Hacker News Reader

Comment by tptacek | Hacker News Reader

Wow, strongest possible disagree. In the mid-to-late 1990s, you could download any project's tarball, grep it for "strcpy", and have an exploitable stack overflow within an hour. Nobody needed any depth in compiler theory, in constraint solvers, or in cryptography. About the only good thing I can say for the 1990s is that you sometimes got to work in SPARC and MIPS assembly.

Software security is harder in 2014, definitely. But that's a good thing.

View on HN

Agreed. Even when you find trivial to exploit bugs, there's quite often not trivial to bypass protections in place. Certainly ways around them, but developing an exploit used to be paint by numbers in comparison.

Oh don't get me wrong. I agree with you. Software security — actually scratch that — security in general is harder in 2014 and by correlation more challenging to boot. I meant that security research used to be more fun before Assange, Snowden, and the NSA came along.

I still love security and have become better at it throughout the years, but the ambience of conspiracy and the out of touch with reality legal ramifications and obstacles make me long for the days when "security was fun".

Or maybe I'm just old now and I'm just reminiscing the good ol days.

Also a good choice for some time:

    grep printf * | grep -v '"'

Reply on news.ycombinator.com