Interview Preparation Guide: Information Security Analyst (Staff Level) at Spotify

Direct answer

Separating the person from the problem means directing your response at the specific piece of work, data, or decision, not at the person's character or competence, and replacing an evaluative claim ("this is sloppy") with an observable one (what you actually saw, and the specific gap). The reframe isn't about softening the message. It's about making the message actionable: a character judgment gives someone nothing to do but defend themselves, while a fact-based statement gives them something to fix, or something specific to correct you on.

Structured elaboration

The core move is to separate the person from the problem: respond to the specific behavior or claim, not to a judgment about who they are. In practice that means distinguishing what you actually observed from the interpretation you layered on top of it.

1. Notice the trigger. A sentence built on an inferred internal state ("you don't care," "you're not thorough") is a judgment. A sentence built on an external, checkable detail (a date, a number, a diff, a specific quote) is fact-based.
2. Convert it. Replace the internal-state claim with what you observed, the specific instance it happened in, and the concrete question or ask that follows from it.
3. Invite correction. End with a question, not a verdict, so the other person can add context you're missing rather than just defend against a conclusion.
4. Keep the pattern separate from the instance. If it's really a recurring pattern that needs addressing, that's a different, private conversation about the trend, still anchored in specific instances, not a trait.

Worked example

Two engineers are deep in a heated architecture debate over which service should own write authority. One says: "You always push for the more complex design because you want something to put on your résumé." That's a character claim with no evidence attached, and it immediately spikes the temperature in the room. If you're facilitating, the live reframe sounds like: "Let's park the why for a second and get to the tradeoff: what specific failure mode are you worried about with the shared-ownership design?" That single sentence does the work live. It drops the interpretation, restates the actual technical question, and hands the conversation back to something answerable. In this case, the redirected conversation surfaces that the real objection was about a specific consistency guarantee under partial failure, which turned out to be addressable in about an hour, not a two-day standoff about who's the better architect.

Trade-offs and pitfalls

• Overcorrecting into vagueness isn't more factual, it's less useful. "There were some concerns" doesn't identify anything a person can act on.
• This is a technique for reducing defensiveness, not for avoiding a hard message. If someone genuinely underperformed, the reframe changes how you say it, not whether you say it.
• Used mechanically, it reads as a script. The goal is genuine curiosity about what happened, not visibly following a formula in front of someone who can tell the difference.
• It assumes reasonable good faith on the other side. If someone repeatedly reframes fact-based feedback as a personal attack no matter how carefully you phrase it, that's a pattern problem, not a phrasing problem, and it needs a direct, documented conversation instead of a softer script.

Direct answer
Set the minimum personal-device requirements by what the device can reach, not by its ownership, and limit the company's management to the work data and work apps on the device. Where the EU and US differ, build to the stricter employee-privacy expectation as the global baseline and add US-only options only where there is a business reason. This is a decision for Security, Legal, HR and employee representatives together; counsel decides what is lawful in each country.

Deciding minimum requirements (risk-based tiers)

1. Define what a personal device may access. For example: email and calendar only (low risk), internal applications (medium), regulated or customer data (not allowed on personal devices).
2. Set requirements per tier.
   | Access tier | Minimum requirements |
   |---|---|
   | Email and calendar | Current supported operating system, screen lock, device encryption, work apps in a managed container (a separate, company-controlled area of the phone holding work apps and data), ability to remove work data remotely |
   | Internal applications | All of the above plus device registration, no jailbreak or root (removing the manufacturer's built-in security restrictions, which lets malware bypass protections), patch within a set window |
   | Regulated or customer data | Company-owned managed device only |
3. Separate work from personal. Use a work profile or app-level management so the company controls the work container, not the whole device.

Reconciling inspection with privacy

• Manage the container, not the person. Remote wipe applies to work data only. No access to personal photos, messages, browsing history or location unless the employee is told and counsel has approved.
• Data minimisation and purpose limitation. Data minimisation means collecting only what is needed; purpose limitation means using data only for the purpose you stated. In the EU, the General Data Protection Regulation requires collecting only what is necessary for a stated purpose; inventory and security telemetry should be the minimum needed. Article 88 lets individual EU member states add their own more specific rules for employee data, including monitoring, so rules vary by country; in practice you ask counsel which national rules apply in each country where you have staff.
• Notice and agreement. A clear policy and acknowledgement. Consent has to be freely given, and an employee who worries that refusing will affect their job is not really free to say no, so employee consent is generally an unreliable basis. A legitimate-interest assessment is a documented test that weighs the company's need (protecting company data) against the employee's privacy and concludes the monitoring is justified and no more intrusive than necessary. Rely on that for monitoring rather than consent (counsel decides the basis).
• Assess the privacy impact of any monitoring (a data protection impact assessment, DPIA: a documented risk review required where processing is likely to be high-risk) and consult employee representatives (such as works councils, elected staff bodies that some countries require employers to consult before introducing monitoring tools) where local rules require it.
• US approach: typically more employer latitude, but state laws and expectations differ, so treat the EU level as the baseline for consistency.

Offer a choice
Employees who will not accept container management get a company-owned device or no access. That keeps the privacy position defensible.

What would change the call
If the business needs access to regulated data from phones, move to company-owned devices for that group rather than loosening BYOD rules.

Direct answer: Work this as a differential diagnosis rather than jumping to conclusions: pull the actual failure reason codes, and correlate the spike's start time against three timelines (recent deploys or config changes, the affected secret's expiry or rotation schedule, and the identity of who's failing) before doing anything destructive. Each of the four causes, configuration drift, credential expiry, a service bug, or a malicious actor, leaves a different fingerprint in that correlation.

Structured elaboration:

Evidence worth collecting regardless of hypothesis: the exact error code, the calling principal's identity, source IP or network segment, and a tight time window around the first failure, then cross-reference the deploy log and the secret's rotation history for that same window.

Short-term mitigations, chosen by hypothesis rather than applied all at once:

• If it correlates with a deploy: roll back the deploy, not the secret.
• If it's expiry: extend or reissue the credential and communicate it, while checking whether this expiry was supposed to be automated and wasn't.
• If it's a bug: rate-limit or circuit-break the failing call path so it doesn't retry-storm the secrets manager; excessive retries can itself look like an attack, and can also hit the secrets manager's own rate limits, causing a second, self-inflicted outage.
• If it's malicious: revoke or rotate the specific secret and lock out the offending principal or IP immediately, rather than waiting for full attribution before containing it.

Worked example: Suppose the failure rate jumps from a near-zero baseline to a clearly elevated, sustained rate for a single internal service, right at a specific deploy timestamp, with every failure returning "access denied" (not "not found" or "malformed"), and all traffic coming from that service's own expected network range. Access-denied plus deploy-time correlation plus a single affected service points strongly at configuration drift, most likely an IAM (identity and access management) permission or role binding that changed in the same release. It rules out expiry, which would ramp up gradually rather than step-change at a deploy, and it rules out malicious access, which would typically come from an unfamiliar identity or network location rather than the service's own known range.

Trade-offs and pitfalls: Treating this as malicious before checking for a recent deploy, and locking out the service's own credentials, can turn a partial outage into a self-inflicted total one. Rotating a secret defensively before understanding why access failed risks the same thing if the new value hasn't propagated everywhere yet. And fixating on raw failure volume without normalizing against the service's own request volume can mistake more overall traffic for a genuine spike in the failure rate.

Approach
Brief sliding-window dedupe using a deque for timestamps and a dict mapping key -> last-seen timestamp. Evict entries older than window_seconds to keep memory bounded; process stream in one pass (O(n)).

Code

from collections import deque

def dedupe_alerts(alerts, window_seconds):
    """
    alerts: iterator of dicts with keys: timestamp (int), signature, src_ip, dst_ip
    yields deduplicated alerts (suppress same signature+src+dst within window)
    """
    window = deque()  # stores (timestamp, key)
    last_seen = {}    # key -> last timestamp within window

    for alert in alerts:
        ts = int(alert['timestamp'])
        key = (alert['signature'], alert['src_ip'], alert['dst_ip'])

        # Evict old entries
        cutoff = ts - window_seconds
        while window and window[0][0] <= cutoff:
            old_ts, old_key = window.popleft()
            # only remove if mapping still points to that timestamp
            if last_seen.get(old_key) == old_ts:
                del last_seen[old_key]

        # If not seen in window, yield and record
        if last_seen.get(key) is None:
            yield alert
            last_seen[key] = ts
            window.append((ts, key))

Key concepts & complexity

• O(n) time, memory proportional to active-window unique keys.
• Suitable for SIEM streaming ingest; works with out-of-order slight drift if timestamps are monotonic chronological.

Edge cases

• Non-monotonic timestamps: require buffering or sort.
• Very high cardinality within window: memory grows accordingly.

Direct answer

Credential stuffing shows up as a burst of many DISTINCT source IPs all failing authentication for one account, followed by a success from one of those SAME IPs, the "one of those same IPs" clause is what separates a genuine credential-stuffing success from an unrelated, coincidentally-timed legitimate login, and the query below is deliberately structured to keep the failing-IP set separate from the eventual success event so that distinction is enforced, not just implied.

Structured elaboration

index=auth_logs user=*
| sort 0 _time
``` stage the failing IPs into their own field so they never get confused with a later success's IP ```
| eval fail_ip = if(action="fail", src_ip, null())
| transaction user maxspan=40m startswith=eval(action="fail") endswith=eval(action="success") maxevents=100
``` eventcount includes the closing success event itself, so subtract 1 for the fail-only count ```
| eval fail_events = eventcount - 1
``` transaction aggregates fail_ip as a multivalue field; nulls (the success event's own row) drop out ```
| eval distinct_fail_ips = mvcount(mvdedup(fail_ip))
``` the success event is the LAST event transaction closed on; its src_ip is the last value of src_ip ```
| eval success_ip = mvindex(src_ip, -1)
| eval success_ip_was_a_failing_ip = if(mvfind(mvdedup(fail_ip), success_ip) >= 0, 1, 0)
| where fail_events > 5 AND distinct_fail_ips > 5 AND success_ip_was_a_failing_ip = 1
| table _time, user, fail_events, distinct_fail_ips, success_ip, duration

Stage-by-stage explanation: the eval fail_ip = if(action="fail", src_ip, null()) line stages a field that is populated ONLY on failure events and null on the success event; this is the specific mechanism that keeps "distinct IPs that FAILED" separate from "the IP that eventually SUCCEEDED," since without it, a naive mvdedup(src_ip) across the whole transaction would conflate the two. transaction ... startswith=eval(action="fail") endswith=eval(action="success") groups each user's failing burst together with the success that closes it, bounded by maxspan=40m (wider than the 10-minute failure window plus the 30-minute success window from the requirement, since transaction's span covers the WHOLE sequence start to finish). The final where clause enforces all three conditions the question specifies: more than 5 failing events, more than 5 distinct failing IPs, and that the success genuinely came from one of those SAME failing IPs, not a coincidentally-timed unrelated login.

Worked example

Python reference implementation of the identical three-condition logic, executed against four cases, including the specific "success from an unrelated IP" edge case the staged fail_ip field exists to correctly reject:

from collections import defaultdict, deque
from datetime import datetime, timedelta

FAIL_WINDOW = timedelta(minutes=10)
SUCCESS_WINDOW = timedelta(minutes=30)
DISTINCT_IP_THRESHOLD = 5

def detect(events):
    fails = defaultdict(deque)
    alerts = []
    for ts, user, ip, action in sorted(events, key=lambda e: e[0]):
        dq = fails[user]
        if action == "fail":
            dq.append((ts, ip))
            while dq and ts - dq[0][0] > FAIL_WINDOW:
                dq.popleft()
        elif action == "success":
            distinct_ips = {i for _, i in dq}
            if len(distinct_ips) > DISTINCT_IP_THRESHOLD and ip in distinct_ips and ts - dq[-1][0] <= SUCCESS_WINDOW:
                alerts.append({"user": user, "success_ip": ip, "distinct_fail_ips": len(distinct_ips)})
    return alerts

base = datetime(2026, 7, 30, 11, 0, 0)

ev1 = [(base + timedelta(seconds=i*30), "victim1", f"198.51.100.{i}", "fail") for i in range(6)]
ev1.append((base + timedelta(minutes=20), "victim1", "198.51.100.3", "success"))
print("Case 1 (TP: 6 distinct fail IPs, success from one of them within 30m):", detect(ev1))

ev3 = [(base + timedelta(seconds=i*30), "victim3", f"192.0.2.{i}", "fail") for i in range(6)]
ev3.append((base + timedelta(minutes=5), "victim3", "192.0.2.99", "success"))
print("Case 3 (TN: success from an IP that never appeared in the failing set):", detect(ev3))

ev4 = [(base + timedelta(seconds=i*30), "victim4", f"198.18.0.{i}", "fail") for i in range(6)]
ev4.append((base + timedelta(minutes=45), "victim4", "198.18.0.1", "success"))
print("Case 4 (TN: success is real, from a failing IP, but 45m later, outside the 30m success window):", detect(ev4))

Output (actually executed with python3):

Case 1 (TP: 6 distinct fail IPs, success from one of them within 30m): [{'user': 'victim1', 'success_ip': '198.51.100.3', 'distinct_fail_ips': 6}]
Case 3 (TN: success from an IP that never appeared in the failing set): []
Case 4 (TN: success is real, from a failing IP, but 45m later, outside the 30m success window): []

Case 3 is the case worth emphasizing: 6 distinct IPs genuinely failed for victim3, but the eventual successful login came from a 7th, never-before-seen IP, exactly the pattern of "some unrelated noise happened, then the legitimate user logged in normally from their own IP," which the "success came from one of the FAILING IPs" condition correctly declines to flag. A simpler query that only checked "6+ distinct failing IPs happened, AND a success happened afterward" (without tying the success specifically to one of those IPs) would have incorrectly alerted on this case.

Trade-offs and pitfalls

• maxspan=40m is a derived value, not an arbitrary one: it needs to comfortably cover the full 10-minute failure-accumulation window PLUS the 30-minute success window the requirement specifies, since transaction's span is measured from the very first event in the group to the very last, not from the end of the failure burst alone.
• Common mistake, demonstrated by Case 3 above: conflating "many failures happened, then eventually a success happened" with "the success came from one of the SAME IPs that failed." The former is a much weaker, noisier signal (ordinary background failed-login noise followed by a user's normal successful login is common and mostly benign) and would produce a materially higher false-positive rate than the latter.
• Tuning path if this proves noisy: the > 5 distinct-IP threshold is the primary tuning lever; an organization behind a large NAT gateway or shared corporate egress IP legitimately produces many "distinct source IPs" for reasons unrelated to attack (mobile carriers, rotating egress IPs), and the threshold, plus a possible IP-reputation/ASN-based enrichment layer, should be calibrated against real observed baseline noise rather than left at an untuned default.
• This detection targets a SPECIFIC pattern of credential stuffing (many distinct source IPs), which distinguishes it from a single-source brute-force pattern; an environment relying on only one of the two has a genuine coverage gap for the other.

Direct answer

A policy decision point (PDP) is the component that evaluates access policy and decides allow or deny; a policy enforcement point (PEP) sits in the request path, gathers the attributes the PDP needs, asks it for a decision, and then actually applies that decision. The PDP decides, the PEP enforces, and separating the two means you can change policy logic without touching every service that has to enforce it.

Structured elaboration

Walking through the concrete example:

1. A user's client sends a request to an internal API.
2. The PEP, commonly a sidecar proxy or an API gateway sitting in front of the service, intercepts the request before it reaches the API's own code.
3. The PEP collects attributes: who is asking (identity or token), what they are asking for (resource, action), and context (device posture, time, source network).
4. The PEP forwards those attributes to the PDP, either over the network or via a local policy evaluation call.
5. The PDP evaluates the applicable policy against those attributes and returns a decision: allow, deny, or allow-with-conditions, such as requiring step-up authentication.
6. The PEP enforces that decision, forwarding the request to the internal API if allowed, or returning an error response if denied.

Caching and latency considerations: every request that follows this flow adds at least one extra hop, PEP to PDP, before the real work even starts. If the PDP is remote and every decision requires a fresh network round trip, that hop can become the largest single contributor to the request's total latency, sometimes larger than the actual business logic. The standard fix is caching at the PEP: either the whole allow or deny result for a short time-to-live (TTL), or, more scalable, caching just the policy rules locally and evaluating them in-process without a network call at all. Caching introduces a staleness trade-off: a decision or policy cached for, say, 30 seconds can still honor a permission that was revoked seconds after the cache was populated, such as a terminated employee's access. The mitigation is either a short TTL for anything security-sensitive, or an active invalidation mechanism where the PDP pushes urgent changes to PEPs immediately rather than relying purely on expiry.

Worked example

Suppose a call to the PDP over the network takes a few milliseconds round trip. If a single user action fans out into three internal calls, each independently checked at its own PEP, that adds roughly three PDP round trips of latency stacked on top of the actual work, which can dominate the cost of an otherwise lightweight request. If each PEP instead evaluates policy against a locally cached policy set refreshed every few seconds, rather than calling the PDP synchronously per request, the per-call cost drops to an in-process check, and the three-hop request only pays for infrequent background policy refreshes instead of three live network round trips.

Trade-offs and pitfalls

Over-aggressive local caching without a way to push urgent revocations, a fired employee, a leaked service credential, is the most common mistake: a fast system enforcing a decision it has not actually re-checked recently is not doing continuous authorization, it is doing periodic authorization with a fast cache in front of it.

Direct answer: with a fixed remediation budget, weight each finding's Common Vulnerability Scoring System (CVSS) base score by a simple asset-criticality multiplier and rank by the product. Using a documented mapping of high, medium, and low criticality to numeric weights of 1.0, 0.6, and 0.3, the public database ranks first, the internal load balancer second, and the dev virtual machine (VM) last, even though the dev VM shares the same raw CVSS score as the top-ranked item.

Structured elaboration:
$\text{Priority} = \text{CVSS} \times w_{\text{criticality}}, \qquad w_{\text{criticality}} \in \{1.0 \text{ (high)},\ 0.6 \text{ (medium)},\ 0.3 \text{ (low)}\}$
This is deliberately the simplest possible model that still fixes CVSS-only ranking's core problem: it can't tell a public database from a disposable development machine when they share a score. The weights themselves are a starting convention, not a law of nature; a team could just as reasonably use 1.0/0.5/0.2, and what matters more than the exact numbers is that the mapping is written down and applied consistently rather than argued about case by case.

Worked example, applying the formula to the three findings:
$\text{PublicDB} = 9.1 \times 1.0 = 9.1$
$\text{DevVM} = 9.1 \times 0.3 = 2.73$
$\text{InternalLB} = 6.5 \times 0.6 = 3.9$
Ranked by priority score: the public database (9.1) first, the internal load balancer (3.9) second, and the dev VM (2.73) last. The load balancer's lower raw CVSS score (6.5 versus the dev VM's 9.1) is more than offset by its higher criticality weight, which is exactly the reordering this simple model is meant to produce.

Trade-offs and pitfalls: this model still has real blind spots it deliberately trades away for simplicity: it says nothing about exposure (a dev VM that's accidentally internet-reachable is far more urgent than this ranking suggests) and nothing about active exploitation. It's a reasonable first step up from raw CVSS sorting, and a natural next question is what other signals you'd fold in once this simple version is in place.

Threat-modeling the pipeline itself, rather than the application it ships, means treating the pipeline as a genuinely privileged system in its own right, since it routinely holds the credentials needed to deploy to production and often runs code it doesn't fully trust.

Assets and trust boundaries

The key assets are: the source repository (what determines what gets built), the CI runners (which execute arbitrary build-defined code), the secrets and signing keys the pipeline holds, and the artifact registry and deployment target (the ultimate destination an attacker wants to reach). Trust boundaries sit wherever untrusted or less-trusted input meets a more-trusted execution context: an external contributor's pull request meeting a runner that has repository write access or secrets access is the sharpest boundary, since a malicious PR is attacker-controlled input running inside a context that may hold real credentials.

Likely attackers and top threats

A plausible attacker profile ranges from an external contributor submitting a malicious pull request, to an attacker who has compromised a legitimate contributor's credentials, to an attacker who has compromised a third-party dependency or CI action the pipeline trusts. The top five threats, roughly in order of how often they show up in real incidents: (1) runner compromise via a malicious build step, letting an attacker read whatever secrets that runner had; (2) supply-chain poisoning via a compromised dependency or third-party action; (3) a malicious pull request triggering a workflow with elevated permissions (the poisoned-pipeline-execution pattern, particularly via triggers like pull_request_target that grant a fork's PR access to secrets); (4) leaked long-lived credentials granting broader access than a short-lived credential would; (5) a compromised signing key letting an attacker produce artifacts that appear legitimately trusted.

Mitigations, prioritized by impact and effort

Highest impact, lowest effort: pin all third-party actions to an immutable commit SHA (addresses threat 2 directly, cheap to implement, no ongoing operational cost). Next: avoid or tightly restrict dangerous trigger patterns like pull_request_target for anything that doesn't strictly need it (addresses threat 3, requires an audit of existing workflows but no new infrastructure). Then: move to ephemeral, least-privilege runners and short-lived, scoped credentials (addresses threats 1 and 4, moderate effort since it may require re-architecting how credentials are issued). Highest effort, addressing the residual risk in threat 5: keyless, OIDC (OpenID Connect)-backed signing removes the long-lived signing key from the picture entirely, closing that threat at the cost of migrating existing signing infrastructure.

Trade-offs

Prioritizing by impact-versus-effort rather than tackling every threat with equal urgency means some real risk (the signing-key compromise threat) stays partially open longer, since it's genuinely the most expensive to fully close; that's an honest, deliberate sequencing choice rather than an oversight, made explicit so stakeholders understand exactly what residual risk remains at each stage of the rollout.

Clarify goals & constraints
Share reliable detection rules, playbooks, lessons across 3 sites, 20 analysts with low friction, auditable changes, and measurable adoption.

High-level process

• Central repo (Git) + lightweight web UI (Confluence/SharePoint or Markdown site) as source of truth.
• CI pipeline validates rules against test harness (unit tests / SIEM sandbox) before merge.

Templates

• Detection Rule template: Name, TTP mapping (MITRE), logic, false-positive notes, test cases, owner, tags, risk score.
• Playbook template: Trigger, pre-reqs, step-by-step actions, escalation matrix, rollback, artifacts to collect, estimated time.
• Incident Lessons template: Summary, root cause, detection gap, remediation, follow-up actions, owners, implementation date.

Review cadence & governance

• Peer review on every PR; weekly triage meeting per site + monthly cross-site sync for prioritization.
• Quarterly tabletop to validate playbooks.

Versioning & traceability

• Git semantic versioning for rule sets, change log in commits, signed commits for approvals, tag releases for production deploys.

Onboarding flow

• Day 1: access to repo + sandbox; 3-day self-study using curated playbooks; week 1: shadowing on live incidents; 30/60/90 checklist to author first small rule.
• Mentor assigned per site.

Automation for distribution

• CI pushes validated rule releases to SIEM via API, feature flags for phased rollout, Slack/Teams notifications on releases, automated running of test cases nightly.

KPIs

• Adoption: % of analysts using central playbooks (tool telemetry), time-to-first-use for new hires.
• Effectiveness: mean time to detect/respond (MTTD/MTTR) pre/post release, false positive rate per rule, rule coverage of incident types, number of lessons closed/actioned.
• Process health: PR lead time, review backlog, test pass rate.

This balances lightweight use with governance, automation, and measurable outcomes appropriate for a 20-person distributed SOC.

Approach (brief)

Use a rolling 10-minute tumbling window with streamstats to count unique failed-login events per source (IP/host) while deduplicating identical events (same host, target account, timestamp or event_id). Then filter hosts with >100 failed attempts in any 10m window and return top 5 target accounts.

index=auth sourcetype=* (action=failed OR result=failure) 
| eval offending_host=coalesce(src_ip, host)
| dedup offending_host user _time event_id
| bucket _time span=10m
| stats count AS failed_count latest(_time) AS window_end earliest(_time) AS window_start by offending_host _time
| where failed_count > 100
| eventstats list(user) AS accounts by offending_host _time
| eval top_accounts = mvindex(mvsort(mvuniq(accounts), -1), 0,4)
| table offending_host window_start window_end failed_count top_accounts

Clause explanations

• index/sourcetype/filter: limit to auth failure events.
• eval offending_host: normalize IP/host field.
• dedup: remove duplicate records per host/user/time/event_id to avoid inflated counts.
• bucket _time span=10m: groups events into consistent 10-minute windows.
• stats ... by offending_host _time: counts failures per host per window; earliest/latest produce window bounds.
• where failed_count > 100: detection threshold.
• eventstats list(user): collect target accounts; mvuniq + mvsort then mvindex extracts top 5.
• table: output requested fields.

Notes

• For sliding-window behavior, replace bucket+stats with streamstats window=600 and a time-based eval if needed.
• Ensure event_id or _raw fingerprinting exists for reliable deduplication.