As a senior developer, Ross McDonald has learned that some job requirements extend beyond what is explicitly stated. Developers must gain expertise in related technical areas like security, algorithms, and data structures to fully meet requirements. It is also important for developers to continuously learn about new technologies and best practices from technical communities to address increasingly complex problems and avoid potential issues. Recognizing the limitations of one's own knowledge and seeking expert advice when appropriate are important skills for developers.

1. Not in the Job Description
Ross McDonald
Senior Developer, FrogSlayer

2. Requirements
• Is a website
• Users can store content
• Users can login
• Only logged in users can
modify content
• User content is analyzed using
client algorithm
Developer knowledge
Assumed Expertise
Client Provided Knowledge

3. Probability / Random Sampling
• Random vs. Pseudorandom
• Correct use of PRNGs
• Converting uniform distributions to non-
uniform distributions

4. Produce a predictable sequence determined by initial seed
• Seed once
• Make sure its properties
fit your need
Pseudorandom Number Generators

5. PRNG Output Transformation Pitfalls
• Bounding with rand()%max or similar
• Producing byte-streams or floats with random ints incorrectly
• Sampling more complex distributions with a uniform PRNG
incorrectly

6. Computer Security Pitfalls
• Not understanding Encryption /
Authentication / Integrity
• Not trusting the defaults and standards
(rolling your own)
• Trusting the defaults and standards

7. Alice Bob
Authentication Integrity Encryption

8. Trust the Defaults
e.g. .NET provides CryptoServiceProvider classes with reasonable
defaults.
• GenerateKey()
• GenerateIV()
• Sane default Mode (CBC)
Original ECB Non-ECB

9. Don’t Trust the Defaults
• No matter how self contained the library is, there is potential for
misuse (e.g. Padding Oracle Attack)
• PGP does not provide forward secrecy
• GnuPG was slow in adopting Elliptic Curve
• The NSA / RSA BSAFE debacle

10. Takeaways
• Recognize problems are more complicated than you might think.
• Never stop learning.
• Immerse yourself in technical cultures (e.g. blogs, podcasts, stack
exchange)
• Know enough about everything to know when your client’s concerns
warrant an expert