3 ms·

we interview people whose only prior work experience is "Line of Business .NET Developer", and they end up showing us how to write exploits I am surprised

by cema 13y ago

we interview people whose only prior work experience is "Line of Business .NET Developer", and they end up showing us how to write exploits I am surprised you sound surprised. Do you label people by the kind of technologies or jobs they held? I mean, you argue against it, which I think is a positive argument, but somehow it seems that the labels people place on technologies and business domains are somehow rubbing off on the people who were using them. Feels myopic to me.

tptacek 13y ago
Zero prior cryptography experience. Zero work history in software security. Hired through a resume-blind work-sample process. Goes on to successfully implement a crypto attack that fewer than 10 people in the world have probably ever implemented before, one that requires debugging a lattice reduction step that takes 6 hours to run before you get to the part where you use a Fourier transform to postprocess the result. Or: Zero prior software security experience. Zero prior Rails experience. Zero prior Ruby experience. Hired through a resume-blind work-sample process. Looks at Rails for the first time, 30 minutes later reports a vulnerability that results in a CVE and a Rails patch. Repeats. Now runs Rails internal review board. I have other examples. Worth knowing: we aren't Rails neophytes (for instance, we're one of the firms that reported the YAML code execution bug) or for that matter crypto neophytes. It's not about what technologies you use; I don't so much care whether someone writes .NET code. It's the "absolutely no prior work experience doing this and no flashy resume to get them in the door" that stick out to me.
- UK-AL 13y ago
  Some of the best software engineers are .NET and Java software developers. These are the guys running massive systems, but no one ever hears about because its boring government/corporate work. But that work is infact the most challenging. Imagine the amount of transactions a bank has to handle every day, without fail! It's just that Hacker News biased to a certain section of society.
  - mattmanser 13y ago
    And they tend to be complex systems with a lot of edge cases and you start getting a feel where all the edge cases actually lurk.
- foobarqux 13y ago
  Did this guy have a math background? Was he coming up with the solution to the problems on his own from scratch?

by cema 13y ago

tptacek 13y ago

Zero prior cryptography experience. Zero work history in software security. Hired through a resume-blind work-sample process. Goes on to successfully implement a crypto attack that fewer than 10 people in the world have probably ever implemented before, one that requires debugging a lattice reduction step that takes 6 hours to run before you get to the part where you use a Fourier transform to postprocess the result. Or: Zero prior software security experience. Zero prior Rails experience. Zero prior Ruby experience. Hired through a resume-blind work-sample process. Looks at Rails for the first time, 30 minutes later reports a vulnerability that results in a CVE and a Rails patch. Repeats. Now runs Rails internal review board. I have other examples. Worth knowing: we aren't Rails neophytes (for instance, we're one of the firms that reported the YAML code execution bug) or for that matter crypto neophytes. It's not about what technologies you use; I don't so much care whether someone writes .NET code. It's the "absolutely no prior work experience doing this and no flashy resume to get them in the door" that stick out to me.

UK-AL 13y ago
Some of the best software engineers are .NET and Java software developers. These are the guys running massive systems, but no one ever hears about because its boring government/corporate work. But that work is infact the most challenging. Imagine the amount of transactions a bank has to handle every day, without fail! It's just that Hacker News biased to a certain section of society.
- mattmanser 13y ago
  And they tend to be complex systems with a lot of edge cases and you start getting a feel where all the edge cases actually lurk.
foobarqux 13y ago
Did this guy have a math background? Was he coming up with the solution to the problems on his own from scratch?