4 ms·

Possible case, furthered tempered by "infosec industry source". :) It is their job to sell fear

sho 7y ago
The entire "infosec industry" is fraudulent, in my estimation. A bunch of assholes selling powerpoints and not a whole lot else. I've seen it a lot. None of them know what they're talking about. Source: my direct experience
- slovenlyrobot 7y ago
  I wouldn't say that, but they do suffer from something the IT industry as a whole suffers from: there is/was a need, and by fulfilling that need, they find themselves in a quandary where they're committed to something that must continue to exist in order to avoid inflicting self-harm. You can't go into business selling software on the assumption you'll sell a single copy and your work is finished. Infosec is no different. There is always this paradoxical need to ensure you never become entirely redundant, regardless of the function you specialize in I think a lot of the great "evolutionary difficulties" in our industry can be phrased this way. It's why things like Microsoft Excel are laughed at even as hundreds of thousands are trained in the art of constructing effectively bespoke spreadsheets apps in Django by the million every year. I hope for a correction some day, just as much as I hope I'm on the right side of it when it comes..
  - sho 7y ago
    You misunderstand. "Infosec" is a shopping list item on govt requirements. "We need this, this, this, and it needs to be secure!" They assume security is just this additional ingredient that can be purchased, mixed in, and boom; project is secure, like mixing in chili to anything will make it hot. The infosec companies do everything they can to encourage this assumption. It's all bullshit, and these people are pure scum.
    - slovenlyrobot 7y ago
      Speaking as a developer, I've had my ass handed to me by competent security folk on several occasions. Unfortunately in the software industry, security must regularly be an additional ingredient that can be purchased and mixed in, because 98% of us are completely clueless and absolutely not thinking about this stuff as we're trying to clear a sprint board
      - thephyber 7y ago
        Serious questions: > because 98% of us are completely clueless Do universities/bootcamps teach OWASP-style classes of programming vulnerabilities these days? Some developers are curious enough to learn them on their own, but many are oblivious. I suspect there could be a startup idea here somewhere. > absolutely not thinking about this stuff as we're trying to clear a sprint board Does anyone have a decent tool/process for remembering all of the detailed tasks for every type of software deliverable? I find myself in a state of cognitive coma after sprint planning when I need to divide tasks into subtasks.
        mdpopescu 7y ago
        I refuse to learn about infosec, for the same reason that I refuse to become an amateur surgeon: I don't want to know enough to be dangerous. This is a field that will take 100% of your time if you want to be good at it, and being "meh" is more dangerous than realizing you don't know anything and paying an expert. (Crypto and security in general were a hobby of mine until I realized how difficult the field really is. "Programming Satan's computer" was one paper that contributed to that.)
        vkou 7y ago
        > Do universities/bootcamps teach OWASP-style classes of programming vulnerabilities these days? Some developers are curious enough to learn them on their own, but many are oblivious. I had exactly one course that touched on security. A course in web programming. The instruction we received consisted of: "If your project is not secure, it will lose points." I'm not sure a single person on that class had one point taken off for getting security wrong. Why would a university care about educating people in something ephemeral, and domain-specific, like security, when it could instead be teaching them about complexity theory and Djikstra, and third normal form?
- professorTuring 7y ago
  You are utterly wrong. The real problem is that there is a vast need for professionals and the lack of them calls a lot of smoke-sellers. And for a lot of people is hard to tell wether they are legit. Just look at the Machine Learning / Artificial Intelligence industry. Also "fraudulent" if you apply the same logic.
  - sho 7y ago
    Oh, I don't think I'm wrong. And neither do you, since your second sentence basically agrees with me. Hit a nerve? And yeah, most of the ML industry is in precisely the same category. A bunch of frauds.
    - professorTuring 7y ago
      I can see your point, but babblers != industry.
- crankylinuxuser 7y ago
  Sounds like your idea of infosec is colored by a bunch of salespeople. You'd be surprised just how many places run public unpatched stuff with admin/root holes here and there. Ive seen passwords like "123456" and "password" and plenty other badness that nobody really bats an eye to. And even simple things like "Use WPA2 and a password manager", for low barrier infosec is routinely ignored. Companies can barely even manage that.... and they have the funds. And it's not like the bad stuff is scare quotes. Ransomware is a thing. Ive seen a hospital network up north get hit by it. City of Madison IN (1h away from me) ended up paying a large sum, cause they thought backups were pointless. Even know of a story where a state government's machine ended up being a warez server. The lead though to clean up a trojaned linux box, was to rsync from a clean one. Left most of the trojan kmods intact. I caught it down the line. Sure, if the likes you're talking about is complaints about IBM with QScan or similar, with grandiose claims that their software will save everything - thats obvious bullshit. Security is definitely a process and procedures, ALONG WITH technical means to facilitate that. Even automated scanning of "front doors", or doing routine searches in Shodan is a magnitude better than nothing.
- Doodood 7y ago
  In your direct experience, have you never come across any non trivial security vulnerabilities?
- deadmetheny 7y ago
  Nice anecdote. There's a shitload of salesmen selling snake oil in security, but they're mostly selling it to idiots and people who think security is a box you tick and not a continual process.

sho 7y ago

The entire "infosec industry" is fraudulent, in my estimation. A bunch of assholes selling powerpoints and not a whole lot else. I've seen it a lot. None of them know what they're talking about. Source: my direct experience

slovenlyrobot 7y ago
I wouldn't say that, but they do suffer from something the IT industry as a whole suffers from: there is/was a need, and by fulfilling that need, they find themselves in a quandary where they're committed to something that must continue to exist in order to avoid inflicting self-harm. You can't go into business selling software on the assumption you'll sell a single copy and your work is finished. Infosec is no different. There is always this paradoxical need to ensure you never become entirely redundant, regardless of the function you specialize in I think a lot of the great "evolutionary difficulties" in our industry can be phrased this way. It's why things like Microsoft Excel are laughed at even as hundreds of thousands are trained in the art of constructing effectively bespoke spreadsheets apps in Django by the million every year. I hope for a correction some day, just as much as I hope I'm on the right side of it when it comes..
- sho 7y ago
  You misunderstand. "Infosec" is a shopping list item on govt requirements. "We need this, this, this, and it needs to be secure!" They assume security is just this additional ingredient that can be purchased, mixed in, and boom; project is secure, like mixing in chili to anything will make it hot. The infosec companies do everything they can to encourage this assumption. It's all bullshit, and these people are pure scum.
  - slovenlyrobot 7y ago
    Speaking as a developer, I've had my ass handed to me by competent security folk on several occasions. Unfortunately in the software industry, security must regularly be an additional ingredient that can be purchased and mixed in, because 98% of us are completely clueless and absolutely not thinking about this stuff as we're trying to clear a sprint board
    - thephyber 7y ago
      Serious questions: > because 98% of us are completely clueless Do universities/bootcamps teach OWASP-style classes of programming vulnerabilities these days? Some developers are curious enough to learn them on their own, but many are oblivious. I suspect there could be a startup idea here somewhere. > absolutely not thinking about this stuff as we're trying to clear a sprint board Does anyone have a decent tool/process for remembering all of the detailed tasks for every type of software deliverable? I find myself in a state of cognitive coma after sprint planning when I need to divide tasks into subtasks.
      - mdpopescu 7y ago
        I refuse to learn about infosec, for the same reason that I refuse to become an amateur surgeon: I don't want to know enough to be dangerous. This is a field that will take 100% of your time if you want to be good at it, and being "meh" is more dangerous than realizing you don't know anything and paying an expert. (Crypto and security in general were a hobby of mine until I realized how difficult the field really is. "Programming Satan's computer" was one paper that contributed to that.)
      - vkou 7y ago
        > Do universities/bootcamps teach OWASP-style classes of programming vulnerabilities these days? Some developers are curious enough to learn them on their own, but many are oblivious. I had exactly one course that touched on security. A course in web programming. The instruction we received consisted of: "If your project is not secure, it will lose points." I'm not sure a single person on that class had one point taken off for getting security wrong. Why would a university care about educating people in something ephemeral, and domain-specific, like security, when it could instead be teaching them about complexity theory and Djikstra, and third normal form?
professorTuring 7y ago
You are utterly wrong. The real problem is that there is a vast need for professionals and the lack of them calls a lot of smoke-sellers. And for a lot of people is hard to tell wether they are legit. Just look at the Machine Learning / Artificial Intelligence industry. Also "fraudulent" if you apply the same logic.
- sho 7y ago
  Oh, I don't think I'm wrong. And neither do you, since your second sentence basically agrees with me. Hit a nerve? And yeah, most of the ML industry is in precisely the same category. A bunch of frauds.
  - professorTuring 7y ago
    I can see your point, but babblers != industry.
crankylinuxuser 7y ago
Sounds like your idea of infosec is colored by a bunch of salespeople. You'd be surprised just how many places run public unpatched stuff with admin/root holes here and there. Ive seen passwords like "123456" and "password" and plenty other badness that nobody really bats an eye to. And even simple things like "Use WPA2 and a password manager", for low barrier infosec is routinely ignored. Companies can barely even manage that.... and they have the funds. And it's not like the bad stuff is scare quotes. Ransomware is a thing. Ive seen a hospital network up north get hit by it. City of Madison IN (1h away from me) ended up paying a large sum, cause they thought backups were pointless. Even know of a story where a state government's machine ended up being a warez server. The lead though to clean up a trojaned linux box, was to rsync from a clean one. Left most of the trojan kmods intact. I caught it down the line. Sure, if the likes you're talking about is complaints about IBM with QScan or similar, with grandiose claims that their software will save everything - thats obvious bullshit. Security is definitely a process and procedures, ALONG WITH technical means to facilitate that. Even automated scanning of "front doors", or doing routine searches in Shodan is a magnitude better than nothing.
Doodood 7y ago
In your direct experience, have you never come across any non trivial security vulnerabilities?
deadmetheny 7y ago
Nice anecdote. There's a shitload of salesmen selling snake oil in security, but they're mostly selling it to idiots and people who think security is a box you tick and not a continual process.