Oh. I see. Sorry, hash collision. I'm talking about the people who perform tasks like exploit discovery and development. You're talking about the people who take that work and run it in script form.
Perhaps a better analogy would be that asking "Why not pen testing?" is like asking why gun designers don't find new jobs as infantry.
Established security firms often focus on business with... guess who? Governments. The NSA employing people directly is not really much different from the NSA hiring contractors who employ people directly.
> You're talking about the people who take that work and run it in script form.
Not entirely. It starts as that, yes, because the first thing you do when attempting to break into a house is check the front door. There are obviously levels beyond this.
> is like asking why gun designers don't find new jobs as infantry.
But it's not entirely like that. There's plenty of firms that hire out security specialists to do code reviews for internal applications. At that point, it's like a gun designing consulting for manufacturing firmson ways to make their products more resistant to small arms. The job won't be the same, but there will be commonalities and the prior experience will transfer over usefully.
Not as much as you'd think. Even if it was, it's not a better place. Now you're trapped in a slightly different sector that you can't leave because your skills don't transfer.
And your job is probably a lot less reliable, because short-term auditing or pen-testing contracts offer a lot less stability than 3-5 year government contracts.
"Help, I love designing guns, but the only people willing to pay me for that will use them for evil!"
If you're a talented "network attack specialist" then you're likely also a worthwhile network engineer. So work in that role and do the gun-design in your spare time and hopefully for a good cause.
That's a pretty poor proposition to make to someone with a family to support. It's poor enough that they're going to ignore you and go on doing work you almost certainly object to.
Also, the skills required to be an effective network attack specialist have very little relation to those required to be a network engineer. I thought I covered this up-thread.
The parent is being a bit of a dick, but he does have a point. Not every job in the world is ethical, and simply being good at something is not always enough reason to do it for a living.
This is ultimately a deeply personal choice that everyone has to make, but sometimes we really can't both have our cake and eat it too.
I also work at a government sponsored R&D lab, so I'm familiar with the conundrum (not for myself - I'm just a dumbass programmer whose skills are so pitifully generic I could go literally anywhere in the world... some of my colleagues - not so much)
I don't know why it's so important that some random HN contributor be polite about this. Isn't everyone here speaking to you, and not your friends? Why does their tone matter so much?
Given that the context is that culture matters and that HN attitudes are relevant, I'm attempting to make the point that being rude does not help shape the attitudes in the way we-the-commentariat want.
Love it or hate it, it's a huge factor in how people make decisions. If you want to shape their behavior, you have to consider how they think and what they care about.
Perhaps a better analogy would be that asking "Why not pen testing?" is like asking why gun designers don't find new jobs as infantry.
Established security firms often focus on business with... guess who? Governments. The NSA employing people directly is not really much different from the NSA hiring contractors who employ people directly.