Hiring Hackers

http://www.schneier.com/blog/archives/2010/06/hiring_hackers.html

by alexandros • 16 years ago

48 13 16 years ago

tptacek2• 16 years ago

You're more likely to hire the wrong person, not less, if you refuse to hire people without certifications. Certifications have been discredited in high-end security.

_pius• 16 years ago

Discredited amongst the truly high-end for whom Matasano is a household name, sure.

Trust me, though, the Booz Allens and Deloittes are still making tons of money by churning out 25 year olds with Masters degrees in "IT" and GSEC certifications, billing them as "security experts" and parking them in John Q. Federal CSO's office at $600/hour.

tptacek2• 16 years ago

You are right, but having said that, when you are hiring, you want the iSec people of the world, not the mumble mumble's.

ja27• 16 years ago

"Would you hire a convicted pedophile to work at a day care center?"

No, but I would consider contracting them to give advice on a child protection policy for a day care.

leftnode• 16 years ago

In reality, probably not. If the parents found out you were contracting a convicted pedophile for whatever reason, it'd be the end of your daycare.

You'd fare much better contracting law enforcement who catch pedophiles for child protection policy.

troels• 16 years ago

I see - The other kind of hackers. This is all very confusing to me.

doki_pen• 16 years ago

How do you get software written without hackers?

RyanMcGreal• 16 years ago

Java.

marr• 16 years ago

Getting "software written" and "hacking" - neither has anything to do with programming languages.

bdickason• 16 years ago

I used to ask recruiters in NYC (this is 1-2 years ago) for candidates with hacking backgrounds. They continuously looked at me with perplexed expression.

From my perspective, they make the best employees. A 1990's hacker, for example, is someone interested in coding and the internet before 'building web apps' was a viable profession. This means they are creative and quite skilled at taking things apart and dissecting them.

ax0n• 16 years ago

Since this has turned partially into a discussion about rhetoric and semantics, I figured I'd join in. I kind of disagree with The Schneier's sentiment, quoted thusly:

"Hacking is primarily a mindset: a way of thinking about security. Its primary focus is in attacking systems, but it's invaluable to the defense of those systems as well. Because computer systems are so complex, defending them often requires people who can think like attackers."

All the way up to "Hacking is a mindset" he's on the right course. Although I'm a security professional by trade and by passion (and was just christened "The Hacker" by my peers at the new job last week), I truly believe that the definition is a bit broader than simply security. Hacking is a mindset: a way of thinking about solutions to complex problems.

It so happens that security is -- or at least can be -- a pretty complex problem, but hackers of all kinds often think about the solutions to their problems by using critical thinking skills, intuition, and intimate knowledge of the system. This applies to complex problems of all varieties.

I understand, to an extent, why his essay was entitled Hiring Hackers, however, Hiring Computer Criminals may have been a more fitting title. Or maybe even simply Hiring Felons, for that matter.

jerf• 16 years ago

Given that the essay opened with "Any essay on hiring hackers quickly gets bogged down in definitions. What is a hacker, and how is he different from a cracker?", I gave him the benefit of the doubt and read that not as his universal definition of the term, but the one he was using for the remainder of the post. Admittedly it could be better labeled.

"Is X a Hacker?" is only a step removed from "Is X art?" When someone gives their definition for the moment, you really have to just accept it, contingently.

joubert• 16 years ago

I'm not sure I would hire someone I don't trust.

Hiring Hackers

Related Stories