Hacker News Reader

Comment by debatem1 | Hacker News Reader

As a hiring security manager: go break shit. I don't care if you have a CEH, I care if you can bring me good vulns. Show me you can break things I care about and that you're not a horrible person and you'll go straight to the top of the list. It's that simple.

How do you get started breaking shit? Github has tons of shit. Go break it. More interested in hardware? Go buy some crappy iot gear and break it. Vulns are not rare and they do not require a damn piece of paper to find. Find them, and you will have no problem finding jobs.

If you are reading this and still don't know where to start, I am happy to help you find things to break and suggest approaches that might help. But seriously,don't waste your time and money getting certified. I don't care at all.

View on HN

To this point, bug bounties, bug bounties, bug bounties. If someone is applying to be a security developer, consultant, or anything beyond a security help desk operator my expectation is that they can tell me about bounties they've collected. In lieu of that, I'll accept them telling me about their ethical disclosures. Also playing CTF's, even without winning is a good sign. It shows passion and that's what matters at this point as we need people in security not because of the money, but because they passionately want to make the world a safer place and enjoy the work as a bonus.

I want to push back against this a bit because you used the word "expectation." Yes, I strongly agree that bug bounties are one way to achieve and demonstrate a certain level of expertise in information security, especially if you are trying to break in. However, don't make it more than a job for people who just want to do the job, and don't arbitrarily make it the whiteboard of the security industry.

My best colleagues, the people I most deeply respect and the people who inspired me to work in this industry all neglect bug bounties. They mostly don't participate in them at all. Bug bounties are usually pursued by people who have the free time and bandwidth for them. For the most part, most security consultants and engineers do not actually engage in them because they are already highly paid. This is why you most frequently see bug bounty participants from countries other than the United States and Western Europe.

Those that do have a full-time position and also engage in bug bounties certainly have a commendable passion for the work (or sometimes more accurately a workable formula for getting to low hanging fruit in new programs first), but please don't expect all or even most skilled security talent to adhere to this rule. Many people enjoy being skilled without sacrificing work-life balance. Just as not every software engineer needs to contribute to open source or have a GitHub profile, not every security engineer needs to have badgers for every company they've hacked.

I agree with you on your assessment, but those people you respect and inspired you are the one's who are already in the field. They already have accomplishments and have done things to earn that respect. I've found that it's near impossible to differentiate "posers" from actual security people when it comes to hiring someone without a long, formal, and vouched for by others security career. This is where bounties and ethical disclosure come into play. Also note the careful choosing of long, formal, and vouched for wording above. There are certainly people in our industry who are here because they are good at social engineering rather than here because of their technical skills or work ethic. Those individuals are very damaging to our field.

Can you clarify what you mean by "good at social engineering"? Do you mean they try to specialize in that and pass it off as actual security rigor ("hacking")?

Exaggerating their skill-set, claiming to have skills when they don't. Yes, it could be the Dunning–Kruger effect in action but more than not I think there is careful plotting involved to deceive. It's actually odd if you think about it a bit. I've been going to DEFCON for the last 11 years, have done the CTF thing, the speaking thing, etc., and it strikes me in many ways as a tale of two cities. You've got your highly skilled and technical security professionals who are talking and sharing but then you have all of the roadies, the fans, the people who watched Hackers and want that lifestyle. We don't see this in any other technical field that I'm aware of - I mean I'm pretty sure there aren't blue-haired database administrator wannabe's showing up to DBCon, are there? What ends up happening is that people like the idea. They want to be a "hacker" but want it as a day job but don't have the technical skill so they must figure out ways to social engineer their way into the field.

The folks at Attrition tend to cover it a bit more when it comes to "security rockstars":

http://attrition.org/errata/charlatan/

Yikes, what a list. I see your point though.

Saw a talk about bug bounties that had some data. Bug bounties mainly go to people in so-called "third world" counties; those are the people who appear to be the ones most interested in them.

CTFs and bug bounties are good. Better is when people have broken something for themselves, and best is when they've made money doing it. I trust that those people know how to think like the attackers I should be really worried about.

Breaking shit is important, so is understanding how to fix them, unless you'll work solely with penetration test. I tell you this because many hiring process for sec engs are around CTF games. From my experience as a security engineer, it's tough to find vulnerabilities, but it's as hard to fix them. Few security guys know how to code to the point of talking to developers or knowing devops to talk to system administrators. Btw, that's I'll write a blog post about this later.

Reading code well is table stakes for me. Writing code well isn't always, but if I hire someone who doesn't write code well it's because I'm betting they can learn to and already have a really solid dev who can pick up the slack.

Ditto this. In my part of the world CEH isn't much, it just states you have a basic idea of the tools and processes needed to be a CEH. Ask a job candidate with a CEH to describe the steps in setting up MiTM server and they probably couldn't. The folks who break shit, like their parents WiFi, are the ones who can answer that.

Having knowledge of C and python helps according to dsacco, where would you recommend starting? Books? Checking others code or how would you go about it?

Reply on news.ycombinator.com