4 ms·

I'm a "software engineer", but I know a plenty of other "software engineers" who know less about TCP/IP than IT people I know. What about being a SWE makes you

I'm a "software engineer", but I know a plenty of other "software engineers" who know less about TCP/IP than IT people I know. What about being a SWE makes you feel more suited for the job?

bitexploder 9y ago
In my experience knowing about TCP/IP is not required depending on the individual's background (say, graphics driver developer). It just turns out most good hackers tend to be curious and either learn it very quickly or already know it. We like software engineers because they can synthesize complex software architectures, whereas someone with only networking knowledge will be at a much larger knowledge deficit on most software focused assessments. Infosec has trended toward application focused security for many years now.
Mandatum 9y ago
This is part of the problem with hiring in InfoSec. I was turned down years ago for a role as a junior because I didn't know enough about some very specific, foundational technology. I joined a consultancy and within a year I was speaking at those same conferences that I met that would-be employer. In an hour you can go over only a finite amount of knowledge, I was asked about aspects of technology I knew very little about because I hadn't tried anything in that space (FWIW it was a segment of networking). To pass over candidates based on a minuet lack of detailed knowledge - to me is crazy. It's like interviewing a builder and asking them if they know where the majority of local maple wood comes from. Who cares, and if you need to know - Google it! Great, now you know more than you ever needed about the local maple industry! YMMV, sample size 1, etc
- fancyfacebook 9y ago
  If you're speaking at conferences then you are doing your infosec career wrong.
  - qaq 9y ago
    Hmm why?
  - Mandatum 9y ago
    If I was a fully funded academic, I'd agree with you. But the reality is I trade my time for money - to maximize the latter, appearing as a "leader" in my field requires I give talks to both technical and business tracks. The former might pay my bills (if they're a successful tech startup), the latter definitely will. Conferences are great for networking and entertaining. They're not great for learning new stuff, there's much better media out there. I'm not sure what your gripes are with it.
dogecoinbase 9y ago
I could pick some random piece of intrinsic tech you know nothing to devalue you quite easily. I work with TCP at a protocol level every. single. day. and I don't doubt that a decent mid-level SWE could pick it up in a less than a week, and be making clever modifications in less than a month. Standards aren't hard. Code isn't hard. Willingness to ask questions is hard. Knowing when you need to stop and think is hard. Dealing with people, in a way that respects their perspective and experience, is hard, and is the primary talent of any engineer, software or otherwise.

I'm a "software engineer", but I know a plenty of other "software engineers" who know less about TCP/IP than IT people I know. What about being a SWE makes you feel more suited for the job?

bitexploder 9y ago

In my experience knowing about TCP/IP is not required depending on the individual's background (say, graphics driver developer). It just turns out most good hackers tend to be curious and either learn it very quickly or already know it. We like software engineers because they can synthesize complex software architectures, whereas someone with only networking knowledge will be at a much larger knowledge deficit on most software focused assessments. Infosec has trended toward application focused security for many years now.

Mandatum 9y ago

This is part of the problem with hiring in InfoSec. I was turned down years ago for a role as a junior because I didn't know enough about some very specific, foundational technology. I joined a consultancy and within a year I was speaking at those same conferences that I met that would-be employer. In an hour you can go over only a finite amount of knowledge, I was asked about aspects of technology I knew very little about because I hadn't tried anything in that space (FWIW it was a segment of networking). To pass over candidates based on a minuet lack of detailed knowledge - to me is crazy. It's like interviewing a builder and asking them if they know where the majority of local maple wood comes from. Who cares, and if you need to know - Google it! Great, now you know more than you ever needed about the local maple industry! YMMV, sample size 1, etc

fancyfacebook 9y ago
If you're speaking at conferences then you are doing your infosec career wrong.
- qaq 9y ago
  Hmm why?
- Mandatum 9y ago
  If I was a fully funded academic, I'd agree with you. But the reality is I trade my time for money - to maximize the latter, appearing as a "leader" in my field requires I give talks to both technical and business tracks. The former might pay my bills (if they're a successful tech startup), the latter definitely will. Conferences are great for networking and entertaining. They're not great for learning new stuff, there's much better media out there. I'm not sure what your gripes are with it.

dogecoinbase 9y ago

I could pick some random piece of intrinsic tech you know nothing to devalue you quite easily. I work with TCP at a protocol level every. single. day. and I don't doubt that a decent mid-level SWE could pick it up in a less than a week, and be making clever modifications in less than a month. Standards aren't hard. Code isn't hard. Willingness to ask questions is hard. Knowing when you need to stop and think is hard. Dealing with people, in a way that respects their perspective and experience, is hard, and is the primary talent of any engineer, software or otherwise.