4 ms·

"For one, I think that security professionals are too keen to collect paychecks for bossing people around and having others do all the hard work." Anyone who's

"For one, I think that security professionals are too keen to collect paychecks for bossing people around and having others do all the hard work." Anyone who's read more than a few write ups of exploit chains wouldn't post something this ignorant. I'm not sure how to interpret this whole post in good faith unless it's satire. Just go read some posts off project zero.

reanimus 3y ago
Yeah, lines like that belie a contempt for security professionals and the work they do that paints the rest of the argument in a different light.
- er4hn 3y ago
  lcamtuf _is_ a security professional. He created p0f, AFL, wrote Silence on the Wire, and has done cybersec jobs from engineering to executive leadership. He has taken to posting mildly trollish stuff ("poasting") on Xitter, but this seems like a well reasoned reply to "Is rewriting entire codebases in a different language worth it?"
  - reanimus 3y ago
    You can argue whether or not the contempt is justified, but if your default position towards others in your field is "they're incompetent and just want to generate work for others", I'll be taking what you say regarding whether or not a given thing is worth working on with a grain of salt.
  - kevingadd 3y ago
    This is valuable context for the post, so thank you for explaining who the author is. It makes his stance on his colleagues all the more confusing though and I can only interpret the post as trolling. At least they're informed opinions, so I can understand why it got posted here.
- kbolino 3y ago
  Sadly, 90% of "security professionals" give the rest a bad name. Unfortunately, for whatever reasons, large bureaucracies seem to have decided that, after doing the same thing to network engineering and systems administration, computer security is just a dump profession in which you put slightly dim people who are only good at repeating mantras. For every pen tester or true security expert who breaks things for fun in their spare time, I've run into far too many more of the "just make the vulnerability scanner turn green" type. It's quite unfair actually that they get lumped together.
tyfighter 3y ago
No, you're not getting it. The reverse engineering itself is obviously extremely difficult work, but it's the work of an individual or at best a small team. Reverse engineering work only provides existence proofs of security issues, mostly singular instances. Taken to its extreme, some reverse engineers believe this means that all memory unsafe software needs to be rewritten. The sheer amount of software written in C or C++ dwarfs the size of the reverse engineering community in amounts I can't even fathom.
- kevingadd 3y ago
  I don't understand how this justifies writing off the work of security professionals as not real work or not difficult. Is the author talking about people who run security scanner scripts and call it a day? If so, why are those people relevant to discussions of memory safety and why generalize the entire discipline based on them? Are we supposed to generalize the traits/experiences of the average PHP developer and apply that to Haskell and C++ experts too? Every field has lazy people or unskilled hacks in it. Some subset of the industry having "bad opinions" also does not mean their work suddenly has no value or they're not trying hard. To me this approach to the hard work of real experts is immediately disqualifying for someone's opinions. They can think it, but if they want to say it they should be prepared to not be taken seriously.

reanimus 3y ago

Yeah, lines like that belie a contempt for security professionals and the work they do that paints the rest of the argument in a different light.

er4hn 3y ago
lcamtuf _is_ a security professional. He created p0f, AFL, wrote Silence on the Wire, and has done cybersec jobs from engineering to executive leadership. He has taken to posting mildly trollish stuff ("poasting") on Xitter, but this seems like a well reasoned reply to "Is rewriting entire codebases in a different language worth it?"
- reanimus 3y ago
  You can argue whether or not the contempt is justified, but if your default position towards others in your field is "they're incompetent and just want to generate work for others", I'll be taking what you say regarding whether or not a given thing is worth working on with a grain of salt.
- kevingadd 3y ago
  This is valuable context for the post, so thank you for explaining who the author is. It makes his stance on his colleagues all the more confusing though and I can only interpret the post as trolling. At least they're informed opinions, so I can understand why it got posted here.
kbolino 3y ago
Sadly, 90% of "security professionals" give the rest a bad name. Unfortunately, for whatever reasons, large bureaucracies seem to have decided that, after doing the same thing to network engineering and systems administration, computer security is just a dump profession in which you put slightly dim people who are only good at repeating mantras. For every pen tester or true security expert who breaks things for fun in their spare time, I've run into far too many more of the "just make the vulnerability scanner turn green" type. It's quite unfair actually that they get lumped together.

tyfighter 3y ago

No, you're not getting it. The reverse engineering itself is obviously extremely difficult work, but it's the work of an individual or at best a small team. Reverse engineering work only provides existence proofs of security issues, mostly singular instances. Taken to its extreme, some reverse engineers believe this means that all memory unsafe software needs to be rewritten. The sheer amount of software written in C or C++ dwarfs the size of the reverse engineering community in amounts I can't even fathom.

kevingadd 3y ago
I don't understand how this justifies writing off the work of security professionals as not real work or not difficult. Is the author talking about people who run security scanner scripts and call it a day? If so, why are those people relevant to discussions of memory safety and why generalize the entire discipline based on them? Are we supposed to generalize the traits/experiences of the average PHP developer and apply that to Haskell and C++ experts too? Every field has lazy people or unskilled hacks in it. Some subset of the industry having "bad opinions" also does not mean their work suddenly has no value or they're not trying hard. To me this approach to the hard work of real experts is immediately disqualifying for someone's opinions. They can think it, but if they want to say it they should be prepared to not be taken seriously.