3 ms·

The vast majority of web developers will never touch things like TLS configurations. We have stuff like nginx and WSGI for a reason! Meanwhile there's a decent

by rtpg 6y ago

The vast majority of web developers will never touch things like TLS configurations. We have stuff like nginx and WSGI for a reason! Meanwhile there's a decent chance of them running into a problem that looks like binary tree manipulation. Despite all the handwringing about btree reversal, not being able to improvise a solution to that is a much more useful indicator than not being able to describe even the basics of TLS.

bawolff 6y ago
Security engineers don't actually recite trivia facts about TLS in their job. Their job is more like, know when you should use TLS and when you shouldn't and know what it does and does not protect against. A security engineer is just as likely to derive a tls cipher config from first principles instead of googling/looking at ssllabs as a programmer is likely to reverse a binary tree from scratch instead of using a library or searching stack overflow. Engineers (of any stripe) aren't hired to recite random knowledge, they're hired to know what knowledge is appropriate to apply to a particular situation.
saila 6y ago
I've been doing web development for a long time, and I've never had to do anything like btree reversal in a web development context. It's probably not even that hard, but I doubt I'd be able to improvise a solution in an interview setting that's nothing like a real work environment. (Memories of trying to work out some kind of graph traversal while someone was basically just staring at me.) It seems to me that people who are doing this kind of work behind the scenes of a web app aren't really doing web development.
busterarm 6y ago
uhh...setting SSL parameters is part of defining an HTTP block in nginx. As someone in a public company with actual customers, we have to deal with TLS configuration all the time (as customers come with requirements and being public comes with compliance/security) and it's important to know what we're doing there... I'm responsible for millions of dollars in infrastructure and the way that I got here was being a web developer who knows how the internet works. And in an engineering organization with hundreds of engineers, most of them tend to come to me first with questions. I have never once in my career had to reverse a btree.

by rtpg 6y ago

bawolff 6y ago

Security engineers don't actually recite trivia facts about TLS in their job. Their job is more like, know when you should use TLS and when you shouldn't and know what it does and does not protect against. A security engineer is just as likely to derive a tls cipher config from first principles instead of googling/looking at ssllabs as a programmer is likely to reverse a binary tree from scratch instead of using a library or searching stack overflow. Engineers (of any stripe) aren't hired to recite random knowledge, they're hired to know what knowledge is appropriate to apply to a particular situation.

saila 6y ago

I've been doing web development for a long time, and I've never had to do anything like btree reversal in a web development context. It's probably not even that hard, but I doubt I'd be able to improvise a solution in an interview setting that's nothing like a real work environment. (Memories of trying to work out some kind of graph traversal while someone was basically just staring at me.) It seems to me that people who are doing this kind of work behind the scenes of a web app aren't really doing web development.

busterarm 6y ago

uhh...setting SSL parameters is part of defining an HTTP block in nginx. As someone in a public company with actual customers, we have to deal with TLS configuration all the time (as customers come with requirements and being public comes with compliance/security) and it's important to know what we're doing there... I'm responsible for millions of dollars in infrastructure and the way that I got here was being a web developer who knows how the internet works. And in an engineering organization with hundreds of engineers, most of them tend to come to me first with questions. I have never once in my career had to reverse a btree.