I am not necessarily asking for thoughtcrime, if that's what you mean. Technology is ripe for benefits and abuse. It's all about the manner in which it is used. For example, can we use sensors and networking on mobile devices to create a distributed system to reliably detect traces of bomb chemicals in the air?
This title is quite broad. There is plenty of open research into software security. It seems you're referring to open development of fuzzing tools. I am not really convinced that any kind of after-the-fact testing is the ultimate mechanism for making security guarantees. It's simply inherently flawed. I'm sure you make a lot of good discoveries with it, but when you're talking about 100% confidence I'd highly doubt it's going to happen. And in security, the difference between 100% soundness versus anything less is huge.
I have an interest in many things, especially privacy. I've used DDG primarily for years (even before the NSA leaks). I do like the idea of improving the product, but as another commenter pointed out, one can have many passions with much more limited time.
While applying for a job doesn't guarantee a return like you said, it's necessary investment so that companies can pick the best fit. This extra requirement, working on their platform to directly improve their service with no compensation before you can even apply, is what I view as bad practice. People can be deeply interested in something without having already directly contributed to it.
Would you view this in the same way if Google started adopting this process?
My opinion: Though I do respect the company so far, I view this as a negative requirement. I tried to frame the question so as to not prime everyone for a negative perception.
I've seen applications that require you to go through some challenge(s) before you can submit an application. I don't necessarily see that as a negative because it can be used to measure a real example of an applicants skill (assuming they legitimately solved it).
I've also had the impression that Mozilla, for example, wants you to have a history of open-source work, especially on Mozilla products. If this is an expectation, I don't necessarily see this as a bad thing because they are not a for-profit organization.
I understand the challenges DuckDuckGo must be facing to establish a sustainable business model while maintaining a commitment to user privacy. However, they are still a for-profit company, and this requirement in the application process seems to do little to demonstrate an applicant's skill, but instead it directly benefits DuckDuckGo financially because it increases the power of their product, at the sole expense of the applicant who I imagine is very unlikely to get hired, considering the popularity of their website versus the size of their team.
This turned me off from applying to the company, even though I'd love to work with them. A quality job search already requires so much time, and I don't want to do work for free when I know it's probably a long-shot from being hired anyway. That factor is compounded when the want you to just be a contractor for a few months at first and then decide whether they actually want to hire you.
I was curious as to how the HN community views this practice in general. If you view this as ethical, then do you view it as a "good" practice, or something that's likely to dissuade quality applicants?