So, I went and got a hair cut yesterday. Actually, "hair cut" probably isn't the right term, since I accompanied my girlfriend to a "salon". (Yes, you have to call it that... I got corrected when saying "barber shop"). And it was significantly different - calling this guy a barber would be like calling Yo-Yo Ma a fiddler. He was a "stylist". Or a "hair designer". Or, perhaps a hair architect.

Of course, I spent the entire time asking questions about what he was doing - everything he did had purpose and was well understood. He was a scientist and an artist of hair. I now know far more about how hair (and especially my hair) works than I ever imagined.

That, of course, made me think of the creation of vulnerability detection rules. The old way of doing it is that of the barber - just whip something together that looks moderately good and works most of the time. No major issues - just "good enough".

Then there's the way that our guys do it - with intent and understanding of all the principles and rules behind what they're doing. I've seen vulnerability rules that I can only call beautiful - they're not just good, they're aesthetically pleasing in their elegance.

That's something I don't see when looking at Nessus - their rules are the "barber" type. Nothing against the product or the people - I really just don't find that the rule authors care about their craft. It's work done just to "hurry up and get it done", rather than getting it done right.

And, similar to my "hair architect" yesterday, it's alwaays the little things that makes the difference. He understood the waves of the hair and the texture with an eye that a normal barber wouldn't have. Just like one of the VERT guys can look at a vulnerability and understand the subtle nuances - the way the code line is likely to have produced the vulnerability, how it should interact with other parts of the code, etc. It's about experience and a lot of time spent studying craft.

And you can see the craftmanship in the results.

It's the difference between a Ford Pinto and a Jaguar. They'll both get you from point A to point B, but one will make sure you're safe and comfortable when you get there. The other just might explode on the way.