Hacking Developer Auction

http://developerauctionhacker.pen.io/

by kanzure • 13 years ago

23 5 13 years ago

developerauctionhacker.pen.io

justinlloyd3• 13 years ago

This usage of the word "hacking" is obviously one I haven't heard before - you put a tracking pixel in your profile so you could log who viewed your auction. You probably got busted because you used getclicky. I put tracking on my auction profile, but it would be an elastic stretch for me to say "I hacked the auction" by monitoring the IP addresses viewing my profile.

But for the rest that you say, I agree, DeveloperAuction have an interesting premise, but you cannot draw any conclusions from any profile traffic you get.

I will add one more observation to the discussion, I found the entire DeveloperAuction process completely opaque and thoroughly mystifying. You touched on this in your write-up; What about avatar? What about headline? Does location matter? Who viewed the profile? What did they like or not? More feedback to the people being made offers would be immensely helpful.

I agree, the fakey profile on the front-page was annoying and could be construed misleading.

On the last day of the auction I appended this text to my profile:

Well, it has been an interesting two weeks. Not one single offer. Guess I am not what the start-ups signed up for DeveloperAuction's services are looking for. Can't be that many people around looking for a CTO.

I embedded some basic analytics in this profile, and set up a script to track the general location of the computer being used to view the profile and send an SMS to my phone each time someone viewed the profile, including their general location.

I wrote a script that would cross-reference AngelList's database of companies with the IP addresses used to view my profile. There were a few weird hits, people logging in from home and local coffee shops, but for the most part, I was able to nail down most of the companies that showed up to look. A couple of home addresses, including one of a VC who lives at a winery in Northern California. Very easy to track through LinkedIn and a quick Google search.

This profile was viewed a total of 51 times between 00:01 on 4/22 and 11:59PM on 5/3. The IP addresses (obscured to protect identity) that viewed the profile were:

    199.87.84.X,03/May/2013
    166.137.191.X,04/May/2013
    174.76.140.X,22/Apr/2013
    38.104.230.X,22/Apr/2013
    199.21.85.X,22/Apr/2013
    24.5.70.X,22/Apr/2013
    199.47.77.X,22/Apr/2013
    199.241.200.X,22/Apr/2013
    206.214.33.X,22/Apr/2013
    216.231.9.X,22/Apr/2013
    216.55.3.X,22/Apr/2013
    173.13.174.X,22/Apr/2013
    96.229.22.X,22/Apr/2013
    96.229.22.X,22/Apr/2013
    216.231.9.X,22/Apr/2013
    98.155.87.X,22/Apr/2013
    99.89.1.X,23/Apr/2013
    174.76.140.X,23/Apr/2013
    152.179.69.X,23/Apr/2013
    12.201.135.X,23/Apr/2013
    50.1.62.X,23/Apr/2013
    173.228.28.X,24/Apr/2013
    50.193.52.X,24/Apr/2013
    69.170.175.X,24/Apr/2013
    199.47.72.X,24/Apr/2013
    67.53.126.X,24/Apr/2013
    74.62.176.X,24/Apr/2013
    74.73.226.X,24/Apr/2013
    64.88.170.X,25/Apr/2013
    98.210.198.X,26/Apr/2013
    208.90.212.X,26/Apr/2013
    208.90.212.X,26/Apr/2013
    208.90.212.X,26/Apr/2013
    208.90.212.X,26/Apr/2013
    208.90.212.X,26/Apr/2013
    208.90.212.X,26/Apr/2013
    50.1.107.X,26/Apr/2013
    24.7.16.X,27/Apr/2013
    76.175.77.X,29/Apr/2013
    76.110.232.X,29/Apr/2013
    166.147.88.X,29/Apr/2013
    67.52.152.X,29/Apr/2013
    208.87.61.X,29/Apr/2013
    209.119.30.X,29/Apr/2013
    208.54.4.X,30/Apr/2013
    216.55.31.X,30/Apr/2013
    207.34.40.5,30/Apr/2013
    198.228.216.X,30/Apr/2013
    12.177.140.X,01/May/2013
    173.247.201.X,01/May/2013
    173.228.89.X,02/May/2013

I created a simple script that would grab the log files from my web server, locate the IP address of computers that viewed my profile -- because they would have downloaded an image when the user looked at the profile -- and then cross-referenced the ICBM address of the visiting IP with the ICBM addresses of each company in AngelList that was 1. Hiring for a technical position and 2. Had a listed address within 1,000 metres of the IP address and then plot a confidence factor on a Google Map view of which companies had come back to pay me a visit and upload the image to imgur so I could be alerted on my Android phone.

    rem first we download the log files from my web server
    wget --user=XXXX --password=XXXX -O access.log "ftp://otakunozoku.com/statistics/logs/access_log"
    wget --user=XXXX --password=XXXX -O processed.log "ftp://otakunozoku.com/statistics/logs/access_log.processed"

    rem process the log files, remove my two known ip addresses, split up the output in to ip address and date
    rem should use "tee" here with process substitution but we cannot do that on bash in Windows, so instead, we use a temporary file
    rem this is what we should use: grep -h -i "itunes_link" *.log | grep -v -E "98\.154\.169\.XXXX|71\.165\.193\.XXXX|70\.36\.57\.XXXX" | awk -v OFS="," "{print $1, substr($4,2,11), substr($4,5,3),substr($4,2,2)}" | tee >(gsort -t , -k 3,3 -k 4,4 hits.csv > date_order_hits.csv) >(gsort hits.csv > ip_order_hits.csv)
    rem instead, we use these three lines:
    grep -h -i "itunes_link" *.log | grep -v -E "98\.154\.169\.XXXX|71\.165\.XXXX\.131|70\.36\.57\.XXXX" | awk -v OFS="," "{print $1, substr($4,2,11), substr($4,5,3),substr($4,2,2)}" > hits.csv
    gsort -t , -k 3,3 -k 4,4 hits.csv > date_order_hits.csv
    gsort hits.csv > ip_order_hits.csv

    rem geolocate all those ip addresses
    del geolocate.xml
    awk -F, "{print \"http://freegeoip.net/xml/\"$1}" ip_order_hits.csv | xargs curl $0 >> geolocate.xml

    rem look up those geolocations on google maps and save the addresses
    rem damnit, never could get sed to generate the proper formatting, just had to run it through gawk in the end
    del addresses.txt
    sed -r -n -e "/<Latitude>/ { N; s/<Latitude>//; s/<\/Latitude>/,/; s/<Longitude>//; s/<\/Longitude>//; s/\n//; s/ //g; p}" geolocate.xml | gawk -F, "{ print \"http://maps.googleapis.com/maps/api/geocode/xml?latlng=\" $1 \",\" $2 \"^&sensor=false\"}" | xargs curl >> addresses.txt

    rem go to angel list REST interface and pull in all companies
    curl ... > all_startups.txt [what? you expect me to supply these commands so you can do the same?]

    rem extract the company addresses and geolocate them
    awk ... | xargs curl $0 > located_addresses.txt

    rem filter companies that are within 1,000 metres of each IP address
    rem get all of the jobs for each filtered company that matches an IP address
    curl ... | sed ... | grep ... > 

    rem remove all companies that are not hiring for a technical position
    awk ... | grep > hiring.txt

    rem cross-reference the geolocation of each angel list company that is hiring for a technical position with each companies' IP geolocation data
    rem plot the locations on a google map with the names of each company and a confidence percentage of who they might be, send the image to imgur
    comb -i -v located_addresses.txt hiring.txt addresses.txt | r conf.r | googplot ... mapped.png | curl -k "mykey=[my imgur api key]&image=mapped.png" http://api.imgur.com/2/upload.xml

Some Of The Addresses That Visited

removed street numbers to protect privacy

    Cottonwood Court, Hillsborough, CA 94010, USA
    Skyfarm, Hillsborough, CA 94010, USA
    Pierce Road, Cupertino, CA 95014, USA
    East Main Street, Grand Prairie, TX 75050, USA
    South Santa Fe Avenue, Vista, CA 92084, USA
    Northwest 120th Street, Potwin, KS 67123, USA
    Stevens Creek Boulevard, Cupertino, CA 95014, USA
    De Anza & Stevens Creek, Cupertino, CA 95014, USA
    Cowper Street, Palo Alto, CA 94301, USA
    Castro Street, Mountain View, CA 94040, USA
    El Camino & Castro, Mountain View, CA 94040, USA
    Old Mountain View, Mountain View, CA, USA
    Nelson Rising Lane, San Francisco, CA 94158, USA
    Mission Bay, San Francisco, CA, USA
    South of Market, San Francisco, CA, USA
    Anacapa Street, Santa Barbara, CA 93101, USA
    3rd Avenue, New York, NY 10003, USA
    Natoma Street, San Francisco, CA 94103, USA
    Slater Avenue, Fountain Valley, CA 92708, USA
    West 17th Street, New York, NY 10011, USA
    West 1st Street, Los Angeles, CA 90012, USA
    South Van Ness Avenue, San Francisco, CA 94110, USA

List Of Companies That Viewed My Profile? Yeah, let's keep that between me and the companies...

kanzure2• 13 years ago

Thank you, your analysis is really compelling and matches what I've seen. It's good to have some realistic numbers about what Developer Auction is offering for talent. What really boggles me is that Developer Auction has an entirely separate hiring track for growing their own team. They don't trust their own vetting process, and instead put candidates through an entirely different screening process. I don't understand this yet.

Their offering to talented developers seems to be somewhat limited. Basically you sign up, spend a while writing out a huge profile (in addition to your resume and public work on github), then they just dump you into the laps of recruiters as part of their normal hiring pipeline. Hey, if I wanted to sit around doing 15 hours of live algorithm screening, I would have just called those companies myself...

This is probably okay for junior developers, but realistically junior developers just need to have a pulse to get hired (and maybe one or two sample projects). As for senior talent, there's few incentives to participate in these antics. Same antics, different names. I got a bunch of offers, but they require a great deal of effort to follow up on everyone and schedule a billion interviews and screens and other things that I am frankly exhausted by.

I would love something like a 1-hour guarantee: receive an initial offer to see if the range is what you have in mind, spend exactly one hour talking with a company before receiving an actual truly real sign-on-the-dotted-line offer. I am just frustrated about the marketing I think, I'll feel better in an hour.

> You probably got busted because you used getclicky.

I got busted because they found me bitbanging some urls. :) Btw, your self-improvement focus is interesting. I often tell people that the most immediately empowering tool they can pick up is programming. After that, there's other projects worth pursuing (both realistic and hypothetical): http://diyhpl.us/wiki/declaration anyway, might not be up your street..

... wtf? you use rgbds? There's only like 10 of us in existence. I use it here: https://github.com/kanzure/pokecrystal

justinlloyd3• 13 years ago

Yeah, I was miffed and mystified by the whole process. Excited to participate but annoyed by the sheer opacity of the pipeline. You're experience went a little further than mine, I got no offers. Ah, what a blow to the ego. ;-)

Regarding the banging on URLs: I don't know if they are becoming more sensitive to that. I did a little digging around via various URLs but never got cautioned on it. You may have gotten a little deeper in to it, or you touched a raw nerve that I didn't stumble upon. :)

I was surprised by how few companies actually viewed my profile. They provide the list at the end of the auction and it was interesting to see how it matched up with my own. Philosophically you have to look at it through a cautionary lens:

How many companies do they have on their list?

How many companies do they have on their list are hiring for a technical position right now?

How many companies do they have on their list are hiring for a technical position right now and looking for the skills I have?

How many companies do they have on their list are hiring for a technical position right now and looking for the skills I have are hiring at the level I am at?

How many companies do they have on their list are hiring for a technical position right now and looking for the skills I have are hiring at the level I am at and making a realistic offer?

I also noted that DeveloperAuction uses Craigslist and LinkedIn to hire their own programmers. Obviously their pipeline is broken or not mature enough and they aren't eating their own dog food.

I sympathise on being dumped in to other companies' generic hiring pipelines once the auction is over. That is a huge disconnect between promises made and the cold, reality of finally getting to a real, sign on the dotted line offer.

Agreed on the Junior developers. There is a fallacy about the tech talent shortage. If you are young, naive, willing to be overworked and underpaid then $100K is a lot of money when you're straight out of college and the only two things you are worried about is whether you will ever have a girlfriend and how much longer can you defer your student loans for.

I think there's only a shortage of tech talent at the lower levels where the machine that has been created by SV and its ilk cannot feed it fast enough with warm, young bodies (that sounds wrong somehow, but you know what I mean.) But this is a discussion for another time and another thread.

The hiring process and pipeline is definitely broken. It is exhausting to go through each company, follow-up, schedule interviews, take time away from work. I am ramping up my “looking for work” efforts right now in anticipation that the start-up I am co-founder of runs out of runway before it can take off. “Dig your well before your thirsty.”

The code on github is never looked at. Not by the “technical recruiters,” not by the hiring managers, not by the engineers and so on. I have sat in an interview and been asked point blank, by the same group of people gathered at once, “do you still code?” “Can you write software?” “Have you ever worked on OpenSource?” and then been told at the end that they felt I “didn’t code enough on a weekly basis to make a significant contribution.” You stand there with your mouth agape at the sheer, unadulterated willful ignorance and lackadaisical interviewing attitude of people some days.

I co-authored slash maintained RGBDS for about 8 years until retiring from active development. During the golden years of GB/GBC/GG development it was the tool to use.

Hacking Developer Auction

Related Stories