4 ms·
I wouldn't say that, but they do suffer from something the IT industry as a whole suffers from: there is/was a need, and by fulfilling that need, they find them
by slovenlyrobot 7y ago
I wouldn't say that, but they do suffer from something the IT industry as a whole suffers from: there is/was a need, and by fulfilling that need, they find themselves in a quandary where they're committed to something that must continue to exist in order to avoid inflicting self-harm.
You can't go into business selling software on the assumption you'll sell a single copy and your work is finished. Infosec is no different. There is always this paradoxical need to ensure you never become entirely redundant, regardless of the function you specialize in
I think a lot of the great "evolutionary difficulties" in our industry can be phrased this way. It's why things like Microsoft Excel are laughed at even as hundreds of thousands are trained in the art of constructing effectively bespoke spreadsheets apps in Django by the million every year. I hope for a correction some day, just as much as I hope I'm on the right side of it when it comes..
- sho 7y agoYou misunderstand. "Infosec" is a shopping list item on govt requirements. "We need this, this, this, and it needs to be secure!" They assume security is just this additional ingredient that can be purchased, mixed in, and boom; project is secure, like mixing in chili to anything will make it hot. The infosec companies do everything they can to encourage this assumption. It's all bullshit, and these people are pure scum.
- slovenlyrobot 7y agoSpeaking as a developer, I've had my ass handed to me by competent security folk on several occasions. Unfortunately in the software industry, security must regularly be an additional ingredient that can be purchased and mixed in, because 98% of us are completely clueless and absolutely not thinking about this stuff as we're trying to clear a sprint board
- thephyber 7y agoSerious questions: > because 98% of us are completely clueless Do universities/bootcamps teach OWASP-style classes of programming vulnerabilities these days? Some developers are curious enough to learn them on their own, but many are oblivious. I suspect there could be a startup idea here somewhere. > absolutely not thinking about this stuff as we're trying to clear a sprint board Does anyone have a decent tool/process for remembering all of the detailed tasks for every type of software deliverable? I find myself in a state of cognitive coma after sprint planning when I need to divide tasks into subtasks.
- mdpopescu 7y agoI refuse to learn about infosec, for the same reason that I refuse to become an amateur surgeon: I don't want to know enough to be dangerous. This is a field that will take 100% of your time if you want to be good at it, and being "meh" is more dangerous than realizing you don't know anything and paying an expert. (Crypto and security in general were a hobby of mine until I realized how difficult the field really is. "Programming Satan's computer" was one paper that contributed to that.)
- vkou 7y ago> Do universities/bootcamps teach OWASP-style classes of programming vulnerabilities these days? Some developers are curious enough to learn them on their own, but many are oblivious. I had exactly one course that touched on security. A course in web programming. The instruction we received consisted of: "If your project is not secure, it will lose points." I'm not sure a single person on that class had one point taken off for getting security wrong. Why would a university care about educating people in something ephemeral, and domain-specific, like security, when it could instead be teaching them about complexity theory and Djikstra, and third normal form?