3 ms·

Yeah, I get the economics of it, which unfortunately can be a good deal for the company. They get numerous people working on a hard problem for basically free.

by meritt 11y ago

Yeah, I get the economics of it, which unfortunately can be a good deal for the company. They get numerous people working on a hard problem for basically free. And most of us do it purely for the challenge and fun, so the reward (if any) is oftentimes irrelevant. It's just there's such a large market for this sort of information (and I'm not talking about stolen credit cards, spam, fraud. Competitive intelligence is a huge industry) and there are many full-time security engineers whose only job is to find the holes some company is trying to outsource to bored programmers.

yeukhon 11y ago
I have extremely limited professional experience being in the security engineering industry, but my impression of a typical security engineer within a tech company: * advocate and standardize security practice in software development and throughout the company (if you don't have a separate IT/enterprise security team) * write automation to enhance your security enforcement/checks prior to production deployment (check if server is running outdated kernel? nodejs version? password committed? basic web vulnerability checks? Security headers like HSTS present?) * act as a consultant in product development (e.g. we handle this data and here is how we plan to use it, do you have any concerns and recommendations)? * code review (besides regular product code review, most of the time there are ad-hoc request from engineers - "hey we need your expertise on writing this feature"), or because the code looks hot ("have been exploited before") and needs a sign off from a security engineer. It is very rare to see someone in a major tech company spend the entire day reviewing code to find vulnerable bugs. You'd spend the whole day running through ASan, UBsan, bunch of fuzzers, whatever, wait for potential exploits to pop up, then you start analyzing the vulnerability, At least that's my understanding, but feel free to shine light.

by meritt 11y ago

yeukhon 11y ago

I have extremely limited professional experience being in the security engineering industry, but my impression of a typical security engineer within a tech company: * advocate and standardize security practice in software development and throughout the company (if you don't have a separate IT/enterprise security team) * write automation to enhance your security enforcement/checks prior to production deployment (check if server is running outdated kernel? nodejs version? password committed? basic web vulnerability checks? Security headers like HSTS present?) * act as a consultant in product development (e.g. we handle this data and here is how we plan to use it, do you have any concerns and recommendations)? * code review (besides regular product code review, most of the time there are ad-hoc request from engineers - "hey we need your expertise on writing this feature"), or because the code looks hot ("have been exploited before") and needs a sign off from a security engineer. It is very rare to see someone in a major tech company spend the entire day reviewing code to find vulnerable bugs. You'd spend the whole day running through ASan, UBsan, bunch of fuzzers, whatever, wait for potential exploits to pop up, then you start analyzing the vulnerability, At least that's my understanding, but feel free to shine light.