51–54 of 54 posts
This is going to be something of a rant, but roll with it. This is a controversial opinion, but I don't believe someone should be a security engineer or a security consultant until they are a provably competent software developer. This harkens back to the analogy of writing and editing - how can you expect to perform competent source code review from a security perspective without having a deep understanding of progr…
This is going to be something of a rant, but roll with it. This is a controversial opinion, but I don't believe someone should be a security engineer or a security consultant until they are a provably competent software developer. This harkens back to the analogy of writing and editing - how can you expect to perform competent source code review from a security perspective without having a deep understanding of progr…
Source: 30 years of security consulting and entrepreneurship, without being a developer.
I love a question with a simple right answer: (Ruby OR Python) AND C. You can skip C if you don't want to do low-level work (embedded, kernels, writing shellcode for memory corruption exploits). Only a small fraction of security people do this kind of work. You cannot skip (Ruby OR Python), even if you don't ever plan to do web work (which is a dumb plan anyways).
What about Go? I haven't seen it mentioned in any of the answers. Go looks very appealing and according to folks on #go-nuts it can be used for scripting. Also, it comes with a standard library that covers crypto, networking and most of what you might need. I would think that being able to cross compile and deploy a single binary when doing pen testing would make Go a good candidate for the infosec field.
I love a question with a simple right answer: (Ruby OR Python) AND C. You can skip C if you don't want to do low-level work (embedded, kernels, writing shellcode for memory corruption exploits). Only a small fraction of security people do this kind of work. You cannot skip (Ruby OR Python), even if you don't ever plan to do web work (which is a dumb plan anyways).
Do you have any recommended resources for learning Ruby from a security point of view? Something like Blackhat Python (http://www.nostarch.com/blackhatpython).