Hacker News Reader

In my experience hiring and then seeing how people perform over time I've roughly concluded that during screening / interviewing absence of a degree is not a negative signal (can be positive), but presence of certifications has consistently been a strong negative signal.

I know there are a few areas in which they are seemingly unavoidable, i.e. government, military, financial. But if I see certifications on a profile I am interested in and I believe we have a role that matches what the person is looking to do, then I will use the more unscripted part of the interview to go to first principles and test the foundations of CompSci understanding with far fewer buzzwords.

Too true. If I see MSCE on the bloody thing, it’s to the bin or I’m going to waste my next fifteen minutes

I did an MCSE in the nineties. It helped me round out my knowledge of the Microsoft products I was working with at the time. It also helped me to dig out of a career rut I was stuck in.

This was before all the bootcamps arrived but even then I wouldn't completely dismiss it.

Yea, back in the 90s MCSE was a better investment and was actually a good way to get hired. I know lots of successful IT people today who got their first 'real' IT job thanks to earning their MCSE. Today I don't think they have the same value.

It's not about whether you did the certification or not. The question is, do you put it on your resume?

>The question is, do you put it on your resume?

That isn't really the question because I haven't written a resume since 1992.

That’s the point.

The only good reason I can see for getting those certs is that it's a far easier path to remaining certified as a Microsoft Partner, and that's quite an enormous deal as far as software licenses, Azure credits, MSDN access, and other bennies.

When hiring I never look for a degree. Of the dozens of employees over the years in my departments I could not say who had a degree and who hadn't.

Some very sharp networking engineers that I've worked with did hold a CCNP or higher certificate. They are not necessarily a bad indicator, but not a sure shot confirmation of ability either.

Certifications were the MOCs of their day. They were good for motivating and organizing your study of a topic. Unfortunately, while MOCs tend to stick to knowledge with proven value, certifications indoctrinate you into the ideas underlying the issuing company's technology, even if it is dubious and unproven. For instance, at the turn of the century, Sun's programming certifications were all about their Java Enterprise ideas that now we're all quite happy to have left behind. I took the Java Certified Web Developer exam way back in 2001 or so, and while it did cover fundamentals of HTTP and cookies and a little bit of the state of web security for the time, most of it was about Sun's ridiculous (in hindsight) web technologies like JSP.

The way the content of the exams came about was, Sun's super smart engineers thought really hard about questions like, "How can we build enterprise-scale software predictably and reliably in the future?" They came up with some ideas that seemed self-evidently true, turned them into a design orthodoxy, built massive technologies and frameworks to enable/enforce them, launched it with a tidal wave of marketing that is hard to imagine now, published hundreds of pounds of books, and created a system of certification exams all before getting enough experience with the technology to realize, "Gosh, we thought this would be a good way to build enterprise systems, but it really isn't." If you got a Java enterprise certification around the year 2000, it largely consisted of indoctrination into ideas that were about to be tossed into the dustbin of history.

At the time, I would have taken any job I got, and getting more Sun certifications like their Enterprise Architect certification (which meant you could explain why EBJ 1 was a really great idea) seemed like a good way to make myself more employable, but luckily for me, shortly after completing the Web Developer certification I got a job unrelated to enterprise Java, and I escaped further investment in that world.

Somewhere in here, there's a general (not-just-computer-science) lesson to be learned about certifications and hierarchies owned by private corporations vs. those owned by the people who work and have a place in them.

anyone doing consulting is pretty much required to do certs. If you want to be a Amazon/Google/Microsoft partner you have to have a pretty high number of certified employees, and you need to be a partner to get most of the work in the field.

cheating is definitely rampant. I find that when trying to find study material for exams, half the search results are exam dumps

Not really my field, so wasn't aware of this. What certs are they typically looking for partners to have?

And I do see it from their point of view: certs are a low-effort (on their part) way to weed out obvious frauds and scam businesses. They're borderline useless, but are at least indicative of effort.

For a company to be a Platinum Partner you'd need so many points, and the points are calculated by looking at how many of your people have which certs. Which certs were needed varied on which company you wanted to partner with. Microsoft and Cisco were the most common I saw.

I earned my Network+ cert last year for a DoD contracting gig. It was kind of nice to learn a few more port numbers, but wow: hours and hours of drilling cable standards and telco protocols from the 1990s, fiber optic connectors, servers to authenticate users dialing into a modem pool, and their official steps to troubleshoot a problem. This was for web development work, but it was basically the only cert they'd accept unless I wanted to learn SAP. And it was all just flash card knowledge. I still couldn't set up a RADIUS server.

In school I was very idealistic about learning: prioritizing understanding over grades---even a bit to my detriment. But forcing me to do pointless learning sure brought out my cynic.

In one Sherlock Holmes story, Watson is appalled to learn that Holmes still thinks the sun revolves around the Earth. But Holmes resents this new fact. It clutters up his well-organized memory with useless trivia. He tells Watson he can't wait to forget it as soon as possible. I'm as eager as Holmes to forget all I learned. It kind of shakes my identity to see myself thinking that way.

And it turns out the cert is only good for 3 years. Then I need to do it all over again. Or write 20 blog posts about networking and get them approved (for a fee I believe). I wonder if this explains some of the dumb tech blogs I see.

Like others here, I've always felt certs were a more negative signal than positive. Mine is on my resume for now, but I'm a little embarrassed by it---how crazy is that?

> certs were a more negative signal than positive

Which represents a real conundrum for job-seekers: you never know if you're talking to somebody who think certs are required, or somebody who thinks that lack of certs is required.

If you're going to continue the government contracting route, know that government agencies (not just DoD) love certs.

Have never done Network+ but I did another similar one that allowed a short (maybe 1-2 hour) refresher course to renew after the 3 years, and I didn't have to go through the whole test again.

I was also told to get CISSP for my current job. It consisted of a week-long class of a guy explaining "American Exam Culture" to us Europeans and practicing exam questions. Then made the exam, bunch of multiple-choice questions where you could guess most of them. Learned basically nothing and now they e-mail me asking for $35 or else I won't be allowed to call myself CISSP anymore, lol.

These things are a racket. Mostly for the companies making the test but below them there's also the whole ecosystem of business trainings, people selling "exam guides", private tutoring and what not. It's very close to a pyramid scheme.

That being said, my trainings from SANS where useful but wildly expensive. The most fun were trainings by Offensive Security such as OSCP. Good luck passing that one with just a few exam trainings.

I find amusing the fractal nature of the universe: we say that some problems are complex (i.e NP-Hard) because no matter the algorithm you design I can devise a problem instance that will take exponential time for your algorithm (informal explanation). Clearly designing metrics for human is even worse: no matter the metric, people will find a way not only to make it hard to measure, but to make the metric fail. Which takes me to the following strengthening of the Turing test:

A true AI will not only pass the Turing test, it will do so by cheating.

Ironically, cheating on exams gives the cheater a form of "artificial intelligence".

I know you stated that's it's informal explanation, but please don't conflate nondeterministic-polynomial with non-polynomial.

I have a proof that NP(Non Deterministic Polynomial)-Hard = Non Polynomial, but it's too long for a HN comment

A link is never too long for a HN comment

If you don't care about IE and Edge compatibility a link can be too long for an HN comment.

Well then I'd recommend using a URL shortener

That raises the question of how long a link the URL shorteners can handle.

The HTTP specs places no limit on URL length. All the specs say is that browsers have finite limits and recommend that everything that transmits or receives URLs allows at least 8000 characters.

A bit of Googling suggests that Chrome can handle URLs of up to 2 MB, Safari 80K, and Firefox somewhere above 64K.

I can't find anything on how long a URL that the popular shorteners can handle.

That gave me an interesting idea.

A URL shortener as a method of data exchange.

The data URI spec does not define a size limit but says applications may impose their own.

Chrome - 2MB for the current document. Otherwise the limit is the in-memory storage limit for arbitrary blobs: if x64 and NOT ChromeOS or Android, then 2GB; otherwise, total_physical_memory / 5 (source). Firefox - unlimited IE ≥ 9 & Edge - 4GB

You also could use blob URLs, which have a 500Mb limit.

An example: 1. Alice constructs a data url with the base64 encoding of a zipped and encrypted document, submits it to her favorite URL shortener and gets a short URL back. 2. Alice transmits the short URL to Bob, perhaps as metadata in an cryptocurrency transaction. 3. Bob receives the short URL, navigates to it in a modern browser and extracts the data.

This is not anonymous unless the shortener is guaranteed anonymous, which it won't be.

I already built a good bit of that: https://thoughts.willcipriano.com/podjeli-a-new-way-to-share...

I used to leave myself messages or short text snippets by requesting a nonexistent page on my website and adding the text as a GET query in the URL. I had my log autorotation set to email me logs after a day or two. So later in the week, when I wanted to retrieve the information, I could just search my email for the name of the nonexistent page, and the text would show up in the relevant access.log. It worked okay for what I needed and aside from the log setup (or grep'ing the apache logs) required no code.

then link it...

I am attaching a file that contains a detailed explanation.[1]

[1] thatsthejoke.jpg

I have been had it seems

(I enjoyed the pun) On the right is the margin that was too small to contain Fermat's alleged proof of his "last theorem".

https://en.wikipedia.org/wiki/Fermat%27s_Last_Theorem

Something about dry humor and HN comments just hits different. Well-played :)

So many commenters who don't know Fermat.

Kirk cheats because he does not accept no-win scenarios :-) https://youtu.be/qs0J2F3ErMc

I didn't see any certification bearer selling themselves as "experts", rather as a way to tell they know the basics - a way to compensate for lack of basic experience. On the other hand, with only little experience in a domain (let's say one project) there's no way you'd cover an entire curriculum, that's why for me a short experience is roughly equivalent to a certification exam. And even if you memorized a dump, that's a dump of answers to real world questions which you know now by heart, which is exactly the point of the exam. This goes for basic-level certifications. The "advanced" certifications are a different story - they must be doubled anyway with long time practical experience, so for those I see little value in cheating: if you tell me you're an advanced XYZ yet can't back that up with year(s) of project experience, sorry dear you took the exam (be it for good or from a dump) for exactly naught.

> The typical approach, apparently, is to acquire a "dump," which is the bank of actual questions, and then repeatedly take "practice exams" so that they've already seen (and memorized) all of the questions that they might encounter during the actual exam. So, blatant cheating.

Interestingly, when I decided to get a ham license, the method you describe as cheating is precisely how every single person and resource recommended preparing for the exam.

I find it fascinating that certs are seen as so important in the military. I work for a Fortune 500 company and we care nothing for certifications. We don’t even really care about education (unless you are applying for an internship or first job out of college). Real life work experience is all that matters. When I look at a resume and see a bunch of certificates listed, it makes me suspicious that they are trying to disguise lack of ability with multiple choice tests. But, that mostly comes back to not having any faith in certificates.

Yeah, but the difference I believe is the FCC publishes the entire question pools to prevent third parties from selling a "dump".

Ideally the pools are far larger than the questions you'd receive on the actual exam so trying to memorize the right answers is actually harder than engaging with the material. These test providers could do the same thing. They should expand their test pools to be extremely large by tweaking the values in each question so that one Q becomes 10.

Prior to the federal government publishing question pools (I believe FAA does too), testing groups would send in folks to sit for the exam, memorize the questions then run outside and record what they saw. Do that enough times and the question pools emerged in their records and then they grew a big business selling that "dump".

I can't imagine managing large question pools manually, but with digital tools it's become trivial in edtech circles. Why these test providers don't end it is beyond me. (Probably because the federal "cert" game status quo is plenty lucrative.)

You could have legit indicators of ability on your resume and you'll get a technical interview anyway. People are being just as suspicious of certs as they are prior experience. No one really trusts resumes at all, so it makes cert trustworthiness kind of moot.

I disagree it's cheating though. Cheating is clearly defined by the exam condition, which are stupid (one time test rather than result evaluation but heh, it s a compromise).

We had this debate between dev in my company because the execs want to see everyone certified for the cloud provider they spent millions choosing without asking us, fine.

So myself I did it the hard way, spent 20 hours studying for this things, preparing for the exam, building little things to make sure I got it, to a point I feel really a lot less noob on the thing and actually start buying into it. I passed with flying color and it took me a quarter of the alloted time at the exam, fine.

But I have colleagues who just asked me what bank was the closest to what I saw at the exam, tried and only studied where they failed, some barely passed, some barely failed, and I insist each time it s better to have a holistic theoretical understanding rather than just a quick practice run but are they worst colleagues ? Some have kids, some are my managers, some are so humiliated to have to be revalidated as competent, they just cant enjoy it. They dont cheat, they do the absolute minimum to get a grade and move on.

And I challenge you to tell you never did that in your entire studying life. I remember a class of compilation theory when I was 19 that I studied the 5 hours before, and forgot 5 hours later to get a 45% grade that still passed my year and fine. Did I cheat? Hell no, but I was lazy and did the bare tolerable minimum.

But, should we certify people in IT like that, I think your manager and your team and your clients already know what you're worth, so I agree it s pointless.

> We had this debate between dev in my company because the execs want to see everyone certified for the cloud provider they spent millions choosing without asking us, fine.

I've heard of something similar.

One of the employee suggested that he didn't need the cert. This really didn't sit well with management. Then he explained why: his previous job was on the team building said cloud product they decided to use. That was the reason he got hired.

Useless to say he didn't work there long.

Ah that's cool :D Me all I could say was "but I spent years deploying in aws when you chose another one when everyone told you not to and nobody s using it because nobody needs it, not because we're not certified". I was met with "you need to get the cert by end of the year", which I got the next week, my eyes rolled the entire time. At least I got to impress people... like I say my colleagues all the time, the best bosses are those who care about useless metrics because they're easy to meet and you dont have to actually deliver anything of value to get praise and raise...

That's antithetical to how the computer security industry should work -- arbitrary certifications don't guarantee compliance or security, at best they suggest it.

To me, this feels like the same problem as OKRs in an organization. When your goal for success is a high score on the exams for a job rather than the ability to do the job, folks will optimize for the high score on the exam. Setting hard goals that determine success will determine where folks spend their time. Along those same lines, I don't see this as a problem for third party entities like CompTIA/(ISC)2/ISACA/Cisco/Etc to fix, but rather poor management and expectations of employees.

OKRs and certificates aren't bad, they just need to measure the objective value to the organization as opposed to arbitrary standards (such as you must have X certificate to work here, or increasing pay based on certs earned).

Those tests mentioned above can be useful litmus tests for folks in the recruiting space to sort through candidates, especially if they have a large number of applicants, but I worry that it excludes folks that could otherwise be very good at the job/role.

I agree completely and I think we should move to a project based way of learning.

Stupid example: You build a rocket, fly it, write how you did it. That demonstrates a certain understanding of physics as

If I want to require an understanding of basic physics I can require people to have done a project which satisfy that requirement.

I've been doing something similar for hiring junior engineers and how well they perform creating a project is the single most important factor to forecast their work performance. No leetcode required.

Assessing that is tough and often doesn't scale well though.

> That's antithetical to how the computer security industry should work -- arbitrary certifications don't guarantee compliance or security, at best they suggest it.

On the other hand, it is how computer security often does work. I can't count the number of times I've had to go through a listing of false-positive flags from some braindead OWASP checklist penetration/vulnerability tester.

Same goes for financial industry regulatory exams. Very little actual learning, a lot of remembering stupid stuff. It's no wonder people want to cheat.

I've also done network stuff, it's quite a lot more technical. But in the end it's still a silly thing to do multiple choice for. Debugging a network is a skill that's hard to boil down to that kind of exam, though to be fair they do show you how in the courses.

I will say that CCNA (taken in 2019) was the most legitimate of these exams. There were a handful of "simulator" questions that involved actually typing some commands into a Cisco IOS switch or router to change the configuration as appropriate. So that required a deeper understanding and forced test-takers to demonstrate what they might need to do on the job as a network technician. However, CCNA also seemed to be one of the exams for which it was easiest to find a "dump" including "practice simulators" taken straight from the real exam.

Yeah I actually used the CCNA simulators for a lot of things early on before things clicked. It's just very hard to examine for in a way that isn't easy to cheat and demonstrates real understanding. After all in the real world every problem has its own quirks.

I did the college CNNA courses and one test was to fix a broken network (using real hardware).

There is no substitute for hands on with real hardware.

Yes, the Cisco certs seem to have a relatively good reputation. I think the higher ones even involve (or at least did) stages where the test-taker spends half a day setting something up, then an instructor breaks it and they have to fix it again. On the other hand, people there complain about the recertification requirements - it's quite a bit of effort to repeat every few years, so unless you're strictly required by an employer or customer to maintain them many let it lapse.

Warning: tangentially related rant!

> The typical approach, apparently, is to acquire a "dump," which is the bank of actual questions, and then repeatedly take "practice exams" so that they've already seen (and memorized) all of the questions that they might encounter during the actual exam. So, blatant cheating.

Children I know in UK high schools (12-18) are being "educated" solely in this manner that you describe as cheating.

I don't think you're wrong.

Basically, the "teacher" gives them past exam questions to do right from the very start of a 5 year course. They never get any reference books (nor online equivalents), they're not taught the subject matter, only taught how to answer the exam questions. It's diabolical but what passes for state education at the moment.

To clarify, I have no problem with practising on past exam questions but you need to actually educate people before you ask them to answer questions on the material.

That happens in the US as well. Its because they use the test scores as a measurement which weigh heavily in decision making regarding teacher retention and promotion. Some teachers hand out the answer sheet 15min prior to a test for the kids to review.

There's a common pattern where in low-performing schools, the kids test above average at the lower levels and then fall off a cliff. This is exactly why: young kids (K-2) are great at memorizing. But if the only skill they learn is memorizing, their ability to extend this as they progress fails. It was startling how much the kids I encountered when I taught math (to high school kids and to college kids who were essentially taking junior high/high school math classes) still relied on memorization and pattern matching. I did what I could to break them of the habits but there's only so much you can do, especially in the post-secondary context where you get 45 hours of instruction time (less time for exams) in the course of a semester.

For a different perspective on certifications, I just got my CKA cert from the Linux Foundation, and that test is legit: all simulation, no multiple choice. They use a full test cluster, backed by killer.sh, and every question involves some legitimate shell skills in addition to knowing k8s backwards and forwards. I was so impressed by the level of work that was put into the testing. May go back and get the other two certs if company will pay for it and it makes sense.

Why do vendors insist on multiple choice? Red Hat solved this problems by making a Red Hat certifications practical exams. You can’t cram from brain dumps if you actually need to understand the content.

Multiple choice isn’t necessarily an indicator of poor quality. Most IQ tests, those administered by psychiatric supervision, are multiple choice intentionally looking for deviation and alignment through repetition and measured variation provided a long enough test. One of the cert exams I took, only one of them, looked for the exact same thing as a means to identify and fail crammers.

Agreed, but it's also going to face even more resistance. I was ok spending all this time on something I knew I could pass quick, but practical ? Damn if you want to do a real test, get into a job with a 3 months probation and your rent on the line and contribute to something that makes money and you're done.

All these certs stuff they re like uni, you know all they prove is very theoretical and you must have too some genius colleagues who can code amazing things but somehow never deliver and some messy dude who iteratively build the money printing software that pays for all this theory.

So, no better test than the client for me.

I see “good certs” done by a truthful person shows me that a person can complete something, and they have the shared vocabulary to start understanding how that cert knowledge fits into their actual job.

Im always surprised at the lack of follow through I see at so many levels.

Certifications for me have always been a negative signal for people that we might hire for startups. I have no idea how that affects folks that want to work for well established companies. It seems like below CIO it might be required for most enterprise IT organizations.

I work as a consultant. I'm certified on some GCP stuff.

Work pays us to study, take the exam and even pays a bonus if we pass.

Am I smarter as a result of that exam? No. But I'm easier to sell. Some clients ask directly for certifications, others ask leading questions to our sales people I think.

Would i put my certifications on every variation of my CV for any job I apply for? Probably no.

While I'm at it: Someone else here writes about instantly rejecting people because of shibbolets like certifications.

I'm fairly smart, well liked by colleagues and very well liked by customers. However I have been dumped in screening I don't know how many times, dumped during interviews etc for something nobody told me but now seems to be gone.

Well everyone who didn't take me seriously: Thanks! I'm now a consultant working somewhere else with someone who pays better. And I am very motivated to give your competitors an edge ;-)

None of my certifications I got were required, I was hired into the enterprise IT field with no formal training. But I will say the process of studying for and taking certifications was wildly beneficial to my job. In my case, I took community college courses aligned to these programs (mostly to keep me on track) and often was able to apply things I was getting from class directly to work. I would say the certifications fill in a lot of gaps, and do give you a good baseline.

It's definitely going to be a "you get out what you put in" thing though. Folks trying to rote-memorize dumps aren't going to get anything out of it. Personally, I used practice tests to evaluate and tell me where I needed to go back and study more, and then jumped back into the material in those places.

Where do the dumps come from. Are test takers contributing to dumps from memory after they finish the exam. People were doing that with the patent bar, which also reuses some questions. Now test takers have to agree to confidentiality requirements.

Good question. These certification exams all include a non-disclosure or confidentiality agreement. In any case, I don't think this could be the result of test-takers recalling questions from memory. We're talking about seeing 100-150 questions, and spending only a minute or so with each one, and many questions involve reading a short paragraph. The "dumps" have the questions and answers verbatim. I think it must be the work of unscrupulous employees at the certification vendors or some of the testing centers.

Are test takers contributing to dumps from memory after they finish the exam?

I'm guessing no, because what could be the incentive to doing that unless there's money involved? Why would someone who passed the test and gained the cert want to dilute the value of the cert they just earned by making it easier for people further down the pyramid to pass the test?

there is absolutely money involved. The amount of people that has to get these certs is absolutely massive. There is a lot of money to be made in selling dumps

As far as I can tell these dumps come from the cert org itself- I needed a CompTIA cert and all of their official materials come with access to a bunch of practice tests.

There's a big difference between the legitimate practice tests that come with an exam guide and a "test dump." Practice tests are examples to give people a feel for the style and scope of the test, and which areas they might need to learn more about. A "test dump" lets people memorize pairs of actual (not example) questions and answers, so they can pass with no knowledge of the underlying concepts or how to apply them.

An important distinction for sure. For exams in general, IMO, practice tests/old exams from previous years allow one to simulate test conditions and improve one's ability to perform under those conditions.^1 This can be especially useful for short answer/essay type questions. It is not uncommon to see question re-use or at least similarity of questions from year to year, but a useful part of the exam preparation process, for me at least, is deriving the answers for onself.

1. Those might even include answers written by previous test-takers. Memorisation of such answers would be futile because the questions change from year to year.

Arguably, practicing a lot of questions that one may encounter during the exam may be a good way of acquiring knowledge?

It can if you go deeper and understand the why behind the answer. The problem is that it's possible to memorize what the right answer is without understanding the material at all.

It's the same problem test driven development faces. Some things can be inferred from a list of test cases (exam answers). But some things require deeper insight that no amount of test cases can provide without spending time actually thinking about the big picture.

http://ravimohan.blogspot.com/2007/04/learning-from-sudoku-s...

The thing that always bugged me was that Offensive Security certifications basically have no official recognition within that system despite being difficult relative to the others (it's often on job posts for contractors though)

How are pay and benefits in the cert-worshipping world? It would be an interesting exercise grinding out the alphabet soup of certs as an alternative to endless algorithm practice.

In the US military, among both uniformed service members and federal civilians, it's still more about seniority, institutional knowledge, and security clearances than certifications (with actual skills being even less important). The pay and benefits are good (much better than average for a given location with similar education and years of experience) if you make a career of it, but you won't start as an O-4 or GS-13 after just passing a bunch of certification exams. Highly paid contractors are typically former military because of their institutional knowledge and security clearances.

The numbers that I see for "Big Tech" software engineers seem to be in a whole different universe, though. Better to keep practicing for your algorithm interviews.

Apparently you get a whole army sitting on that certificate culture and feed of from wherever the $$$ comes from. Can't get rid of them.

Thanks for your comment. I thought I was the only person that thought the focus on certs in defense / mil is ridiculous

I figured those certifications were largely useless, but I guess they aren't.