Hacker News Reader

Comment by XMPPwocky | Hacker News Reader

To be clear, most of the folks doing this sort of security research are probably worse programmers than your average senior dev, or at least not noticeably better.

It's a distinct skillset.

To whatever extent they might build software that's more secure than the average dev's, that really comes down to applying their security skills and toolset to their own software- thinking like an attacker- not any particular skill at software engineering.

View on HN

Of course, this is not always true: a lot of good security researchers are software engineers as much as they are exploit authors. Writing tooling isn't sexy, but sometimes you just have to do it, and if you don't do a good job you aren't going to be able to use it.

Software exploits and tooling don’t need to bug free, they just have to work some of the time on some devices under some circumstances.

Luck too.

The birthday lottery still plays a roll: being born with the particular set of predispositions, and the right family and environment to encourage strengthening those predispositions.

Bad tooling, like any other bad software, has limited utility: it cannot be reused or built upon. Sure, your quick script might work for now, but five years later everyone is going to be using the thing another person wrote because nobody wants to touch what you made.

I mean, that just sounds like enterprise software.

define programmer, programmer is not software engineer by default

they are exploiting the 'quality' codebase written by your so-called average dev or software engineers

and since when software engineering does not take security into account?

> most of the folks doing this sort of security research are probably worse programmers than your average senior dev, or at least not noticeably better.

Hard disagree. Maybe you can argue that they might not have skillset/experience of writing good quality code but they need to know the very in depth of each of the component from javascript to kernel. It's not a separate skill. It's the same skill as what senior dev do only the folks who write exploit need to understand allocations in bit level detail in each layer of the machine in which code is executed. eg I would recommend seeing the coding episodes of geohot who was a hacker and look how fast he could write the "ordinary" code like setting up website and other things.

Reply on news.ycombinator.com