White House Takes Security Pitch to Silicon Valley - <AUTHOR> http://www.nytimes.com/2015/04/27/us/white-house-takes-cybersecurity-pitch-to-silicon-valley.html <comment><USER2> > "I think that people and companies need to be convinced that everything we > do in the cyber domain is lawful and appropriate and necessary," Mr. Carter > told students and faculty at Stanford.

Right, because what they're doing in the cyber domain isn't lawful. Naturally they'll fix that retroactively.

> He urged the next generation of software pioneers and entrepreneurs to take > a break from developing killer apps and consider a tour of service fending > off Chinese, Russian and North Korean hackers...

Yeah, exploitation of vulnerability isn't partisan or nationalistic. While narrowly possible, it isn't really practical to fend off Chinese hackers without also fending off American ones, and vise versa.

> ...even as he acknowledged that the documents leaked by Edward J. Snowden, > the former intelligence contractor, "showed there was a difference in view > between what we were doing and what people perceived us as doing."

I can't help but picture these hacks that shill for the administration like cheaters who've been caught trying to talk their way out of it.

"Baby, I know I said I was visiting my grandma last night, and while I admit that leaked photograph of me kissing and groping my former lover is authentic, I swear to you it's not like that! The kiss had to be collected in case it was needed in the future but it's not cheating because I wasn't feeling into it at the time. You've got to understand there's a difference in view between what we were doing and what people perceived us as doing. I lied to keep you safe! Think of the greater good baby!!"

<comment><USER3> > ...even as he acknowledged that the documents leaked by Edward J. Snowden, > the former intelligence contractor, "showed there was a difference in view > between what we were doing and what people perceived us as doing."

That one boggles my mind. On 2013, Mar 12, Clapper lied to congress about NSA spying. The purpose of a lie is so that people perceive something different from reality. So they achieved their goal, they're just sorry they got caught.

<comment><USER2> Baby it was just the most truthful answer I could tell you. I mean, I'm sorry, I should have been more careful in my statement. I acknowledge that. But I must stress, that I did not wittingly make out and fondle. What I did was not, in any way, targeted at our relationship. My eyes were closed, and I was merely doing my duty to feel up our enemies. There is just no other technical way to go about it. And I resent the implication of wrongdoing in the unfair way you questioned me about the situation.

Now, you know I love you. I would never do anything behind your back. That's why all of your friends were fully briefed on this encounter. And they all agreed that it was necessary and appropriate. Well, almost everyone. I vow to bring the perpetrator who leaked the photo to justice! And so in light of this, we can have an important debate about who else I deny I have slept with, who else you have proof I sleep with and what other sexual acts I must do with them in order to safeguard our relationship.

But let's not forget what's important. We need to work together to build a framework for a process where I continue to see others I'm attracted to, particularly the Russian and Chinese ones, in a way that respects privacy, by preventing you from finding out, but with proper oversight that is transparent, accountable, and consistent with my unwavering support for monogamy. After all, the security of our relationship depends on it.

<comment><USER4> I am a bit creeped out at how well you are at spin..

</comment></comment></comment></comment><comment><USER5> Carter's words sound like the man who see's his judgement, but still uselessly pleads innocent for the decisions he believes should be kept in the dark.

I remember when my small private university received its first DOJ request in 2005 to install wire-tapping hardware on our servers. We in the IT department circled up and met, deciding to ignore this letter as a disgrace to the American public, the constitution, and the human values we believed in. Even receiving shamed us, and stirred anger and fear for years after.

When we ignored it, no request came again and no consequence -- because the people who asked us to do wrong would never ask us to do it again by the light of day.

Remember: stand true to what is right for you and those around you, whether in private or in public, and you'll never regret that choice from this day to your last.

<comment><USER6> Interesting, how do you know it was the actually the DOJ and not lets say Chinese or Russians using faked official looking letterhead to get a backdoor in your system.

This is just an example of how government stupidity when it comes to computer security is leading to MORE vulnerability and insecurity.

You did the right thing if dragged into court you could have rightfully pointed out that you refused for patriotic reasons since the whole thing "smelled" wrong and sounded like an attempt by foreign bodies to infiltrate your network, which would have got you into alot of trouble...

I wonder how the likes of Googles of this world response to similar requests...

<comment><USER7> Maybe the higher ups thought about that and invited the relevant engineers (or their boss) from Google and the likes at their offices in the Pentagon or some other place. At least that is not fakable.

</comment></comment></comment><comment><USER8> > _"I think that people and companies need to be convinced that everything we > do in the cyber domain is lawful and appropriate and necessary," Mr. Carter > told students and faculty at Stanford._

Good luck with the convincing. Quite a few of us can read, so it will be rather impossible.

> _The right of the people to be secure in their persons, houses, papers, and > effects, against unreasonable searches and seizures, shall not be violated, > and no Warrants shall issue, but upon probable cause, supported by Oath or > affirmation, and particularly describing the place to be searched, and the > persons or things to be seized._ > [http://en.wikipedia.org/wiki/Fourth_Amendment_to_the_United_...](http://en.wikipedia.org/wiki/Fourth_Amendment_to_the_United_States_Constitution)

> _Shortly after the terrorist attacks on Sept. 11, 2001, President George W. > Bush secretly told the N.S.A. that it could wiretap Americans' international > phone calls and collect bulk data about their phone calls and emails without > obeying the Foreign Intelligence Surveillance Act._ > [http://www.nytimes.com/2015/04/25/us/politics/value-of- > nsa-w...](http://www.nytimes.com/2015/04/25/us/politics/value-of-nsa- > warrantless-spying-is-doubted-in-declassified-reports.html?_r=0)

> _On July 9, 2012, when asked by a member of the press if a large data center > in Utah was used to store data on American citizens, Alexander stated, "No. > While I can't go into all the details on the Utah data center, we don't hold > data on U.S. citizens."_

[http://en.wikipedia.org/wiki/Keith_B._Alexander#Statements_t...](http://en.wikipedia.org/wiki/Keith_B._Alexander#Statements_to_the_public_regarding_NSA_operations)

Why are these people not in prison for violating the constitution on a mass scale? Their only defense can be that they were simply "following orders."

The USA PATRIOT Act will be viewed by historians as something akin to the Reichstag Fire Decree [http://en.wikipedia.org/wiki/Reichstag_Fire_Decree#Backgroun...](http://en.wikipedia.org/wiki/Reichstag_Fire_Decree#Background)

<comment><USER9> So, it is not actually a criminal offense for law enforcement to violate the 4th amendment in collecting evidence. All that happens is that in pre-trial, a defense counsel can file a motion to suppress that evidence based on the exclusionary rule[1]. If the judge decides that the evidence was collected illegally, it is thrown out and cannot be presented to the jury. Less than 90% of cases go before a jury, but a knowledgable and zealous attorney can get evidence thrown out (or "c'mon, you know that will never fly with Judge Saris"d out) before a plea deal. This is the only way we have that warrants be sought, that they be validly[2] issued and that they be followed.--the threat that a criminal will "Get off on a technicality", either because the DA doesn't think she can prosecute, or because the evidence gets thrown out in pre-trial, or because an appeals/SCOTUS decision throws out the case.

None of that matters if the evidence collected is never intended for criminal prosecutions. Either by the FBI or by the NSA.

At least one of Boston's federal judges serves on the FISA court and I have it on the word of Boston's clerk of court that the FISA court judges care deeply about doing a good job and being a check on executive overreach. I believe him. But that doesn't matter at all.

[1] Everyone should read [http://lawcomic.net/guide/?p=1585](http://lawcomic.net/guide/?p=1585) and actually look at this flowchart for the 4th amendment [http://lawcomic.net/guide/?p=2256](http://lawcomic.net/guide/?p=2256).

[2] Most warrant requests are granted, not because it is a rubber stamp, but because the conditions for warrant approval are predictable and judges don't like having their time wasted with dumb requests. It's not like the patent office.

</comment></comment><comment><USER10> I'm sure there's a way for Silicon Valley and the US government to work together, but Silicon Valley can and should bring it's own demands to the negotiating table. This looks like a very one sided deal right now. The government gets to keep its secret courts, mass surveillance, secret drone strikes and foreign policy interference and expects the brightest and best minds in tech to sign up to facilitate all that.

No deal. There is another way. I'm sure many in tech would take up the gauntlet of protecting all people if it were to be executed in a way that fits with the ideals of those people - which coincidentally align pretty well with what the US Constitution and Bill of Rights put forth 223 years ago.

If the US wants security they can have it. If they want to continue to expand the military industrial complex, they should go looking elsewhere.

<comment><USER11> _I 'm sure there's a way for Silicon Valley and the US government to work together, but Silicon Valley can and should bring it's own demands to the negotiating table._

I don't exactly trust the policy positions of the handful of major corporations that rate on the White House's radar to be beneficial to the end user/society in general.

<comment><USER12> Not only that, but there is simply zero confidence in negotiation with the government and you are a fool to believe anything else. You don't even have to rely on echos and messages from ancestors and predecessors, with general warnings about the abuses of the power of governance in the hands of humans; you can just look at the last few years of all the deception, all the abuses, all the killing, all the thieving, all the protection of thieves, and pilfering of civil society, and all the lies. There is absolutely zero trust or confidence to be found. Unfortunately for the government and any government, its track-record is permanent, there are no re-dos without revolution. Once the image, once the record has been sullied in the most grotesque and lazy manner in which it has been for the last 15 years+ there is simply no going back. The damage is permanent, irreplaceable, and immutable.

You had one chance and choice on 9/12/2001, government; and you chose to play right into the hands and goals of the tactic of terrorism ... turning on your own people and sacrificing your principles at the cost of vanquishing the tenuous and feeble trust civil society had placed in you.

Maybe you will be successful in steering the massive ship and changing perceptions and molding society as you have before in the past, government. But for now, there is a lot of trust to be made up through apology, action, and prosecuting perpetrators, i.e., showing that your actions are not just more empty promises and lies that any other run of the mill addict uses to avoid accountability for their actions and impacts on those in their lives.

</comment></comment></comment><comment><USER13> It baffles the mind how little the government seems to understand technology. Yes let's create a universal key but to make sure it's not abused or falls into the wrong hands we'll just split it up over agencies or setup an escrow. Never mind the fact that this undermines the security of every single piece of American data if we're compelled to use it.

If you're up to not good you're just going to download a non-backdoored encryption toolkit from somewhere else.

<comment><USER14> _" If you're up to not good you're just going to download a non-backdoored encryption toolkit from somewhere else."_

Good point. Software is made all around the world and there's no way for USA government to force it's backdoors (call it "golden key" or whatever) into all of it, especially in the age of open source. The purpose of wiretaping consumer grade software is clearly monitoring and controlling of casual citizens, not fighting serious criminals, hackers or enemy cyberarmies.

<comment><USER15> It is always a mistake to assume the opponent is ignorant or stupid. Of course the government knows the futility of trying to enforce the use of only "approved" encryption.

A law that required the use of "approved" encryption necessarily bans real encryption tools. Anybody that is actually secure is made a criminal, which is one more law that can be enforced arbitrary if someone decides you are a problem.

It should be fairly easy to filter for non-approved encryption with DPI. This gives them a nice map of all the "subversives" that are trying to evade the "monitoring and controlling of casual citizens".

</comment></comment></comment><comment><USER16> "I think that people and companies need to be convinced that everything we do in the cyber domain is _lawful_ and appropriate and necessary," (Emphasis mine)

Step 1, make this first point true at least (the second and third points will probably be debated until the heat-death of the universe).

Quite heartened by the rest of the article though; techies standing by their principles.

<comment><USER17> > Quite heartened by the rest of the article though; techies standing by their > principles.

Funny principles, those.

Ads, privacy violations, more ads, dark patterns, some more ads.

<comment><USER18> No, those are just those pesky business people forcing that on the purity of my Docker lib.

</comment></comment></comment><comment><USER19> > He urged the next generation of software pioneers and entrepreneurs to take > a break from developing killer apps and consider a tour of service fending > off Chinese, Russian and North Korean hackers, even as he acknowledged that > the documents leaked by Edward J. Snowden, the former intelligence > contractor, "showed there was a difference in view between what we were > doing and what people perceived us as doing."

You mean there was a difference in view between what you said you were doing, and what your leaked internal documents SHOWED beyond a shadow of a doubt what you were actually doing and planning on doing.

Do these guys not know their audience?

</comment><comment> white-flame I, for one, appreciate that this is a mainstream media article that doesn't seem to paint the government as in the right at all. It leaves the last word with the tech sector in refuting the government's positions, which is refreshing to see.

(at least that's how I read it as a tech guy)

</comment><comment><USER20> "Mr. Obama, on a trip to Stanford in February, had expressed sympathy with those who were striving to protect privacy, even while saying it had to be balanced against the concerns of the F.B.I. and other agencies that fear "going dark" because of new encryption technologies."

"Expressing sympathy" means absolutely nothing when concrete actions have been taken to undermine privacy and security.

I hope that the tech industry can organize around resisting the government to provide security and privacy for their users.

The more robust anti-spying measures we have, the more secure we'll be from malicious actors who would use our communications against us for their own gain.

</comment><comment><USER21> So is Washington ever going to acknowledge that they've done something wrong or are we going to keep playing the fascism game?

<comment><USER20> Keep playing the fascism game. So far their strategy has been to double-down every time there's a debate. Their only real trick is to clamp down more and insist it's permanent when they're questioned.

It'll break eventually.

</comment></comment><comment><USER22> "Going dark" is exactly what should happen. The only secure system is a secure system.

For all countries X, the government of X is absolutely untrustworthy.

</comment><comment><USER23> I wonder if this is going to work out as well for them as working with Silicon Valley in the 90s worked out: [http://en.wikipedia.org/wiki/Clipper_chip](http://en.wikipedia.org/wiki/Clipper_chip)

</comment><comment><USER24> I sure hope Silicon Valley isn't buying what D.C. is selling.

<comment><USER24> btw, not inferring that there's no room for compromise. But I think one of the only ways to make "surveillance" policies sustainable is by making their operations fully transparent. I get the eerie feeling this is not what US Govt. wants to do.

</comment></comment><comment><USER25> White House Takes Backdoor Insecurity Pitch to Silicon Valley

</comment><comment><USER26> The text for this article on the nytimes fronpage reads:

>The computer industry is seeking to block surveillance, including by the N.S.A., which fears "going dark" on terror threats.

I find something about the use of "the computer industry" to describe Google et al be really quaint. It's understatement. Also, what industry doesn't depend on the computer industry these days?</comment>


Rebble with a Cause: How Pebble Watches Were Granted an Afterlife - <AUTHOR> https://www.ifixit.com/News/rebble-with-a-cause-how-pebble-watches-got-their-amazing-afterlife <comment><USER2> I'm actually surprised there isn't a small and cheap off the shelf internal hardware solution that could be used to rebuild a Pebble equivalent. I know driving the display is probably a pain, but China has been pumping out smart watches and components for a while now.</comment>


This Is Why Facebook Thinks You Have 46-Year Friendships - <AUTHOR> http://time.com/4165241/facebook-friends-glitch-46-years/ <comment><USER2> Unix epoch? Unix epoch (maybe according to some guy at Microsoft).</comment>


Ask HN: What's the best programming language to learn for security? - <AUTHOR> I'm talking about all these firms that specialise in security for companies. If I wanted to work at one of these, what programming language would I need to know?
I assume it would be something like C++, but I don't know.
On another note, how many programming languages (and what programming languages) do you think someone would need to know to have a successful career in that field? <comment><USER3> Depends on what type of security you want to get into.

General Pentesting: Python or something higher level. Lots of library and tool usage (i.e. scapy, nping, nmap, metasploit)

Application Security: Learn frameworks more than languages. How to work inside of Rails, Spring, ASP, PHP stuff, etc. Common security bugs that exist in these codebases, how to fix them, and how to recognize them. It is more important here HOW things work not how to make really big things work. There are tools that you need to know how to use too, like Burp or some kind of HTTP proxy.

Exploit Development/Reversing: Goes without saying you need to know C very well. You also need to know Assembly very well and how to navigate around the OS. How windows exploits work from the basics like finding kernel32.dll to bypassing ASLR and other types of exploitation techniques. Fuzzing, etc. This probably has the highest bar of entry.

Your side note, how many programming languages do you need to be successful. The answer is a minimum of 1 if you know everything about it. You can add a lot of value doing things like AppSec Consulting for Java if you know a ton about securing Java frameworks.

You can email me if you have any questions. I love talking security

<comment><USER4> I actually don't think you need to know assembly all that well to do exploit dev and reversing. What you need is:

(a) native-level proficiency with C and the memory hierarchy that C tries to abstract (ie: you want to understand what goes in registers, when, and why, and how a stack frame is laid out and why)

(b) at least limited working proficiency with compiler theory, most especially the analysis of control flow graphs

As time goes on, knowing little working-programmer details like how LEA gets used for multiplication is getting much less important, and understanding compiler IRs (particularly LLVM) is getting more important. Weirdly (but awesomely), both exploit dev and reversing is becoming more and more theoretical (predicate translations and satisfiability, symbolic execution, &c) and less and less systemsy, and the systemsy stuff is getting larger- scale: like, writing whole-system emulators to reverse firmware targets.

I guess my argument would be: you don't ever need to learn how to write a decent assembly program to get to (a) and (b), and by the time you have (a) and (b), you'll _easily_ be able to pick up whatever assembly you need as you go.

<comment><USER3> That's fair. I think my point with the paragraph still stands though, that this path has the highest bar of entry. I think the demand for this type of worker is way lower, even in the beltway.

</comment></comment></comment><comment><USER4> I love a question with a simple right answer:

(Ruby OR Python) AND C.

You can skip C if you don't want to do low-level work (embedded, kernels, writing shellcode for memory corruption exploits). Only a small fraction of security people do this kind of work. You cannot skip (Ruby OR Python), even if you don't ever plan to do web work (which is a dumb plan anyways).

<comment><USER5> Second this, but want to add:

You don't necessarily need to be able to sit down and bang out quality C, but learning some C is a great way to understand how software works at a lower level than you'll get from Python or Ruby. On the other hand you can apply that understanding to more quickly and correctly understand what higher level code is doing and what risks it is taking.

If you don't already have a good theoretical background, learn some C. Something like C++ or even Rust would work for this too, but those introduce a lot more language concepts that you don't really need.

<comment><USER4> I think C++ and Rust are actually a bad idea here. Learn C. Don't bother with C++ until you've got C down.

I mean, learn Rust if you want to write Rust code. But for the objective I'm addressing with C, you need C.

<comment><USER6> Agreed, in addition a lot (if not most) of the low level attack surface (drivers, kernels, web servers) are still written in C, it's still the lingua franca (with C++ somewhat second).

</comment></comment></comment></comment><comment><USER7> You very much have to be flexible. Most valuable would be C and assembly knowledge (and knowledge of the low level details of both is pretty much required).

As for tool writing, any high level language (perferably what your employer uses). For example, if MetaSploit is used knowledge of Perl/Ruby would be required.

Picking up multiple imperative languages is easy, though. Fortunately most languages in the field are imperative.

Depending on the software in question, knowledge of how virtual machines operate can also be useful.

</comment><comment><USER8> First off, obviously there isn't really a clear black/white answer to this. Secondly even security is such a broad field that it really depends on your focus (a similar question could be what programming languages/technologies are the best for web development, where you'd get answers ranging from classic LAMP stack, to Node.js, python, RoR, Angular and many others, and it depends on whether you want to do front-end, back-end, both or whatever combination). So firstly I'd say it's important to pin-point what you are personally interested in; I'd say that if you want to be working on some "serious" exploits in widely used software, you are looking at C and Assembly, and C++. Obviously for web hacking, you'd be looking more at scripting languages, both in terms of their usages as the underlying technologies, as well as to automate those mundane repetitive tasks, so PHP, ASP, Perl, Python, Bash scripting etc. is something to look into. But you should also be well versed in sys-admin tasks, things like maintenance, event logging, filesystems and permissions... And lastly there is networking and all the issues and things associated with it, tcp/ip stack, routing and so much more.

The thing is, working in security isn't really dependant on the programming languages you know, either what will matter is your specialization (if you have any), or the overall skillset that you can offer to the company (if you can secure a web application on a shared host, but don't do anything about file permissions and other settings on the server, either someone else needs to do it, or the security of the webapp is pretty useless); be aware that you will be (or should be) learning something all the time, again depending on your interests, and at the same time you have to stay on top of news in research and exploits, so in a way it's really tough but also very interesting.

</comment><comment><USER9> The E language ([http://erights.org/](http://erights.org/)) was designed to express smart contracts back before Bitcoin was invented -- really forward- looking and, to me, educational. You don't in the least need to know it for a career in the field, but it changed how I think about security.

[http://erights.org/elib/capability/ode/index.html](http://erights.org/elib/capability/ode/index.html) is probably the best quick intro.

<comment><USER10> FWIW, Cap'n Proto ([https://capnproto.org](https://capnproto.org)) is a cross- language network protocol based on E's design (with direct help from E's creator, Mark Miller). So if you're interested in E-style capability-based security but want to use a more mainstream language, consider taking a look at Cap'n Proto.

(Also Sandstorm ([https://sandstorm.io](https://sandstorm.io)) is a server platform implementing this model. Disclosure: I am the lead developer of both of these projects.)

</comment></comment><comment><USER11> Do 2 things in parallel.

Learn C, there's plenty of open source C code strictly related to security, from OpenSSL, to OpenSSH, to the Linux kernel.

Learn full stack web programming (SQL, a language, html+js). As for the language, PHP could be good as there's a lot of history of (in)security, but I definitely recommend learning a framework - I like yii (yes it is), but choose any. Studying a framework is useful to learn how much things could go wrong, if not done properly (SQL injection, XSS injection, ...).

</comment><comment><USER12> There are a lot of great answers on here (Python/Ruby for general scripting, C/C++/ASM for reverse engineering, web stack technology for web application security, etc) -- but I wanted to focus on a slightly different approach.

I've run security teams for the last six years or so, and it's surprising to some people how _little_ programming is often involved in penetration testing and application security assessments. If you're looking to do network and/or (web|mobile) application security, it's often unnecessary.

That said: learning how to do some scripting is always beneficial, and clearly understanding how code works is very important to understanding systems, networks, and applications. My advice, though, is that if you're trying to work in security it's probably better to learn the fundamentals of the area(s) of security that interest you, rather than focusing on a programming language or framework that you think will be relevant.

There are a lot of great resources out there, but shoot me an email (address in profile) if you'd like a little more info.

Good luck!

<comment><USER4> Programming is a hard requirement for app pentesting.

<comment><USER13> Programming, but not software engineering. For example, it can be merely a nuisance if the tools you write leak lots of memory, acceptable to parse XML with a regular expression, and not a problem at all if programs run entirely within an environment you control aren't themselves secure.

<comment><USER4> OK, but it's not merely a nuisance if you can't understand why it's unsafe to parse XML with a regexp, and you might not grok the issue viscerally unless you're a good programmer.

</comment></comment></comment></comment><comment><USER14> There are currently 17 threads in response to this question. None have taken the architectural angle, one that can be well introduced with the _Rule of Least Power_ which states _Use the least powerful language possible for a given problem. Prefer declarative languages over procedural._ Now think for awhile about what that is actually saying...

Could it be that the heart of a secure system has little to do with process- oriented thought, and much to do with declarative policy?

In fact, in a well designed system, that should be the case. Unfortunately, there are bugs in all systems, so process-oriented thinking will always have a place. But in big picture terms - the 'heart' of a security stance - <USER2> really do need to be thinking in this way, particularly at design time, and generally also as an attacker.

Unfortunately, a declarative (policy-driven) architecture is essentially useless unless you ensure the system actually follows policy... for instance, by actually generating it largely from policy. This degree of rigor is rare in practice, but highly desirable in theory.

If you want to ensure your skills target big picture, are applicable to building things and not just tearing them to pieces (which in the security world often decays in to a range of puerile one-upmanship as visible at most prominent industry events), you could consider specializing in this area. In that case, you would do well to learn about declarative DSLs (domain-specific languages) and learn some of the more common ones. Then, practice generating things (documentation, functional code, application-level proxies, protocol test suites, policy compliance test suites) from those definitions... the generation could be done in any language, though using something simple with lots of libraries would be smart (possibly go, ruby, python, even perl or php).

Just thought it was worth contributing a different perspective here.

</comment><comment><USER15> Look into python and play around with scapy... look into Perl and play around with Metasploit... know how to implement your own Tor hidden-service keyserver and how to make your own site use an SSL/TLS cert... before you have completed all four of these tasks you will have a good idea of the landscape and will have learned a lot, possibly answering your own question.

<comment><USER4> Metasploit is Ruby. In 10 years of consulting with a progressively larger and larger team, I'm not sure I ever saw someone use scapy. It's not that scapy is bad, so much as that direct targeted low-level packet manipulation is kind of a 90s problem statement.

<comment><USER15> Gotcha, thanks for the clarification. So then, I suppose my recommendation of learning Metasploit and looking into Perl/CGI/PHP/javascript site security features are certainly separate/more than one thing. My aim was to suggest some broad "security programming" fields/projects that are easy to get started in or get quick results with and contain enough documentation and specialty uses that allow them to be drilled down into specifically if that part of the landscape interests OP. Also, doing cool things with scapy is fast and easy and learning to write your own scapy code seemed to teach me a lot about packet security very quickly. I was assuming that if one is an autodidact, the things I listed will keep you busy reading/learning related subject matter and introduce you to some cool things and familiarize yourself with what's out there while getting visible/fast results with a tool chain rather than just learning for learning's sake. There's a certain balance between thinking and doing; with excess of either it's easy to lose touch with reality/scope. This is why, when people want to "learn Linux" for example, I find out what they're interested in and point them toward some projects/packages... rather than pointing them to general Linux documentation which often has new users feeling like they're reading Greek without examples, or leads to eyeglaze.

</comment></comment></comment><comment> V-2 Related: [http://techcrunch.com/2015/05/02/and-c-plus-plus- too/](http://techcrunch.com/2015/05/02/and-c-plus-plus-too/)

 _We fail to learn. Heartbleed. GHOST. The Android 4.3 KeyStore. Etcetera, etcetera, etcetera._

 _C was and is magnificent, in its way. But we cannot afford its gargantuan, gaping security blind spots any more. It's long past time to retire and replace it with another language._

[...]

 _So please, low-level programmers of the world, I beseech you (while, to be clear, also respecting you immensely): for your next project, try Rust rather than C /C++. There is no longer any good reason for today's software to be as insecure as it is. Those old warhorses have served us well, but today they are cavalry in an era of tanks. Let us put them out to pasture and move on._

(Personally I'm rather neutral on the issue (I don't work with low-level languages), I just think it's good food for thought.)

<comment><USER16> This is advice useful for architects and engineers, and would be preaching to the pen-testing choir.

It is necessary for the member of such a security company to think of the software that they learn is first a tool used to attack other software (Metasploit, Burp, hand-written tools such as WWMD, quick one-off, discardable code used during a test), and secondly to develop a deep understanding of how the software under test works.

And, as I and others have noted previously in this forum, not all of the dramatically-reported errors are due to the low-level nature of C. Some are glaring implementation-language independent protocol errors.

</comment></comment><comment><USER17> There's also a language-portable state of mind.

[http://phrack.org/issues/1/1.html](http://phrack.org/issues/1/1.html)

[https://en.m.wikipedia.org/wiki/Fravia](https://en.m.wikipedia.org/wiki/Fravia)

</comment><comment><USER18> I believe comments here that programming isn't a necessity aren't really correct. A strong programming knowledge to the point of expertise is what you should aspire towards in a security-related career.

Language is a hard question though, there are a lot of things to consider around what sector you want to focus on. The holy trinity seems to be Python, Ruby and C.

ASM is probably very overlooked in general, but also a lot harder to master. Good luck, hope you get to a point where you can take a few steps forward. This is going to be an enormous area of interest over the next few years (much more so than it already is) so enjoy the challenge and the money ;)

</comment><comment><USER19> [http://security.stackexchange.com/questions/55723/are- there-...](http://security.stackexchange.com/questions/55723/are-there-secure- languages)

a specialized one: [https://developer.mozilla.org/en- US/docs/Zest](https://developer.mozilla.org/en-US/docs/Zest)

[https://answers.yahoo.com/question/index?qid=20081013174535A...](https://answers.yahoo.com/question/index?qid=20081013174535AAjvmY1)

</comment><comment><USER20> Low-level stuff. C. Assembler. Firmware. Debuggers.

</comment><comment><USER21> You're going to want to learn more than one, but for your first programming language I would suggest Python.

There are already a lot of people who suggested you a laundry list of langauges: yeah, you'll need to learn them all. However, that takes years. Don't fool yourself by thinking it doesn't. It will come with time.

</comment><comment><USER22> You can avoid C/C++/ASM if you're specialising in web application/mobile app security. However it's suggested you learn them anyway, given the domai8n of experience required for security roles.

</comment><comment><USER23> _This is going to be something of a rant, but roll with it._

This is a controversial opinion, but I don't believe someone should be a security engineer or a security consultant until they are a provably competent software developer.

This harkens back to the analogy of writing and editing - how can you expect to perform competent source code review from a security perspective without having a deep understanding of programming? Even if you do not know a specific language you're reviewing (ideally you should, though), you can at least generalize your understanding to look for common patterns of insecure coding.

The reason why I stress this so emphatically is because, despite the fact that you are asking which programming languages to learn, my experience with the security industry is that most people just don't have much real programming experience, which is absurd.

There are many firms where they will bill out their consultants at $2000+ _per day_ and their consultants couldn't build a simple Twitter clone if they were handed a complete spec.

I would much rather someone who can sit down and write a compiler and who has no security experience whatsoever than someone who knows all the payloads for XSS and how to find them manually. One of these people understands software engineering as a discipline and where it goes wrong, and the other is basically learning different "routes" without truly understanding everything under the hood. I can teach the person who writes compilers to find serious memory corruption vulnerabilities in a week. I can't teach someone who has never programmed to find subtle mass assignment flaws in Ruby/Rails.

This is not a straw-man dichotomy. Like 'tptacek said, it is _absolutely necessary_ for you to have a programming background if you want to work in AppSec. And God help you if you try to work on security in firmware or embedded systems and don't have this background.

My personal opinion is that all security engineers should be senior software engineers. There is a good quote by Ryan McGeehan (former Director of Security at Facebook, then Coinbase, now Hackerone) where he explains that the most competent security engineers start out by fully mastering a particular discipline. After they hit that point, finding vulnerabilities becomes extremely easy. You don't need to memorize different payloads or routes or rote methods of testing. When you have written a lot of C you will understand a buffer overflow in a half hour (enough to really be dangerous, anyway).

Working in security without a lot of experience programming is like trying to ski a black diamond without having mastered all the fundamentals. _Do not do it._ It is entirely too fashionable in the industry to hire people who don't know what they're doing, please do not add to this.

Now that my rant is over - you should learn Python and C. Ruby and Lua are also good; most people you'll find in the industry will be doing scripting in Python. You should know C for its rich history and deep connection with the information security industry, and also because most of the interesting vulnerabilities will be found in software projects written in C.

Source: A few years of security consulting, and now working as a security engineer in FinTech.

<comment><USER24> I don't think this is controversial at all. It's completely agreeable.

</comment></comment><comment><USER25> It is good to learn python/c/c++/java.These programming languages will help you.

</comment><comment><USER26> what kind of security? for instance web exploits can be written in any language even in bash scripts,. Your question is way to vague to give an accurate and pertinent answer.

</comment><comment><USER27> It's more about how you use it than the language itself.

</comment><comment><AUTHOR> Thanks so much for all the advice so far!

</comment><comment><USER28> Python can be very useful

</comment><comment><USER29> its helpful to know the clients language of choice

i would say 75% of the time: asm/c/c++/sql are req languages. python may be as well, lots of exploits are written in python b/c its fast to write for...

if you dont got that ur gonna need or bonus to have: knowledge of exploit methods for bash/win/php/ruby/sql and other common languages

just my take on it, cheers</comment>


Make your bootstrapped startup work - Lessons from the trenches - <AUTHOR> http://codercofounder.wordpress.com/2010/09/28/make-your-bootstrapped-startup-work/

<comment><USER2> Sorry to sound confrontational but:

Why should we listen to startup advice from a startup that is still just a landing page and a mailing list signup?

You talk about MVPs and getting to launch, but you yourself have not launched... I'm confused.

<comment><AUTHOR> Look, I am just reflecting on what things could have been done differently, and those that would have maximized the delta with our current status. You don't have to listen to advice, but if you are building something and you are in those first few months of bootstrapping, I do believe the advice is still sound.

When we started out I had a notion of what the primary obstacles to launch would be. I now have a completely different notion of what those obstacles are, and I think it's perfectly fine for me to share what I've learned myself.

<comment><USER3> Reflecting on something while working through it is interesting to me b/c it's less prone to revisionism. Maybe just refer to it less as advice and more as an experience.

<comment><AUTHOR> Agreed. I should have stayed away from advisory tone.

</comment></comment></comment></comment><comment><USER4> Off topic, but you're building a like-system (I have a part-time hobby one I've been sort of working on too) and I just wanted to wonder how you decided to go ahead?

The biggest concern I had was that the market is saturated with solutions that don't work because of disinterest, and anything I made could be beaten well- enough by Facebook in a good week's work. Sure I had a couple of edges but I couldn't spot _the_ edge that would fix everything, and when I found a local competitor (I live in a pretty small city with minimal startups) I was convinced that everyone must be working on this.

So.. long story short I'd love to hear how you decided this was the thing to work on and how (without giving too much away) you hope to overcome the problems for your product's sector.

</comment><comment><USER5> Hard to argue with anything in this post except one thing: the fact that you made it in the first place. I really don't mean to be negative, but you should be building when you are blogging.

For the record:

as soon as possible != after you blog about it

a landing page != a MVP

lessons from the trenches != yet-to-be-launched

Please practice what you're preaching and get your MVP out there. Then blog about it. That's something I would want to read about.

<comment><AUTHOR> Admittedly I got a little carried away with this one, so thanks for bringing me down to earth. I think some of the frustration having to do with our current status is turning into these long winded tirades on my blog. I'll keep them more toned down and private in the future.

I do hope to write something that you will enjoy reading about soon.

</comment></comment><comment><USER6> "We are building an online social app that lets you stay on top of and enjoy anything that your friends find interesting, good, likable, cool, irresistible and noteworthy, or things they just liked for no reason. Of course, it's also a way for you to tell your friends what you like."

This description reminds me of Facebook.</comment>


Redesigning Income Tax - <AUTHOR> https://www.owlfolio.org/uncat/redesigning-income-tax/

<comment><USER2> I enjoyed this. I also agree with the author that it has no chance of adoption.

For me it comes down to varying definitions of "fair". The mathematical approach we have here is inherently fair because percentages have the concept of "fairness" encoded within them; all incomes will treated equally.[0]

However, when talking about tax reform "fair" tends to be used to mean the opposite - taxing larger incomes more severely[1]. Sure there's a problem there, but it's not being marketed honestly: using separate scales compounds the effect of the usual more scientific scaling. I'm not saying that this isn't sensible - but it's certainly not the same as fairness.

[0] Fair is just a word. I'm not talking about [http://en.wikipedia.org/wiki/FairTax](http://en.wikipedia.org/wiki/FairTax) but the concept is similar I suppose

[1] For example: [http://www.bnn.ca/News/2014/04/30/Canadas-wealthy-take- bigge...](http://www.bnn.ca/News/2014/04/30/Canadas-wealthy-take-bigger-slice- of-income-pie-OECD.aspx) "Therefore, it is all the more important to ensure that top earners contribute their fair share of taxes" is fine in principle, but it doesn't mean that to "increase effective taxation paid by top income recipients" makes it more "fair".

</comment><comment><USER3> I'm not convinced that income tax reform needs to be so radical. However, I am convinced by the first part of his reform which involves instituting a basic universal income. In my mind a basic income solves a few fundamental socio- economic problems:

1) Allows us to eliminate complex welfare and social security schemes, while providing food and life security for every citizen. You can't eliminate all homelessness and poverty, but a basic income goes a long way towards eliminating most of it.

2) Drives development through increased mobility. People tend to cluster around areas where job availability is high leading to overcrowded cities with high real estate prices. A basic income provides the life security necessary to pursue living somewhere else, and will encourage people to move to "cheaper" areas where their basic income will go much further. Why live in NYC on your basic income when you could live in Kansas where your money goes a lot further? You'd instantly re-invigorate middle America and cities badly in need of urban renewal like Detroit.

3) Directly drives up GDP growth through increased consumption - Rather than flowing inflation through fed/bank lending or government spending, flow inflation bottom up through consumer spending.

4) Eliminates the economic paradox of sustaining human labour that can easily be mechanized.

5) A basic income is a cushion which creates an incentive towards higher- education and/or re-training and/or artistic/artisinal endeavours. Whichever country implements a basic income will cultivate the greatest scientific and artistic talent in the world.

I could go on but I'll stop there.

I realize there are some strong counter arguments against the basic income, but most would simply argue that a basic income would have no real effect. Given the potential benefits of such a proposal, I think it's an experiment worth trying. The potential pros are too numerous to list while the potential con is that it will be a complex poltical exercise that may have no effect.</comment>


Ask HN: Why does "Ask HN" not have a "newest" page? - <AUTHOR> "Show HN" has a page where you can see the newest submissions of that type [0], and it seems odd that "Ask HN" doesn't have the equivalent.<p>[0] https://news.ycombinator.com/shownew <comment><USER2> I wrote an HN viewer in Vue with this function. Just click the heading until "Ask HN" shows then click the clock/triangle header over the points to order by points or time.

[0] [https://hackerer.news](https://hackerer.news) [1] [https://github.com/git-grep/hackerer-news](https://github.com/git- grep/hackerer-news)

<comment><USER3> Super minimalist and to the point -- I like it.

Note: On mobile, I can't see the links if the title is too long.

<comment><USER2> Thanks. It tries to be responsive by using dual or single column view. I suppose the next step is to use a two line per item responsive view. I've often had trouble with clipped items as well.

I tend to use it where connectivity is spotty (subterranean transit) so I can see headings for days and open several pending links that load at the next stop with network.

</comment></comment></comment><comment><USER4> I wish there were a separate section on the website interface for Ask HN that made it convenient for people as well as remembering that it's there. Even more importantly, to compete less with articles. Most Ask HN threads are 0 to 1 or 2 comments.

<comment><USER5> There is - click the 'Ask' link in the top navigation.

</comment></comment><comment><USER6> Ask HN and regular submissions are inherently different from Show HN.

You can also find Ask HN submissions in the "new" section.

If you want to propose a changes your best bet is the contact email in the footer.</comment>