Hacker News Reader

Comment by alt227 | Hacker News Reader

> Secure software is - somehow - niche. And as such, it’s much more expensive.

Its not expensive because its niche, its expensive because its hard. Its a lot easier to learn a bit of html and javascript and knock up some web projects then it is to become proficient at all the things necessary to be good at security. Generally it also takes consulting with maths experts who have spent their life studying cryptography and as such command a decent wage.

View on HN

Good cryptography is written once by experts -- never by you! -- and shared widely via free libraries. It's a one-time cost, not a recurring one.

Computer security is expensive but that expense has nothing to do with cryptography.

> Generally it also takes consulting with maths experts who have spent their life studying cryptography and as such command a decent wage.

It doesn't take a maths degree to look out for SQL injection attacks or to audit software & write up a risk assessment.

There's very little, if any, incentive to do anything more securely than absolutely necessary. It is only a problem, when it is a problem and is treated that way in nearly every org I've worked in.

> There's very little, if any, incentive to do anything more securely than absolutely necessary.

There wasn't.

I agree that security isn't bottlenecked by our ability to learn. We generally fail at the grit needed to do it day after day, especially when the benefits aren't immediately visible.

"Its not expensive because its niche, its expensive because its hard."

I'd counter and suggest it is expensive because almost nobody gives a damn about the first 3 layers in the OSI model, and have pushed most security responsibility up to layers 4-7. That's roughly half of your attack surface still exposed.

Reply on news.ycombinator.com