While interviewing for a company, I was asked to submit several code samples that highlight my “best” work. I was pinged back with several questions regarding a specific code sample, one of which alluded to a bug.
The code sample was a WCF Web service that uses AES to encrypt an opaque blob. The blob is used by the service to identify all resources for a specific service request. The bug was that the .NET RijndaelManaged class was used with CBC mode, without properly setting the IV. The RijndaelManaged class will autogenerate an appropriate IV during class instantiation, which in the code sample, occurs during first usage of encryption, and is persisted for the life of the ASP .NET Application. Since ASP.NET applications can be restarted for a variety of reasons, it’s possible that a these opaque blobs would be “invalidated” from one service call to the next because of a new IV value generated during App startup (the bug).
The question itself was “where is IV set for decryption?”
My response is already to admit that this is a bug; but since they asked for my “best” work, am I SOL on this position for having submitted a sample with a bug? Is there more I can say?
I’m hesitant to outline the situation because I don’t want to seem like I’m making an excuse, but the encryption code was turned off while our service was in pre-alpha, and the project was killed before we ever went into production.
Everyone writes bugs. Part of your job as a programmer is how you deal with those bugs. I would try outlining the situation, fixing the bug, and resubmitting your code, just like you would at the job. After that, it depends on the company and how they make their hiring decisions. If it were me, however, and you showed initiative and took responsibility by following up on and fixing the bug, I don’t know if it would be a deal breaker. In fact, it could turn a negative into a positive.