3 ms·
That’s what Google’s project zero is. The problem is, there are a vanishingly small amount of engineers talented enough to find these kinds of things. And if
by atonse 5y ago
That’s what Google’s project zero is.
The problem is, there are a vanishingly small amount of engineers talented enough to find these kinds of things.
And if NSA wanted to hire a few hundred they’d have to go the defense contractor route which will inevitably lead to them getting 1 great engineer and 499 extremely mediocre ones.
- allendoerfer 5y agoI would look at things getting parsed and throw some fuzzers at it. Maybe data mining Github to use some real world strings for it. I think with that approach even my normal sized brain would find problems. It is about the willingness to invest, not brainpower. If I was tasked to "improve security" at my current project, I could instantly tell you things that could be looked into, even though reasonably precautions are already taken and there are already processes around it in place. I bet it is the same for most programmers.
- carlmr 5y ago>I would look at things getting parsed and throw some fuzzers at it. Maybe data mining Github to use some real world strings for it. I think with that approach even my normal sized brain would find problems. Given that you're mentioning fuzzers and a decent source of inputs you could use, I think you're either underestimating yourself or overestimating the actual "average" of software developers.
- jokoon 5y agoJust hire good engineers, and train them inside the NSA.