Passing IIT Bombay’s FOSSEE Quiz at 3 AM, and Walking Away

So let’s revert back some months …

I just came to know about a fellowship program by IIT Bombay, named FOSSEE. It’s just 26 hours before hitting the deadline, let’s get into it!

From the documentation, it mainly included two steps :

1. Passing the qualification exam
2. Doing a screening task (building something from a short list)

The Qualification Exam

It seemed to be a competitive programming style exam where you had to code from problem statements and it ran tests (by executing test-cases) on your written code. The twist was .. they were using their own platform.

So, I, obviously being a security enthusiast, looked for vulnerabilities. And, sadly, I found many. Such as, .. well, I’ve mailed them, so, for now, I’ll just stick with the one that anyone can see, literally, a n y o n e.

I saw that when you hit compile/run button, if it’s all good, well then, yay!
If not, it obviously came back with an oh-no message, but it also said things which normally, a platform shouldn’t. (like throwing assert error messages!)

What error, again ?

Python’s assert statement is a debugging aid that tests a condition. If the condition is true, it does nothing and your program just continues to execute. But if the assert condition evaluates to false, it raises an AssertionError exception with an optional error message.

And what exactly did the messages look like ? (It shouldn’t be too bad …)

Traceback (most recent call last):
  File "<input>", line 4680, in <module>
    (...)
AssertionError: SORRY, SIR, BUT IT LOOKS LIKE THE ANSWER IS 3.14

Yes, that bad …

It was something around 3 AM, and tomorrow I had classes from 9–5, so, obviously, I .. couldn’t resist. Come on, I was feeling sleepy!

Gaming the system

Just wrote a script (pwn.sh) which did the following :

1. Made a POST request to the entrance exam with a “trigger_payload”
2. Grabbed the response, used basic regex, extracted the answers
3. Crafted “final_payload” with the answer, sent a POST request carrying that payload
4. REPEAT, at last printing “You just passed the qualification exam, sir.”

Why all this?

I told you before, right? It’s the 18th already, it’s closing in under 21 hours and hey, don’t ask this again, remember, the clock is ticking!

To be honest, I solved most of them, but exploited a few boring and exhaustive questions. For example, (yes, this was the level of the questions)

class ArithmeticProgression:
    def __init__(self, a=1, d=1):
        self.a = a
        self.d = d
    def get(self,n):
        return (self.a + (n - 1) * self.d)
    def sum(self,n):
        return (n * (2 * self.a + (n - 1) * self.d)) / 2

There was nothing left to learn from writing that out, and the clock was ticking. So the script took care of questions like these, and I saved my hours for the screening tasks.

Okay, we’re clear with Step 1, let’s head over to Step 2

Screening Tasks

Please note that “only” those candidates who have Passed the Shortlisting Python Quiz are supposed to attempt Any One of the following Screening Tasks:

Screening Task 1: Create a Task Manager Django App
Screening Task 2: Create an Application using PyQt/Kivy
Screening Task 3: Create a Python Desktop Application
Screening Task 4: Port Given Code from Python 2 to Python 3

And those involved doing cool stuff like writing test cases, using VCS, …

The Django one, for example, was a task manager with sign-ups, teams, tasks and comments, where only the right people could view or edit each task. You had to build it in a new GitHub repository, write test cases and, this is the part to remember:

Commit your code at regular intervals by doing small incremental changes to your code (committing huge blobs of code all at once is not recommended).

Yes, it’s a fun exercise, it reminds me of Mungell’s awesome-for-beginners#python, or Tuvtran’s project-based-learning#python.

The commit history problem

You’d think “regular intervals” settles it. A few hours of work can’t pass for steady progress, and the interviewers can read the history.

Except that history is only as honest as the person who wrote it. One of the greatest and worst things about git is that we can rewrite it. Every commit carries its own dates, and a simple script can set them to anything:

> set GIT_COMMITTER_DATE="12/12/12 3:33p +0000"
> set GIT_AUTHOR_DATE="12/12/12 3:33p +0000"
> git commit --amend --no-edit

So I could have built the app by coding straight for a few hours, abused the commit history and shown the interviewers steady, regular work.

But …

That would have been unethical (in my opinion).

You can say all of this was already “bad”, and I won’t fight you on it. But there’s a line somewhere, and where it sits depends on the individual. That’s what values are. (Values, Ethics and Government course which we all have to finish this semester so…)

For me, it sat right between the two steps.

The quiz? The bad way, or maybe the intelligent way, you decide. It was a test of core programming concepts, I understood them, and I could have written every answer by hand. The script only skipped the boring part.

The screening task was different. I could have built that app too, I know Python and I’ve worked with all of the technologies. But that task was never really about knowledge. It was about commitment, and I surely didn’t have any for that fellowship. Faking a commit history would have meant lying about the one thing they were actually testing.

That program was meant for teaching fellows a good workflow. If I made the cut, I would have taken the place of someone who loved I.I.T. Bombay, dreamt about this fellowship and worked crazy for months, learning things I didn’t even want to learn.

What’s the gist?

I decided to leave the program, did not submit the screening task. That’s it.