Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Infosec's Jerk Problem (2013)

adversari.es

Post reply on HN
Print view View original

81–90 of 142 posts

Re: Infosec's Jerk Problem (2013)

#81

Post by nickpsecurity »

jerf wrote: post #71
nickpsecurity wrote: post #63

Earlier quoted context omitted.

Nonsense. Defense is plenty fun. Anyone can find a 0-day. The principles and some methods are the same crap as Schell et al did in MULTICS security evaluation they published decades ago. Same kind of stuff Burroughs was preventing in 1961. More interesting was when the old guard tried to build something that couldn't be compromised under any circumstances. Others tried to find and master key areas of the problem. The…

"To me at least." I suppose I wasn't clear. I have fun with it too for the most part or I wouldn't be doing it. But I observe that I'm a rare duck that way. And the unrelenting stream of bugs caused by the same fundamental root-cause issues over and over again can get old. How many times do I have to see an XSS brought on by using string concatenation on HTML? How many times do I have to see, well, any of several vul…

Ahh, you do web applications. Then you might like my summary of state of the art for that:

https://www.schneier.com/blog/archives/2014/04/the_security_...

It's due for an update in near future with resources that a few people here shared with me. Still has lots of interesting stuff, though. Might not help in your day job as you can't dictate the stuff to management or dev team. However, you could enjoy doing it in private on FOSS project exploring those tools or improving/cloning them for others.

There's also projects that try to automate prevention of known classes of bugs. If you find some easy to use, maybe bring it to attention of your management showing they make QA more efficient & liability lower while requiring no extra costs on dev's part. Win-win.

Re: Infosec's Jerk Problem (2013)

#82

Post by maffydub »

vox_mollis wrote: post #39
dkopi wrote: post #32

Earlier quoted context omitted.

The real solution in my opinion is educating people on security. not just developers, but also end users, sales people, and product managers. When users start choosing the robust and secure product over the quick and insecure product, sales will pick that up, product will follow, and programmers will treat security just like any other feature.

Respectfully disagree, here. Infosec has been trying the education path for decades, now. It's not working. Either something needs to change about the educational process, or acceptance that it's failed is warranted. I think fixing development will be more optimal than fixing users. There is no legitimate reason that OWASP top ten or lack of buffer bounds checking should still be in the wild in 2016, whereas users wi…

I think the challenge here is: if the users don't care, why should the CEO of your company?

...and if the CEO doesn't care, why is he going to want to pay developers to (as you say earlier) "always include security robustness as a required feature during the software estimation cycle"?

So, unless the users _do_ care, the only way I can see this happening is if it costs no more to the CEO/users to do this than it costs not to... and that either means * all developers swearing your security "Hippocratic oath" (which, as you say, will never happen) * languages/tooling that mean that this becomes automatic (where there have been steps forward, but we're clearly not "there", and I doubt ever will be).

Re: Infosec's Jerk Problem (2013)

#83

Post by FlyingCoconut »

jvehent wrote: post #76
FlyingCoconut wrote: post #59

InfoSec: "There is a vulnerability." me: "PR or GTFO." The problem described is that ISOs are professional nags instead of software shippers.

That only works if your application is simple enough for the infosec folks to know how to write a patch for it. If the organization has 200 of those apps, it's unlikely a transversal security team is able to write patches for each one of them.

Whither Agile? Cross functional teams, sitting together.

This is The Reason (tm) :)

Re: Infosec's Jerk Problem (2013)

#84

Post by tptacek »

lawnchair_larry wrote: post #73
tptacek wrote: post #28

I carve up this problem differently. To me, the field can be divided into two basic categories of people: 1. People who are into security to prosecute some immortal struggle between good and evil. 2. People who are into security because of the engineering challenge. It's the people in group (1) that I tend to have a problem with. Often, for the "good guys" security professionals, engineering facts are just a means to…

This is a strange statement. Do you underestimate how many of your friends and respected peers are #1? I think it's the #2s who are too quick to dismiss #1s that I tend to have a problem with. I don't think jerkiness correlates with either of them even a little bit.

There are people who are both #1 and #2, but they're pretty rare. Or, at least, that's the perception I get, because I don't generally have to interrogate people to learn if they're #1s: they're all too happy to broadcast that fact.

Re: Infosec's Jerk Problem (2013)

#85

Post by tptacek »

makomk wrote: post #75
altotrees wrote: post #54

Earlier quoted context omitted.

I have read through every comment here, and fail to see a lack of self-awareness in any of them. Perhaps you are seeing things from a perspective I have not considered...or you are boldly trolling from a throwaway account. If it is the former, please elaborate.

I suspect it has something to do with tptacek's very strongly pro-US-state political views and his dismissive attitude to people who don't share those views, as demonstrated in the above comment.

First of all, this site is like a study in the Fundamental Attribution Fallacy. When I read comments like this, I'm certain the person writing them has no idea what I believe, but has someone managed to develop an entitlement to that knowledge because we share a message board. Unable to discern what it is I actually believe, you instead try to interpolate it from random comments on HN. Spoiler: it's not working. I'm especially amused by how many different political villains I've managed to be cast as. Am I libertarian? Am I a statist? Am I a right-winger? Am I an SJW? Depends on the thread!

Stop doing that.

Second, the #1/#2 distinction has nothing to do with the US government. Overwhelmingly, the #1's I've interacted with have cast "criminals" in the "bad guy" role, not NSA. The point isn't who the adversary is, it's that they're animated solely by the idea that they're in a real struggle with some kind of adversary in the first place.

Re: Infosec's Jerk Problem (2013)

#86

Post by tptacek »

davidw wrote: post #55
tptacek wrote: post #28

I carve up this problem differently. To me, the field can be divided into two basic categories of people: 1. People who are into security to prosecute some immortal struggle between good and evil. 2. People who are into security because of the engineering challenge. It's the people in group (1) that I tend to have a problem with. Often, for the "good guys" security professionals, engineering facts are just a means to…

All I know is that far too many "security guy" discussions sound like dick waving contests pronounced in the tone of The Simpsons' "Comic Book Guy".

It's sadly nothing at all like debates between people pushing different unit testing methodologies.

Re: Infosec's Jerk Problem (2013)

#88

Post by tptacek »

vox_mollis wrote: post #61
tptacek wrote: post #28

I carve up this problem differently. To me, the field can be divided into two basic categories of people: 1. People who are into security to prosecute some immortal struggle between good and evil. 2. People who are into security because of the engineering challenge. It's the people in group (1) that I tend to have a problem with. Often, for the "good guys" security professionals, engineering facts are just a means to…

I can think of several people who fit firmly into both. Moxie, for instance. I fail to see how these two categories are mutually exclusive.

Hold on. The definition of my #1 category isn't a belief in good and evil; it's the idea that their primary function in the field is to save the world, not to perfect security engineering. Looking at Moxie's work, I don't think anyone can legitimately accuse him of not taking engineering seriously.

Re: Infosec's Jerk Problem (2013)

#89

Post by bcook »

tptacek wrote: post #84
lawnchair_larry wrote: post #73

Earlier quoted context omitted.

This is a strange statement. Do you underestimate how many of your friends and respected peers are #1? I think it's the #2s who are too quick to dismiss #1s that I tend to have a problem with. I don't think jerkiness correlates with either of them even a little bit.

There are people who are both #1 and #2, but they're pretty rare. Or, at least, that's the perception I get, because I don't generally have to interrogate people to learn if they're #1s: they're all too happy to broadcast that fact.

Are you speaking from personal (statistically insignificant) experience or do you have some quantifiable evidence to share?

Your HN-karma & real-world accomplishments aside, do you honestly think you can psychologically categorize a group accurately enough that we should use your defined stereotype to improve ourselves and/or society?

Post reply on HN