4 ms·

I agree with you on your assessment, but those people you respect and inspired you are the one's who are already in the field. They already have accomplishment

I agree with you on your assessment, but those people you respect and inspired you are the one's who are already in the field. They already have accomplishments and have done things to earn that respect. I've found that it's near impossible to differentiate "posers" from actual security people when it comes to hiring someone without a long, formal, and vouched for by others security career. This is where bounties and ethical disclosure come into play. Also note the careful choosing of long, formal, and vouched for wording above. There are certainly people in our industry who are here because they are good at social engineering rather than here because of their technical skills or work ethic. Those individuals are very damaging to our field.

dsacco 10y ago
Can you clarify what you mean by "good at social engineering"? Do you mean they try to specialize in that and pass it off as actual security rigor ("hacking")?
- patcheudor 10y ago
  Exaggerating their skill-set, claiming to have skills when they don't. Yes, it could be the Dunning–Kruger effect in action but more than not I think there is careful plotting involved to deceive. It's actually odd if you think about it a bit. I've been going to DEFCON for the last 11 years, have done the CTF thing, the speaking thing, etc., and it strikes me in many ways as a tale of two cities. You've got your highly skilled and technical security professionals who are talking and sharing but then you have all of the roadies, the fans, the people who watched Hackers and want that lifestyle. We don't see this in any other technical field that I'm aware of - I mean I'm pretty sure there aren't blue-haired database administrator wannabe's showing up to DBCon, are there? What ends up happening is that people like the idea. They want to be a "hacker" but want it as a day job but don't have the technical skill so they must figure out ways to social engineer their way into the field. The folks at Attrition tend to cover it a bit more when it comes to "security rockstars": http://attrition.org/errata/charlatan/ http://attrition.org/errata/charlatan/
  - dsacco 10y ago
    Yikes, what a list. I see your point though.

dsacco 10y ago

Can you clarify what you mean by "good at social engineering"? Do you mean they try to specialize in that and pass it off as actual security rigor ("hacking")?

patcheudor 10y ago
Exaggerating their skill-set, claiming to have skills when they don't. Yes, it could be the Dunning–Kruger effect in action but more than not I think there is careful plotting involved to deceive. It's actually odd if you think about it a bit. I've been going to DEFCON for the last 11 years, have done the CTF thing, the speaking thing, etc., and it strikes me in many ways as a tale of two cities. You've got your highly skilled and technical security professionals who are talking and sharing but then you have all of the roadies, the fans, the people who watched Hackers and want that lifestyle. We don't see this in any other technical field that I'm aware of - I mean I'm pretty sure there aren't blue-haired database administrator wannabe's showing up to DBCon, are there? What ends up happening is that people like the idea. They want to be a "hacker" but want it as a day job but don't have the technical skill so they must figure out ways to social engineer their way into the field. The folks at Attrition tend to cover it a bit more when it comes to "security rockstars": http://attrition.org/errata/charlatan/ http://attrition.org/errata/charlatan/
- dsacco 10y ago
  Yikes, what a list. I see your point though.