Hacker News Reader

Comment by Mandatum | Hacker News Reader

How does the requirements NDA thingy work? Does every single tester/bidder need to sign an NDA? At what point of the process does the NDA need to be signed?

I feel a little uncomfortable signing an NDA unless the work has been outlined and the work is to begin.

Also I think you're really cutting out a significant portion of the market with LinkedIn requirements. I understand it's probably needed to filter the plebs, but you should probably allow for an alternative sign-up approach (ie combination of phone verification, require business email, etc).

Altogether very cool! I'm trying to get into InfoSec myself. Good to see innovation in the industry!

View on HN

The NDA is mutual. It might say 'company x failed our pic-audit, we need help fast'. It guarantees we keep that secret but use that info to find the right match.

Also on the pen test side, we wont't say vendor C put in a $10k bid, you should put one in at $9k. It just means we value trust and privacy, as everyone in the security field should. Testers would also sign an NDA when they take a job, so that they won't leak things they learned in confidence.

> The NDA is mutual. It might say 'company x failed our pic-audit, we need help fast'. It guarantees we keep that secret but use that info to find the right match.

Sorry, I'm not sure I exactly understand that. ELI5?

1 Way NDA: Let's have an open honest conversation, but as you signed MY NDA, written in MY favor then: I CAN tell everyone about YOUR secrets, but you CANNOT tell anyone about my secrets

2 Way NDA (also called Mutual NDA):Let's have an open honest conversation, and as you signed MY NDA, written in neither party's favor then: I CANNOT tell anyone about YOUR secrets, and you CANNOT tell anyone about my secrets. It enables honest dialogs.

TLDR>> 1 Way NDA's suck

The LinkedIn approach is to validate people are who they say they are. We have a number of people who have very limited LinkedIn profiles, and some that have 'skeleton profiles'. Once you authenticate the profile you fill out is only seen by us for the purpose of finding you work. We take the 'stealth' very seriously. We also didn't want to store people's creds.

Reply on news.ycombinator.com