nobody confident in their own abilities is panicking

[jackryder@infosec.exchange]

@catsalad @Viss
I chime in with a "Haven't you people ever heard of commenting your goddamn code? No..."

[viss@mastodon.social]

@jackryder @catsalad dat fallout boy doe

[insidertreat@infosec.exchange]

@Viss @catsalad y'all write jokes, not tragedies.

[jackryder@infosec.exchange]

@Viss @catsalad
Wrong Fallout but still kind of cool.

[jackryder@infosec.exchange]

@InsiderTreat @Viss @catsalad

Thnks fr th Xmms

[acdha@code4lib.social]

@krypt3ia @Viss That's my prediction: intense executive pressure is going to lead to a lot of budget being blown on vendors, and then people who're being asked to do more with less will run the risk of being scapegoated when it doesn't work as well as it did in the demo.

Not a new story in infosec but it's cranked up to 11 this time…

[krypt3ia@infosec.exchange]

@acdha @Viss Ayup. I also think there is a fair amount of automation that is happening as well that leads to less need for headcount, but this AI shit is out of hand.

[da_667@infosec.exchange]

@Viss this is the "appsec is gonna save cybersecurity" shit all over again.

[viss@mastodon.social]

@acdha @krypt3ia my one hope is that all the yolo types, the ones who lied on their resumes to get infosec jobs, who cannot function without having to google everything or rely on a chatbot to do their jobs for them will have to admit defeat and crawl back to starbucks or wherever it is they came from

[da_667@infosec.exchange]

@Viss 5-10 years ago, companies that did appsec assessments were beating themselves off about how writing better code was gonna eliminate cybersecurity and yet, we're still here.

[viss@mastodon.social]

@da_667 the beatings will continue as long as people who dont know shit about computers continue to find themselves in leadership positions where they make the rules about how computers work and who can do what with them

[viss@mastodon.social]

@da_667 heh, i remember a bunch of folks saying how "solid technical controls will eliminate phishing"

then i remember saying "2fa will eliminate phishing"

then "totp will eliminate phishing"

then "zero trust will eliminate phishing"

then "okta will kill phishing"

then "facial recogition and fingerprints will eliminate phishing"

no - as long as you can social a human into clicking shit, phishing will exist.

[fritzadalis@infosec.exchange]

@da_667 @Viss
More LOC means fewer vulns, right?

[krypt3ia@infosec.exchange]

@Viss @acdha There is nuance to be had here though. Sure there was a push for everyone to get into the cybers for the six figures, but, on the other side of it, there is just SO FUCKING MUCH to this field that no one can be a master of it all.

So, using Google is a feature that we all use. I can't vouch for the lying on resume's but, I think we have a problem in our community of being all the "smartest one's in the room all the fucking time"

[cr0w@infosec.exchange]

@Viss @da_667 Maybe if engineers were actually engineers and didn't just import * from * for everything including OSs then there wouldn't be such an attack surface.

[krypt3ia@infosec.exchange]

@Viss @acdha This also goes for the AI equivalent of google searching.

[viss@mastodon.social]

@krypt3ia @acdha maybe i should clarify

i am very specifically referring to people who:
- do not have a technical background
- were formally hair dressers or coffeeshop folks, or oil changers
- who took 1 bootcamp class, or 1 'masters' course, and now want to be leadership or senior redteamers
- these people flatly cannot function without their crutches
- they should never ever have been let to be in charge of shit

[krypt3ia@infosec.exchange]

@Viss @acdha And yet, here we are.

[viss@mastodon.social]

@krypt3ia @acdha its because "you can buy your way into infosec". i even did a talk on it

[krypt3ia@infosec.exchange]

@Viss @acdha Buying certs and those who are paper tigers working in the field are all symptoms of "business"