Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What's the best programming language to learn for security?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 54 posts

Re: Ask HN: What's the best programming language to learn for security?

#41

Post by tptacek »

wslh wrote: post #40
tptacek wrote: post #17

I love a question with a simple right answer: (Ruby OR Python) AND C. You can skip C if you don't want to do low-level work (embedded, kernels, writing shellcode for memory corruption exploits). Only a small fraction of security people do this kind of work. You cannot skip (Ruby OR Python), even if you don't ever plan to do web work (which is a dumb plan anyways).

JavaScript/Node.js/modules are essentials now since Node is pretty popular. For example, many Bitcoin modules like Copay are written in JavaScript and not available in other programming languages.

Ruby or Python is more important than strong JavaScript, and everyone who knows Ruby or Python has at least weak JavaScript. If you specialize in JavaScript security, you need it, but you can say the same thing about Intercal.

Re: Ask HN: What's the best programming language to learn for security?

#42

Post by wslh »

tptacek wrote: post #41
wslh wrote: post #40

Earlier quoted context omitted.

JavaScript/Node.js/modules are essentials now since Node is pretty popular. For example, many Bitcoin modules like Copay are written in JavaScript and not available in other programming languages.

Ruby or Python is more important than strong JavaScript, and everyone who knows Ruby or Python has at least weak JavaScript. If you specialize in JavaScript security, you need it, but you can say the same thing about Intercal.

I don't think you can fairly compare JavaScript with Intercal in this context. JS is very popular now and you can see a lot of job posts that give you a hint about the market size for security reviewing Node applications.

Additionally, Node modules are a fertile ground for bug searching.

Re: Ask HN: What's the best programming language to learn for security?

#43

Post by sekasi »

I believe comments here that programming isn't a necessity aren't really correct. A strong programming knowledge to the point of expertise is what you should aspire towards in a security-related career.

Language is a hard question though, there are a lot of things to consider around what sector you want to focus on. The holy trinity seems to be Python, Ruby and C.

ASM is probably very overlooked in general, but also a lot harder to master. Good luck, hope you get to a point where you can take a few steps forward. This is going to be an enormous area of interest over the next few years (much more so than it already is) so enjoy the challenge and the money ;)

Re: Ask HN: What's the best programming language to learn for security?

#44

Post by javajosh »

tptacek wrote: post #41
wslh wrote: post #40

Earlier quoted context omitted.

JavaScript/Node.js/modules are essentials now since Node is pretty popular. For example, many Bitcoin modules like Copay are written in JavaScript and not available in other programming languages.

Ruby or Python is more important than strong JavaScript, and everyone who knows Ruby or Python has at least weak JavaScript. If you specialize in JavaScript security, you need it, but you can say the same thing about Intercal.

JavaScript is the most deployed interpreter in the world, and therefore almost certainly handling the greatest amount of independent data in the world. So whether or not you think it's a bad joke, it's important.

Re: Ask HN: What's the best programming language to learn for security?

#45

Post by tptacek »

wslh wrote: post #42
tptacek wrote: post #41

Earlier quoted context omitted.

Ruby or Python is more important than strong JavaScript, and everyone who knows Ruby or Python has at least weak JavaScript. If you specialize in JavaScript security, you need it, but you can say the same thing about Intercal.

I don't think you can fairly compare JavaScript with Intercal in this context. JS is very popular now and you can see a lot of job posts that give you a hint about the market size for security reviewing Node applications. Additionally, Node modules are a fertile ground for bug searching.

Sure. But the premise of the question is, what language (singular) should someone pick up to do "security for companies" (I read from that: appsec). I cheated by giving 2; formally, the right answer to this question was simply "Python OR Ruby".

Re: Ask HN: What's the best programming language to learn for security?

#46

Post by tptacek »

javajosh wrote: post #44
tptacek wrote: post #41

Earlier quoted context omitted.

Ruby or Python is more important than strong JavaScript, and everyone who knows Ruby or Python has at least weak JavaScript. If you specialize in JavaScript security, you need it, but you can say the same thing about Intercal.

JavaScript is the most deployed interpreter in the world, and therefore almost certainly handling the greatest amount of independent data in the world. So whether or not you think it's a bad joke, it's important.

I think I sent the wrong message with the Intercal comparison.

My point was that the logic that brings you to "you need Javascript if you specialize in Javascript security" works for any language, including Intercal.

It was not that Javascript is a language as dumb as Intercal.

If I had to make a list of 3 languages to know for security people, Javascript would probably be my #3 (Java might be #3, and Javascript #4; I'd have to think about it.)

BTW: Unlike a lot of people on this thread, assembly wouldn't be in my top 5. It is much, much more important that appsec people be able to fluently write C than it is that they be good assembly programmers. Even full-time reversers don't spend that much time reading assembly in bulk.

Re: Ask HN: What's the best programming language to learn for security?

#47

Post by tptacek »

ejcx wrote: post #15

Depends on what type of security you want to get into. General Pentesting: Python or something higher level. Lots of library and tool usage (i.e. scapy, nping, nmap, metasploit) Application Security: Learn frameworks more than languages. How to work inside of Rails, Spring, ASP, PHP stuff, etc. Common security bugs that exist in these codebases, how to fix them, and how to recognize them. It is more important here HO…

I actually don't think you need to know assembly all that well to do exploit dev and reversing. What you need is:

(a) native-level proficiency with C and the memory hierarchy that C tries to abstract (ie: you want to understand what goes in registers, when, and why, and how a stack frame is laid out and why)

(b) at least limited working proficiency with compiler theory, most especially the analysis of control flow graphs

As time goes on, knowing little working-programmer details like how LEA gets used for multiplication is getting much less important, and understanding compiler IRs (particularly LLVM) is getting more important. Weirdly (but awesomely), both exploit dev and reversing is becoming more and more theoretical (predicate translations and satisfiability, symbolic execution, &c) and less and less systemsy, and the systemsy stuff is getting larger-scale: like, writing whole-system emulators to reverse firmware targets.

I guess my argument would be: you don't ever need to learn how to write a decent assembly program to get to (a) and (b), and by the time you have (a) and (b), you'll easily be able to pick up whatever assembly you need as you go.

Re: Ask HN: What's the best programming language to learn for security?

#48

Post by ejcx »

tptacek wrote: post #47
ejcx wrote: post #15

Depends on what type of security you want to get into. General Pentesting: Python or something higher level. Lots of library and tool usage (i.e. scapy, nping, nmap, metasploit) Application Security: Learn frameworks more than languages. How to work inside of Rails, Spring, ASP, PHP stuff, etc. Common security bugs that exist in these codebases, how to fix them, and how to recognize them. It is more important here HO…

I actually don't think you need to know assembly all that well to do exploit dev and reversing. What you need is: (a) native-level proficiency with C and the memory hierarchy that C tries to abstract (ie: you want to understand what goes in registers, when, and why, and how a stack frame is laid out and why) (b) at least limited working proficiency with compiler theory, most especially the analysis of control flow gr…

That's fair. I think my point with the paragraph still stands though, that this path has the highest bar of entry. I think the demand for this type of worker is way lower, even in the beltway.

Re: Ask HN: What's the best programming language to learn for security?

#50

Post by may0 »

tptacek wrote: post #17

I love a question with a simple right answer: (Ruby OR Python) AND C. You can skip C if you don't want to do low-level work (embedded, kernels, writing shellcode for memory corruption exploits). Only a small fraction of security people do this kind of work. You cannot skip (Ruby OR Python), even if you don't ever plan to do web work (which is a dumb plan anyways).

What about Go? I haven't seen it mentioned in any of the answers.

Go looks very appealing and according to folks on #go-nuts it can be used for scripting. Also, it comes with a standard library that covers crypto, networking and most of what you might need.

I would think that being able to cross compile and deploy a single binary when doing pen testing would make Go a good candidate for the infosec field.

Post reply on HN