Hacker News Reader

Comment by Minor49er | Hacker News Reader

Most job postings online are made through an applicant tracking system (ATS). Many of these also handle application submissions as well. These systems typically let the HR department filter through results that they don't want. Unless the striker is adding enough variety in the applications and when they are submitted, I think it would be pretty easy to match and discard the bogus ones.

View on HN

It looks like this script is using the standard Faker module email generation, which will generate email addresses exclusively with domains at example.net, example.com, and example.org. It also attaches the exact same .png [0] for the resume in every fake application. So these should be pretty easily filterable based on those 2 facts alone.

Additionally, there are plenty of red flags that any human reviewer would quickly pick up with these applications. The addresses don't exist. The random prior occupations it submits are rarely in line with what you'd expect for these positions. The name generator is pulling random first names for the last name as well. And the randomly generated email addresses contain names that don't match the name on application. So, the script will submit an application for "Susan Justin," a former Surgeon with the email address ronaldbrewer@example.com, at an address that doesn't exist.

I'm sure this is a nuisance for the HR analyst who's the first line of defense in reviewing applications. And they might've had to bring in someone with more technical/fraud skills to help weed out the fake applications, but it seems quite manageable.

[0] https://github.com/SeanDaBlack/KelloggBot/blob/main/src/resu...

Some of the resume screening service charge per application though, so it might at least cost Kellog a little bit of money.

Though they'll probably use that as an excuse to not provide insurance or pay a living wage... :(

Said money will be recouped when they sue the people flooding them under the CFAA and seek damages.

"Unless the striker is adding enough variety in the applications and when they are submitted, I think it would be pretty easy to match and discard the bogus ones"

That wouldn't be so hard to do, would it?

Not at all. Many of the people from Reddit are specifically applying using local zip codes, local addresses, and local area code phone numbers. Kellogg is going to have a massive headache trying to sort through these imo.

Edit: One thing I didn't think of was application source IP address. It's possible the ATS records that info when an app is submitted, so they could possibly delete bogus records that way but I'm no ATS expert and this is literally just my own conjecture.

Yes IP, and also User Agent doesn’t look like it’d be hard to filter against using the posted code.

Also they could just pull the listing then go to some temp agencies (for example manpower, randstad) and say 'i would like to hire 10 people that have these qualifications'. I know a couple of people who do not even look at company websites and deal only with companies like this for these kind of jobs. They are perfectly fine being forever temp.

A lot of applicant tracking systems will start to fall over at a certain level of items in the database.

I've written systems that integrate with these. The old crop (bullhorn and similar) probably wouldn't be able to do what you're saying easily. The more modern ones out of the usual places could likely do it easily.

I base this opinion off of ~6 year old data and experiences. The "best" horror story was an ATS that used client-side browser datetime without timezone support as their official timestamp record for various events.

I’m sure that never, ever caused any problems for anyone, ever. /s

No, but it's surprisingly easy to overlook things like content, format, time of day, etc, when the goal is simply "flood their inbox"

Reply on news.ycombinator.com