It's Canonical. The company that literally asks for high school grades and a multi-page essay on any job application and will pass if you're not in the 99th percentile of year 9 maths even while requiring many years experience (which means you probably don't even know what your year 9 maths scores were). All the while they pay a fraction of any other Bay Area tech company.
What i just described isn't a joke or an exaggeration either. It's literally part of the application process and you can look this up.
Anyway they are quite simply hopelessly mismanaged and no one should be touching Canonical products at this point.
I worked there for a couple years. IMO, the hiring process holds Canonical back from scaling like a typical tech co, but they probably don't want to. It also attracts a very specific type of person; everyone I personally worked with was very bright and capable.
IME, because of pay, they have a hard time retaining "senior" talent, eg Nvidia, Chainguard, Amutable, Lambda, etc etc etc all have lots and lots of senior+ Canonical engineers. Especially in the age of AI, I think this is a "people-strategy" mistake.
The application process is very long and you absolutely lose great candidates because of it. Salaries are not US-tech competitive, but absolutely are Central/South America and Europe competitive. Lots of great Brazilian and Polish engineers, for example.
Also I have never seen a post on HN, Reddit etc about Canonical/Ubuntu that doesn't complain about hiring process. I think it does a pretty incredible amount of damage to the brand.
> It also attracts a very specific type of person; everyone I personally worked with was very bright and capable.
I don't know anyone at canonical personally, so I have no specific opinion. However. This smells like the same bullshit peddled by any tech company's hiring policy but executed less competently.
can confirm, interviewing there was unpleasant and demanded a ridiculous amount of work before ever getting to talk to a human. There was a post on HN a little while back about someone who made it much further along in the process: https://news.ycombinator.com/item?id=44149549
Yeah, I did try applying to them a year or so ago and got a lot of those questions too. The really weird thing to me (and what confuses me) is why exactly they want these questions? How exactly is someone supposed to share their "rationale or evidence for the high school performance selections above" when the "grades" for maths/native language is decided by the institution/teacher doing the grading and not by the student? And, even better: why exactly does Canonical need this information at all? I'm pretty sure that it's well-understood that your grades in high school (let alone college) say absolutely nothing about you today. And there are many, many, many reasons why someone in HS or college might perform poorly but in actuality they're brilliant and very capable.
Shuttleworth is rich and Ubuntu/Canonical is his personal feudal holding. They basically can do whatever dumb thing they want and none of it actually matters because they don't really need to respond to market forces.
I've worked for one of these businesses before - basically staffing a daycare running a very compelling roleplay scenario so a millionaire/billionaire has an excuse to get away from their family for 10 hours a day. It works best if you're a fresh grad college kid who doesn't realize any of that for a few years and is just glad to have gotten a job.
So, the actual intent of all of their hiring circus is to ensure they don't accidentally hire someone who realizes what's going on.
Can you share the backstory behind your gripe, this comment feels oddly specific to what appears unrelated to someone outside who doesn't know what you know. Makes me think there's some personal and deeper roots behind it
Not OP, but why is it unrelated? Hiring practices and salaries are very much related to staff working in a company. A lot of people just refuse to jump through the hoops when they have a choice where to work. People willing to do so will just go to FAANG to maximize TC. That leaves us with a more desperate and less qualified pool of candidates. I doubt many people dream about working in Canonical, it isn't Google from decades ago.
It's pretty straightforward, go have a look at their careers site and application form. What parent is saying I believe is that they're leaving a lot of talent on the table because of questionable hiring practices; talent that would help proactively (or at least reactively) mitigate things like this.
It's because Canonical spams LinkedIn with tens of thousands of job posts (despite only having ~1800 employees) because they put ads for the same remote job listing in hundreds of different cities. As a result, basically anyone who's ever looked for a tech job on LinkedIn has at least looked at the first step of Canonical's job application process (including where it asks about how well you did at math in high school, your SAT scores, your college class ranking and GPA, etc).
I don't currently nor have ever even worked in the industry but have heard so many stories so often about this sort of thing it is now permanently associated whenever the name Canonical comes up.
Look it up so it isn't just coming from me. It's a quick Google "Canonical hiring process" and there's no shortage of wait wtf was that type of posts on this. You can also go on their website and try to apply for any job just to be further shocked.
They ask for; A massive multi-choice questionaire. A massive free form list of questions. An ask for an essay. Grades from High school through to University. That's to start the process of many rounds of interviews followed by finally an interview with Mark Shuttleworth himself who's known to say no on vibes.
Personally i applied for a senior management role after ~30years working at multiple other very large and well known companies. The pay at canonical was literally 1/5th but i was curious. I was honest about my high school scores and immediately given a thanks for your time but we will pass dialog on their website after stating maths scores in year 9. I'm not even fucking kidding. Obviously i was gobsmacked. It was a blessing to get knocked back that early all things considered.
We're talking put him in a straightjacket loony tunes type of shit when it comes to Shuttleworth. You can also look up various personal interactions. It's utterly fucking insane.
I have no particular insight into Canonical's problems, but all large companies "ship their org chart" to some degree. Insofar as Canonical has abstruse hiring practices, it stands to reason that practical failures to perform adequate security responses are downstream of those practices.
It's common. I interviewed there years ago - full rebel, did not provide them my transcripts, grades etc. Last interview supposedly is run by Shuttleworth himself. Anyway, got a better gig meanwhile.
To be fair i did get knocked back but not at all butthurt since it was at the very first stage on the application after filling in high school maths scores from ~40 years ago in a country that doesn't even have GPAs (so i have no idea what to even enter in that box).
The knockback didn't hurt. It just made me think Canonical was lead by a lunatic and a quick Google will confirm this.
Reminds me of Epic (healthcare company). I was close to finishing grad school, and they wanted my SAT scores. When I gave it to them, they couldn't stop gushing. I wanted to wash my hands with a lot of soap at that point.
In the US, businesses ask for it because the SAT serves (or used to serve) as a decent proxy for IQ. A business cannot ask an applicant to take an intelligence aptitude test without a lot of extra cost to ensure the business complies with Griggs v. Duke Power Co (1971), so the cheaper workaround is to ask for SAT scores in conjunction with other proxies such as the school into which you were able to gain admission.
> In the US, businesses ask for it because the SAT serves (or used to serve) as a decent proxy for IQ. A business cannot ask an applicant to take an intelligence aptitude test without a lot of extra cost
Epic actually did (does?) administer a full blown "entrance exam" - generic problem solving skills, with some basic coding and math stuff. They literally arrange with the university to administer it in a classroom setting. So yeah, kind of like an aptitude test.
I actually don't mind that, as it ensures all applicants are being judged on a level field.
It's quite rare for people graduating with a BS to be quizzed about SAT scores - the focus tends to be more on GPA, etc. But asking for SAT scores when you've been in grad school for so long...? Kind of ridiculous. And if you are going to ask, might as well ask for the GRE scores instead.
They also did (do?) a full personality quiz. You know, the type where they give you a scenario, and say are you more of A or B, and you often find yourself to be neither or both...
Haha, I remember years ago I did apply there but as soon as I saw the high school questions I just closed the page. Always pay attention to these red flags
I just love that this is always one of the top comments when it comes to Canonical.
"Nah, let's not build up our technical street cred by doing stuff right, we'll torpedo that by making bizarre aspects of our culture stick in people's minds. Success!"
And just for full disclosure, I've never applied or have went through their process, all I know about it is second-hand through comments like these. It's just a terrible look to have that be what people think about your company.
Feels like India approach where they will ask high school certificates and every personal details like marriage, family history and things like that lol.
I wonder why they stop at high school grades. I don’t touch distros unless their engineers had perfect grades throughout elementary and middle school /s
One could pull them down at any point in the last week. Yesterday afternoon they were still in "proposed", but I checked this morning (EST/UTC-5) and they there were in "updates". Some tracking of timeline of when the updates to the repos happened seems to be available at:
Seems like a good time to ask: what do people use, if not ubuntu, on a web server? Like for example for a rails app, on EC2... asking for a friend (who is me).
Ubuntu has been the easy default for things like WSL (Windows Subsystem for Linux) for my coding on Windows, and a linux VM on my home server. But I don't really like the idea of having a distro that doesn't treat security patching with urgency in the age of AI-fueled exploits. Need a standard distro with decent hardware support, low churn, and fast patching.
People are saying Debian. What are the tradeoffs? (other than faster patching on Debian of course)
I haven't had a documented packet with IPOptions arrive on any of my firewalls, the packets are typically dropped, so exploiting remotely is going to be very difficult. In theory you could use another exploit and then lateral move in some networks which don't drop them at a router level.
Since October 26 (noble) and 28 (resolute), when the kernel versions in question hit "proposed". November 2 is just the weblog post, but the solution was available the week before.
My understanding is that everyone gets this at the same time.
Ubuntu Pro provides security updates for packages that wouldn't otherwise be supported by Canonical at a given point in time. If your version of Ubuntu is still within the (non-extended) support period, kernel security updates are always provided regardless of Pro.
Ubuntu is the only Linux distro with an LTS release that has not patched this issue, so saying this is a problem with LTS distro kernels in general is categorically false.
This is not a problem with Debian LTS, you’re getting timely security updates. Debian fixed this vulnerability three weeks ago within two days: https://www.debian.org/lts/security/
It's Canonical. The company that literally asks for high school grades and a multi-page essay on any job application and will pass if you're not in the 99th percentile of year 9 maths even while requiring many years experience (which means you probably don't even know what your year 9 maths scores were). All the while they pay a fraction of any other Bay Area tech company.
What i just described isn't a joke or an exaggeration either. It's literally part of the application process and you can look this up.
Anyway they are quite simply hopelessly mismanaged and no one should be touching Canonical products at this point.
I worked there for a couple years. IMO, the hiring process holds Canonical back from scaling like a typical tech co, but they probably don't want to. It also attracts a very specific type of person; everyone I personally worked with was very bright and capable.
IME, because of pay, they have a hard time retaining "senior" talent, eg Nvidia, Chainguard, Amutable, Lambda, etc etc etc all have lots and lots of senior+ Canonical engineers. Especially in the age of AI, I think this is a "people-strategy" mistake.
The application process is very long and you absolutely lose great candidates because of it. Salaries are not US-tech competitive, but absolutely are Central/South America and Europe competitive. Lots of great Brazilian and Polish engineers, for example.
Also I have never seen a post on HN, Reddit etc about Canonical/Ubuntu that doesn't complain about hiring process. I think it does a pretty incredible amount of damage to the brand.
> It also attracts a very specific type of person; everyone I personally worked with was very bright and capable.
How well did you and your colleagues do at math in high school?
I wonder why these bright abd capable people didn't join a company that actually pays reasonably.
> Salaries are not US-tech competitive, but absolutely are Central/South America and Europe competitive.
Don't their salary bands change between countries? They're offering 55k-ish to a Senior SWE in France, which is a low-ball offer even there.
If they're so bright and capable why can't they patch their OS?
> It also attracts a very specific type of person; everyone I personally worked with was very bright and capable.
I don't know anyone at canonical personally, so I have no specific opinion. However. This smells like the same bullshit peddled by any tech company's hiring policy but executed less competently.
can confirm, interviewing there was unpleasant and demanded a ridiculous amount of work before ever getting to talk to a human. There was a post on HN a little while back about someone who made it much further along in the process: https://news.ycombinator.com/item?id=44149549
Made me happy I was cut loose early.
Yeah, I did try applying to them a year or so ago and got a lot of those questions too. The really weird thing to me (and what confuses me) is why exactly they want these questions? How exactly is someone supposed to share their "rationale or evidence for the high school performance selections above" when the "grades" for maths/native language is decided by the institution/teacher doing the grading and not by the student? And, even better: why exactly does Canonical need this information at all? I'm pretty sure that it's well-understood that your grades in high school (let alone college) say absolutely nothing about you today. And there are many, many, many reasons why someone in HS or college might perform poorly but in actuality they're brilliant and very capable.
Shuttleworth is rich and Ubuntu/Canonical is his personal feudal holding. They basically can do whatever dumb thing they want and none of it actually matters because they don't really need to respond to market forces.
I've worked for one of these businesses before - basically staffing a daycare running a very compelling roleplay scenario so a millionaire/billionaire has an excuse to get away from their family for 10 hours a day. It works best if you're a fresh grad college kid who doesn't realize any of that for a few years and is just glad to have gotten a job.
So, the actual intent of all of their hiring circus is to ensure they don't accidentally hire someone who realizes what's going on.
Can you share the backstory behind your gripe, this comment feels oddly specific to what appears unrelated to someone outside who doesn't know what you know. Makes me think there's some personal and deeper roots behind it
EDIT: I'm shocked.
Not OP, but why is it unrelated? Hiring practices and salaries are very much related to staff working in a company. A lot of people just refuse to jump through the hoops when they have a choice where to work. People willing to do so will just go to FAANG to maximize TC. That leaves us with a more desperate and less qualified pool of candidates. I doubt many people dream about working in Canonical, it isn't Google from decades ago.
It's pretty straightforward, go have a look at their careers site and application form. What parent is saying I believe is that they're leaving a lot of talent on the table because of questionable hiring practices; talent that would help proactively (or at least reactively) mitigate things like this.
It's because Canonical spams LinkedIn with tens of thousands of job posts (despite only having ~1800 employees) because they put ads for the same remote job listing in hundreds of different cities. As a result, basically anyone who's ever looked for a tech job on LinkedIn has at least looked at the first step of Canonical's job application process (including where it asks about how well you did at math in high school, your SAT scores, your college class ranking and GPA, etc).
I don't currently nor have ever even worked in the industry but have heard so many stories so often about this sort of thing it is now permanently associated whenever the name Canonical comes up.
Look it up so it isn't just coming from me. It's a quick Google "Canonical hiring process" and there's no shortage of wait wtf was that type of posts on this. You can also go on their website and try to apply for any job just to be further shocked.
They ask for; A massive multi-choice questionaire. A massive free form list of questions. An ask for an essay. Grades from High school through to University. That's to start the process of many rounds of interviews followed by finally an interview with Mark Shuttleworth himself who's known to say no on vibes.
Personally i applied for a senior management role after ~30years working at multiple other very large and well known companies. The pay at canonical was literally 1/5th but i was curious. I was honest about my high school scores and immediately given a thanks for your time but we will pass dialog on their website after stating maths scores in year 9. I'm not even fucking kidding. Obviously i was gobsmacked. It was a blessing to get knocked back that early all things considered.
Not my post but has more detail and matches what i saw. Be amazed at the insanity in the leadership at Canonical that allows for this; https://www.reddit.com/r/recruitinghell/comments/15kj845/can...
We're talking put him in a straightjacket loony tunes type of shit when it comes to Shuttleworth. You can also look up various personal interactions. It's utterly fucking insane.
> What sort of high school student were you?
What sort of answer are they looking for here?
You'd think space-faring South African billionaire would be Musk, but no.
I have no particular insight into Canonical's problems, but all large companies "ship their org chart" to some degree. Insofar as Canonical has abstruse hiring practices, it stands to reason that practical failures to perform adequate security responses are downstream of those practices.
It's common. I interviewed there years ago - full rebel, did not provide them my transcripts, grades etc. Last interview supposedly is run by Shuttleworth himself. Anyway, got a better gig meanwhile.
Just go interview there and you'll learn all about it for yourself.
Lol what an infuriating comment. "you must be butthurt from your interview"
To be fair i did get knocked back but not at all butthurt since it was at the very first stage on the application after filling in high school maths scores from ~40 years ago in a country that doesn't even have GPAs (so i have no idea what to even enter in that box).
The knockback didn't hurt. It just made me think Canonical was lead by a lunatic and a quick Google will confirm this.
Canonical is looking for bureaucrats, so at least they are honest in the hiring process. Look at the Canonical people on the Debian lists.
High school grades? That's pretty wild man.
Reminds me of Epic (healthcare company). I was close to finishing grad school, and they wanted my SAT scores. When I gave it to them, they couldn't stop gushing. I wanted to wash my hands with a lot of soap at that point.
In the US, businesses ask for it because the SAT serves (or used to serve) as a decent proxy for IQ. A business cannot ask an applicant to take an intelligence aptitude test without a lot of extra cost to ensure the business complies with Griggs v. Duke Power Co (1971), so the cheaper workaround is to ask for SAT scores in conjunction with other proxies such as the school into which you were able to gain admission.
> In the US, businesses ask for it because the SAT serves (or used to serve) as a decent proxy for IQ. A business cannot ask an applicant to take an intelligence aptitude test without a lot of extra cost
Epic actually did (does?) administer a full blown "entrance exam" - generic problem solving skills, with some basic coding and math stuff. They literally arrange with the university to administer it in a classroom setting. So yeah, kind of like an aptitude test.
See https://pigment.is/blogs/blogs/epic-systems-skills-assessmen...
I actually don't mind that, as it ensures all applicants are being judged on a level field.
It's quite rare for people graduating with a BS to be quizzed about SAT scores - the focus tends to be more on GPA, etc. But asking for SAT scores when you've been in grad school for so long...? Kind of ridiculous. And if you are going to ask, might as well ask for the GRE scores instead.
They also did (do?) a full personality quiz. You know, the type where they give you a scenario, and say are you more of A or B, and you often find yourself to be neither or both...
Haha, I remember years ago I did apply there but as soon as I saw the high school questions I just closed the page. Always pay attention to these red flags
I just love that this is always one of the top comments when it comes to Canonical.
"Nah, let's not build up our technical street cred by doing stuff right, we'll torpedo that by making bizarre aspects of our culture stick in people's minds. Success!"
And just for full disclosure, I've never applied or have went through their process, all I know about it is second-hand through comments like these. It's just a terrible look to have that be what people think about your company.
Feels like India approach where they will ask high school certificates and every personal details like marriage, family history and things like that lol.
Indian corporate has problems but this doesn't seem to be true apart from standard background checks (a la HireRight).
I wonder why they stop at high school grades. I don’t touch distros unless their engineers had perfect grades throughout elementary and middle school /s
As outlined in this weblog post:
* https://ubuntu.com/blog/fixes-available-in-proposed-pocket-f...
The fixes were in the "proposed" repo since October 26 (noble) and 28 (resolute):
* https://launchpad.net/ubuntu/+source/linux
One could pull them down at any point in the last week. Yesterday afternoon they were still in "proposed", but I checked this morning (EST/UTC-5) and they there were in "updates". Some tracking of timeline of when the updates to the repos happened seems to be available at:
* https://ma.ttias.be/linux-cve-2026-98432-vulnerable-kernels/
The kernels goes through an QA testing processes, and per this September post, they're looking at shortening the timeframe for kernel updates:
* https://canonical.com/blog/accelerating-delivery-of-cve-fixe...
Seems like a good time to ask: what do people use, if not ubuntu, on a web server? Like for example for a rails app, on EC2... asking for a friend (who is me).
Ubuntu has been the easy default for things like WSL (Windows Subsystem for Linux) for my coding on Windows, and a linux VM on my home server. But I don't really like the idea of having a distro that doesn't treat security patching with urgency in the age of AI-fueled exploits. Need a standard distro with decent hardware support, low churn, and fast patching.
People are saying Debian. What are the tradeoffs? (other than faster patching on Debian of course)
Rocky Linux. But I've built my career working with RHEL-compatible/derivative distros like CentOS, Fedora.
I personally use Debian both on my servers and desktops, for the last 15 years or so.
Marketing, man. Ubuntu did more for Linux than a lot of other things by just lowering the bar of entry.
I switched back to Debian.
Me too
I think debian is a polular choice
FreeBSD
You were wrong to have confidence in Ubuntu before this, you are doubly wrong for it to still be "shaking your confidence".
You are expecting some quality that was never there. Visibly so.
According to Canonical product team, fixed Ubuntu kernel is at proposed:
https://news.ycombinator.com/item?id=50348688
Or install newest mainline test kernel, but it had less testing, YMMV:
https://news.ycombinator.com/item?id=50358616
Has there been a documented exploit of this CVE on Ubuntu or on the other distros before they were patched?
Here’s the real answer. It’s not as scary as the original reporters made it out to be.
I haven't had a documented packet with IPOptions arrive on any of my firewalls, the packets are typically dropped, so exploiting remotely is going to be very difficult. In theory you could use another exploit and then lateral move in some networks which don't drop them at a router level.
it's rolling out..
https://ma.ttias.be/linux-cve-2026-98432-vulnerable-kernels/
Aren't the patches out since a day?
Holy crap, they are showing in apt… why in the world wouldn’t they update the dang CVE page?!
I agree though, this took too long.
Thank you for this! Finally patched
Likely needs a human from another department to press a button, and they have not "synced" with the team publishing the patch.
They need to "stack hands" and "gain alignment". ( i work in consulting :P )
I was asking "what in the world is taking Ubuntu so long" back in 2006.
There has been a workaround available since nov 2: https://ubuntu.com/blog/fixes-available-in-proposed-pocket-f...
The fix is to install Debian
Or build your own kernel from kernel.org and install that. I moved one of my Ubuntu dev boxes to 7.3.1.
Maybe... IBM RHEL. Or Arch. Or NixOS. Or Fedora. Anything that doesn't ship apt.
They all had flaws and holes in their package manager in the past, or how are they magically 100% secure?
> since nov 2
Since October 26 (noble) and 28 (resolute), when the kernel versions in question hit "proposed". November 2 is just the weblog post, but the solution was available the week before.
Maybe the patch is going through their interview process?
Does Ubuntu Pro get this fix any sooner, or is it the same for everyone?
My understanding is that everyone gets this at the same time.
Ubuntu Pro provides security updates for packages that wouldn't otherwise be supported by Canonical at a given point in time. If your version of Ubuntu is still within the (non-extended) support period, kernel security updates are always provided regardless of Pro.
Discussion:
WTF Ubuntu?
https://news.ycombinator.com/item?id=50337608
This is a problem with LTS distro kernels in general. You're trading the feeling of stability at the kernel level for security updates.
Ubuntu is the only Linux distro with an LTS release that has not patched this issue, so saying this is a problem with LTS distro kernels in general is categorically false.
This is not a problem with Debian LTS, you’re getting timely security updates. Debian fixed this vulnerability three weeks ago within two days: https://www.debian.org/lts/security/
LTS distros can track the LTS kernels and they’ve all been updated
For Ubuntu it was _all_ their kernels though...