4 ms·

To be clear, most of the folks doing this sort of security research are probably worse programmers than your average senior dev, or at least not noticeably bett

To be clear, most of the folks doing this sort of security research are probably worse programmers than your average senior dev, or at least not noticeably better. It's a distinct skillset. To whatever extent they might build software that's more secure than the average dev's, that really comes down to applying their security skills and toolset to their own software- thinking like an attacker- not any particular skill at software engineering.

YetAnotherNick 5y ago
> most of the folks doing this sort of security research are probably worse programmers than your average senior dev, or at least not noticeably better. Hard disagree. Maybe you can argue that they might not have skillset/experience of writing good quality code but they need to know the very in depth of each of the component from javascript to kernel. It's not a separate skill. It's the same skill as what senior dev do only the folks who write exploit need to understand allocations in bit level detail in each layer of the machine in which code is executed. eg I would recommend seeing the coding episodes of geohot who was a hacker and look how fast he could write the "ordinary" code like setting up website and other things.
VMtest 5y ago
define programmer, programmer is not software engineer by default they are exploiting the 'quality' codebase written by your so-called average dev or software engineers and since when software engineering does not take security into account?
saagarjha 5y ago
Of course, this is not always true: a lot of good security researchers are software engineers as much as they are exploit authors. Writing tooling isn't sexy, but sometimes you just have to do it, and if you don't do a good job you aren't going to be able to use it.
- TheSpiceIsLife 5y ago
  Software exploits and tooling don’t need to bug free, they just have to work some of the time on some devices under some circumstances. Luck too. The birthday lottery still plays a roll: being born with the particular set of predispositions, and the right family and environment to encourage strengthening those predispositions.
  - saagarjha 5y ago
    Bad tooling, like any other bad software, has limited utility: it cannot be reused or built upon. Sure, your quick script might work for now, but five years later everyone is going to be using the thing another person wrote because nobody wants to touch what you made.
    - TheSpiceIsLife 5y ago
      I mean, that just sounds like enterprise software.

YetAnotherNick 5y ago

> most of the folks doing this sort of security research are probably worse programmers than your average senior dev, or at least not noticeably better. Hard disagree. Maybe you can argue that they might not have skillset/experience of writing good quality code but they need to know the very in depth of each of the component from javascript to kernel. It's not a separate skill. It's the same skill as what senior dev do only the folks who write exploit need to understand allocations in bit level detail in each layer of the machine in which code is executed. eg I would recommend seeing the coding episodes of geohot who was a hacker and look how fast he could write the "ordinary" code like setting up website and other things.

VMtest 5y ago

define programmer, programmer is not software engineer by default they are exploiting the 'quality' codebase written by your so-called average dev or software engineers and since when software engineering does not take security into account?

saagarjha 5y ago

Of course, this is not always true: a lot of good security researchers are software engineers as much as they are exploit authors. Writing tooling isn't sexy, but sometimes you just have to do it, and if you don't do a good job you aren't going to be able to use it.

TheSpiceIsLife 5y ago
Software exploits and tooling don’t need to bug free, they just have to work some of the time on some devices under some circumstances. Luck too. The birthday lottery still plays a roll: being born with the particular set of predispositions, and the right family and environment to encourage strengthening those predispositions.
- saagarjha 5y ago
  Bad tooling, like any other bad software, has limited utility: it cannot be reused or built upon. Sure, your quick script might work for now, but five years later everyone is going to be using the thing another person wrote because nobody wants to touch what you made.
  - TheSpiceIsLife 5y ago
    I mean, that just sounds like enterprise software.