Hacker News Reader

Comment by saagarjha | Hacker News Reader

Plenty of people working on the defensive side are famous, sometimes even more famous than those who do offensive work. Take, for example, Google Project Zero, or the numerous people on “infosec Twitter” who are almost invariably doing defensive work. People who do exploit development tend to be a lot more quiet about what they do and where they work.

View on HN

I think Project Zero would count as offensive work in this regard; they are actively trying to find problems in other systems, rather than trying to stop other people trying to find problems in their systems.

Project Zero is an offensive team doing defensive work.

But their work is essentially penetration testing and exploit development. That usually counts as offensive side. They are not designing and building secure-by-design stuff, for example.

They are known for breaking stuff, and everyone wants to be the same.

Goal might be defensive in everything cyber security researchers do, but that was not my point.

Project Zero is not defensive. Infosec Twitter has both sides.

I do agree with you that defense is a large part of the industry. My perspective is even that most organizations are looking for “defense” roles. The field is very wide (e.g., folks working on cryptography to sec ops).

It is defensive, but for the best guys out there, the carrot is on offensive side. You are not getting rewarded for doing perfectly secure systems, unless you work in very big company.

It means that most of the average guys build defense, and then the best guys test them and pick the money when something is found. While we could prevent most issues if those best guys help on building the systems instead.

But they have no motivation, because they get more money from other things.

I think that you might actually observe that finding attacks on systems is common, while developing a “perfectly secure system” is much harder to do, if not impossible.

Reply on news.ycombinator.com