8 ms·

> It will be a long, long time before the marketplace evolves sufficient technological measures to guard against state-sanctioned/possibly-state-sponsored malic

> It will be a long, long time before the marketplace evolves sufficient technological measures to guard against state-sanctioned/possibly-state-sponsored malicious actors operating with impunity in a lawless environment. Unfortunately, the marketplace -- at least certain segments of it -- are far beyond .mil/.gov in terms of capacity and sophistication. E.g., AWS's formal tools for code-level security is what DARPA's been yelling about doing for decades, but gov't contractors and the branches/agencies are unable/unwilling to catch. I'm not sure how to fix gov or mil, but a good starting point within mil is to stop making career officers with theology and polisci degrees but zero CS training the first-line managers of cyber commands.

dataangel 5y ago
> AWS's formal tools for code-level security what tools?
- someguydave 5y ago
  yeah what tools?
  - sodality2 5y ago
    https://aws.amazon.com/security/provable-security/ https://aws.amazon.com/security/provable-security/ as one example
- sodality2 5y ago
  https://aws.amazon.com/security/provable-security/ https://aws.amazon.com/security/provable-security/ as one example
Phrodo_00 5y ago
What AWS tools? This [1]? If so, it looks interesting, I need to take a closer look at it. [1] https://aws.amazon.com/security/provable-security/ https://aws.amazon.com/security/provable-security/
StrictDabbler 5y ago
The first time I ran into somebody who was in charge of a technical department but had only degree in Applied Theology my jaw hit the floor. Applied theology. By the third time I had to seek out existential comfort.
- emptysongglass 5y ago
  This upsets me a bit because I graduated from art school but got into DevOps because I was a Linux nerd since I was in my early teens. There is room for us. It doesn't make us terrible fits for the job. On the contrary, I think people with unconventional backgrounds can offer unconventional insights into software architecture. What you got a degree in shouldn't be the make or break of your career.
  - throwawaygh 5y ago
    > DevOps because I was a Linux nerd since I was in my early teens You are an exception. In the military and certain parts of the corporate world ("enterprise" companies mostly), there is a wide-spread and systemic problem with horrendously unqualified people managing software/IT groups. E.g., Susan Mauldin for a recent example. We can allow space for self-taught people without opening the flood gates. No one should be in charge of IT security without first developing deep technical expertise at some point in their career.
    - derivagral 5y ago
      > Susan Mauldin For anyone as confused as I was, this is probably referring to the Equifax security officer. My local search engine mostly brought up a murder case.
      - canadianfella 5y ago
        You have a local search engine?
  - StrictDabbler 5y ago
bilbo0s 5y ago
career officers with theology and polisci degrees but zero CS training the first-line managers of cyber commands. Is this true? This can't be true. Surely they must have some CS experience? I took my last bus off a USMC base so long ago I've raised a kid who's in med school since. Can someone with more recent experience chime in on whether or not this is hyperbole?
- thatfunkymunki 5y ago
  I was a cyber operator in the USAF for years, and finished up my active duty in late 2019. This is completely accurate. Not only are the first-line officers generally uneducated in CS/IT/security, the people training them are equally uneducated. This is apparently by design.
  - mcguire 5y ago
    Once upon a time, I heard a story about Air Force officers working on some technical problem that required a relatively advanced education. Until a new CO moved in and said that that kind of thing wasn't going to wash; AF officers don't work, they manage.
Mitzi 5y ago
On whether it's being unable or unwilling: one could argue that various gov agencies actively invest in keeping software insecure, e.g. by buying up zero-days.
bee_rider 5y ago
It seems more that the most competent government agencies and private organizations are in the same general ballpark, but anyway that doesn't matter, because the ones getting hacked are the least competent of either group.

dataangel 5y ago

> AWS's formal tools for code-level security what tools?

someguydave 5y ago
yeah what tools?
- sodality2 5y ago
  https://aws.amazon.com/security/provable-security/ https://aws.amazon.com/security/provable-security/ as one example
sodality2 5y ago
https://aws.amazon.com/security/provable-security/ https://aws.amazon.com/security/provable-security/ as one example

Phrodo_00 5y ago

What AWS tools? This [1]? If so, it looks interesting, I need to take a closer look at it. [1] https://aws.amazon.com/security/provable-security/ https://aws.amazon.com/security/provable-security/

StrictDabbler 5y ago

The first time I ran into somebody who was in charge of a technical department but had only degree in Applied Theology my jaw hit the floor. Applied theology. By the third time I had to seek out existential comfort.

emptysongglass 5y ago
This upsets me a bit because I graduated from art school but got into DevOps because I was a Linux nerd since I was in my early teens. There is room for us. It doesn't make us terrible fits for the job. On the contrary, I think people with unconventional backgrounds can offer unconventional insights into software architecture. What you got a degree in shouldn't be the make or break of your career.
- throwawaygh 5y ago
  > DevOps because I was a Linux nerd since I was in my early teens You are an exception. In the military and certain parts of the corporate world ("enterprise" companies mostly), there is a wide-spread and systemic problem with horrendously unqualified people managing software/IT groups. E.g., Susan Mauldin for a recent example. We can allow space for self-taught people without opening the flood gates. No one should be in charge of IT security without first developing deep technical expertise at some point in their career.
  - derivagral 5y ago
    > Susan Mauldin For anyone as confused as I was, this is probably referring to the Equifax security officer. My local search engine mostly brought up a murder case.
    - canadianfella 5y ago
      You have a local search engine?
- StrictDabbler 5y ago

bilbo0s 5y ago

career officers with theology and polisci degrees but zero CS training the first-line managers of cyber commands. Is this true? This can't be true. Surely they must have some CS experience? I took my last bus off a USMC base so long ago I've raised a kid who's in med school since. Can someone with more recent experience chime in on whether or not this is hyperbole?

thatfunkymunki 5y ago
I was a cyber operator in the USAF for years, and finished up my active duty in late 2019. This is completely accurate. Not only are the first-line officers generally uneducated in CS/IT/security, the people training them are equally uneducated. This is apparently by design.
- mcguire 5y ago
  Once upon a time, I heard a story about Air Force officers working on some technical problem that required a relatively advanced education. Until a new CO moved in and said that that kind of thing wasn't going to wash; AF officers don't work, they manage.

Mitzi 5y ago

On whether it's being unable or unwilling: one could argue that various gov agencies actively invest in keeping software insecure, e.g. by buying up zero-days.

bee_rider 5y ago

It seems more that the most competent government agencies and private organizations are in the same general ballpark, but anyway that doesn't matter, because the ones getting hacked are the least competent of either group.