I can't help but see security professionals as fakers, they seem to mostly be box-tickers rather than the professionally curious, in school and college I was up to no good with tech, but now when my employer is recruiting to establish an in-house cyber team I know I'm not what they're looking for and never was.
I exclude the RE guys who are undoubtedly extraordinary.
I think like most things there is a power law distribution when it comes to these sort of roles. I've worked with a few really good security teams in my career. The good ones work with the teams, possibly embedded on improving security. The better ones also write tools and libraries for service teams to consume. The best ones act like internal white hats, constantly probe and assess, and submit patches as well.
Sadly the vast majority of sec teams are not this and exist solely to run some tool that spits out a list of dubious vulns and then dump said list as a pile of tickets into the dev backlog.
One place i worked, the CISO even came up with some slogan for the info-sec along the lines of "observe and report" after I kept trying to show the info-sec how to run, build, test, and patch our various packages and tools their scanners would complain about.
"Riffling through other files, Mendax found mail confirming that the
attack had indeed come from inside MILNET. His eyes grew wide as he
read on. US military hackers had broken into MILNET systems, using
them for target practice, and no-one had bothered to tell the system
admin at the target site.
Mendax couldn't believe it. The US military was hacking its own
computers. This discovery led to another, more disturbing, thought. If
the US military was hacking its own computers for practice, what was
it doing to other countries' computers?
"
>This is not unlike the surprise in underground.txt
I thought that was originally a book?
I distinctly remember reading it during an in school suspension in the 2000s.
I tried to go back to my township library and read it again years later, but someone had stolen it around the time that Wikileaks truthfully revealed that the DNC had kneecapped Bernie in the primaries.
(Many folks don't seem to distinguish between the public airing of unpleasant truths that could not be aired without their own actions, and "disinformation" in the "covid is a hoax" vein. To them, anything contrary to their narrative is evil and bad, and if only those dastardly Russians would stop making them look bad my making them send several illegal emails they could stop voting like Republicans)
> Then: We were the kids who saw the blinking cursor not as a barrier, but as
an invitation. We typed characters into the voids and got back secrets. Our
goal was not destruction, it was understanding — to understand the systems
better than those who built them.
> Now: Hacking is a job title. Curiosity has been commodified. A thousand
"Bug Bounty Platforms" are trying to monetize your desire for
understanding, to turn it into CVEs and T-shirts.
I learned to code specifically because as a kid I wanted to be a hacker; I was reading explanations of a buffer overflow in physical magazines before I learned how to code.
It’s been more than a decade since I even touched these kind of resources, but in a way those people are still the reason I can put food on the table now.
I really should revisit the community at some point, if only to see what the current environment is like. Things must have changed a lot since the time a teenager could bypass any security in their surroundings.
Someone gave me a physical copy at WHY2025 in exchange for telling him about Evan Doorbell's Telephone Tapes[1]. I should probably read it. Seems to have a lot of fascinating content.
There is an ASCII chart in https://phrack.org/issues/72/18_md#article which references https://arxiv.org/pdf/2008.07753 [PDF], a 2020 article showing that open source peaked in 2013. In some qualitative sense that feels intuitively correct, but I am skeptical that in the modern world filled with a zillion NPM dependencies and the cloud YAML explosion and now vibe-coded everything that we are actually producing less lines of open source than we did in 2013. Is anyone aware of newer studies that investigate this?
That is my article. The data source (Open Hub) may not be completely representative of open source, but the precise trend I was aiming to cite was hard to find elsewhere (and especially to find a graph for!)
Although I had not used WebAssembly, the problem (and how to mitigate it) were obvious to me right after reading section 2, although perhaps not to everyone (but I expect I am not the only one who finds it obvious; there are probably others).
Readit News
https://phrack.org/issues/72/19#article
I exclude the RE guys who are undoubtedly extraordinary.
Sadly the vast majority of sec teams are not this and exist solely to run some tool that spits out a list of dubious vulns and then dump said list as a pile of tickets into the dev backlog.
One place i worked, the CISO even came up with some slogan for the info-sec along the lines of "observe and report" after I kept trying to show the info-sec how to run, build, test, and patch our various packages and tools their scanners would complain about.
"Riffling through other files, Mendax found mail confirming that the attack had indeed come from inside MILNET. His eyes grew wide as he read on. US military hackers had broken into MILNET systems, using them for target practice, and no-one had bothered to tell the system admin at the target site.
Mendax couldn't believe it. The US military was hacking its own computers. This discovery led to another, more disturbing, thought. If the US military was hacking its own computers for practice, what was it doing to other countries' computers? "
I thought that was originally a book?
I distinctly remember reading it during an in school suspension in the 2000s.
I tried to go back to my township library and read it again years later, but someone had stolen it around the time that Wikileaks truthfully revealed that the DNC had kneecapped Bernie in the primaries.
(Many folks don't seem to distinguish between the public airing of unpleasant truths that could not be aired without their own actions, and "disinformation" in the "covid is a hoax" vein. To them, anything contrary to their narrative is evil and bad, and if only those dastardly Russians would stop making them look bad my making them send several illegal emails they could stop voting like Republicans)
Dead Comment
> Then: We were the kids who saw the blinking cursor not as a barrier, but as an invitation. We typed characters into the voids and got back secrets. Our goal was not destruction, it was understanding — to understand the systems better than those who built them.
> Now: Hacking is a job title. Curiosity has been commodified. A thousand "Bug Bounty Platforms" are trying to monetize your desire for understanding, to turn it into CVEs and T-shirts.
I learned to code specifically because as a kid I wanted to be a hacker; I was reading explanations of a buffer overflow in physical magazines before I learned how to code.
It’s been more than a decade since I even touched these kind of resources, but in a way those people are still the reason I can put food on the table now.
I really should revisit the community at some point, if only to see what the current environment is like. Things must have changed a lot since the time a teenager could bypass any security in their surroundings.
[1] https://evan-doorbell.com/
Will try dillo but I guess I will be stuck using Firefox.
edit: dillo worked fine.