News for hackers. Stuff that matters.
Re:Ask HN: Are Certifications Useful in Infosec? by tptacek on Sunday June 13, 2021 @02:47PM (#27495147)
Why would you recommend OSWE? What's an example of a specific benefit you'd get in appsec (also my specialization!) by holding that certification?
Re:Ask HN: Are Certifications Useful in Infosec? by Techbrunch on Sunday June 13, 2021 @03:11PM (#27495353)
An example would be to be able to read source code in different languages (Java, PHP, JavaScript, C#) and be able to identify, chain vulnerabilities and write an exploit script to automate everything.

You can find the syllabus here: https://www.offensive-security.com/awae-oswe/

Re:Ask HN: Are Certifications Useful in Infosec? by tptacek on Sunday June 13, 2021 @03:14PM (#27495384)
You're suggesting you might consider getting OSWE in order to learn appsec?
Re:Ask HN: Are Certifications Useful in Infosec? by Techbrunch on Sunday June 13, 2021 @03:25PM (#27495488)
I would not recommend OSWE to learn appsec since it is teaching "Advanced Web Attacks" and assume that you know the basics.

Something that is really interesting I think is the whitebox approach that some people in infosec might be missing if they don't come from a developer background and never botherered looking at the code introducing the vulnerabilities.

If you want to learn appsec I recommend Web Security Academy: https://portswigger.net/web-security

Re:Ask HN: Are Certifications Useful in Infosec? by tptacek on Sunday June 13, 2021 @03:28PM (#27495512)
PortSwigger is great. Certifications, on the other hand, are not a good way to learn appsec.
Re:Ask HN: Are Certifications Useful in Infosec? by appsecengthrow on Sunday June 13, 2021 @06:42PM (#27497262)
No specific benefit or skill.

Just that I would recommend it because I felt good going through the challenges and that someone took the time to set up VMs and writeups for me.

In conclusion, it was more of a consumption thing than an investment.