3 ms·

Speaking as a developer, I've had my ass handed to me by competent security folk on several occasions. Unfortunately in the software industry, security must reg

Speaking as a developer, I've had my ass handed to me by competent security folk on several occasions. Unfortunately in the software industry, security must regularly be an additional ingredient that can be purchased and mixed in, because 98% of us are completely clueless and absolutely not thinking about this stuff as we're trying to clear a sprint board

thephyber 7y ago
Serious questions: > because 98% of us are completely clueless Do universities/bootcamps teach OWASP-style classes of programming vulnerabilities these days? Some developers are curious enough to learn them on their own, but many are oblivious. I suspect there could be a startup idea here somewhere. > absolutely not thinking about this stuff as we're trying to clear a sprint board Does anyone have a decent tool/process for remembering all of the detailed tasks for every type of software deliverable? I find myself in a state of cognitive coma after sprint planning when I need to divide tasks into subtasks.
- mdpopescu 7y ago
  I refuse to learn about infosec, for the same reason that I refuse to become an amateur surgeon: I don't want to know enough to be dangerous. This is a field that will take 100% of your time if you want to be good at it, and being "meh" is more dangerous than realizing you don't know anything and paying an expert. (Crypto and security in general were a hobby of mine until I realized how difficult the field really is. "Programming Satan's computer" was one paper that contributed to that.)
- vkou 7y ago
  > Do universities/bootcamps teach OWASP-style classes of programming vulnerabilities these days? Some developers are curious enough to learn them on their own, but many are oblivious. I had exactly one course that touched on security. A course in web programming. The instruction we received consisted of: "If your project is not secure, it will lose points." I'm not sure a single person on that class had one point taken off for getting security wrong. Why would a university care about educating people in something ephemeral, and domain-specific, like security, when it could instead be teaching them about complexity theory and Djikstra, and third normal form?

thephyber 7y ago

Serious questions: > because 98% of us are completely clueless Do universities/bootcamps teach OWASP-style classes of programming vulnerabilities these days? Some developers are curious enough to learn them on their own, but many are oblivious. I suspect there could be a startup idea here somewhere. > absolutely not thinking about this stuff as we're trying to clear a sprint board Does anyone have a decent tool/process for remembering all of the detailed tasks for every type of software deliverable? I find myself in a state of cognitive coma after sprint planning when I need to divide tasks into subtasks.

mdpopescu 7y ago
I refuse to learn about infosec, for the same reason that I refuse to become an amateur surgeon: I don't want to know enough to be dangerous. This is a field that will take 100% of your time if you want to be good at it, and being "meh" is more dangerous than realizing you don't know anything and paying an expert. (Crypto and security in general were a hobby of mine until I realized how difficult the field really is. "Programming Satan's computer" was one paper that contributed to that.)
vkou 7y ago
> Do universities/bootcamps teach OWASP-style classes of programming vulnerabilities these days? Some developers are curious enough to learn them on their own, but many are oblivious. I had exactly one course that touched on security. A course in web programming. The instruction we received consisted of: "If your project is not secure, it will lose points." I'm not sure a single person on that class had one point taken off for getting security wrong. Why would a university care about educating people in something ephemeral, and domain-specific, like security, when it could instead be teaching them about complexity theory and Djikstra, and third normal form?