3 ms·

My take on that: Security vulns move waaay faster than algos Setting your security test labs takes way more effort than opening IDE, LeetCode, checking inform

My take on that: Security vulns move waaay faster than algos Setting your security test labs takes way more effort than opening IDE, LeetCode, checking informatic olympics tasks or maybe some book/pdf/write up/wiki When developing algos you're in your own world meanwhile security often has to mess with other things like software, standards and stuff e.g you're interested in web sec/hacking, then except understanding of standards (what it allows and what not, etc.) then you have various implementations to care about like web browser - chromium, gecko, ie, safari and stuff. It's a lot of effort! Let's say that you want to find vulns in PDF parsers/renderers by checking their code source code - I think it'd take a lot of effort to check and understand (let alone exploit) those implementations in two major browsers (I suppose they're different, but I've never checked that) >I also don't think ctf's are a good model for security questions during interviews I didn't meant that, sorry if I made it sound as if I expected people to solve CTF tasks during SE interviews Just wanted to encourage people to do cool stuff :)

bawolff 6y ago
The core doesn't really move that fast. 90% of everything is still an injection vulnerability of one form or another, and if you go above the level of vulns, most organizations are really looking for people to do risk analysis, in which case, the actual vulns somewhat become less central (however there are lots of different types of security engineers, and lots of them have very different responsibilities) It depends a lot on what you're doing of course. I do web application security stuff (glorified xss detector), i've personally felt that the most useful tools by far are the browser dev console and curl, but ymmv. > I didn't meant that, sorry if I made it sound as if I expected people to solve CTF tasks during SE interviews >Just wanted to encourage people to do cool stuff :) Oh i definitely agree, ctfs can be a lot of fun.
- twox2 6y ago
  At the end of the day most compromises that aren't state sponsored happen using low-tech methods like sim-swapping and spear phishing.
  - bawolff 6y ago
    Honestly, that's the high tech end of what happens. Most compromises are credential stuffing.
    - twox2 6y ago
      Yeah, for sure. It's bizarre that it's not standard practice to just blocklist previously used credentials from already documented leaks.

bawolff 6y ago

The core doesn't really move that fast. 90% of everything is still an injection vulnerability of one form or another, and if you go above the level of vulns, most organizations are really looking for people to do risk analysis, in which case, the actual vulns somewhat become less central (however there are lots of different types of security engineers, and lots of them have very different responsibilities) It depends a lot on what you're doing of course. I do web application security stuff (glorified xss detector), i've personally felt that the most useful tools by far are the browser dev console and curl, but ymmv. > I didn't meant that, sorry if I made it sound as if I expected people to solve CTF tasks during SE interviews >Just wanted to encourage people to do cool stuff :) Oh i definitely agree, ctfs can be a lot of fun.

twox2 6y ago
At the end of the day most compromises that aren't state sponsored happen using low-tech methods like sim-swapping and spear phishing.
- bawolff 6y ago
  Honestly, that's the high tech end of what happens. Most compromises are credential stuffing.
  - twox2 6y ago
    Yeah, for sure. It's bizarre that it's not standard practice to just blocklist previously used credentials from already documented leaks.