6 ms·
#NotAllSecurityExperts Only pointing that out, because apparently this was a big deal on Twitter a couple weeks back, where one group of experts were arguing t
by RandomInteger4 8y ago
#NotAllSecurityExperts
Only pointing that out, because apparently this was a big deal on Twitter a couple weeks back, where one group of experts were arguing that you weren't a real security expert without being able to code, and the other group arguing the contrary.
- tptacek 8y agoI don't know what "security expert" means, but I do believe that you can't secure software if you can't code, and I do believe most real-world security jobs require you to secure software.
- RandomInteger4 8y agoDon't tell me; tell the folks on Twitter. I was surprised as well. Quite a few of them took the "You don't need to code" side.
- michaelmrose 8y agoHow can you be a security expert insofar as the domain is software if you can't code?
- RandomInteger4 8y agoHonestly, I have no clue. That's a question for the security experts on Twitter.
- icedchai 8y agoThey can understand common patterns and find problems. That doesn't mean they can fix them.
- michaelmrose 8y agoYou can probably tell people how to physically secure their premises or not to put passwords on post it notes without knowing how to code but you can't help them write secure code if you can't you know code. This is like taking drivers ed from someone who can't drive. In theory you could reiterate material you had read on the matter and some material may even be of value but only a fool would learn to drive from someone who can't. The fact that not everyone is willing or able to see the emperor is a nudist doesn't mean his threads are real.
- icedchai 8y agoMany code-related security problems can be discovered externally without even seeing the code (simple examples: XSS attacks, SQL injection problems, etc.) Generic advice like "escape your inputs" can be provided. I am not saying this is valuable advice...