4 ms·
Note this is by Jann Horn, the same Google security researcher who discovered Spectre/Meltdown. Serious props to this guy, and hopefully he stays in a whitehat
by steelframe 8y ago
Note this is by Jann Horn, the same Google security researcher who discovered Spectre/Meltdown. Serious props to this guy, and hopefully he stays in a whitehat role where he can find and deal with these issues through responsible disclosure.
- ronnier 8y agoWow he’s only 22 https://www.bloomberg.com/news/articles/2018-01-17/how-a-22-year-old-discovered-the-worst-chip-flaws-in-history https://www.bloomberg.com/news/articles/2018-01-17/how-a-22-...
- merb 8y agoI mean with 20 (while still in colleague), cure53 got already curious about Horn, which is quite crazy. (cure53 is one of german's best penetration/security company, they even analayze your software as a service, they actually pentested curl: https://cure53.de/pentest-report_curl.pdf https://cure53.de/pentest-report_curl.pdf, prometheus: https://cure53.de/pentest-report_prometheus.pdf https://cure53.de/pentest-report_prometheus.pdf and probably other high valuable software)
- romed 8y agoPerhaps people new to the codebase (or the industry, or to life in general) are less likely to view existing constructs as obviously correct, and therefore more likely to point out flaws.
- quotemstr 8y agoThat's one reason big tech companies should allow easy inter-team transfers.
- romed 8y agoAlso why you should give all the critical projects to interns.
- sleepydog 8y agoI think you are right. It definitely takes more than that, but you can be the smartest guy in the world and you won't discover many vulnerabilities if you assume certain components are "hallowed ground". Apparently he thought of the spectre-style vulnerabilities while through the Intel processor manuals[1]. How many established engineers would a) read through these reference manuals at all, and b) question the implementations described therein? [1]: https://www.bloomberg.com/news/articles/2018-01-17/how-a-22-year-old-discovered-the-worst-chip-flaws-in-history https://www.bloomberg.com/news/articles/2018-01-17/how-a-22-...
- ndesaulniers 8y agoNew opinions are always suspected, and usually opposed, without any other reason but because they are not already common. ~John Locke
- samfisher83 8y agoI think software is a young mans game. I think bugs like this take a lot of intense time and focus. As you get older you got other things to distract you like kids, wife, house etc.
- copperx 8y agoYou could make exactly the same argument for math research. It is somewhat true, but not entirely. There are many breakthroughs by older people.
- dman 8y agoI am a lot more careful now, as compared to the start of my career. I have a lot more experience with testing and by all metrics I can measure the code that I ship goes out with a much lower defect rate. I think it is just the reverse - I think software is an excellent profession to stick to for the long haul, because with even a moderate amount of effort you can improve tremendously over time.
- deleted 8y ago[deleted]
- samfisher83 8y agoIf this was true why is there rampant ageism in SV?
- edoceo 8y agoMath and computers are closely related. Loads of cool math discovery was done by the under 30 group.