Actually, most of the people in question are already well along that career path and working for contracting firms. It's just not a career path that that lets them leave direct or indirect government work.

Who, other than a government, is going to pay you well to find vulnerabilities in popular software? Google's Project Zero belongs to the incredibly small set of programs in that area that isn't a joke.

I read "network attack specialist" as more general than that. I imagine there's a lot of demand for network penetration testing. When it gets down to individual programs, such as email clients, etc, (this is what I think you are implying above) then yes, I agree that it's likely harder to sell the idea of those skills being useful in a consulting context to companies. In that case, I would guess your best path would be to join an established security firm, but I imagine that market is small and highly competitive.

Oh. I see. Sorry, hash collision. I'm talking about the people who perform tasks like exploit discovery and development. You're talking about the people who take that work and run it in script form.

Perhaps a better analogy would be that asking "Why not pen testing?" is like asking why gun designers don't find new jobs as infantry.

Established security firms often focus on business with... guess who? Governments. The NSA employing people directly is not really much different from the NSA hiring contractors who employ people directly.

> You're talking about the people who take that work and run it in script form.

Not entirely. It starts as that, yes, because the first thing you do when attempting to break into a house is check the front door. There are obviously levels beyond this.

> is like asking why gun designers don't find new jobs as infantry.

But it's not entirely like that. There's plenty of firms that hire out security specialists to do code reviews for internal applications. At that point, it's like a gun designing consulting for manufacturing firmson ways to make their products more resistant to small arms. The job won't be the same, but there will be commonalities and the prior experience will transfer over usefully.

Not as much as you'd think. Even if it was, it's not a better place. Now you're trapped in a slightly different sector that you can't leave because your skills don't transfer.

And your job is probably a lot less reliable, because short-term auditing or pen-testing contracts offer a lot less stability than 3-5 year government contracts.

I have no sympathy for this kind of whining.

"Help, I love designing guns, but the only people willing to pay me for that will use them for evil!"

If you're a talented "network attack specialist" then you're likely also a worthwhile network engineer. So work in that role and do the gun-design in your spare time and hopefully for a good cause.

That's a pretty poor proposition to make to someone with a family to support. It's poor enough that they're going to ignore you and go on doing work you almost certainly object to.

Also, the skills required to be an effective network attack specialist have very little relation to those required to be a network engineer. I thought I covered this up-thread.

It doesn't get better by adding even more entitled whining.

If you have a family to support then how about choosing a less problematic career path than "Network Attack Specialist"?

You are not entitled to making a living from your favorite hobby if that entails building a dystopian future for everyone.

Have you considered that telling someone to give up their livelihood is not a good way to get them to accept your advice?

The parent is being a bit of a dick, but he does have a point. Not every job in the world is ethical, and simply being good at something is not always enough reason to do it for a living.

This is ultimately a deeply personal choice that everyone has to make, but sometimes we really can't both have our cake and eat it too.

I also work at a government sponsored R&D lab, so I'm familiar with the conundrum (not for myself - I'm just a dumbass programmer whose skills are so pitifully generic I could go literally anywhere in the world... some of my colleagues - not so much)

It is a deeply personal choice. It's also one that doesn't get any easier when people insist on being dicks about it.

I don't know why it's so important that some random HN contributor be polite about this. Isn't everyone here speaking to you, and not your friends? Why does their tone matter so much?

Given that the context is that culture matters and that HN attitudes are relevant, I'm attempting to make the point that being rude does not help shape the attitudes in the way we-the-commentariat want.

"a family to support". ah the ole "but think of the CHILDREN" argument. so sophisticated.

Love it or hate it, it's a huge factor in how people make decisions. If you want to shape their behavior, you have to consider how they think and what they care about.

Nope, a network engineer is way different.

Much closer would be writing boot loaders and compilers.