make me feel like crap.

Most people claim that McKinsey has a great feedback system, but it failed in my experience and maybe that is what led to us choosing another consulting company.

It taught me a great lesson though. Regardless of who I interview now; resident, attending, or any other position, I personally call them to let them know our decision.

<comment><USER7> It is a good point to be polite to everyone. It is a Hollywood attitude: the "Hollywood No." Super kind, polite, excited people who figure out the best way to decline you, because nobody knows how big you could get.

On the other hand, your situation might be rare. How often, in the graph of commercial interactions, does the dissatisfied recruit become potential client? Outside the extremely highly compensated (like actors and CEOs), probably very rare.

<comment><USER8> _How often, in the graph of commercial interactions, does the dissatisfied recruit become potential client?_

I've had about a sixteen year industrial career now. Most of it spent in the web / internet space. I can think of six cases off the top of my head.

Two of those are probably causing major recruitment problems for particular companies - since the dissatisfied people are 'names' in a fairly narrow field, and are somewhat vocal about their experiences.

It happens a _lot_ more than you think. I talked to a guy in NYC last week who was originally from the UK and we have people in SF and Cambridge UK among our common acquaintances. Six degrees gets really freaky quite quickly once you've been around a few years.

To pick an example from my own experience - I once went to do an interview after being told that it was a position that allowed telecommuting and was of a certain minimum salary. When I arrived it turns out neither of those was true. The recruitment agent had lied. Wasting a day of my time, and an afternoon of the companies.

I know this because the guy who was interviewing was somebody I hired at another company about five years previous to that. I had a lovely time listening to him call up the recruiting firm and rip them a new one. That firm no longer works for him, or for me, at any company we've worked at. I know of others that we have related this story too have shuffled that particular organisation to the bottom of the pile.

Everybody starts somewhere. Paying it forward pays off.

<comment><USER9> _"Six degrees gets really freaky quite quickly once you've been around a few years."_

Yup, not only are there former students of mine teaching Maths, but I met an ex-student of a student of mine who is now in training.

Education _used_ to have really good hiring and feedback on interviews in the UK in my experience but since the rise of the HR/litigation culture recently it is about the same as everyone else...

</comment></comment></comment></comment><comment><USER10> I interviewed with a very well known company in these circles. I was delighted as they are known for paying attention to the everyday aspects of running a business & being open about it. (It was actually my 2nd time applying & interviewing with them. I didn't hear back that time either, having had a Skype interviewed with the founders).

However, I was more than disappointed that after two interviews with staff members, personality test and contact from the CEO that I was in the final shortlist - a month long process - I never heard back again. The only way I knew I hadn't been hired was once the new hire was announced on the company blog.

Between the creative application they'd asked for, interviews & tests, I'd put in a couple of full days of work. Being rejected would have been fine, understandable, but never letting me know was disrespectful & goes against the culture they project.

A few weeks later, the same company advertised the exact same position again on their blog, as I believe they wanted even more coverage than the first person they hired. I decided not to apply that time.

All in all, a simple 2 line email thanking me for the effort and letting me know would have sufficed. Over a month of waiting for an email to drop was painful.

<comment><USER11> What company was that?

<comment><USER10> I won't say because the point to me is not to out the company. All I would like is that any reader who has been in a position to hire takes heed of what people go through.

Lots of well-known companies on HN and around suggest a lot of how-to advice and ways for doing business, but my personal sour experience suggests they don't practice what they preach.

If someone reads this and suspects it may be their company, all the better. Do something about it.

</comment></comment></comment><comment><USER12> I'd encourage everyone to take it a step further.

If the candidate is strong, then I send them links to job openings at some of our peers, partners, and even competitors (depending on skills). Sometimes we get people who are solid technically but just not the right fit for our culture or team. In this case, they may be a good fit for another team. Your meta goal is to get strong candidates to work in the larger ecosystem that surrounds your company, not just your team.

This extra step always surprises and delights candidates, even if they don't end following through. They'll then go on to think and say great things about your company.

It's an incredibly nice thing to do that will pay dividends. I'm Twitter "friends" with several candidates we passed on by took this approach with. It's lead to several business development meetings, a partnership, and evening a speaking engagement. They've also referred new candidates to us.

I've had nothing but win from this and strong encourage others to try it.

<comment><USER13> YES.

I've done a bit of that sort of matchmaking for some great folks who've reached out to me. Its incredibly hard for most job seekers to know which businesses are a good fit (and vice versa) until they chat with each other.

I've done a surprising amount of that sort of matchmaking in the past 6 months (smart folks reach out to me, I redirect them to a place that would be an exciting fun fit for them right now). I'm pretty amazed as how awesomely its worked out for all those folks and associated companies.

It gives me great pleasure to be doing that matching for other people (and which I've never had the pleasure of getting myself).

[meta remark: its also been the first time I've seen how my ability to have a really good read on how folks will get along & what their strengths/weakness/growth areas are actually ridiculously useful. I'd long thought those two skills of mine are useless]

</comment></comment><comment><USER14> The local newspaper printed the following just last week (possibly fake and not sure how it was attached to the email but good publicity nevertheless):

I was an applicant for a role at Bell Tea and Coffee Company recently. In due course I received an email advising I was unsuccessful. It read: _'We are genuinely sorry that we couldn't offer you an interview this time, but as a token of our appreciation for your interest in working for Bell Tea and Coffee Company, we enclose a little something to assist you in your job search (Bell Tea sachets). All super heroes need a little pick-me-up from time to time and our Bell Kenya Bold tea is especially designed to do just that!'_ All too often these days we don't even receive an acknowledgement to job applications. So well done, Bell, for making a small kindness. It is pretty tough out there for jobseekers.

</comment><comment><USER15> As a hiring manager, I tried to have my recruiting managers or sourcers handle the notification of bad news whenever possible, but I made the mistake of doing so myself a few times and will never do it again. While certainly most people either don't reply or simply provide an extremely rude e-mail response upon the no-offer status, I've had a decent share of stalkers. The behavior has varied from:

\- Women crying.

\- Men telling me I was going to starve their family to poverty if they don't get this job.

\- Men harassing me repeatedly.

It goes on. Admittedly, even back then (~2005/2006) I was too easy to contact (phone number in resume online), but dealing with the no-offer responses from candidates was by far the most stressful thing I've ever done related to hiring, and I have the utmost respect for the usually young folks in recruiting who have to deal with it on a daily basis. I personally found the, "we may have to let you go if your performance does not improve" conversations easier.

So, yeah, the comments responding to this post make it sound like all kittens and baby smiles if you give the, "no hire" mail, but it's pretty far from that in reality.

<comment><AUTHOR> Absolutely. If it's an imperative for the hire-er to say "no thanks", it's _just as important_ for the unhired to be polite, too, to say "thanks for your time" and move on.

<comment><USER16> Agreed. Also, at some level, hearing those responses is a good thing. If I was hiring and someone started crying/complaining about my non-interest, I'd keep their name on file as someone to never, ever hire. Don't want that kind of person working with/for/around me. Sometimes bad replies are helpful, especially if you are in a very small field.

<comment><USER17> What is "that kind of person"?

<comment><USER16> Someone who tells a hiring agent that they won't be able to pay their rent if they don't get this job.

THAT kind of person.

</comment></comment></comment></comment></comment><comment><USER18> I have been instructed by legal affairs that non-contact after rejection is the safest choice for avoiding discrimination lawsuits. whether or not this is true, too much direct disobedience of management and legal usually results in starting ones own job search...

<comment><USER19> I wonder why this is seen as being an effective way of mitigating the risk of discrimination lawsuits? At some point, whether you explicitly tell them or not, the candidate knows they didn't get the job.

I can see where it might be problematic to go into reasons why they didn't get the job, but I'm having a hard time seeing what risks a simple notice informing them they didn't get it causes?

<comment><USER20> It's quite simple: Wording. Somebody might have gotten sloppy writing requirements for the new position, or HR may have misunderstood the requirements.

This may be enough to give the rejected applicant ammunition for a law suit. I've been to several interviews where I've had to dig out that what they say they're looking for doesn't match the position they actually want to fill.

I'm a straight, white male in my thirties, so discrimination is far from my mind. Other people may form different ideas, though..

</comment></comment></comment><comment><USER21> Devil's advocate here (and an employer)..

Its common for thousands of applicants to respond to a posting, many of whom are not vaguely qualified. So when a position is filled, its not uncommon to be turning down several thousand people.

Honestly, do _you_ want to send a disappointing email to 3000 people and then deal with the responses? More importantly, do you have time? Remember, wasting time on the wrong problems is a sure-fire way to kill your business.

That said, if you've responded to a candidate at all, much less had an interview of any kind - then absolutely, you must follow-up. Those people have good reason to believe you might be an opportunity for them, and you owe it to them to respond one way or the other ASAP.

Sidebar: the current situation is _awful_ for employers. Some start-up, PLEASE fix this. A job board where candidates can only submit 1 application per day would be a tremendous step in the right direction.

<comment><USER22> I can say that it's been fairly standard for me to be interviewed (a few times in one case) and then having the firm never contact me again, and not even answer a brief email asking about progress.

This in marketing departments for high tech firms, mind you.

Clearly, they a) don't care, and b) know they can get away with it.

</comment></comment><comment><USER23> Silence after sending the resume in and especially after in–person interview kills every motivating molecule in me. I wish there was some kind of metrics based on feedback attached to my profile, so that after interviews, I'd bounce to that perfect position, as "one man's trash is another man's treasure".

Best rejection letter I got so far:

"We're sorry to say we couldn't accept you for a position at XXX. Please don't take it personally, it was a hard decision. The applications we receive get better every day, and since there's a limit on the number positions, we have to turn away a lot of genuinely promising people.

Another reason you shouldn't take this personally is that we know we make lots of mistakes.

We're trying to get better at this, but the hard limit on the number of people we hire means it's practically certain that people we rejected will go on to do something amazing. "

<comment><USER24> I spent a few months looking for work recently, and this style of rejection email seems to be a form letter these days. 'heaps of quality applicants' kind of thing. It feels made up, but the important thing is that now you know you didn't succeed and you can strike it off your list.

</comment></comment><comment><USER25> While I agree that it is the decent thing to do, the whole '' Reply>Copy>Paste>Send. 5 seconds.' is probably not entirely accurate. Many organizations spend weeks going through hundreds of applications before contacting the candidates that they _are_ interested in.

Also, in general, if you've applied and haven't heard anything back by the end of the week, it's probably safe to cross them off your list. If it turns out they are a dinosaur that takes longer to get back to you - then their response simply gives you another option, or perhaps your first option. It's really not that big of a deal overall.

<comment><USER26> > While I agree that it is the decent thing to do, the whole '' > Reply>Copy>Paste>Send. 5 seconds.' is probably not entirely accurate. Many > organizations spend weeks going through hundreds of applications before > contacting the candidates that they are interested in.

I think the stories about effort required to look at applicants is a load of hooey and is an excuse to make HR departments and managers seem busy. It's very hard for for me to believe that a hiring manager has to eyeball a resume for more than a minute to see if the candidate goes in the "maybe" pile or the "no" pile, and no more than 5 minutes to take a good look at each resume in the "maybe" pile and continue to subdivide from there (each division would take more time to look at the meat of the resume). I seriously doubt even huge organizations like Google have humans look at hundreds of resumes for a single position.

The absence of reply is human nature: No matter how nice you put it, you're actively rejecting them, and that's a hard thing to do. When you think about all the times you've been rejected it's usually by being ignored whether it be a friend not picking up the phone, a girl not replying to the message you sent her on the dating site, or by an employee who pretends to not hear you. Yes, it's painful at times, but much less painful than a verbal "I don't want to talk to you."

The other aspect is that by replying it initiates (or continues) an interaction. HR employees or hiring managers would like to say "thanks but no thanks" but then the applicant will want to argue, make their case, beg, or in the worst situation get angry.

Another reason they don't send replies is because they want to keep their options open. Sometimes their first pick declines the offer and it would be very awkward for them to send the letter and then come back and make you an offer, or even more awkward if the number one pick accepts, they send out the letters, then the number one pick backs out.

Companies should send the "thanks but no thanks" replies to everyone that the hiring company has responded to and they should send them from a "no reply" type address where replies are blackholed or deleted.

On a side note: With the explosion of technology HR is no longer qualified to screen technical resumes. For almost every other profession it's easy to see who's qualified and who's not, but when you have a group of non-technical people dealing with thousands of technical terms and buzzwords they aren't qualified to make the decisions, and if they're simply matching keywords then they're an obstacle to the process and can be replaced by machines. Yes, calling for machines to replace humans isn't pretty but in this day and age it's the way the world works and people in HR need to up their game.

> Also, in general, if you've applied and haven't heard anything back by the > end of the week, it's probably safe to cross them off your list.

I send em and forget em, it's much less stress that way.

The only time you should actively pursue a position is when you have a direct line to the decision maker or their boss. Recruiters are powerless because they can't ask for updates too often and are at the mercy of the hiring company. Good luck getting someone in HR on the phone directly to make your case. It's even harder to find out the name of the hiring manager when you're applying at a megacorp.

Find the decision maker if you want to pitch directly or to follow up, but if you can't, just spray and pray.

<comment><USER8> _think the stories about effort required to look at applicants is a load of hooey and is an excuse to make HR departments and managers seem busy. It's very hard for for me to believe that a hiring manager has to eyeball a resume for more than a minute to see if the candidate goes in the "maybe" pile or the "no" pile, and no more than 5 minutes to take a good look at each resume in the "maybe" pile_

I've been on the hiring side and have spent time with hundreds of resumes and it can take _days_. Especially in times of economic woe where you tend to get a lot more qualified applicants.

Even with strong well defined hiring characteristics anything past the first couple of passes takes time - or is arbitrary/probability driven.

Let's take your strategy with 250 applicants (and I've _way_ larger numbers on occasion);

* 250 - 1m per resume into yes/no. Let's be generous and say that cuts out 150. At your one minute per-resume that's over 4.1 hours gone already. (I can tell you that 1m is a hopelessly optimistic number. 1m for the people who totally suck. 2-5mins minimum to deal with the amazing number of really quite talented people who completely suck at communicating those skills in a resume.)

* 100 left - at 5m per resume. That's another 8.3 hours gone (and again 5m is way optimistic for a vaguely deep look). Let's say that cuts it down to 25.

* 25 - deep look. That's time spent googling, poking at their track history. Discussing pros and cons with team. That's at least 10m per resume. Another 4.1 hours minimum.

... so thats _more than sixteen hours doing nothing but reading and reviewing resumes_. Which translates, once you take doing actual work around that, screen breaks, lunch, etc. into probably nearly three days of actual time. For time estimates which are, in my experience, optimistic...

Not that this is an excuse for not getting in touch after a 'no'. If you're getting hundreds of applications you set up a process that can deal with hundreds of applications - but the selection process itself can and does take time and effort. It's damn hard and, in my experience anyway, technical folk foul it up just as much - if not more than - HR professionals.

</comment></comment></comment><comment><USER27> Big difference between responding to every resume (not really practical) and responding to someone who has put time and effort into a grueling interview process and has reason to believe they are on some sort of short list.

Quite some time ago I was recruited by Apple for a mgmt position (team of ~50). I flew from NYC to CA (they paid of course), went through 8+ hours of interviews with people I would be reporting to, parallel with, and managing.

Long story short, after waiting two weeks and hearing nothing, I had to pester the recruiter with 3 or 4 phone calls (unanswered messages) before I "caught" him answering his cell, whereupon he said something very brief and off-putting about not being a good fit, and acting like I had breached some sort of rule of etiquette by insisting on a direct response.

I had no way of knowing what their process was, whether I was still in the running (of course I had a hunch I wasn't, but you really never know with this sort of thing). I had decisions I had to make that were impacted by this trailing variable of probability that I might have a big-shot job in Cupertino.

Anyone who gets to that point in the process deserves the respect of a formal indication that you are not the chosen one.

</comment><comment><USER28> I'm amazed advice like this needs to be given. I was contacted and asked for a resume by someone at Rumblefish who wouldn't divulge how he got my contact info and complained about how hard it was to hire good developers. The position looked interesting and I consider myself a pretty good developer so sent him my resume and told him I would call in a couple days to chat.

Before I called, I spent some time going over the job description writing down notes so we could make the best use of our time.

He didn't answer his phone, my last email, or his voicemail and I never heard from him again. Maybe he just knew after reading my resume that I was the wrong person for the job. Because of his lack of professionalism we'll never get to have a conversation about why, and I'll never refer anyone to them.

With such powerful analytical skills and immaculate professionalism I'm baffled as to why they're having trouble finding good developers.

</comment><comment><USER29> I've had various experiences of good and bad HR/internal recruiters but the one that really deflated me was with one of the larger Ruby companies in the Bay Area.

I applied through a resume website, applying to 4 positions that I thought fit what I could do.

I got a email/call from their recruiter, then I did a technical phone screen and passed. Due to scheduling I was in the Bay Area a day later so I had a 45 minute pair programming assignment onsite instead of doing it over the phone/internet.

After I passed that they emailed me asking me to come into their offices the next day for the full onsite interview. During the full onsite interview, I did pair programming with 2 different people on 2 different programming tests, and did two 2-person interviews.

The first clue that should have alerted me to something being wrong was that I was suppose to talk to the CTO but because of "conflicts" he could do the interview. My recruiter shook my hand, thanked me, and then I left.

I wasn't sure whether or not I was going to get the job. I had felt pretty good about the programming tests but during the 2-on-1 interviews I felt they were forcing me to answer questions where the only correct answer was the one they had set out in advance in their head. I didn't really know which way it would go.

So how did I find out I got rejected? Essentially they changed the status of my application on the resume site from 'In Progress' to 'Reject' and the resume site sent me a notification tell me I had been rejected for the position. Just to be sure I got the message the person also rejected me from the three other positions I had applied for. So in the end I got 4 Rejection Letters from the company. They couldn't even be bothered to e-mail me directly and tell me, "No."

Considering the reputation of the company as one that "cared about its customers" and was considered one of the "darlings" of Silicon Valley, I felt pretty crushed being treated this way by them.

<comment><USER30> Sadly, I have found this to be standard procedure these days.

</comment></comment><comment><USER31> I agree. I have been on the side of not receiving any update after an interview, and also on the side of having to poke the recruiters about whether they got back to the interviewee when we decided to pass on him/her; and finally doing it myself.

It is absolutely the decent thing to do. I feel sorry for people who only have interest in you as long as they can potentially get something from you. Typically I avoid associating with such people, as that says a lot about their ethical standards.

Edit: Spelling

</comment><comment><USER32> So having just gone through the job search process, I agree it's frustrating. However, I'm not that frustrated if I don't hear anything from a company if the only thing I've done is apply. Applying is a very impersonal thing.

However, if I attended an interview and didn't hear back, that is incredibly frustrating.

It's important to manage expectations; ambiguity is the enemy of mental health during the job search and you'll be immersed in it so learning to cope is essential.

</comment><comment><USER33> The other benefit of being civil, polite and responsive is the candidate may not be the best match now, but they will know other people and meet people when they do get a job. They are far more likely to recommend your company to those people. It helps sell your company and they will remember it in their future career and business dealings.

My only qualms have been what to do about the people who made no effort - <USER2> folks who borderline spammed every email address they can find. So far we have also responded to all of them too.

</comment><comment><USER34> There are many examples here, both positive and negative, but I keep wondering, why people anonymize the unfavourable ones? I'd really love to know which company was that "company X", "company [HNer] won't publicly name", or "well known company in these circles". Those are important data points in order to know whether or not one should get involved with a particular company.

<comment><USER35> Because often they're very anecdotal. Companies like Google employ hundreds of recruiters. It stands to reason that out of those hundreds there are a few who are not particularly great (downright bad, even). I also hear that big names make people sign NDA's when interviewing, although this has never happened to me.

Additionally, naming and shaming often isn't very beneficial for your career! People move around a lot, especially in recruitment.

</comment></comment><comment><USER36> I interviewed with both Google and Microsoft when I first graduated. MS one was way more smooth but it was largely because they've sent a team out and we did face-to-face interviews. At the end of the day I was told that I was not a good fit. The only thing I was pissed about is that they haven't told me they wanted a Software Tester right away. Since I wasn't interested in such a position, it'd save both parties a huge time.

Google one was quite a story. First of all, they reached out to me. Then it took them 3 weeks to schedule an over the phone interview. I've changed like 4 recruiters along the way, and no one told me way. This is a bad practice since for international hires, recruiters are way more important.

This is where it gets interesting. My interviewer failed to call me at appointed time, I mailed my recruiters, got a big lie, they scheduled for a week after. It was ok since accidents can happen. Over next to weeks I did two interviews (why on earth can't they schedule them one a day?) and I was told to wait for a committee. Ok, no problem. After 10 days, and a pissed off email, they told me that I had to get a 3rd one. Another week of waiting, and interviewer failed to call again! I was raging by that time. Another week. The interviewer failed to call again. I wrote an email telling them to not to bother with excuses. Right before I hit send, interviewer calls. I was raging so the interview was a bust. They waited 2 weeks to give me a response.

Moral of the story: If you need to have 3 or more interviews do them in a short time. In that 2.5 months time I've did so many things, Google became irrelevant, a joke for me. I do get that hiring is hard, as I'm doing it myself; but I always try to return to an applicant in a weeks time. Still now and then Google recruiters ping me over Linkedin. I've told every single one to send an offer right away and skip the interview process. I get the silent treatment =)

</comment><comment><USER37> Once after an interview I wrote an email to thank the group I interviewed with for their time and to say that I did not think it would be a good fit. About a month later they wrote to inform me that I wasn't a good fit for their group. So there are cases when hearing nothing negative would be preferable than hearing something negative.

</comment><comment><USER38> Over a year ago, I applied to a job that I considered a great match with my experience and interests. Never heard from the company after applying. I had a couple of offers from other companies and I choose one.

Many many months later (7-8?) the company contacted me that they thought my resume was great and if I was interested in an interview. Even if I did not have a job, I still would not have gone through the interview due to the company's previous behavior.

What were they thinking? Either they are incompetent or they stockpile resumes for when they actually need to hire. There is nothing wrong with saying that you are not a good fit right now, but they will keep your resume on file. It really does happen. My wife was hired at a company a few months after she was rejected for a different job. They hired someone else, but came back to her when something else opened up.

<comment><USER39> Applying for a job doesn't necessarily guarantee a response in many cases. This is mostly a case of companies getting way more applications and resumes than they can handle. Many companies handle this by storing the incoming resumes in a database and searching for potential hires when they have an open position. It of course would be nice if these companies at least sent an automatic reply indicating that they would contact you if they were interested sometime in the future, but an automatic contact doesn't mean much either and sets the expectation that if you reply enthusiastically, you'll get a reply (which is unlikely given the volume for some companies).

</comment></comment><comment><USER40> Many years ago, I applied for a Google job that I was totally unqualified for. I didn't even get an interview, but they sent me a nice _snail mail_ paper rejection letter anyway. I've heard mixed things about their interview process, but I still get a have a nebulous warm fuzzy feeling when I think about possibly sending a resume in again one day, because of one simple, probably automated, $.29[1] response.

Conversely, at a company I won't publicly name, I got the silent treatment [2], _after getting an offer_ , for asking if I could take two months off between jobs. I can only imagine what would have happened if I tried to negotiate salary.

I understand and appreciate the blogger's comment that people should behave decently, by the simple virtue of being human. But, that's not going to convince anyone who doesn't already want to be a decent person. But what ever happened to unenlightened self-interest, naked greed, and pure avarice? Not only did they sour me on the company, they lost two other potential hires into the same group, when I told them how their potential future boss treated me when I didn't take the offer without negotiating, after being asked why I didn't take the job.

There's pretty much no benefit to treating people shoddily, and a huge potential downside, when the candidate pool you're trying to employ hears about it. Why do it?

[1] Probably less, since they doubtless qualify for bulk mail rates.

[2] I sent a couple of emails to follow-up, and tried calling and leaving a voicemail once. I had the hiring manager's number (and that's the person I would have been directly reporting to), because he gave it to me in case I had any questions. Months later, I asked a friend of mine at the company what happened, and he told me "Yeah, X is pretty busy". The funny thing is, it was a huge microprocessor project that was staffing about 40 circuit designers / logic implementers, and the hiring manager told me they were expecting to continue hiring for another six months. It actually took them longer than that to fill all the positions they wanted, and I would have started before they were finished with the arch/perf simulations and moved onto real logic work anyway, even with a two month delay. I would have saved them paying me two months salary without having any work for me to do!

EDIT: Sorry for adding something after there have been replies, but it's been a long time since this happened. After looking through old emails to jog my memory, I see that they sent me a standard form with a bunch of info they wanted filled out, before I interviewed. One of the fields was availability, which I listed as 2+ months out. It's a big bureaucratic company, so it's understandable that there are standard forms which get sent out that hiring managers never look at, but ignoring this particular thing this particular time is a bit funny, ex post.

<comment><USER25> While you might disagree, asking to start in two-months is not exactly the same as salary negotiation. Most places have schedules and deadlines and the reason they are hiring is often due to the fact that they have a project that needs to meet some deadline on schedule.

Two months in the project lifecycle is a long time for any project. I'm not surprised they gave you the silent treatment. On the other hand, had you asked for more money, I'd be surprised if they balked -- _if_ their offer was genuine.

<comment><USER19> Asking to delay the start date by two months might not be standard, but it isn't incredibly unreasonable either - if they are already employed, they are going to be delaying by 2-3 weeks by default anyway, and finding another candidate may end up taking just as long anyway.

It's probably something that should be brought up before an offer is made, but I don't think it is a good reason for a company to simply ignore someone they've made an offer to - a polite "no, we need you to start within 2-3 weeks" is an acceptable response.

</comment></comment></comment><comment><USER41> One recent experience I had left a bad taste in my mouth. I applied for a position, did a quick screen interview, took a 2-hour online IQ and math test, did a one hour phone interview, and then did an in-person interview where I had to take another test and then meet with 3 people for one hour meetings.

I got an automated email the next week letting me know they were not interested. At the very least, I would have at least like the email to come from the corporate recruiter I had been communicating with, not firstname.lastname@example.com. I think it's rude to not give some personal acknowledgement and I put in close to 10 hours of my personal time working with them. Though a company that behaves this way is probably not one if like to work for.

</comment><comment><USER42> I'm a 3+ year HNer, using a throwaway because while I'm looking for work, I'd not like others to know this publicly (should we form a club?)

What the OP describes truly does seem to be almost standard operating procedure today. In one instance this happened even after I had substantial contact with the company:

* phone screen with recruiter;

* technical phone screen;

* completed a _substantial_ pre-interview coding project;

* multi-hour interview with 6 technical interviewers, including on-the-spot coding tests;

This process took _a month and a half_. I was assured by the recruiter that I did awesomely on all of these, and then, silence...

Only after pressing them for weeks did I finally get a reply: "sorry, we're not hiring for that position after all". It's incredibly rude to put someone through this kind of process, only to insult them at the end (if you acknowledge them at all).

I've been on the opposite end of the interviewing table many times, and I understand that there are all kinds of reasons to reject a candidate (technical skills, people skills, personality, just plain "bad fit").

And sometimes it's best from a legal standpoint to not even explicitly say why a candidate is being rejected. But a simple "sorry, we feel you're not a good fit for this position" _as soon as you know you will not be making the hire_ , will save an incredible amount of worry and anxiety, and let people get on with their lives.

</comment><comment><USER43> In the US? Liability. That's why this doesn't happen. Actually having to tell someone "we're not hiring you," regardless of polite spin, puts you in the crosshairs of a lawyer.

Much like discussing former employees in my "right-to-work" state. "Yes, she did work here from P to Q. No we can not discuss her work performance." Doesn't matter if she was the model employee or an incompetent moron, saying _anything_ is a potential liability. If you express your opinion that she was that incompetent moron, you're stifling her ability to find work and a jury of her peers will find against you, the former employer.

So back to the topic at hand. Say you get the generic "not hiring you" email. Are you going to leave it at that? If so, great, everyone can move on. Or are you going to try to appeal to the HR staffer's humanity and harass them with questions like "why not?" And then some candidate gets all pissy because "that's not what the job ad said!" and lawyers. So we send the email from a generic address that ignores replies ... and someone fouls up and sends it to all current candidates.

Should companies adopt a "we're not hiring you" generic message to send out and just never reply to replies? Sure. I'd love that. It's easier to ignore people.

</comment><comment><USER44> The one that I hate more than any other is the "You look great; I'll contact you in a couple days" to then never hear from them again, even after you try multiple follow-ups.

My favorite was the one where I got flown out to the Bay Area for an interview at Apigee[1]. They dropped the ball by not having everybody there to interview me, meaning they couldn't get all the information about me they would have liked[2]. When I left, it was all roses (including a said follow-up comment like above), and then complete and total silence. I get you may not think I'm right for the job, but flying somewhere takes a lot of my own, personal time.

1\. I'm naming names for two reasons: one, I, like the author, think it's deplorable. More importantly, if you are going to take a potential employee's time without the courtesy of a simple reply to one of multiple questioning emails by saying, at least, "No, thanks", others deserve to know what to expect as well. I couldn't even get a response on how to get reimbursed for incidental travel costs without tracking down somebody outside of HR.

2\. I don't think this had any impact on their decision to ignore me. It didn't even concern me, but, taken with the other events, it points to a lack of respect for candidates.

</comment><comment><USER45> The author of the submitted blog post begins with

"I'm looking for work right now; and I have looked for work in the past. It's something everyone does, now and again."

There is indeed an ongoing interest in finding paying work among the many participants on Hacker News. That's why I have devoted time and effort (with the kind help of several other HN participants) to writing up a FAQ about company hiring procedures,

<http://news.ycombinator.com/item?id=4613543>

which gives job applicants tips on what to get ready for at companies that use the best procedures.

"It is bizarrely standard, if you've decided not to hire someone, to simply never contact them again.

"Don't accept this. Don't behave this way."

It's easy to tell other people to do work you are not going to have to do yourself. You have no idea how many other applications were sent in for the same position.

HN participants luu

<http://news.ycombinator.com/item?id=4768830> <USER7>
<http://news.ycombinator.com/item?id=4768999> <USER18>
<http://news.ycombinator.com/item?id=4768864>

and hso9791

<http://news.ycombinator.com/item?id=4769295>

all have pertinent comments in this thread that appeared overnight in my time zone, at various comment levels.

The key idea is that companies get unimaginably more applicants, some with very poor fits to the advertised job requirements, than most job applicants suppose. I strongly sympathize with the idea that if someone has applied for a job I advertise, I might as well be polite enough to reply. As Winston Churchill said (hat tip to the HN participant who recently mentioned this quotation), "After all, when you have to kill a man it costs nothing to be polite."

<http://richardlangworth.com/when-you-have-to-kill-a-man>

It costs nothing to be polite, but it costs a little to send out a response, even by email. A company in hiring mode is looking for people to respond to its paying customers. It is GROSSLY impolite to ignore a paying customer. When forced to prioritize by press of busyness, most companies devote more time and effort to responding to paying customers than to job applicants who in many cases are taking a shotgun approach to applying for jobs. I assume that all the HN participants here who have recently applied for jobs have done careful research and only applied for positions for which they are a prima-facie good fit and well qualified. But at all the workplaces I have ever worked at, the company has received many out-of-the-blue applications on a cold-call basis, and many responses to advertised openings with an extremely poor fit to job requirements. And meanwhile there may be people on staff whose job it is to HIRE new people who fit, but there is no one on staff who is assigned to have time and resources to answer absolutely every job application that comes in, even for advertised positions. The inexpensive availability of word-processing software on personal computers, beginning in the 1990s, has deluged most companies with many more applications than most companies have procedures in place to answer individually. That's tough on the job applicant, but that's reality. I agree with everyone here who says it's the decent thing to do, and can even in some cases be the expedient thing to do, to answer a job application with a definite result in a polite tone, but all companies have higher priorities, and at least one of those priorities is decently answering actual paying customers.

<comment><USER46> I assume that most recruiters keep a list of applicants for a given ad. Is it really asking too much to copy that list into an email client and send them a polite response? We are not talking about 5 minutes per applicant, we are talking about 5 minutes total.

All that talk about paying customers is bullshit. This kind of attitude, to only do stuff that directly results in more revenue -- paying customers are turned off by that attitude as well.

</comment></comment><comment><USER47> This is an unfortunate side effect of recruiter compensation. Most internal recruiters are paid a somewhat low (for Valley at least) base with a nice bonus when a certain quantity of hires is reached.

Thus internal recruiting is a sweatshop assembly line where it's always juggling between closing the candidates who passed the interview round and moving on to sourcing the next batch.

Almost no company puts effort (or pays bonuses) for nice rejections. Depending on the status of the recruiter himself (full-time vs contractor brought in to boost the company to a certain headcount), your rejection might generate a reply. Internal recruiters won't bother (they simply don't have time for it and are not compensated in any way), but contractor guns-for-hire will reach out and be nice about it, since in 6 months they'll move on to another company, and you'll still be in their rolodex as a potential candidate they can hit again to reach their quota.

</comment><comment><USER30> I feel strongly about this. As a relatively recent college graduate who has has applied to dozens of jobs over many months, I can confirm that non- response has definitely been the status quo in my experience. Until I got numb to rejection and because accustomed to the status quo, I would feel compelled to seek out hiring managers or HR and ask, "Why don't you have the decency to even acknowledge my application status?" Instead, of course, I would simply inquire about "following up" on my application in the event that this was even possible to do.

"Go to our website" is the new mantra for hiring employers. And that's fine, but I'm stunned that many can't be the least bit bothered to set up some sort of response system. "Overwhelming number of applicants" is no excuse in the day of email...even an automated message, if phrased thoughtfully, would suffice perfectly fine.

</comment><comment><USER48> Times have changed I guess. The last time I applied for work was over twenty years ago. Back then resumes were printed on paper and mailed (or hand delivered) to prospective employers. It was very rare to never hear back. You almost always received a rejection letter if there was no interest in you.

</comment><comment><USER49> I cannot speak for other industries but in mine, video games, this practice seems to be formed by the 3d party recruiters in order to collect fees.

Applying to any company's ad for an engineering position rarely produces any response while in the same time every engineer is hounded by recruiters even while not looking for a job. You can apply, wait for weeks with no response then call an agency recruiter of your choice and have a phone interview scheduled in 2 days tops.

Looking at recruiters in my Linkedin network I can see how most of them move between 3d party agencies and contract/staff HR positions at the studios so I imagine there are many connections between internal and external HR. With the recruiting fees being 10s of thousand dollars and HR people paid peanuts it is statistically unlikely that most of them stay honest.

</comment><comment><USER50> I so concur with this post. How hard can it be to send an automated email: 'We're sorry to inform you that you have not been selected for position X. Thank you for your time and consideration.'

</comment><comment><USER51> i recently just changed jobs, so i can give a first-hand opinion on this.

firstly, the fact that many companies, after interviewing candidates, don't bother to contact interviewees afterwards is a big problem. it reflects personally on the people who run these companies and hire their workers. if your someone they want, they will kiss your ass to no end, but the second they don't want you, you're treated like a worthless piece of shit.

as i went through the recruitment process, i interviewed with a bunch of companies, from startups to larger, more established companies. i have to say that the situation was a lot more improved than a few years ago. a few years ago, i would talk to companies like ebay, and even getting all the way up to discussing salary, both ebay and the recruiters stopped talking to me abruptly, for unexplained reasons. i was pretty much put off paypal and ebay for those reasons.

this time around, it was mainly the startups that were pretty rude in notifying me that i was no longer being considered.

when i finally decided on a job, i was still in talks with several companies. i was sooo tempted to just stop responding to their emails, but instead i did the right thing and emailed them all personally, telling them that i had accepted another offer. most of the companies responded back congratulating me, and only a single startup didn't bother responding.

i am hopeful that we have turned the corner, and that being professional in one's correspondence, especially during the hiring process, is important.

<comment><USER52> "if your someone they want, they will kiss your ass to no end, but the second they don't want you, you're treated like a worthless piece of shit."

I'd like to be given more graceful declines, certainly, but you can't seriously expect them to devote the same amount of time dealing with rejections that they do on acquiring talent. That's not a reasonable request to make of any employer that goes through hundreds of applicants for every firm hire.

</comment></comment><comment><USER53> As someone in a position to hire, I make a point of telling people no -- but only if I've taken the time to interview them. No way I'm taking the time to write back to every candidate that applies over the transom.

Important people have enough crap to deal with every day, and it's just not reasonable to expect a response to every piece of communication they receive.

<comment><USER54> "Important people" also have assistants who are tasked with sending out these letters.

Takes about 20 seconds to say, "hey, we're hiring Jane Smith, send out the 'sorry' letter to the other interviewees, and the 'thanks, it's on file' letter to all the other applicants"

</comment></comment><comment><USER55> People posting here should name names of their negative experiences. How else can we learn who the problem actors are?

</comment><comment><USER56> This. A thousand times. Not only is it the decent thing to do, it's incredibly fucking rude not to.

</comment><comment><USER57> Naturally, this goes way beyond non-hiring. Invited to do something but can't/don't want to? Don't ignore the invitee; let her know. Send that text. You can tell a lot about your relationship with someone by this.

</comment><comment><USER58> Thank you. This seems to be the practice for many recruiters now, too. For more than ten years I've wondered what's happened to common decency and professionalism.

<comment><USER52> "For more than ten years I've wondered what's happened to common decency and professionalism."

Monster and Craigslist, I assume.

</comment></comment><comment><USER59> diiq, you should have made the font a bit smaller.

</comment><comment><USER60> The theme has got the style of 6wunderkinder.com

</comment><comment><USER61> EDIT: The below is correct and I stand by it. Please read the argument carefully.

Let me ask you, as you have opened six tabs and are applying one by one to them, would you like to have your inbox interrupt you with a message you have to spend time on, but which actually has the same effect (after the 2 minute interruption) as if you didn't get it? Because if you get 10 such emails, that's 20 minutes that could have been what it takes to get job (one of the six you were currently applying for) but you don't because the day is over and you go home or do something else.

The below is correct and I stand by it. Obviously if it is a position such as a high-level directorship where it is quite normal to do one such application for 2-3 weeks, then this does not apply.

\-----

I don't really get this perspective. It's a funnel. (For both you and them).

You're sending out 30-200 applications per day - do you really want your inbox cluttered at the first stage of the funnel with "Email undeliverable"? How about "Thank you your application has been received"? Well, I don't!

Maybe if I didn't have a funnel but was applying to ONE job at a time for 3-11 days. This is literally 1/300th of the rate you should be going at. 0.3% of the full-time job that looking for a job entails. Sorry, but at this rate how suprised can you be that you don't have one? The proper rate is to apply for 30-100 jobs every 8 hours you are actively on the market, which shouldn't be long.

If none of the 100 applications gets to the next stage of the funnel, it's better to have 0 responses. As opposed to, say, 7 undeliverable emails, 93 "Thank you, your application has been received" and another 93 saying, unfortunately your application was not a good match. Think about it. This is 186 spam emails you have to read insstead of having 0 emails to read before you can continue the work of sending out applications. It's noise coming into your inbox to interrupt your process.

Can you imagine if every single IP that went to your site generated an email to you unless that IP became a paying customer in the same session? But actually, the analogy is more like: every IP that comes to your site generates an email to you saying your sales pitch has been received. And it generaets an email to you if the IP starts filling out the form but does not complete it. Maybe if you have 3 visitors per month. But that is not a viable strategy.

The ONLY possible effect of that 186 spam emails (7 undeliverable, 93 thank you, your application has been received, 93, we won't be calling you's) is that MAYBE you miss one of them that ACTUALLY asked for more informatino (i.e. where you progressed through the funnel).

The ONLY time I want to hear back is where I am proceeding through the process. I have actually, legitimately, missed such emails because I thought they were automated or I missed them a long with a bunch of automated responses I also got.

It's the same at every stage. Getting 20 responses to 20 interviews would be spam. I don't care about places that don't give me a job offer, since I should be spending the same time sending out the daily 20-100 applications.

If you do progress to getting 2-3 job offers, choose the best one, or name your price. If you don't hear back, it didn't work.

If you don't get to here, keep repeating the 200. People, there is ONE of you. ONE. But there are probably tens to hundreds of thousands of companies you could be working for.

do you really want the fact that you can't work for all of them (which is a mathematical guarantee) spamming your inbox?

Let me ask you this: would YOU like to LITERALLY DOUBLE the number of emails you send at EACH funnel step, by writing another email to everyone you previously sent an email to, saying you won't be pursuing it? Do you want to halve the signal-ratio by having the next funnel step include not only signal (ones going forward) but noise (rejections).

This would be like building a web app funnel where half of your "conversions" are in fact thoughtful no-thankyou. That's not a signal, that's noise. If the customer doesn't sign up, that's all the signal you need.

<comment><USER20> Maybe it would be better to spend some time on: -certifications -further education -market/company research -polishing applications -part time job at neighborhood kiosk

Instead of just going automatic shotgun all over every position you see?

<comment><USER61> if the response rate is 0%, sure. but you find that out pretty quick, if you're actually sending applications instead of, as suggested here, reading automated responses. Sure, send out 100 emails and if you don't get 17-20 responses, you've got a problem.

But the "solution" suggested here is far worse.

It suggests to me that this person DOES have a 20% response rate, but then is waiting around for that 1 application per week that they send.

This is insanity itself (unless it is a ceo or high level director or other extremely, extremely scarce position with a hugely different funnel. same if you know someone, obv.)

I mean, just think it through. Imagine that the OP here is really lucky, because it turns out statistically that he has a 15% response rate (his phone rings 15 times every time he sends 100 applications), an 80% interview rate (80% of the time his phone rings, they ask a few questions and call him in) and a 75% second interview rate, and a 100% offer rate at the end of the second interview, and a 20% great-offer rate out of those offers - really, top of the market.

This is a great position to be in. All you have to do is send enough applications in, and the only thing stopping you is the fact that you are sifting through all this crap that the funnel gives you.

If I didn't have a job, which I do, I would not mind sending thirty emails today, thirty tomorrow, and thirty the day after (in the mean while the phone has rung 15 times), going in to 12 interviews and 8 second interviews, and getting a selection of 2 fantastic jobs to choose from.

Meanwhile, the OP can have the very same response rate, 15%, and spend 5 weeks on 5 applications, waiting to hear back. In fact, this results in only 55.62% chance of hearing back from a single person at the end of all 5 weeks (the formula is 1-0.85^5). And that's just step 1 of his funnel.

so of course he will be frustrated if he doesn't hear back from that one person. oh well, he's going about it wrong.

as the OP stated his case, I do believe his only problem is too small reach. Not, as you suggest, a 0% response rate.

Of course, if you do find that (after 3 days nobody gets back to you out of the 28+37+26 applications) instead of the 10-20 that you expected, then you change your strategy. This also reduces your down-time, because you are never "waiting", and if on day 4 the three previous days turn out to have had some lead time but you get 20 calls, so much the better. :)</comment></comment></comment>


Web front end to console weather app - <AUTHOR> https://github.com/chubin/wttr.in <comment><USER2> Now I have weather in Emacs.</comment>


The Internet of Gas Station Tank Gauges - <AUTHOR> https://community.rapid7.com/community/infosec/blog/2015/01/22/the-internet-of-gas-station-tank-gauges?hn-repost <comment><USER2> In my first job as a Software Developer about 5 or 6 years ago I worked at a company which connected to forecourt controllers (which managed ATGs, fuel pumps, etc) on petrol forecourts in the UK, retrieved the data and presented it to a team of analysts for reporting back to the forecourt owners.

To this day, the most difficult software challenge I have had to tackle was to retrieve the data from the serial port of a controller called the DOMS 2000. It had been replaced a number of years earlier by a new model but was still in wide service.

We had very limited documentation and I spent weeks observing the data being transmitted from the serial port while performing actions using a simulator. Eventually I managed to reliably intercept and correctly interpret almost every command.

I believe, to this day, I may well be one of the foremost experts on the DOMS 2000 on the planet.

<comment><USER3> What would you say was the biggest cause for this to be so difficult? is it "just because" you didn't have the proper documentation? or was the nature of the communication protocol itself hard due to its design? or was it perhaps the fact that both factors would compound terribly?

</comment></comment><comment><USER4> This is what the NSA and all digital counter-terrorism theatre players should _really_ do with public money: take a good hard look at the network infrastructure underpinning critical business segments, and force them to clean up their act. Be "the common man's pentest agency".

<comment><USER5> According to _@War_ , which I just read, NSA has been poking into "vital national interests" like fuel distribution for years. That they haven't discovered (or having discovered, urged people to fix) this issue, is kind of an indictment of their abilities. Of course, having their dirty laundry aired by contractors isn't a great endorsement either. I wouldn't actually mind if they helped the various insecure agencies of the federal government improve. At this point, however, it doesn't seem reasonable for them to bother "the common man".

<comment><USER6> The NSA is a bit crippled. They are so intensely afraid of someone (anyone) figuring out what they do or how they do it that they can not act on any information they gather. The 9/11 Commission report showed that the NSA had full access to all of Mohammed Attas communications, knew exactly where he was, had translated his messages, etc, yet they did nothing about it. When the CIA requested access to the information they had, the NSA refused. When the FBI requested access to the information, the NSA refused. The degree to which they are obsessively paranoid can not be overstated. It's quite possible that they are very well aware of these weaknesses along with multitudes of others, but they will never say a word about it for fear that someone might figure out what they do.

<comment><USER7> This is possibly the most important comment on this thread.

</comment></comment></comment></comment><comment><USER8> I have a Customer who uses this equipment (the Vedeer-Root gauges that the article describes) in unattended fueling stations. They moved from dial-up modems in the stations to Internet connections a couple of years ago (to facilitate modern credit card processing) and, at that time, the vendor who handles the tank gauges asked me to forward a port through each of the the stations' firewalls to the gauge. The idea that I was going to terminate a VPN in each station and accept no unsolicited traffic from the Internet was completely foreign to them. With that in mind, I'm not at all surprised by what rapid7 is reporting here. It's likely that those IP addresses where they're finding tank gauges also have other targets (like video surveillance systems, environmental monitoring systems, automated fire suppression systems) receiving Internet traffic on forwarded ports, too.

<comment><USER9> This sort of thing happens everywhere. Grain dryers, wastewater treatment plants, etc.

You get industry-specific vendors that believe their solution is opaque to anyone that hasn't received their specific training and they run loose. The end-user doesn't care because their expert in [whatever automation] tells them it has a password or proprietary protocol and can't be accessed without a program that's only given to trusted (industry) insiders.

<comment><USER6> There are some great presentations on YouTube from the Chaos Communication Congress and similar conferences about the abyssmal security of PLC-controlled industry stuff, including prisons. It is exactly as you say. They think their systems are too obscure for anyone to figure out. Of course, they hire the cheapest talent they can find to bang the things together in the first place and constantly look for ways to cut staff and replace developers and security personnel with newer (cheaper) people all the time, so they never end up with anything of any significant complexity. Even many places that think their networks are airgapped turn out not to be. In one prison discussed during one talk I watched, the prison had a commissary or something run by McDonald's... someone had connected to the commissaries Internet connection giving the Internet a direct route into all the insecure systems controlling the prison.

</comment></comment></comment><comment><USER10> How do you do "responsible disclosure" of a multi-vendor multi-customer vulnerability like this, with vendors not from the IT industry (or at least they don't realize they are in that industry, heh), who almost surely have no easy way to contact them to report vulnerabilities.

Real question. Was this irresponsible disclosure? What should they have done? (Are those doing the disclosing risking criminal prosecution?). I don't know the answers.

</comment><comment><USER11> I've been kind of wondering what the business case for "internet of things" is for years, and now I realize. It's a modern SCADA. No more, no less.

<comment><USER12> There are a few different parts. I keep thinking about amazon, facebook and google's programmable infrastructures. Control needs to be secure, but data acquisition could be public. I can imagine a gas company that supports surge pricing like uber.

If all this stuff is visible as a web service, you can take a regular old programmer and optimize inventory and delivery schedules. I'm sure that happens now, but i'm not sure how sophisticated it is. There's probably some value in a car being able to access the octane rating and price of gas on fillup, which would update your phone with price and performance metrics. I think there's also an aspect of service discovery you're overlooking.

I guess the point is, the words "internet of things" are goofy and overused, but it implies being more pervasive, open and standardized than scada.

</comment></comment><comment><USER13> /r/netsec discussion: [https://www.reddit.com/r/netsec/comments/2te5h8/the_internet...](https://www.reddit.com/r/netsec/comments/2te5h8/the_internet_of_gas_station_tank_gauges_thousands/)

</comment><comment><USER14> Access to 3% of US gas station real time data should be enough to give you an edge in open markets. It might be enough to find mispriced stocks before earnings. Not that I'm suggesting anyone should do such a thing.

</comment><comment><USER15> shodanhq search: [http://www.shodanhq.com/search?q=INVENTORY+port%3A10001](http://www.shodanhq.com/search?q=INVENTORY+port%3A10001)

telnet, ctrl-A, I20100

</comment><comment><USER16> You wonder how many other internet connected things are exposed this way. I've always wondered if there are internet connected traffic light systems (I know most systems are ancient technology) are vulnerable in the same way.

<comment><USER17> They are. And some Wind Farms (windmill generators).

[http://shodanhq.com](http://shodanhq.com)

Here's a fun search: [http://www.shodanhq.com/search?q=Anonymous+access+granted](http://www.shodanhq.com/search?q=Anonymous+access+granted)

<comment><USER5> That looks like FTP-type sites? What's the point?

<comment><USER17> Sure, the link I had has FTP sites, with absolutely no login required.

What can you do with an FTP site? Host your own phishing site. Modify the owner's own webpages.

Related to this article: if you can narrow the addresses down to ones that also have these gas meters, then you can modify their website to say "Hey; free gas!" and mark their tanks as 'always full'.

The key take-away here is that there is a literal TON of unsecured sites and multiple ways that something bad could be done.

</comment></comment></comment></comment><comment><USER18> If this was only read-only access, it could be useful - especially in times of shortages.

</comment><comment><USER19> Fun fact: One of these stations can have almost 100,000 gallons of fuel in it. My cab driver this morning used to be a mechanical engineer working on gas stations in the US. Apparently modern filling stations typically have 2 (gasoline) or 3 (with diesel) 30,000 gallon tanks. The gauges by themselves might not be able to cause a big problem but I would hope anything that involved in the safety of the system is well-built.

</comment><comment><USER20> I think it's been like this for a long time. Before things like port scanning there was wardialing.

</comment><comment><USER21> Broken link. Redirects to [https://securitystreet.jive-mobile.com/#jive- document?conten...](https://securitystreet.jive-mobile.com/#jive- document?content=%2Fapi%2Fcore%2Fv2%2Fposts%2F6980) with a blank grey page.

<comment><AUTHOR> The problem seems to be on your side. Maybe check your browser plugins ?

      Request Method:GET https://community.rapid7.com/community/infosec/blog/2015/01/22/the-internet-of-gas-station-tank-gauges?hn-repost
      Status Code:200 OK

<comment><USER22> The ?hn-repost seems especially brazen. And indeed the submission history shows it was posted 5 days ago and received 2 points.

Timing, a better title, or both?

<comment><AUTHOR> Both I guess. A mail from @ycombinator.com asked me for a repost.

</comment></comment></comment></comment><comment><USER23> "...approximately 5,800 ATGs with TCP port 10001 exposed to the internet and no password set."

Are we talking about simple monitoring information here, or some kind of administrative access?

"In our opinion, remote access to the control port of an ATG could provide an attacker with the ability to reconfigure alarm thresholds, reset the system, and otherwise disrupt the operation of the fuel tank."

Remote access to a control port would indeed conceivably allow these activities, no "in our opinion" required. But you haven't told me whether this is indeed remote access to a control port.

Also, the ISP pie graph just looks like a typical distribution of customers across ISPs. How useful is this supposed to be?

<comment><USER24> Well, the docs for these things are online and there are hundreds of opcodes. Some are less benign than "inventory status". One hopes that any of the "S" opcodes ("set" as opposed to "inquire" or "I" opcodes) are protected by the " System RS-232 Security Code", but I'm not about to try to find out.

<comment><USER25> One would also hope that the System RS-232 Security Code is actually unique to each device and is not simply specified in a manual somewhere.

<comment><USER10> I'm guessing the "Systems RS-232 Security Code" is a 4-digit numeric PIN, or at any rate a fairly low-entropy password normally, and that there is absolutely no rate-limiting or monitoring or other guard against a live brute force attack.

It looks like the documentation's been taken down from the URL included in the OP. I'm sure it's available elsewhere, but I haven't tried to find it.

</comment></comment></comment></comment><comment><USER26> And now we wait...

While I like stuff like this, it's basically an open invitation to start messing about.

</comment><comment><USER27> The world of SCADA is terribly insecure, and has been pretty much ever since the leased lines got replaced by internet connections to save some costs.

If 'the terrorists' really would like to do damage this would be an excellent target.

</comment><comment><USER28> The pie charts remind me of this article:

[http://www.businessinsider.com/pie-charts-are-the- worst-2013...](http://www.businessinsider.com/pie-charts-are-the-worst-2013-6)

</comment><comment><USER29> Seems irresponsible to release this publicly.

<comment><USER30> How else do you get these people to change? We're not talking about a problem at a single company here. It's a wide spread issue of people apparently being either unaware or just not caring enough about security.

A well-connected industry insider may be able to get things moving. But if industry insider exist who care enough, why hasn't this been fixed a long time ago?

For an outsider, bringing the issue up in public is probably the most effective way to get this fixed. And it's not like they published a script to exploit this.

<comment> irq-1 Obama just doubled-down on the CFAA; our government and society doesn't want to know, and they don't care about 'the most effective way to get this fixed.'

</comment></comment></comment><comment><USER31> I was in on a conference call last week where they said there are currently no crypto protocols which are safe and effective for small footprint iot applications. Of course the NSA is trying to fast track not one but two new ciphers for this application.

<comment><USER32> I don't totally buy that conclusion. Yes, you won't get any useful security on an Arduino, but there are plenty of small footprint devices that will do full TLS. I'm using TI's CC3200 right now with TLS 1.2 using ECDHE_RSA_WITH_AES_256_CBC_SHA to connect to our APIs and this thing is just a Cortex M3 doing all the crypto. (There's probably AES accelerator, but I doubt there is any hardware doing the PKI stuff.)

I mean, sure, it's a more expensive chip, it's two ARM cores plus a WiFi MAC in a single package, but it's pretty much all the computing and connectivity you would need for a normal iot kind of application in a less than 1 cm^2.

</comment></comment><comment><USER33> I once wrote software for a Gilbarco gas station pump, basically a "next gen" model of the kind used by ordinary folks all across the country daily. I too was surprised then by how much Internet related tech we were expected to use and interface with. (I was not the overall architect. And I saw the practical advantages of those choices.)

Let's just say I could smell the security holes.</comment>