3 ms·

We must be nearing (or at) the top of the "cyber security" or whatever-the-fuck you call it bubble that everyone is scrambling to jump on, get funding for, be a

We must be nearing (or at) the top of the "cyber security" or whatever-the-fuck you call it bubble that everyone is scrambling to jump on, get funding for, be acquired, etc. Last week my brother in law (who's 50) breathlessly told me he was starting his new career as a "cyber security analyst" and plunking down $9k for a 20-week course. Yup, I'm sure this is going to end well.

gpcz 3y ago
This reminds me of Joe Kennedy (JFK's father) getting out of the 1920s stock market right before the Depression because his shoe-shine boy was giving him stock tips.
- xx__yy 3y ago
  Just like that time my taxi driver was telling me about "investing" in Bitcoin
keyle 3y ago
I'm surrounded by "opsec experts" (or whatever their name is lately) that keep running daily checks for windows pwned machines, against our servers which are all linux. Like 4000 tests a day, always returning green charts, looking great on weekly meetings I'm sure. They've demanded that we drop the WAF for them (WAF still irks me, it implies you don't know what you're running, but that's another day's topic), so that they can "better test our infrastructure". They're completely oblivious on how a buffer overflow would be executed, and I'm pretty sure they couldn't tell me what the difference is between http2 and http. I'm really saddened by the fact that this industry just barely runs from one breach to the next, pretending everything is fine, not understanding any of it and slapping on one-click solutions and pen-testing up the wazoo. For christ sakes I had to correct a report saying our data was stored in a "community", because it's a third party data centre they never heard of. I'm close to encourage my children not to get into the IT industry...
coffeesque 3y ago
> plunking down $9k for a 20-week course. I find this attitude kind of depressing. When I was in CS undergrad I thought about going into security because it seemed like this thing where you needed a bunch of systems background. To understand some exploits e.g. [0] you'd need hardware-related knowledge like branch prediction and memory hierarchy. Or something like stack smashing you'd need to know the process memory model and maybe some assembly It seems to me like security is split into two camps: the people who are out there in the wild who find exploits and the "bootcamp" crowd [0] https://en.wikipedia.org/wiki/Spectre_(security_vulnerability) https://en.wikipedia.org/wiki/Spectre_(security_vulnerabilit...
- keyle 3y ago
  There is most definitely a split between the people that are "traditionally" trained and understand the underlying layers, vs. the bodies added to a head count, to bolster some agenda.
- don-code 3y ago
  I for one am actually pretty glad to see the role commoditized. Software's one of few roles where you need the deep theory component (a CS degree) to practice (land a respectable gig). My impression is that this is because we, the software industry, have done a poor job separating the theory from practice. Much as you hire an electrician, as opposed to an electrical engineer, to wire your house, or a carpenter, rather than a mechanical / structural engineer, to build your house, I do think we should be finding ways to separate "programmer" from "computer scientist". These are both completely legitimate roles, and deserve to be paid according to their value produced - they're both quite high! But the fact that I need a deep understanding of data structures, operating systems, computer architecture, or other college-level concepts to write software feels like a shortcoming. If CS researchers can set standards for software, rather than _write the software itself_, we can more easily create on ramps and shallow ends for people to use. Low code tools and LLMs are great steps in this regard, but I feel that they're still stigmatized from the enablement perspective.

gpcz 3y ago

This reminds me of Joe Kennedy (JFK's father) getting out of the 1920s stock market right before the Depression because his shoe-shine boy was giving him stock tips.

xx__yy 3y ago
Just like that time my taxi driver was telling me about "investing" in Bitcoin

keyle 3y ago

I'm surrounded by "opsec experts" (or whatever their name is lately) that keep running daily checks for windows pwned machines, against our servers which are all linux. Like 4000 tests a day, always returning green charts, looking great on weekly meetings I'm sure. They've demanded that we drop the WAF for them (WAF still irks me, it implies you don't know what you're running, but that's another day's topic), so that they can "better test our infrastructure". They're completely oblivious on how a buffer overflow would be executed, and I'm pretty sure they couldn't tell me what the difference is between http2 and http. I'm really saddened by the fact that this industry just barely runs from one breach to the next, pretending everything is fine, not understanding any of it and slapping on one-click solutions and pen-testing up the wazoo. For christ sakes I had to correct a report saying our data was stored in a "community", because it's a third party data centre they never heard of. I'm close to encourage my children not to get into the IT industry...

coffeesque 3y ago

> plunking down $9k for a 20-week course. I find this attitude kind of depressing. When I was in CS undergrad I thought about going into security because it seemed like this thing where you needed a bunch of systems background. To understand some exploits e.g. [0] you'd need hardware-related knowledge like branch prediction and memory hierarchy. Or something like stack smashing you'd need to know the process memory model and maybe some assembly It seems to me like security is split into two camps: the people who are out there in the wild who find exploits and the "bootcamp" crowd [0] https://en.wikipedia.org/wiki/Spectre_(security_vulnerability) https://en.wikipedia.org/wiki/Spectre_(security_vulnerabilit...

keyle 3y ago
There is most definitely a split between the people that are "traditionally" trained and understand the underlying layers, vs. the bodies added to a head count, to bolster some agenda.
don-code 3y ago
I for one am actually pretty glad to see the role commoditized. Software's one of few roles where you need the deep theory component (a CS degree) to practice (land a respectable gig). My impression is that this is because we, the software industry, have done a poor job separating the theory from practice. Much as you hire an electrician, as opposed to an electrical engineer, to wire your house, or a carpenter, rather than a mechanical / structural engineer, to build your house, I do think we should be finding ways to separate "programmer" from "computer scientist". These are both completely legitimate roles, and deserve to be paid according to their value produced - they're both quite high! But the fact that I need a deep understanding of data structures, operating systems, computer architecture, or other college-level concepts to write software feels like a shortcoming. If CS researchers can set standards for software, rather than _write the software itself_, we can more easily create on ramps and shallow ends for people to use. Low code tools and LLMs are great steps in this regard, but I feel that they're still stigmatized from the enablement perspective.