<div dir="ltr">No group of professionals meets except to conspire against the public at large ( Mark Twain)<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Mar 8, 2013 at 12:14 PM, Jim Kinney <span dir="ltr"><<a href="mailto:jim.kinney@gmail.com" target="_blank">jim.kinney@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">All very valid points.<br><br><div class="gmail_quote"><div class="im">On Fri, Mar 8, 2013 at 11:50 AM, Leam Hall <span dir="ltr"><<a href="mailto:leamhall@gmail.com" target="_blank">leamhall@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On 03/08/2013 11:24 AM, Jim Kinney wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Exactly. What this does do is require that public facing code that has<br>
the potential to cause harm is reviewed and approved by someone that<br>
society, working through bright people in the field, trusts will stamp<br>
that code as "best available methods at this time". There will still be<br>
loads of jobs for non-certified coders.<br>
<br>
We already have the Business A -> Business B process. It doesn't work<br>
very well.<br>
</blockquote>
<br>
Business B has a lousy marketing department then. There is a significant need for security and to have CISSP, GIAC, or even Security+ people on teams, IF YOU LISTEN TO THEM, helps loads. You can tout the reduced code vulnerabilities from meeting X standard and note that you actively recruit security talent is leverage.<br>
</blockquote></div><div><br>That's where a legal requirement will help this process. There are plenty of people who are bright and good enough to do this but the PHB doesn't listen because of PHB reasons. <br></div>
<div class="im"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Damon's point about requiring certification raises a different issue. Keep in mind that much of what we know is reinforced by daily usage and decreases over time. If you get an RHCE it means you passed a rigorous test. If you passed that test a decade ago, like me, you need to show that you have kept current. And I don't mean paying for another certification, but actively doing stuff in the field.<br>
</blockquote></div><div><br>Just like other fields, that license is only valid with ongoing training credits. My vet has to go back to school every year to keep her practice certs valid. Her staff does not have to have practice certs. A RHCE on RHEL4 is nearly useless on RHEL6 (changed EVERYTHING on user security! and that doesn't account for selinux :-D )<br>
</div><div class="im"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
And doing new stuff, too. A lot has changed in the last decade and there are lots of critical bits now that didn't exist then. That's what I love about Linux; you can know everything today and tomorrow will bring something new.<br>
<br>
The questions start to boil down to "What are the best practices that (a) actually work and (b) can be implemented with reasonable budgets?" and "How do we evaluate the ability to implement and inspect for them?"<br>
<br>
Would that be a reasonably fair set of questions?<br></blockquote></div><div><br>This is good. Maybe is could be organized by criticality level based on breach outcome. Some things are already covered by various levels of computer security (some is bone-headed) from DoD. So different levels of engineering proficiency with different needs.<br>
</div><div class="im"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Leam<br>
<br>
______________________________<u></u>_________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org" target="_blank">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/<u></u>listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/<u></u>listinfo</a><br>
</blockquote></div></div><span class="HOEnZb"><font color="#888888"><br><br clear="all"><br>-- <br>-- <br>James P. Kinney III<br><i><i><i><i><br></i></i></i></i>Every time you stop a school, you will have to build a jail. What you
gain at one end you lose at the other. It's like feeding a dog on his
own tail. It won't fatten the dog.<br>
- Speech 11/23/1900 Mark Twain<br><i><i><i><i><br><a href="http://electjimkinney.org" target="_blank">http://electjimkinney.org</a><br><a href="http://heretothereideas.blogspot.com/" target="_blank">http://heretothereideas.blogspot.com/</a><br>
</i></i></i></i>
</font></span><br>_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
<br></blockquote></div><br></div>