Hacker News Reader

Comment by neilv | Hacker News Reader

When I was consulting on some government programs, I consciously kept my resume off the Internet.

I didn't have access to anything useful to spies, but some of the keywords might look to someone like I did. Like how some recruiters seem to spam all keyword search hits on LinkedIn.

I knew I'd have to report any kind of security incident, and I thought that might interrupt my contracts and income, while a cautious bureaucracy processes the incident. So, no resume online. Also, measures to try to prevent a random burglar from inadvertently stealing the work laptop.

(Now that I'm away from that work, I get to enjoy LinkedIn recruiter spams for Junior Python Leetcode Hazing Engineer roles, like everyone else.)

View on HN

Don’t know why you’re getting downvoted. I’d imagine that not publicising your employment status is a run of the mill security measure for specific roles and industries that are subjects of targeted attacks.

As a meatspace equivalent I’m sure there are not many CIA operatives walking around foreign countries and giving out CIA-stamped business cards.

Off-topic: Given that state cyber entities maintain networks isolated from the internet, how do they adapt to the rise of tools like Co-Pilot and ChatGPT in the software engineering landscape? This kind of security setup inherently restricts access to such tools, potentially slowing their pace. Thoughts?

Don't use them, duh. Pay enough money to get a copy on premises if it ever gets useful enough for that. In the time they'll get around to changing their procedures, models will get small enough that it will be a non-issue.

Disclaimer: layman's opinion, I only know what internet knows.

I work at a large SF based SaaS, there's so much money in that space the company spun up a team to build an air gapped version of our product for restricted networks.

It's definitely much slower than the private sector, but if the agencies decide they have a use case, they'll throw money at it until it works in house.

I think that's an over-reaction. I am in a similar situation (I don't want certain people to know where I work), but I am OK with keeping the old CV, which doesn't mention the place where I work now, still online.

I have also asked the head of HR to make absolutely sure that my name is not on their public "our team" page. As a side effect, I always giggle during the mandatory corporate security training that tells how to deal with targeted attacks and demonstrates example phishing emails - so far, I received zero, if we don't count tests by a pentest agency.

Yeah, today, if I needed to keep a lower profile about a role, I'd still want to be on LinkedIn (if only to be reachable by contacts, now that the Web is so centralized), so I'd do something like that.

Reply on news.ycombinator.com