3 ms·

I transitioned from writing trading software to writing software to secure networks (with a brief startup co-founding stint.) Here's my biased, objective, and a

I transitioned from writing trading software to writing software to secure networks (with a brief startup co-founding stint.) Here's my biased, objective, and anecdotal opinion. Security is just another knowledge domain. More than any other domain, security has a clear divide between understanding the math behind cryptography (primes, elliptic curves...), understanding how to implement correct and high-performance code (sse4, avx,simd..), and high-level use of crypto implementations to create secure protocols (diffie-hellman, tls...) On top of that there's a new category that's emerging in the field of what I would call embedded/root of trust security in the form of SGX and TPM. If you stay with the mind-set of "use TLS and PGP" that's very commendable but probably not very challenging. Going all the way up and down the crypto stack is extremely challenging. Squeezing every last cycle out of CPUs is very lasting (we'll always need crypto )and very transferable (mobile devices, clients, servers, embedded, companies of any size, companies of any domain...) It's also political and philosophical at times. Basically it's a hacker's dream to work in security.

tptacek 10y ago
Very few people working in security do cryptography. In fact, despite the fact that the author of this post is a trained cryptographer, virtually none of his professional work is cryptographic (he's a reverser). I think one of the good things about security is that it exposes you to so much domain knowledge (like cryptographic algorithms and bare-metal programming). But executing well in security (and particularly software security) is more about a specific kind of problem-solving mindset. The unique difference between security and other subfields of CS is that security provides you with an adversary; it's intrinsically competitive in a way that other kinds of computer science aren't.
cderwin 10y ago
> Here's my biased, objective, and anecdotal opinion. Surely you mean subjective, not objective.

tptacek 10y ago

Very few people working in security do cryptography. In fact, despite the fact that the author of this post is a trained cryptographer, virtually none of his professional work is cryptographic (he's a reverser). I think one of the good things about security is that it exposes you to so much domain knowledge (like cryptographic algorithms and bare-metal programming). But executing well in security (and particularly software security) is more about a specific kind of problem-solving mindset. The unique difference between security and other subfields of CS is that security provides you with an adversary; it's intrinsically competitive in a way that other kinds of computer science aren't.

cderwin 10y ago

> Here's my biased, objective, and anecdotal opinion. Surely you mean subjective, not objective.