A naughty CV hack | Hacker News Reader

A naughty CV hack

howlingmob.net

72 pointsjlangenauer47 comments

First, I'd get annoyed if I found you tried to bug a CV you sent me. I'd definitely tell you not to send something like that to my clients.

Second, I think that while HTML resumes are a fine thing to post on your website, they are a terrible format for sending to a prospective employer. You are virtually guaranteed that it will be mangled behind comprehension by the time an interviewer gets it.

Don't send HTML resumes. Don't send DOC files. Send PDFs. Hiring managers expect to have to read PDFs, they will print reliably, and they won't launch MS Office when someone clicks on them. PDF. It's the way to go.

> [...] HTML resumes [...] You are virtually guaranteed that it will be mangled

Do you mean it will be changed by other people, or...? I'm not sure who are you expecting to mangle it and why.

No, I don't mean on purpose.

Mail clients and Internet Explorer are both perfectly capable CV-mangling engines.

Ah... I thought he meant HTML file attached to the email, not a "HTML email".

I meant HTML files attached to the email. They print badly. They don't display reliably. Use PDF.

Even if you use vanilla HTML and/or test cross-browser display?

Yes. I've seen way too many mangled CVs. Stick to PDFs unless the company in question requests a specific format. Beware of agencies deliberately changing your CV regardless of format (see my other comment).

There are exactly no mainstream browsers that print even fairly basic HTML pages reliably, IME. Typically, the scaling and positioning of page elements ranges from poor to seriously clipped/unreadable once you get beyond the most trivial formatting.

I recommend PDFs too. That way it stops pesky and unethical recruiters from "adjusting" your CV without your knowledge.

How does that stop them? Most 3rd party readers have basic editing capabilities and any unethical recruiter could trivially afford (or unethically obtain) Acrobat Pro.

It just makes it more difficult. Everyone has Microsoft Word, but not everyone has Acrobat Pro, or the other 3rd party tools. If you're really paranoid, you could digitally sign your PDF, but that seems like overkill.

Right, it's just deterrence. No amount of signing is going to stop a determined and evil recruiter from just retyping your CV with their buzzwords added. Can't imagine that actually happening, but I am reminded of the employer looking for "pink box testing" experience...

Can't imagine that actually happening

You've been leading a sheltered life. The majority of CVs we received via a recruitment agency at Kuju (game developer) had been changed by the agency, and I'm not just talking about removing the contact details.

Some CVs were so mangled that I'm pretty sure they were a copy & paste job from a PDF into MS Word.

My piece of advice: if you ever have an agency apply for jobs on your behalf, insist on seeing the final version of your CV before they send it. They probably mean well, but they frequently end up misrepresenting you because they just don't understand your job. Yes, this also applies to agencies specialised on the tech sector.

Recruitment companies use automated CV parsing software to extract structured data (contact details, employment/education histories, coded skills based on keywords in your CV, etc, etc) from all kinds of CV formats, including PDF.

From that structured data, they can recreate your CV content in their house style, even if it was originally a PDF.

(My employer is a market leader in this area, although 90%+ CVs I see are Doc files, and we mostly use an automated Word process for stripping contact details from those and adding recruiter's logos.)

Only the smallest recruiters are doing any of this stuff by hand using Word/Acrobat. It's all automated, like a sausage factory.

Anyway, if you make it hard for them to process your CV how they like it, they'll just chuck it. In that case, why bother sending it to recruiters at all? If you need their help, you need to play by their rules.

I usually get asked to help screen resumes for applicants to the department I'm in... every single one has either been a .doc attachment (pretty much all of the contractor positions) or pasted into a html email (pretty much all of the permanent positions). I don't believe I've ever seen one in PDF (except when I was looking for work after college... they asked me to re-send it as a .doc).

And I'm a hiring manager who just checked 121 resumes in his mail spool, ~65% of which were in PDF. But sure, I guess there's someone out there who's never seen a PDF resume.

What industry are you in and how do you get most of your resumes? Might have something to do with it.

Your evidence is anecdotal. Don't assume that every company everywhere in every industry deals with the same things that you do.

As is tbrownaw's evidence. Maybe there are relevant statistics somewhere?

The comment:

> But sure, I guess there's someone out there who's never seen a PDF resume.

Seems to imply that he feels that his experience is the same for 99% of the rest of the world, and that tbrownaw's evidence is in the minority. The problem is that both of them only have anecdotal evidence, so neither can claim to have 'the big picture,' though tptacek seems to infer that he does ("But sure, I guess there's someone out there" implies that this 'someone' is all alone/the only person).

Likewise, it seems in the UK Infosec industry recruiters send CVs in Word format where possible (and usually track changes), whereas individuals tend to send PDFs generated in Word, OpenOffice or commonly (for technical folk) Latex.

Recruiters hate Latex.

> Recruiters hate Latex.

Since when? I've made my PDF CVs using LaTeX (XeLaTeX, actually) for years. I've never had a problem, and I get the occasional comment about how nicely presented the CV is.

Agencies hate PDFs in general, since they can't mess around with them as easily, but that's their problem.

Wait a minute: Do you mean LaTeX source code, or LaTeX generated PDF, or just PDF? And what do you mean by "recruiters"? The guy you will work with? the HR people? Or the agencies?

Most of all, why do "recruiters" hate "Latex"? (This is a real question, whose response might serve me soon.)

I'm going to guess here but... I think @iuguy meant LaTeX source code. PDF from latex is probably fine.

Why do they hate it? Because most of them probably can't open it.

tptacek, would you consider that a 'bug' even if you noticed it and carefully traced it? I think I'd assume the guy previously referred to a CSS file but now included it inline and forgot to remove the old <link type='text/css'>. Maybe I'd be suspicious if python responded with headers that said, "hi this is a python web server!". But linking to an empty CSS (or getting a 404 !) would not ever raise my suspicions. That's part of its beauty!

Hmm, on 2nd thought, getting the server to send a 404 while tracking the resume's travels is even more elegant.

I'd only be annoyed if in the interview he bragged about bugging the resume!!!

it's easy to track 404s. They show up in your access logs. You can just post-process the logs.

You can return 404 with python as well.

but what's the point? you'll be taking up a whole bunch of CPU cycles on every request when you can just use a fraction of the total once a day.

Why wouldn't it be a "bug"? That's what they call such things in spam emails.

Most big resume processing systems mangle them anyway. I have referred friends during my time at both Google and Microsoft. Both companies ask you to paste a plain text version of the resumes.

http://blogcritics.org/politics/article/how-to-make-your-tin...

First, don't send bugs. It's not going to tell you anything worthwhile when people don't detect it and it's just going to annoy people who do.

Second, send resumes in the format expected by the recipient. This is still occasionally a .doc file. PDF covers most bases but not always. I think, statistically, nobody ever failed to get a job because they failed to produce an HTML resume. Send what the person on the other end is easily going to read. Consider figuring that out your first interview question.

> PDF. It's the way to go.

Seems 5 out of 10 malware writers agree ;-) http://www.theregister.co.uk/2010/03/09/adobe_reader_attacks...

OK, I also prefer PDF, and I know the problem is the Adobe Reader (and the scripting added back in 2003 or so). I try to stick to the OSS readers.

But I would think that web-bugs are also possible in modern PDFs (with web links and js). No ?

Was anyone else really thrown off by the strange choices in bold and italic?

Yes. At first I thought he was italicizing each mention of a programming language, which is a nice idea. Then python was bold and not italic, and I lost the thread.

New startup idea: Google Analytics for Resumes.

http://www.trackmycv.com/

StackOverflow Careers gives you metrics on views, search hits, inquiries, etc.

He's worried about embedded viruses in .doc files but has no qualms about adding tracking code to .html!?

Do you seriously think those are at all similar?

While not as useful as this trick, I've setup analytics on my external facing resume site, and it's been interesting to see the results.

It's been great for finding out how recruiters use google to search for resumes, and to find out where open positions are in my area of expertise.

In the past I've just sent a link to my resume and looked at my access logs. This has worked for me, but the printed results are often cringe worthy.

Can't you trigger an "onload" type event in a PDF or simply attempt to load a hidden image into your page from a tracking URL.

it will ask the user for confirmation before attempting to reach out to the web

This is also a fairly common way to track people down. I used something similar, with an HTML email, to find an SEO shuyster who had defrauded a friend. It helped prove he was in the country (despite his claims). It gave us a good reason to try and setup a sting where instead of meeting a potential customer, he was greeted by a process server.

Also a good reason why to never read HTML emails.

I remember the time when bugged or, worse, malware-carrying emails were impossible. I even wrote an article on e-mail viruses circa 96.

Thanks, Microsoft, for making this too possible (by bundling HTML and scriptable Word processing into mail viewers)...

Reply on news.ycombinator.com