Hacker News Reader

Comment by nickysielicki | Hacker News Reader

From a linked article in the OP.

> He urged the next generation of software pioneers and entrepreneurs to take a break from developing killer apps and consider a tour of service fending off Chinese, Russian and North Korean hackers, even as he acknowledged that the documents leaked by Edward J. Snowden, the former intelligence contractor, “showed there was a difference in view between what we were doing and what people perceived us as doing.”

So our 'defense secretary' thinks that being capable of writing ruby on rails apps means that someone knows what a NOP sled is. Fantastic!

Screw all of these idiots in suits. I'm not afraid of North Korean hackers. I've not been afraid of Russian hackers throughout the past decade and I'm not afraid of Chinese hackers now. And even if I was, I can assure you, there's nothing at all that the US government could do to alleviate that.

View on HN

I think you're slightly off the mark. The defense secretary probably has no idea what Ruby-on-Rails or NOP sleds are. He wants to encourage folks who are clearly intelligent and strongly motivated, with a background in software, to come to the DoD and apply their energies and efforts to learn about electronic offense and defense. Surely they don't expect _everyone_ who enrolls in the Army Corps of Engineering to understand the engineering fundamentals of war machines. They teach it to them on top of their diverse backgrounds in other branches of engineering (water/waste, civilian infrastructure, automotive, etc...). Their background is important to learning the new knowledge quickly -- and they have a gap to fill.

Few folks are born with expertise in design patterns, user analytics, and UI design. They develop those skills with education and practice. The DoD wants those same folks to apply their energy and brainpower to learn and develop a new sector of knowledge.

If they could just hire computer security experts right away they wouldn't be targeting app developers.

Yeah this was an interesting take. One could also argue that if you take a "tour of service" it should be to protect US citizens from their own agencies (personally I'd be more afraid of them than random Chinese cyberterrorists).

I think what he wanted to communicate is "lots of smart people in SV but we can't compete with SV so GOGO patriotism card".

I too am puzzled by what the defense industry thinks Silicon Valley is going to be able to produce, but that's the point of Silicon Valley - huge amount of creative potential and ambition. It's not likely that all of the solutions will be cyberweapons.

One of the largest and most impressive responses to cyberwarfare to date are the US's information sharing programs. These programs and formats (STYX, TAXI, etc) enable patterns from detected cyberattacks to be rapidly shared across industries so that exploits and tactics, command and control centers and so forth can't be repeated. This raises the cost to the attackers, aggravates them, and slows them down. Some of these programs have automated components with minimal human interaction in the loop.

So I think it is these sorts of solutions the DoD is likely looking for.

They're confused old men, for the most part. They probably have bizarre notions of people duking it out with e-guns and cyberknives in The CyberVirtualSpace that guy from darpa demo'd in '76.

The ones who are more up to speed are after malware, the more cunning the better.

SV was built on providing things that go fast and go bang

I didn't know what a NOP sled was so I looked it up: turns out that I did know what it was (a sequence of instructions that do nothing so that you can be more flexible in where your pointer overflow hits) I just hadn't heard that name before.

That said I doubt it would be that difficult to teach a bright rails guy how to attack applications, especially not web apps.

But knowing that you will be forced to spy on your own people and serve as a tool for evil, why would you sign up? To defend against the Chinese, fine. To keep Putin at bay, fine. That isn't what the NSA does most these days.

> So our 'defense secretary' thinks that being capable of writing ruby on rails apps means that someone knows what a NOP sled is. Fantastic!

Very recently the gap between those shrunk by quite a large margin. Anyone with some programming ability can play through a few of the Starfighter challenges; if they succeed, they will indeed know what a NOP sled is (and, more importantly, have coded one!)

Reply on news.ycombinator.com