The Engineer Crunch

Re:The Engineer Crunch by cema on Tuesday February 18, 2014 @02:29PM (#7260460)

  we interview people whose only prior work experience is
  "Line of Business .NET Developer", and they end up
  showing us how to write exploits

I am surprised you sound surprised. Do you label people by the kind of technologies or jobs they held? I mean, you argue against it, which I think is a positive argument, but somehow it seems that the labels people place on technologies and business domains are somehow rubbing off on the people who were using them. Feels myopic to me.

[ Parent | on HN ]

Re:The Engineer Crunch by tptacek on Tuesday February 18, 2014 @02:36PM (#7260509)

Zero prior cryptography experience. Zero work history in software security. Hired through a resume-blind work-sample process. Goes on to successfully implement a crypto attack that fewer than 10 people in the world have probably ever implemented before, one that requires debugging a lattice reduction step that takes 6 hours to run before you get to the part where you use a Fourier transform to postprocess the result.

Or: Zero prior software security experience. Zero prior Rails experience. Zero prior Ruby experience. Hired through a resume-blind work-sample process. Looks at Rails for the first time, 30 minutes later reports a vulnerability that results in a CVE and a Rails patch. Repeats. Now runs Rails internal review board.

I have other examples. Worth knowing: we aren't Rails neophytes (for instance, we're one of the firms that reported the YAML code execution bug) or for that matter crypto neophytes.

It's not about what technologies you use; I don't so much care whether someone writes .NET code. It's the "absolutely no prior work experience doing this and no flashy resume to get them in the door" that stick out to me.

[ Parent | on HN ]

Re:The Engineer Crunch by UK-AL on Tuesday February 18, 2014 @09:54PM (#7261528)

Some of the best software engineers are .NET and Java software developers. These are the guys running massive systems, but no one ever hears about because its boring government/corporate work. But that work is infact the most challenging. Imagine the amount of transactions a bank has to handle every day, without fail!

It's just that Hacker News biased to a certain section of society.

[ Parent | on HN ]

Re:The Engineer Crunch by mattmanser on Wednesday February 19, 2014 @04:12AM (#7262668)

And they tend to be complex systems with a lot of edge cases and you start getting a feel where all the edge cases actually lurk.

[ Parent | on HN ]

Re:The Engineer Crunch by foobarqux on Wednesday February 19, 2014 @12:28AM (#7261973)

Did this guy have a math background? Was he coming up with the solution to the problems on his own from scratch?

[ Parent | on HN ]