it's certainly not acceptable that all they are saying is "certain elements of our customers’ information." very unacceptable, if it's credit card numbers or home addresses, they have to reveal that. the current language makes it look like they want to hide some kind of very bad news which is worse. Also their August post indicated that the developer account that was compromised had no access to customer data, so why exactly was that wrong.

For a password management company, they can't even be bothered to fuzz their export functionality. QuickCheck works unreasonably well on `import(export(a)) == a`.

But maybe it's intended to be buggy, in order to keep you in their walled garden. Clearly the sync between devices works, so they have solved this problem.

I have been a paying customer of Lastpass for about 15 years. I moved to Bitwarden for all sorts of reasons. I work in technical information security so it was also for that teason (but not only)

And, to be fair, it's a large part of the Docker experience.

I recently had a pretty much identical experience with a vendor that is industry leading in their sector and counts most large companies among their customers. Just imagine what their cloud looks like.

A supply chain attack on these guys wouldn't even be difficult, and the only reason I can imagine we haven't heard about it is that we just haven't heard about it.

When you're on prem you only have to worry about your own employees opening sketchy PDFs. When you're not, you have to worry about everyone in your supply chain opening sketchy PDFs.

Nevermind the fact that the next time a major world conflict occurs, the big 4 cloud providers will probably be destroyed, taking about 90% of the western economy with it.

User authentication has been a hot mess for at least two decades. Passwords need to go.

Won’t be touching LastPass again except offline, while I figure out where to go from here. I had been putting off finding a better password manager, but this is the last straw.

https://keepassxc.org/docs/#faq-keepassx

Syncthing improves the security, for instance, just in case a vulnerability creeps into the keepass code.

Syncthing works, has no central server to be beholden to, is free, and I have much more stability with it.

An engineer at our competitor got laid off and my PM found out and hired the guy to do FPGA work. My PM knew the guy through some contracts we had with the competitor and assumed he was an expert in the field. Turns out the guy was more of middleman between program management and the engineers so while he could talk about the work, he hadn't really done it in like 10 years. My PM got the hiring expedited and since we don't really do interview tests in our industry, the guy was now on our team before anyone could ask any pertinent questions.

Long story short, the FPGA team starts assigning him work but it's taking way too long and he's asking for more documentation and for help on things that he definitely would have worked on in his supposed previous job. Eventually we all figure out that he kinda overstated how fresh his skills are and we transition him to a sort of documentation role so he wasn't burning hours on things he just couldn't handle. While he was perfectly capable of doing that kind of work, it involved a lot of insight to our design so it took him a while to get onboarded to the system and able to properly describe the design. Eventually he was doing good work and got the project to the point where he wasn't needed but he left a bad taste in everyone's mouth. We could have hired two junior engineers to do the work he was doing for the same price and probably gotten it done much faster. After the guy transfered over to another project, we reamed out our PM about his hiring decision and begged him to give us some input next time. Of course, due to the waste of money from the last guy, the functional managers stopped taking hiring inputs from our project and would just assign whoever the fuck they thought we needed despite the kind of roles we actually needed.

[0] https://www.joelonsoftware.com/2006/10/25/the-guerrilla-guid...

You might be surprised.

However, your comment comes across as an attack intended to maybe silence his experience.

It’s arguable whether a simple senior filter and “HR stuff” is a red flag or not, but how does it make this site worse?

  public enum Color {
    RED, BLACK
  }

  public enum Suit {
    Diamonds(RED, '♦'),
    Hearts(RED, '♥'),
    Clubs(BLACK, '♣'),
    Spades(BLACK, '♠');

    Color color;
    char symbol;

    public Suit(Color color, char symbol) { this.color = color; this.symbol = symbol; }
  }

  public enum Rank {
    Ace('A'),
    Two('2'),
    //...
  }

  public record Card(Suit suit, Rank rank) {
     // ... 
  }

You wouldn't want to check whether a poker hand has a pair by using a bunch of instanceof's or getClass()-shenanigans. You also don't want to encode knowledge about poker into into the card object. That's just data.

Shuffle

Draw

Deal

Cut

Pile

Turn

Now imagine you have pinocle uno and cribbage as games. they each start with a different set of cards, but can use the functions above. The fact that it’s a 52 card deck with suits and ranks isn’t stated by GP, and there’s also the optional jokers.

For a real game, you’d probably need the back of cards as well for animation, and maybe you implement card designs to give the game some customization - now the deck needs some more properties or methods.

After all of that, think of whether the generic deck could be used to play magic or pokemon by using inheritance.

For lastpass, the closest parallel they might have to a deck is a password generator. Implementing that would seem like work. The deck stuff is all premature optimization for a single game, but they are checking your knowledge of inheritance, so just go along with it.

Many card games have a reduced deck - e.g. lots of French card games use a 36-card deck. Some card games use multiple decks mixed together (e.g. Canasta). Some have extra cards (jokers are common, there are others); some have entire extra suits (e.g. games that used to be played with various forms of tarot decks).

All this stuff needs to be parameterised, and suddenly you have an enterprise-worthy class hierarchy and a ton of complexity before you've even really started on game-specific stuff.

Would you really just ignore the requirements and give the simplest starter as a way to start a conversation?

I did a take home for Walmart Labs once and they completely ghosted me. What a complete waste of time.

They get progressively more complex as we go, but the candidate is fully aware they are filter questions that I hope they clear with zero effort.

If thats what they are asking for, implement it, programmers and their ego always trying to "LoL, DuM iNtErViEw QuEsTiOn".

There is so much to learn from a person by just seeing how they solve a simple problem like this one.

1. State actors

2. For profit criminals

3. Teens for lulz and street cred

I guess the first group would probably keep it pretty quiet. The second would keep it quiet until they've abused the data as much as they want to, then sell the remainder on the dark web. The third would make a big noisy mess right away.

2. Inject code in build to export user's passwords to remote server after update is installed

Several years ago the trendy thing to do for security was to get a USB-A security dongle and lock your important accounts with it. Nowadays, laptops from several major manufacturers no longer ship with a USB-A port, so if you need to log in again and don't have a USB-C dock handy, you're locked out until you can find one.