3 ms·

I often debate if I should go into the hacking world, best case I get bug bounties, worst case I get rich and I contribute immoral actions. I think its far eas

I often debate if I should go into the hacking world, best case I get bug bounties, worst case I get rich and I contribute immoral actions. I think its far easier to make $3,000,000 as a hacker than a worker/entrepreneur. Its way easier to find flaws/bugs than to do the entire Capitalism thing correctly. Then I see that half of these major attacks required social engineering.... Maybe being a hacker is significantly easier. I only need to fool 1 person, there are a lot of people, and merit isnt exactly how everyone got to their position. Anyway point being: People are amazed by hacking, they shouldn't be, its relatively easy if you are a mere 10 year programmer. Most of us pick relatively moral work, so the number of attacks are small. It is also why we really need to treat security on computers like its no stronger than your home's front door lock. There are too many attack vectors to be perfectly safe.

AndyMcConachie 3y ago
> People are amazed by hacking, they shouldn't be, its relatively easy if you are a mere 10 year programmer. +1 Between roughly 1999 and 2013 I was primarily a test engineer for networking switches/routers/telephony products. I found bugs for a living and wrote them up, and in the process I found plenty of security vulnerabilities and wrote them up. Security bugs aren't really that different from other bugs. Yet for some reason we lionize people who find security bugs. Most security issues are simply quality issues. But by calling them security issues we shift the focus away from the software producer creating shit code to an attacker doing something bad. The case with xz is a little different, because we have someone who intentionally added bad code and tried to hide it. But for unintentional bugs that rise to security vulnerabilities it's 99% a QA problem.
- _kb 3y ago
  QA is focused on testing a product or system against how it should work. Security analysis tests against how it shouldn't. The second of those is a much larger search space. Both are important. The argument around blame shifting is apt. The same case has been made for the usage of the term 'bug' (aka an externality). It's 2024, we don't have moths crawling into relays on our computers. We have implementation faults, invalid designs, unsound architecture, inaccurate documentation, ambiguous requirements, and a myriad of other ways to express how software may be defective. Using those terms hurts, and may even invoke some level of concern from those outside of the engineering org - this is a great reason to embrace them.
  - manquer 3y ago
    > QA is focused on testing a product or system against how it should work It would be pretty poor QA who only tested happy paths . Any competent quality analyst will be expected to test for failure states, boundary conditions and so on .
saulpw 3y ago
I think your worst case is a bit off. Worst case you go to prison for a very long time? And if you do make that $3m as a hacker, now you have to spend your time worrying about whether someone will eventually catch you because of that one time you logged into a service without using enough VPNs.
saagarjha 3y ago
Security engineer here. Your viewpoint is exceptionally skewed to the point of being wildly inaccurate. Being good at security work is like any other skill and has a payout distribution more akin to being a star performing artist than a 9-to-5 job. That is, everyone hears about the people that make millions, but they’re actually missing that most people make far less than that, even when they’re good at their jobs. And in your case the people who are not good at their jobs also end up in jail. And just like learning to play music, you can get really good at it if you practice for 10 years–but most people won’t, and even then if you’re in the top 1% but not the top 0.1% the difference in pay might be several orders of magnitude. Just being a software engineer is a far more reliable way to be well off.

AndyMcConachie 3y ago

> People are amazed by hacking, they shouldn't be, its relatively easy if you are a mere 10 year programmer. +1 Between roughly 1999 and 2013 I was primarily a test engineer for networking switches/routers/telephony products. I found bugs for a living and wrote them up, and in the process I found plenty of security vulnerabilities and wrote them up. Security bugs aren't really that different from other bugs. Yet for some reason we lionize people who find security bugs. Most security issues are simply quality issues. But by calling them security issues we shift the focus away from the software producer creating shit code to an attacker doing something bad. The case with xz is a little different, because we have someone who intentionally added bad code and tried to hide it. But for unintentional bugs that rise to security vulnerabilities it's 99% a QA problem.

_kb 3y ago
QA is focused on testing a product or system against how it should work. Security analysis tests against how it shouldn't. The second of those is a much larger search space. Both are important. The argument around blame shifting is apt. The same case has been made for the usage of the term 'bug' (aka an externality). It's 2024, we don't have moths crawling into relays on our computers. We have implementation faults, invalid designs, unsound architecture, inaccurate documentation, ambiguous requirements, and a myriad of other ways to express how software may be defective. Using those terms hurts, and may even invoke some level of concern from those outside of the engineering org - this is a great reason to embrace them.
- manquer 3y ago
  > QA is focused on testing a product or system against how it should work It would be pretty poor QA who only tested happy paths . Any competent quality analyst will be expected to test for failure states, boundary conditions and so on .

saulpw 3y ago

I think your worst case is a bit off. Worst case you go to prison for a very long time? And if you do make that $3m as a hacker, now you have to spend your time worrying about whether someone will eventually catch you because of that one time you logged into a service without using enough VPNs.

saagarjha 3y ago

Security engineer here. Your viewpoint is exceptionally skewed to the point of being wildly inaccurate. Being good at security work is like any other skill and has a payout distribution more akin to being a star performing artist than a 9-to-5 job. That is, everyone hears about the people that make millions, but they’re actually missing that most people make far less than that, even when they’re good at their jobs. And in your case the people who are not good at their jobs also end up in jail. And just like learning to play music, you can get really good at it if you practice for 10 years–but most people won’t, and even then if you’re in the top 1% but not the top 0.1% the difference in pay might be several orders of magnitude. Just being a software engineer is a far more reliable way to be well off.