Hacker News Reader

Comment by only_as_i_fall | Hacker News Reader

Is there evidence that the average hacker is smarter than the average developer? I would expect the opposite to be true because legitimate work seems more profitable/stable, but also I'd imagine the difference is t that high either way

View on HN

I think the incentives are lopsided. The developer does not personally bear the blow of their company's data breach (unless they're dedicated cybersec personnel) whereas the hacker reaps all the reward of getting access.

The parent never used the word "smarter". By definition, the average developer is developing applications, but the non-average developer is doing something else, possibly hacking. Hacking is not the average activity (the way that word is used today).

With regards to skill sets, I have repeatedly found that people who engage in hacking range from skill sets of "knowing how to use a hacking kit" to "uber developer with security knowledge". There is a wide range of skills and knowledge.

However, it is practically an entry requirement for someone in the security space to view software differently than most programmers. That is defined as non-average.

They didn't say smarter but they did say above-the-average which implies better (as opposed to worse), rather than it being a different skill set. That is to say, I know exceptional "hackers" who can't code their way out of a pair bag, or build any sort of GUI. Similarly, I know some really good programmers who don't intimately understand how computers work a tenth as well as hackers do. There are genuinely smart people in both camps, but they're different skill sets.

Of course not, this is just the parent poster's opinion. The truth of the matter is that there exceptional individuals who decide to get into software development and software security. The problem with software is that often companies don't invest into securing their software, and that has to be a priority. Perhaps having the SEC force fines for not securing mission critical software is the first step?

I remember after finishing our CS studies we were taken by the Army to take a day long test. We were warned better fail the test unless we are willing to be enrolled. However this might be an isolated case.

In turn, I guess a security professional is more scarce than an average developer. The question is if all security professionals are hired to strenghten systems, or some of them to break it.

Yes, large engagements frequently include a "red team" who's job it is to try and break into the system.

I used to think this way, it can be really dangerous to assume level of intelligence from background information.

More to the point, hackers can be very motivated to break things in a way that the average developer is not motivated to secure them.

You hit it. Cracking a system that has mountains of attack vectors is interesting, fun, and potentially profitable. There is so much to probe and try. Flip it around and look at the priorities of software developers Ina corporate setting. Most of them are so sick of dealing with security hoops and theatre it's the last thing they want to think about.

Reply on news.ycombinator.com