But I do think this is a serious issue and I'm astonished at the sheer number of you who cannot allow discussion of it and will not allow your beliefs to be questioned.
I would engage the debate but after all the downvotes I'm barred from posting so it's not much of a debate. The system here is designed to reinforce groupthink.
If you distribute a program with broken security, it needs testing and fixing. If this was a real program, as opposed to an exercise, it would have gotten a security advisory.
So, the only failed "test" here would be writing a reverse-engineering-resistant program and expecting that to provide "security", and that's less a test of morals and more a test of competence. But as an exercise, written to be intentionally buggy, this was quite good.
Now, a good question to ask before this exercise would have been to ask the inverviewee to discuss the idea and implications of prompting for a password in a client-side application; look for them to explain public/private key cryptography and security versus obscurity.
Yes, I agree. They do not go around testing doorknobs unsolicited and without permission. Which has absolutely nothing at all to do with this story, since he has both permission and was instructed to do so by his interviewers.
He was not asked to crack the NSA's database on metadata for phone calls. They are command line examples.
I downvoted you for unnecessarily swiping at the candidate saying: "This was a test of morals, and you flunked." You state this absolutely when in reality it is almost certainly a subjective minority opinion you hold.
Deleted comment
I didn't care what your morals are, it's just bad interviewing. But, if you really want to bring up your morals, why are you deploying underhanded interview tactics? You let applications rest on the implied assumptions about a professional environment. Someone is extending you the professional courtesy of assuming that (if hired) you won't ask them to act immorally; you use that against them to walk them into a trap. How does that fit into your moral system?
Don't make it look like you are being persecuted. You are the one lording over a minority opinion over someone in an attempt to persecute them.
They didn't ask him to crack Photoshop or AutoCAD or anything... they're freaking crackmes. It seems like quite a sensible way to approach such an interview since it takes significant time, can be done overnight on their own workstation and isn't a huge requirement like "write us a game entirely in assembly".
There is nothing immoral about cracking a crackme file, which is the very reason why the file was created.
Deleted comment
But if somebody says "we want to hire you, pick this lock", your first response has simply got to be "wait, we need to discuss this."
Is the lock attached to your competitor's back door, or did you just place a lock cylinder on the meeting table? Remember, you're hiring a locksmith.
You've provided the applicant an ethical and legally safe environment to apply their skillset and tasked them with proving their skillset. What do you expect to happen?
How many of your everyday business skills can be used immorally? If you preface every demonstration or application of your abilities with a moral clarification, my immediate thought would be "The lady doth protest too much, methinks"
There is a good chance you would hire someone that doesn't know how to do it. If you don't want them to do it, then don't ask. This, IMO, is the wrong way to test morals.
I don't see anything immoral about it. It was not a real application, it was not causing damage to anyone and it was totally related to the job position.
We _were_ discussing it, you got a few downvotes, so what? Disagreement is a form of discussion, had you wished to iterate on the explanation of your stance I would have gladly continued until we distilled the conversation down to the core bits we don't see eye to eye on. Maybe neither of us would be swayed, but at least we'd see where one another were coming from.
I said this before but deleted it because I thought it was a low blow, but in light of your edit I'll reiterate: the problem with this conversation was not your moral stance, it was your arrogance.
Deleted comment
Would you have the same objections if the test was a complicated SQL injection?
Deleted comment