Hacker News Reader

Comment by jvehent | Hacker News Reader

> I always try to explain to my clients that web security is a complex field and they should hire a pro for that area...

No. Just no.

Every other field of engineering includes security and safety as a core requirement of anything they do. Software engineering is no different, and while specialists can help, every engineer needs to know how to write secure code if we are to improve the sad situation the Internet is in.

Sell yourself as a software engineer who knows security, and watch the money rain as literally everyone tries to hire you.

View on HN

> Sell yourself as a software engineer who knows security, and watch the money rain as literally everyone tries to hire you

How can you brag about the fact that a software engineer who knows security is worth more on the market, then try to claim that every engineer needs to know how to write highly secure code? Those are incompatible ideas.

A lock manufacturer designs locks. A carpenter designs the building the lock is securing.

You wouldn't rely on your carpenter to build you a lock, because you understand that they are two separate domains of knowledge. You need to have this same mindset about good security and good engineering.

Digital security requires a high amount of specialized knowledge and involves far more variables than lock construction. It also requires constant vigilance and integration, where as a lock is fire-and-forget.

> How can you brag about the fact that a software engineer who knows security is worth more on the market, then try to claim that every engineer needs to know how to write highly secure code? Those are incompatible ideas.

Software developers who have the abilities they should are more valuable than those who . . . don't. That doesn't seem controversial.

No they don't. Engineers building bridges don't sit around choosing what kind of fences or security cameras the construction site needs.

The abstraction doesn't fit. Where the civil engineers would be expected to build a bridge that doesn't collapse when the wind is Just Right (key word: Tacoma Narrows Bridge), software makers are expected to build a lock that doesn't open when someone whistles Just Right (key word: SQL injection).

Bridge builders are not expected to make the bridge itself defend against saboteurs, unlike software. To painfully extend the scenario: the wind is relatively well understood and once you've learned a lesson and guarded against it as a bridge builder, a given bridge can be considered stable.

Not so with software. One vuln fix, 5 more show up to take its place over time.

Malicious actors & botnets = the wind now (bear with me please). Once the bridge no longer collapsed via a certain Just Right tune, the wind would stop blowing the old Just Right way and instead try finding a new Just Right way, like whirling in a tight circular motion in just the right spot to see if it can unscrew bolts, or attempt -ddos- to tornado itself into a waterspout to try to collapose the bridge.

Security is not a one and done operation.

Yeah, that makes sense. In other words, software is far easier to build, but requires much more effort to maintain - in which security is prominent.

The might think about whether the bridge can cope with a hurricane, however.

they may not know the models of cameras and the specs, but they do know they need to attach them somewhere and how they work.

Reply on news.ycombinator.com