A quick review showed a lack of : Reflections on Trusting Trust Ken Thompson ( http://cm.bell-labs.com/who/ken/trust.html ) Any list without it, is a list without it.
You should've said:
> I find your lack of trust disturbing.
Recommended Security Reading
11–20 of 51 posts
Re: Recommended Security Reading
#12Alright. If you are a web developer or you are a whatever who knows nothing about security, please read resources that apply to whatever you do.
Learning security on a topic will make you so much better at what you do and it will make you learn internal details AND best practices.
The things you build will be BETTER not just more secure
I'm really tired of reporting account hijacks and Remote code executions to startups who look at me blankly when I explain what I did
Re: Recommended Security Reading
#13A real hacker would tell you that all these books are really not needed. All you need to know is in-and-out of any one os( say windows), and good understanding of any one hardware architechture (say x86). Practical reverse engineering\hacking is then about getting your hands dirty by doing things using tools like IDA. What you really need is a very strong intuition and understanding of software upside-down (from hardware instructions to source code and vice versa). There is a reason why practical hacking\reverse engineering is an ART.
Re: Recommended Security Reading
#14Avoid _Applied Cryptography_. You probably won't get too much value from _Introduction to Modern Cryptography_, either.
The only cryptography book I can recommend is _Cryptography Engineering_ (nee _Practical Cryptography_, which is virtually identical).
You would be surprised how few professional security people know anything about cryptography. It certainly isn't a qualifier.
I generally have a hard time with any book list for security people that includes, for instance, _Design Patterns_.
Re: Recommended Security Reading
#15Avoid _Applied Cryptography_. You probably won't get too much value from _Introduction to Modern Cryptography_, either. The only cryptography book I can recommend is _Cryptography Engineering_ (nee _Practical Cryptography_, which is virtually identical). You would be surprised how few professional security people know anything about cryptography. It certainly isn't a qualifier. I generally have a hard time with any b…
> I generally have a hard time with any book list for security people that includes, for instance, _Design Patterns_.
Would you please elaborate on this point? I am not familar with that book and so do not know why its inclusion reflects poorly on the list (or the list author's assessments).
Re: Recommended Security Reading
#16Avoid _Applied Cryptography_. You probably won't get too much value from _Introduction to Modern Cryptography_, either. The only cryptography book I can recommend is _Cryptography Engineering_ (nee _Practical Cryptography_, which is virtually identical). You would be surprised how few professional security people know anything about cryptography. It certainly isn't a qualifier. I generally have a hard time with any b…
> I generally have a hard time with any book list for security people that includes, for instance, _Design Patterns_. Would you please elaborate on this point? I am not familar with that book and so do not know why its inclusion reflects poorly on the list (or the list author's assessments).
_Design Patterns_ is one of those books that nerds of a certain vintage all have on their bookshelves. The lucky ones --- most of them! --- haven't read it carefully. It's a book about software architecture, and, more specifically, about turning C++ into Smalltalk.
It has absolutely no relevance to software security, even in terms of background material about computer science. (It's actually of dubious relevance to programmers in general). It's one of a couple books on this list that give it the flavor of "I just typed up my bookshelf".
It doesn't help that the summary is "Required reading for any serious programmer".
Re: Recommended Security Reading
#17Earlier quoted context omitted.
> I generally have a hard time with any book list for security people that includes, for instance, _Design Patterns_. Would you please elaborate on this point? I am not familar with that book and so do not know why its inclusion reflects poorly on the list (or the list author's assessments).
_Design Patterns_ is one of those books that nerds of a certain vintage all have on their bookshelves. The lucky ones --- most of them! --- haven't read it carefully. It's a book about software architecture, and, more specifically, about turning C++ into Smalltalk. It has absolutely no relevance to software security, even in terms of background material about computer science. (It's actually of dubious relevance to p…
I agree that _Design Patterns_ has little to do with security, but I think you are being a bit hard on it from a programming perspective.
Certainly the book is tremendously useful for ObjC programmers because Apple incorporated most of these patterns into Cocoa and Cocoa Touch. And as someone who has done code review with junior Android developers, I wish that more devs read it. When a security researcher refers to a MITM attack or SQL injection, this higher level concepts mean something and it enables clearer conversation. That's what design patterns provide to software developers.
Re: Recommended Security Reading
#18The Tangled Web is written by Michal Zalewski. The book is the updated version of the famous Browser Handbook. [1] I still recommend looking at it if you can't get The Tangled Web. IMO, this is the bible of web security today.
I really hope people can put together a web security book (and free) that is up-to-date. To me, the Tangled Web does a pretty good job, but there are still nuts and bolts missing or wordy.
OWASP wiki is okay-ish but I really hate digging the wiki just to find the information is either incorrect or outdated.
Re: Recommended Security Reading
#19A real hacker would tell you that all these books are really not needed. All you need to know is in-and-out of any one os( say windows), and good understanding of any one hardware architechture (say x86). Practical reverse engineering\hacking is then about getting your hands dirty by doing things using tools like IDA. What you really need is a very strong intuition and understanding of software upside-down (from hard…
From the linked page:
A real hacker would tell you that all these books are really not needed.
Who's saying that these "need" to be read? Maybe the HN title has been changed in the meantime, but this is entirely presented as a list of resources. You're not going to argue against reading books as a component of education, are you? And I don't even want to know where that "real hacker" stuff is coming from. That word hasn't meant anything concrete for over a decade.
Re: Recommended Security Reading
#20Earlier quoted context omitted.
_Design Patterns_ is one of those books that nerds of a certain vintage all have on their bookshelves. The lucky ones --- most of them! --- haven't read it carefully. It's a book about software architecture, and, more specifically, about turning C++ into Smalltalk. It has absolutely no relevance to software security, even in terms of background material about computer science. (It's actually of dubious relevance to p…
I agree that _Design Patterns_ has little to do with security, but I think you are being a bit hard on it from a programming perspective. Certainly the book is tremendously useful for ObjC programmers because Apple incorporated most of these patterns into Cocoa and Cocoa Touch. And as someone who has done code review with junior Android developers, I wish that more devs read it. When a security researcher refers to a…
(To save you some explaining time:) I'm excruciatingly familiar with the GoF patterns and much of the broader pattern movement (I'm a recovering C++ programmer). So:
Of the original GoF patterns, which specific ones make it easier to discuss SQL injection?