Gregynog

Once a year, Aberystwyth’s Computer Science department take their second year students to Gregynog, for the purpose of preparing them for job interviews (mostly for the upcoming industrial year placements many students take between years 2 and 3). I’ve attended this for the last few years as an ‘Industrialist’ and help run mock interviews.

Initially when I first attended Gregynog as an Industrialist, it was because we [Pale Purple] were looking to hire an industrial placement student. For the last two years we haven’t, but it is still a very interesting weekend and I hope I’m able to provide something useful to the students and help them (besides it’s a free weekend away in quite nice settings 🙂 )

This year, was a bit different from previous years – namely we had much smaller groups of students (5 as opposed to around 10); and it was spread over two days (rather than one) so we effectively had a lot more time with each student.

Anyway, aside from a nice weekend away in Mid-Wales and a morning run through the countryside chasing pheasants, squirrels and rabbits for me….  what else did we learn?

Students are useless at selling themselves

It was quite common for students to not include relevant, useful information on their CVs – for example, one said something like “experience with Debian based distributions”, what we discovered he meant was “I’ve owned a multi-user VPS for the last few years, running Debian. It’s a web server which hosts subversion repositories for projects I’m involved in”…. great, so why didn’t you say you knew about Version Control and Linux Systems administration then? Skills which are highly desirable for a web developer. Others had experience of MySQL, or CISCO qualifications which weren’t mentioned. I’m sure there was far more.

We learnt that some (perhaps 15-20%) had experimented and undertaken extra-curricular study – but finding this out was hard. “So you’re interested in 3d graphics – have you done anything outside lectures on this?” “Err…. err… oh, yeah, I’ve…..”

Online Presence?

Logic would dictate that a student who has a strong interest in web development would have their own blog or some other form of online presence where they could experiment and so on. After all, if you have a passion in a subject area (as so many claimed in their covering letter) you would think they’d have dabbled in CSS (and heard of CSS Zen Garden), Javascript (jQuery) or loads of other stuff. One student mentioned jQuery.

Of the 40 students I interviewed, about 2 had a URL mentioned within their CV. Perhaps 4 used Twitter. (As evidenced by the lack of tweets using the #Gregynog hash tag perhaps?). Those who claimed an interest in photography hadn’t included a relevant flickr URL and so on.

If I advertise for a job, I will narrow down the initial pile of CVs to around 5 – of those, I’ll have tried to research each applicant online (Google, Twitter, Facebook, Uni web pages etc) – if I find anything bad I might change my selection, conversely if I find something good (e.g. a portfolio) I’m likely to favour them. The first interview involves me spending an hour or more with each student where I’ll ask them to undertake a short code test (fizz buzz, recursion and a random PHP code critique) and score each. Hopefully I’ll then get down to 2-3 who I’ll invite back to our office for a much longer interview (1/2 to 1 day). This isn’t possible for each student at Gregynog, but I do repeat the same process to the group as as whole.

Students overrate their abilities

“Advanced PHP” in student-esque means “I’ve done part of a small module on PHP, and I couldn’t write a simple program to add up a list of numbers”.

On the other hand there were students there who had written PHP in a commercial environment, and had relevant experience, yet said hardly anything about it. About 5 had mentioned experience of WordPress, yet we knew that they’d all installed and experimented with WordPress as part of a first year module.

“Comfortable with SQL” actually means “I can’t write a query like ‘select email from users where id = 2′”.

Students don’t follow the news

Of the students I interviewed, 2 or 3 knew about the #TwitterJokeTrial; Few knew about Oracle’s handling of Java, OpenOffice (and many others at lwn) or people’s worries over MySQL. Hardly any were involved in any form of user group (aside from one or two who had been to Fosdem).

Some didn’t know what they wanted to do

Some students were clearly not interested in either job (Java developer or a web dev). In these circumstances it was fairly obvious this was the case from seeing the CV and covering letter – so I could often only open with a “So, what do you want to do when you graduate?”, unfortunately this was often met with “err… I’m not sure”.

Students don’t seem to understand the recruitment process

It seemed lost on many students, that vacancies can get 10-30 or more applications. And a non-technical person may be screening the CVs before they get through to someone technical. For this reason, the CV needs to include buzz words and common acronyms which are easy to read and spot. It needs to be ordered along the lines of “Name, Statement, Skills, Relevant Experience, Education, Work experience, Referees”, and not contain a long list taking up half a page of all their module marks from the first year or two of University and also their A-levels and GCSEs. At most, I’d expect A-levels and GCSEs to have a line or two each.

Covering letter / CV – TL;DR.

A covering letter needs to be brief – clearly state which job they are applying for, and be easy to read (not more than one side of small print). Make sure your name is clearly on the covering letter and CV. Obvious stuff, you’d think.

Spelling Punctuation and Grammar

I can’t claim to be perfect, but few students had spell checked their CV. The age old suggestion of using beer as a carrot to get their friends to review/read their CV and give them feedback seemed to be well received. I can but hope. (Note, I’m not claiming to be perfect here – but I’m unlikely to write ‘badmington’ or ‘Solarus’ or ‘java’ or ‘i ‘).

Summary

As a general rule, the majority of the CVs were good – but they could have been so much better. We all seemed to be banging on over the weekend how so many of the students were good – yet totally useless at selling themselves.

One student really shone out to me – he was clueful about open source stuff, had contributed to open source projects and attended conferences and was able to critique ‘my’ PHP code – even though PHP wasn’t something he especially knew or was interested in (SQL Injection, non-existant error handling, no form validation, separation of concerns, no documentation, no captcha to stop automated form submission ….). I’ve no doubt he’ll do well in his degree.

That’s enough for now.

Twitter Weekly Updates for 2010-11-14

  • OH: @bryns 'we're not water boarding them yet' … #Gregynog #
  • .@bryns has made a student cry during interviews. Result! #Gregynog @abercompsci #
  • The Sat Nav entrance. Nice. http://twitpic.com/36eix1 #gregynog #
  • Let's try http://www.favoriterun.com/295867 – you know where to send search and rescue if I blow up and fail to return. #annualGregynogRun #
  • http://twitpic.com/368u7s the hard working industrialists. #
  • Cv reviewing. Hard work. http://twitpic.com/368tb8 #
  • Hello Gregynog. #
  • RT @madeupstats On average, a man will walk 70% further than a woman during his lifetime, yet buy only one fifth as many pairs of shoes. #
  • Crap! Robin Hood airport is closed. You've got a week to get your shit together, otherwise I'm blowing the airport sky high!! #IAmSpartacus #
  • Guess it's time to head off to Gregynog for me too… 2 days of interviewing students… hmm… #
  • RT @GeneHunt Tried a new machine at the gym. It made me feel sick after an hour's use – it's got KitKats, Mars bars & crisps in it. #
  • RT @paulmatthews86 http://bit.ly/680Ajy <– I couldn't have described it better myself #
  • Stupid French people – Renault can name new car Zoe as girls' case rejected http://www.bbc.co.uk/news/world-europe-11732595 #
  • Great PR there Amazon – Row over Amazon sales of paedophile advice guide http://www.bbc.co.uk/news/world-us-canada-11731928 #
  • Go away cold. It's time to move on to someone else. #
  • a world of tweets – 'degrades gracefully to flash on older browsers' 🙂 http://t.co/H3wtsYz via @aworldoftweets #
  • ,@rowangoodwin slept till 8:50am. 🙂 #
  • Ah. I love invoicing people. It's a good day. Aside from the burnt smell. #
  • Twitter vs toaster. Twitter won. http://twitpic.com/35lb4d #
  • Baked beans, chilli, garlic etc seem to be a lethal smelling combination. Perhaps I should stay away from work today…. #IHateMyBoss #
  • Coffee flavoured semolina wasn't a total failure. I wonder what else I could add coffee too…. Hot chocolate, cakes, ice cream, milk ….. #
  • Dear Server; When I stay up late to reinstall you, please try to behave. If I had physical access, you would have been kicked. Very hard. #
  • Wow. We might manage to be on time for #phpwm tonight. Dare I say 'early'… Perhaps me not driving is why…? #
  • Stupid body. Was fine while running but enjoyed coughing once I got home. Still. My lungs might be purged now. #
  • RT @GeneHunt I'm just buying a Marathon, Opal fruits, some Jif and Oil of Ulay for the girlfriend..at least some things will never change. #
  • RT @GeneHunt The girlfriend tried my handcuffs on for size…now that's what I call a charm bracelet. #
  • Kcachegrind or valkyrie running on a xdebug output file kills X on maverick 🙁 webgrind doesn't fail at least. Stupid computer. #
  • Hey. Not bad @rowangoodwin. I'll settle for an 8am wake up if you insist. #cleverkid #happydaddy #
  • RT @GeneHunt Funny how attractive women always drive cute little cars.That reminds me, the girlfriend's Panzer needs an MOT. #
  • *cough* *cough*. Think I need to purchase some anti-cold stuff. Wish the rain would go away too. #

Twitter Weekly Updates for 2010-11-14

  • OH: @bryns 'we're not water boarding them yet' … #Gregynog #
  • .@bryns has made a student cry during interviews. Result! #Gregynog @abercompsci #
  • The Sat Nav entrance. Nice. http://twitpic.com/36eix1 #gregynog #
  • Let's try http://www.favoriterun.com/295867 – you know where to send search and rescue if I blow up and fail to return. #annualGregynogRun #
  • http://twitpic.com/368u7s the hard working industrialists. #
  • Cv reviewing. Hard work. http://twitpic.com/368tb8 #
  • Hello Gregynog. #
  • RT @madeupstats On average, a man will walk 70% further than a woman during his lifetime, yet buy only one fifth as many pairs of shoes. #
  • Crap! Robin Hood airport is closed. You've got a week to get your shit together, otherwise I'm blowing the airport sky high!! #IAmSpartacus #
  • Guess it's time to head off to Gregynog for me too… 2 days of interviewing students… hmm… #
  • RT @GeneHunt Tried a new machine at the gym. It made me feel sick after an hour's use – it's got KitKats, Mars bars & crisps in it. #
  • RT @paulmatthews86 http://bit.ly/680Ajy <– I couldn't have described it better myself #
  • Stupid French people – Renault can name new car Zoe as girls' case rejected http://www.bbc.co.uk/news/world-europe-11732595 #
  • Great PR there Amazon – Row over Amazon sales of paedophile advice guide http://www.bbc.co.uk/news/world-us-canada-11731928 #
  • Go away cold. It's time to move on to someone else. #
  • a world of tweets – 'degrades gracefully to flash on older browsers' 🙂 http://t.co/H3wtsYz via @aworldoftweets #
  • ,@rowangoodwin slept till 8:50am. 🙂 #
  • Ah. I love invoicing people. It's a good day. Aside from the burnt smell. #
  • Twitter vs toaster. Twitter won. http://twitpic.com/35lb4d #
  • Baked beans, chilli, garlic etc seem to be a lethal smelling combination. Perhaps I should stay away from work today…. #IHateMyBoss #
  • Coffee flavoured semolina wasn't a total failure. I wonder what else I could add coffee too…. Hot chocolate, cakes, ice cream, milk ….. #
  • Dear Server; When I stay up late to reinstall you, please try to behave. If I had physical access, you would have been kicked. Very hard. #
  • Wow. We might manage to be on time for #phpwm tonight. Dare I say 'early'… Perhaps me not driving is why…? #
  • Stupid body. Was fine while running but enjoyed coughing once I got home. Still. My lungs might be purged now. #
  • RT @GeneHunt I'm just buying a Marathon, Opal fruits, some Jif and Oil of Ulay for the girlfriend..at least some things will never change. #
  • RT @GeneHunt The girlfriend tried my handcuffs on for size…now that's what I call a charm bracelet. #
  • Kcachegrind or valkyrie running on a xdebug output file kills X on maverick 🙁 webgrind doesn't fail at least. Stupid computer. #
  • Hey. Not bad @rowangoodwin. I'll settle for an 8am wake up if you insist. #cleverkid #happydaddy #
  • RT @GeneHunt Funny how attractive women always drive cute little cars.That reminds me, the girlfriend's Panzer needs an MOT. #
  • *cough* *cough*. Think I need to purchase some anti-cold stuff. Wish the rain would go away too. #

Twitter Weekly Updates for 2010-11-14

  • OH: @bryns 'we're not water boarding them yet' … #Gregynog #
  • .@bryns has made a student cry during interviews. Result! #Gregynog @abercompsci #
  • The Sat Nav entrance. Nice. http://twitpic.com/36eix1 #gregynog #
  • Let's try http://www.favoriterun.com/295867 – you know where to send search and rescue if I blow up and fail to return. #annualGregynogRun #
  • http://twitpic.com/368u7s the hard working industrialists. #
  • Cv reviewing. Hard work. http://twitpic.com/368tb8 #
  • Hello Gregynog. #
  • RT @madeupstats On average, a man will walk 70% further than a woman during his lifetime, yet buy only one fifth as many pairs of shoes. #
  • Crap! Robin Hood airport is closed. You've got a week to get your shit together, otherwise I'm blowing the airport sky high!! #IAmSpartacus #
  • Guess it's time to head off to Gregynog for me too… 2 days of interviewing students… hmm… #
  • RT @GeneHunt Tried a new machine at the gym. It made me feel sick after an hour's use – it's got KitKats, Mars bars & crisps in it. #
  • RT @paulmatthews86 http://bit.ly/680Ajy <– I couldn't have described it better myself #
  • Stupid French people – Renault can name new car Zoe as girls' case rejected http://www.bbc.co.uk/news/world-europe-11732595 #
  • Great PR there Amazon – Row over Amazon sales of paedophile advice guide http://www.bbc.co.uk/news/world-us-canada-11731928 #
  • Go away cold. It's time to move on to someone else. #
  • a world of tweets – 'degrades gracefully to flash on older browsers' 🙂 http://t.co/H3wtsYz via @aworldoftweets #
  • ,@rowangoodwin slept till 8:50am. 🙂 #
  • Ah. I love invoicing people. It's a good day. Aside from the burnt smell. #
  • Twitter vs toaster. Twitter won. http://twitpic.com/35lb4d #
  • Baked beans, chilli, garlic etc seem to be a lethal smelling combination. Perhaps I should stay away from work today…. #IHateMyBoss #
  • Coffee flavoured semolina wasn't a total failure. I wonder what else I could add coffee too…. Hot chocolate, cakes, ice cream, milk ….. #
  • Dear Server; When I stay up late to reinstall you, please try to behave. If I had physical access, you would have been kicked. Very hard. #
  • Wow. We might manage to be on time for #phpwm tonight. Dare I say 'early'… Perhaps me not driving is why…? #
  • Stupid body. Was fine while running but enjoyed coughing once I got home. Still. My lungs might be purged now. #
  • RT @GeneHunt I'm just buying a Marathon, Opal fruits, some Jif and Oil of Ulay for the girlfriend..at least some things will never change. #
  • RT @GeneHunt The girlfriend tried my handcuffs on for size…now that's what I call a charm bracelet. #
  • Kcachegrind or valkyrie running on a xdebug output file kills X on maverick 🙁 webgrind doesn't fail at least. Stupid computer. #
  • Hey. Not bad @rowangoodwin. I'll settle for an 8am wake up if you insist. #cleverkid #happydaddy #
  • RT @GeneHunt Funny how attractive women always drive cute little cars.That reminds me, the girlfriend's Panzer needs an MOT. #
  • *cough* *cough*. Think I need to purchase some anti-cold stuff. Wish the rain would go away too. #

Twitter Weekly Updates for 2010-11-07

  • Bromsgrove 4ths lost match. Perhaps 3-1. Well done Ludlow. #hockey #
  • Clearly to balance out the karma (lie in), @rowangoodwin is having many wee-accidents. Two sets of clothes now used :-/ #
  • I have the cleverest son ever. He didn't wake till 830am (on a saturday). Result. #
  • Now @aypok has finally learnt how to cook sausages. #fail #
  • Lloydstsb I am beginning to hate you. This card reader boll–ks is not helpful. #businessbanking #fail #
  • The sausage cooking preparations begin. #FatMinions #SausageWeek #
  • Now wishing I'd not had quite so much to eat for dinner. I might be waddling on the hockey pitch. 🙁 #
  • ProTip: Application feedback/suggestion loops are unlikely to be working if the SQL contains "…. order by rand()" #
  • RT @PalePurpleLtd Apparently we're in sausage week. Co-op has been raided and cooking is underway. #
  • "Daniel trusted god". And that is why he failed.

    Why does @rowangoodwin want all the trains? http://twitpic.com/33iqau #

Twitter Weekly Updates for 2010-11-07

  • Bromsgrove 4ths lost match. Perhaps 3-1. Well done Ludlow. #hockey #
  • Clearly to balance out the karma (lie in), @rowangoodwin is having many wee-accidents. Two sets of clothes now used :-/ #
  • I have the cleverest son ever. He didn't wake till 830am (on a saturday). Result. #
  • Now @aypok has finally learnt how to cook sausages. #fail #
  • Lloydstsb I am beginning to hate you. This card reader boll–ks is not helpful. #businessbanking #fail #
  • The sausage cooking preparations begin. #FatMinions #SausageWeek #
  • Now wishing I'd not had quite so much to eat for dinner. I might be waddling on the hockey pitch. 🙁 #
  • ProTip: Application feedback/suggestion loops are unlikely to be working if the SQL contains "…. order by rand()" #
  • RT @PalePurpleLtd Apparently we're in sausage week. Co-op has been raided and cooking is underway. #
  • "Daniel trusted god". And that is why he failed.

    Why does @rowangoodwin want all the trains? http://twitpic.com/33iqau #

This afternoon on #phpwm

Without trying to repeat too much others may have already, this afternoon on the #PHPWM IRC channel one resident seemed to be having a ‘lolwut’ competition, well – posting links which showed ‘lolwut’s (In english: highlighting security problems in web sites).

Sure, you might think, so what ? There will always be a website somewhere with a security flaw…. Except the websites in ‘todays’ list were from the top 10-15 google results when searching for ‘PHP Development UK’. The sites returned should reflect companies or individuals who are offering (one would assume) professional PHP development, and should therefore be clueful about such issues….

SQL Injection at large
SQL Injection / XSS in a 'professional' website

We came across someone claiming 6 years of professional web development experience – who was vulnerable to an XSS attack (subsequently fixed as I write this post, so there’s little point in me including a screenshot).

Of course, Akrabat then chipped in with a “I hope my work site isn’t vulnerable” type comment – so obviously we had to have a go at breaking it, just to put his mind at rest … and we nearly succeeded – I found an error message in an error page which outputted mostly unescaped input – it seemed to have some filtering in place, but we worked around this by inputting %3D type characters, converting IP addresses to integers and so on – which was an amusing experience.

The rest of us seem to be running WordPress, and as funny as this may sound, I suspect it’s more secure (at least out of the box) due to the fact more people have tried poking and breaking it. Unless your hosting is with 123-reg …. in which case it seems you’re going to be in trouble.

<rant>

If you want to avoid Cross Site Scripting (XSS) holes – make sure you escape or filter what you’re writing out – using either something like htmlentities or strip_tags or htmlpurifier. This must include error messages – if they contain any user supplied data. Every code base we have audited for third parties have contained Cross Site Scripting or SQL Injection vulnerabilities. This sucks. I’ve blogged in the past (although this was probably on my old drupal based website) about how easy this is to fix from an architecture point of view, if you’re writing something bespoke (which the sites in question seemed to be) – follow the MVC design pattern and when assigning data to the ‘view’ make it so that it is escaped by default (e.g. override Smarty::assign()). To avoid SQL Injection’s either use prepared statements everywhere, or use an ORM layer like Propel.

</rant>

(For the record – all sites were informed ….)

One vaguely interesting outcome from the above is that it seems obvious to me that I need to re-do the Pale Purple website – as it’s not really changed in 2-3 years now… which is perhaps not good. This time I think I’ll use WordPress, as it’ll mean I can stop supporting Drupal

Twitter Weekly Updates for 2010-10-03

  • I sweat. A lot. #
  • I think minecraft is overtaking the office. There's already an internal server. *sigh*. #
  • Hello orange shop and xperia 10 mini thing. I'm glad it wont be my phone (horrible keyboard) #
  • It wouldn't be the Post Office if there was no queue. #
  • Once were warriors #oneofmyfavoritemovies #
  • Mystery solved:
    grep -i 'drop database mysql' ~/.mysql_history |wc -l = 1. *sigh* (not my server, I just need to migrate site off) #mysql #

Some good news

This morning I ran 3 miles.

This is good. I can now run again. Stupid Achilles tendon appears to be fixed again.

I’ve felt like a fat slob over the last 11-12 weeks, missed a marathon and rediscovered cycling.

Lesson learnt: Next time my Achilles tendon goes (as no doubt it will knowing my luck), carve it out with a scapel and wait for a new one to grow back. That’ll teach it.

Twitter Weekly Updates for 2010-09-19

  • Welcome @LeaseDeskDotCom to Twitter. They have a very nice looking application (PHP/MySQL etc) *cough* #
  • Php / mysql performance blog post – removing the need for a separate 'count' query when searching. #mysql http://bit.ly/caEXlx #
  • Swinging in the park. #
  • You know you're going to have "fun" reviewing code when you see foo.php foo.20090101.php foo_old.php etc etc. #
  • Logging in to a website with username of "' or 1=1 or '". Result! #sqlinjection #security #