Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security is Mathematics

daemonology.net

Post reply on HN
Print view View original

21–30 of 49 posts

Re: Security is Mathematics

#21

Post by bigmac »

tptacek wrote: post #19

The best security researchers in the world are almost uniformly not trained in mathematics. Here's a short list of top-tier researchers. Spot the mathematicians! * Mark Dowd * John McDonald * Alex Sotirov * Dino Dai Zovi * Charlie Miller * Michal Zalewski * Aaron Portnoy * Dave Aitel * David Litchfield * Barnaby Jack This doesn't invalidate the blog post, but I will go on to suggest that quite a lot of people with ex…

Leaving off the top cryptographers from a list of security researchers seems a bit disingenuous. However, including cryptographers might make Colin's argument trivially obvious, since so many of the top crypographers come from mathematics backgrounds. Therefore, I'll just add Rolf Rolles to your list, and note that he does come from a mathematics background.

Re: Security is Mathematics

#22

Post by Tycho »

jdp23 wrote: post #11
stcredzero wrote: post #10

Earlier quoted context omitted.

Right. I don't think thorough economic analyses come into play nearly enough when people think about security.

Also an excellent point. Ross Anderson started pushing the term "Security Engineering" around 2000 and economics were a big part of it.

Can you elaborate on the economics involved, please? Sounds interesting.

Re: Security is Mathematics

#23

Post by tptacek »

bigmac wrote: post #21
tptacek wrote: post #19

The best security researchers in the world are almost uniformly not trained in mathematics. Here's a short list of top-tier researchers. Spot the mathematicians! * Mark Dowd * John McDonald * Alex Sotirov * Dino Dai Zovi * Charlie Miller * Michal Zalewski * Aaron Portnoy * Dave Aitel * David Litchfield * Barnaby Jack This doesn't invalidate the blog post, but I will go on to suggest that quite a lot of people with ex…

Leaving off the top cryptographers from a list of security researchers seems a bit disingenuous. However, including cryptographers might make Colin's argument trivially obvious, since so many of the top crypographers come from mathematics backgrounds. Therefore, I'll just add Rolf Rolles to your list, and note that he does come from a mathematics background.

Neither Colin nor Schneier was talking about cryptography. Cryptography and security are not the same thing.

Rolf Rolles is a very smart guy, but he's not a security researcher; he works in content protection and reverse engineering. Having said that: sure. That's one. One. :)

Re: Security is Mathematics

#24

Post by levigross »

tptacek wrote: post #19

The best security researchers in the world are almost uniformly not trained in mathematics. Here's a short list of top-tier researchers. Spot the mathematicians! * Mark Dowd * John McDonald * Alex Sotirov * Dino Dai Zovi * Charlie Miller * Michal Zalewski * Aaron Portnoy * Dave Aitel * David Litchfield * Barnaby Jack This doesn't invalidate the blog post, but I will go on to suggest that quite a lot of people with ex…

The author of the article was referring to a method of learning a proper security mind set. Its a classic self learning vs classroom based learning.....

Re: Security is Mathematics

#25

Post by cperciva »

tptacek wrote: post #19

The best security researchers in the world are almost uniformly not trained in mathematics. Here's a short list of top-tier researchers. Spot the mathematicians! * Mark Dowd * John McDonald * Alex Sotirov * Dino Dai Zovi * Charlie Miller * Michal Zalewski * Aaron Portnoy * Dave Aitel * David Litchfield * Barnaby Jack This doesn't invalidate the blog post, but I will go on to suggest that quite a lot of people with ex…

Charlie Miller

You mean the Charlie Miller who has a PhD in mathematics, right?

Also, did you seriously just write a list of top-tier security researchers which didn't include djb?

Re: Security is Mathematics

#26

Post by leif »

Forget security, programming is mathematics. If you program, you should be doing this whether you're writing security code or not. Nothing saves me more keystrokes or debugging time than proving things about my algorithm before I code it, and I know this comes from math because my CS-only friends can't do it. I don't care if you want to go in to algorithm theory or get a software job at a bank, if you're a CS major, you need to take some rigorous math or you'll be at a disadvantage.

Re: Security is Mathematics

#27

Post by leif »

tptacek wrote: post #19

The best security researchers in the world are almost uniformly not trained in mathematics. Here's a short list of top-tier researchers. Spot the mathematicians! * Mark Dowd * John McDonald * Alex Sotirov * Dino Dai Zovi * Charlie Miller * Michal Zalewski * Aaron Portnoy * Dave Aitel * David Litchfield * Barnaby Jack This doesn't invalidate the blog post, but I will go on to suggest that quite a lot of people with ex…

Whether they have "Mathematics" on their diploma is immaterial; I'd bet good money that most of these guys took some real serious math classes in school.

Re: Security is Mathematics

#28

Post by tptacek »

cperciva wrote: post #25
tptacek wrote: post #19

The best security researchers in the world are almost uniformly not trained in mathematics. Here's a short list of top-tier researchers. Spot the mathematicians! * Mark Dowd * John McDonald * Alex Sotirov * Dino Dai Zovi * Charlie Miller * Michal Zalewski * Aaron Portnoy * Dave Aitel * David Litchfield * Barnaby Jack This doesn't invalidate the blog post, but I will go on to suggest that quite a lot of people with ex…

Charlie Miller You mean the Charlie Miller who has a PhD in mathematics, right? Also, did you seriously just write a list of top-tier security researchers which didn't include djb?

I didn't know Charlie had a math degree! That's two. :)

Rolf Rolles is more of a security researcher --- a lot more --- than Daniel Bernstein. But I'll concede it! He's a third.

We're at 3. Do you think I can't name 10 more notable security researchers, justifying each of them, to back up my point here?

Re: Security is Mathematics

#29

Post by Someone »

dkarl wrote: post #18

Knuth is famous for the remark "Beware of bugs in the above code; I have only proved it correct, not tried it", and the implicit statement that a proof-of-correctness is not adequate to ensure that code will operate correctly is one I absolutely agree with My boss told me a similar story of a computer science professor giving a cross-group talk in which he pitched the concept of formal methods to a group of physicist…

You can see that computer science is an applied science. A mathematics professor would have given a proof that such an algorithm exists or, more likely, that algorithms exist for solving several more general problems, and left it at that.

Re: Security is Mathematics

#30

Post by chwahoo »

Where the author's narrative breaks down is when he draws a parallel between security and proofs of theorems. The closer connection is between security and adequacy of theorems.

It is true that you need to make sure your software conforms to its specifications and that process does involve informal (or formal) proof-like reasoning, but that is only a small part of the challenge. This is the part that mathematicians would be good at, but other technologies are good at the this as well (type checkers prove weak properties, verification tools prove stronger ones). None of this requires a "twisted mind", just attention to detail.

The problem of writing software specifications that correspond to the abstract notion of security is the tougher task. In math, the closest analogy is figuring out what theorems people actually care about. While I don't know for sure, I'm skeptical that a math education emphasizes this skill. Security takes this skill a step further and requires Schneier's "twisted mind" to consider all the real-world ways that things could go wrong (including, among other things, the incentives that might motivate an adversary) and write specifications for secure, but useful, software.

Post reply on HN