It’s surprising how often folks mistake familiarity and expertise with one area as competency in a field writ large. This happens often in the vuln-dev vs AVs/TI debates, the ‘if you’d only used Chrome’ camp, and ‘experts’ vs the people debates.
It’s usually not worth engaging, however, I think it’s important to counteract myopic views that may affect effective recruitment in infosec writ large.
Security depends on a multitude of layers, of which the code, hardware, and system architecture is only a small part. For this, specialists can do great things. But as is often the case, politics, finances, user engagement, psychology, marketing dynamics will decide far more.
Your wonderful code and devious vulns fascinate and delight experts but they don’t amount to much without a generalist understanding of all the factors involved in: attention, incentives, adoption, balance of probability assessments, and the ability to effect change in each.
Perhaps in your erudite corner of infosec, elite programmers are all you need. In mine, the last thing I need is another programmer. Self-driven, passionate learners capable of connecting concepts with code, discern intentions with campaigns, and relate complex player dynamics...
...with tasking and incentives is what I need. And I’ve met far more generalists that have picked up adequate programming to suit their needs than I’ve met dedicated programmers who’ve been able to broaden their thinking to see past the minutiae of the code in front of them.
