Hacker News Reader

Comment by jpadvo | Hacker News Reader

Lucas and his team are amazing. Everyone makes mistakes, and no system will be perfectly secure. So in my mind the best parts of the entire post were these:

"We have hired professional white hat hackers with government level security experience to attempt regular pen tests on our system, both as regular users as well as giving them special access and seeing if they can get through."

and

"If you find a security flaw and report it using the Full Disclosure Policy to security@phpfog.com with notice, we will help strengthen your security reputation in a very public way and reward you generously."

View on HN

Hiring white hat hackers is a joke. They are the ultimate in hacks.

Step 1. Open up Metasploit Step 2. Button Mash. ???? Step 3. Profit

I downvoted this too, but wish I hadn't. He has a point.

He could have made his point in a more intelligent way.

Just, do be aware that there are a lot of people that fit the description he gave; they are particularly numerous among the people who use the words "white hat" or "hacker" (with any modifier) in their services.

Downvotes because of phrasing? Here.

So called 'white hat hackers' tend to be fraudulent script kiddies who couldn't hack their way out of a gibs0n.

They often attend classes like this http://www.infosecinstitute.com/blog/ethical_hacking_compute... and read a book or two like this http://www.google.com/products/catalog?q=hacking+exposed&.... Some times they'll even have a sweet certification like this https://www.eccouncil.org/certification/certified_ethical_ha....

And at the end of the day all they're doing is getting the down low on your system with nmap and then going all turbo with metasploit. And if they are feeling up to a challenge they might even rip someone's exploit from milw0rm.

99% of them are frauds and the other 1% are sellouts.

Thanks for rephrasing. It really does make a difference. I actually got some value out of this comment, whereas from your previous comment I got none.

Can you explain your "1% are sellouts" comment? Are you saying that top-tier crackers that accept money for their services are sellouts?

I'm sure this is going to ruffle feathers, but whatever.

The way you become a 'top tier hacker' is by exploiting and reversing in the community (black/grey hats). Much of this is done through working with people who you respect and may have more experience than you.

Through this comes a certain level of respect, to where going public with exploits and such is a hindrance to the community and only serves your selfish agenda for fame or whatever.

Your exploiting all the people you've worked with in the past, ripping their ideas, and handing them off to assholes who then try to teach classes on 'ethical hacking' or whatever.

So yes, I'm calling them sellouts.

*Edit - Another problem I have is that these people generally tend to misrepresent 'black hacks' as a whole and try to play themselves off as bigger than life personas.

You're judging a point by the way it was made rather than its ultimate goal?

I mean, I'm all for praising gymnastics, but if we're trying for truth here shouldn't endgame be valued over execution?

Nessus?

Reply on news.ycombinator.com