Oct 6, 2026, 3:27 PMI discovered a minor vulnerability in a job seeking site. The API shows whether salary should be hidden and also contains the min/max salary, regardless of whether it's hidden or not.
When submitting an application, would it be immoral to use that information for the suggested salary field?
@north US culture is one of the few in the world that keeps salary secret.
@corbden @north “US culture is one of the few in the world that keeps salary secret...”
FROM LABOUR. There's an entire industry that exists to keep employers informed about the job market and what it takes to hire top performers.
Efforts to crowd-source similar information for labour exist, but at the end of the day the money is in serving employers in their efforts to maximize value from employees,, so that's what capitalism does.
Oct 6, 2026, 7:38 PM@raganwald @corbden @north It's wild that keeping labor in the dark about salaries works so well in the US, considering there's been *federal law* forbidding employers from dissuading employees from talking about their salaries.
It's been that way *since 1935*, and yet a disturbing number of US workers think it's illegal for them to talk about their pay rates, instead of it being illegal for employers to try to stop us.
@kagan @corbden @north For the record, it concerned being asked about compensation, and the answer is,
"In the last five years, my comp has ranged from X to Y," without explaining how you calculate X and Y. If they demand more details, ask for their salary history. If they get mad, walk out.
But most employers were ok with my X to Y answer as close enough.
@kagan @corbden @north As for X and Y, not exactly rocket science.
X was the least I was paid in cash in any one year of the previous five.
Y was the most, but I also throw in non-cash comp like the estimated value of how much coffee I drink for free, the cash value of free lunches, equity, everything. That makes for a big range, which makes it hard to be rejected on that basis alone.
But if asked for more details, I would always refuse diplomatically.
@kagan @corbden @north I have also been on the hiring side for more than twenty years, including stints as a director and VP of Eng. That range actually *is* enough, and any employer saying otherwise is no longer selecting a candidate, but is now doing opposition research for the salary negotiation.
i have called a few people out for that, and suggested that if they find me a firm negotiator, maybe that should be a plus since my job would also involve interviewing.
Oct 6, 2026, 8:30 PM@raganwald @corbden @north Cool strategy, thanks! I'll definitely keep it in mind for the next time I find myself in that situation.
I especially like the, "if they get mad, walk out" bit.
Oct 6, 2026, 9:04 PM@raganwald @kagan @corbden employers ask you how much you made? wtf
@north So, without you doing anything nefarious or them doing anything that they did not design the system to do, they sent you salary information. They also sent you the fact that they would prefer you not consider that information and believe that you will not
It is mildly adversarial to ignore that preference & allow them to retain that false belief but it is not at all immoral. Mildly adversarial is always the best way to deal with an employer, as with any sales relationship.
Oct 6, 2026, 5:17 PM@grumpybozo Adversarial is fun. I was very tempted to not report it to the vendor, but I think I made the right choice by doing so.
@north Reporting the bug (esp. if it is to an intermediary vendor) is a different issue than using the info that the bug leaked. It’s always ideal to report a bug, but there’s no rush to do so before you’ve been through the hiring process.
Oct 6, 2026, 5:33 PM@grumpybozo Totally agree. Story time.
A few years ago, I discovered that Nebula, a DNA sequencing company stored coupon codes in the source. One coupon would let you buy a kit for $1. I reported it and escalated multiple times, until one day they silently fixed the issue by hitting an API to check validity - good. I tried some of the codes that were in the source, but they didn't work...except one; you guessed it, the code that reduces it to $1.
I talked to a few friends (s/o @j0hnnyxm4s) who agreed that it wouldn't be immortal to use the code, because they were specifically told about it and left it working, so it must've been intentional.
6 weeks later:
total 580G
-rwxrwxrwx 1 north north 205G Jul 8 2023 NG12HXYK4W.mm2.sortdup.bqsr.cram
-rwxrwxrwx 1 north north 4.1M Jul 8 2023 NG12HXYK4W.mm2.sortdup.bqsr.cram.crai
-rwxrwxrwx 1 north north 434K Sep 27 2023 NG12HXYK4W.mm2.sortdup.bqsr.hc.report.html
-rwxrwxrwx 1 north north 1.1G Sep 27 2023 NG12HXYK4W.mm2.sortdup.bqsr.hc.vcf
-rwxrwxrwx 1 north north 220M Sep 27 2023 NG12HXYK4W.mm2.sortdup.bqsr.hc.vcf.gz
-rwxrwxrwx 1 north north 1.6M Jul 8 2023 NG12HXYK4W.mm2.sortdup.bqsr.hc.vcf.gz.tbi
-rwxrwxrwx 1 north north 186G Jul 8 2023 NG12HXYK4W_1.fq.gz
-rwxrwxrwx 1 north north 189G Jul 8 2023 NG12HXYK4W_2.fq.gz
-rwxrwxrwx 1 north north 2.8K Jul 9 2023 igv_session.xml