[mechanical_fish]

But I am qualified! I designed a cryptosystem just last week, and nobody's broken it yet!

Moreover, the PDF that I published on my personal website sounds very erudite, and doesn't contain any obvious spelling errors. I have over fifteen years' experience in the lab [1], have authored nearly a dozen scientific publications in prestigious journals such as Physical Review Letters and Cancer Research [2], and have seven years' experience as a semiconductor process technologist. [3] So I don't see how you can dismiss my work out of hand, particularly since you, as a security professional, have an obvious conflict of interest. [4]

[1] At least two years of which involved making photocopies, washing glassware, and ordering pizza.

[2] This is actually true, for reasonable values of "nearly" and "prestigious". You must also remember that being Nth author counts as "authoring".

[3] Also true. And so relevant, too!

[4] Notice that "the desire to toot your own horn" never seems to count as a "conflict of interest".

[tptacek]

While noting that nobody else is going to toot your horn for you, I'll say that cryptography was just the first thing to come into my head, for obvious reasons. I can't tell from the tone of your comment, but if you've worked in semiconductors, cancer research, and cryptography, let me be the first to proclaim that you have a bad-ass resume.

[mechanical_fish]

Oh, I totally lied about the cryptography. :) I have a copy of Schneier on my shelf that I occasionally put under my pillow at night... does that count?

All that I know about cryptography is that anyone who claims to have written their own unbreakable system, but hasn't had that system vetted by other cryptographers, is nearly 100% likely to be completely full of it.

The semiconductors and cancer research are true. It sounds so much more impressive than it actually is, though, which is kind of my point. Yeah, I've worked in several fields, and I like to think I learned something from all of that time, but if I wrote a crypto paper I would still be talking out of my ass. Hell, if I wrote my own cancer research paper I'd be talking out of my ass -- my role in the cancer lab was mainly "physics guy who knows how to change the light bulbs on the multiphoton microscope".

[tptacek]

So then, I made a half-assed analogy:

  programmer : semiconductor engineer :: surgeon : researcher

Was I talking out of my ass? Because of the three CS fields I mentioned, I barely work in one of them. =)

[mechanical_fish]

Well, I want to avoid insulting, e.g., my former co-author, a neurosurgeon who also does oncological research... but I don't think your analogy is bad at all.

It's generally true that the skills, the approach, and the techniques of surgeons and researchers are completely different. Surgery is a specialty. For example, I've had the head of surgical oncology at a very prestigious hospital tell me that he doesn't know much about chemotherapy -- there are other experts for that. And none of those clinical guys are necessarily experts in the causes of cancer, nor in its rate of incidence.

The stereotype, of course, is that every surgeon thinks that being a surgeon makes you an expert in everything. Sometimes that mold fits: Tremendous self-confidence is almost a requirement for being a great surgeon, and the side effect can be... an excess of confidence. And sometimes the mold is unfair. The field I briefly worked in -- antiangiogenesis -- was founded by the late Judah Folkman, a famous surgeon who did his even-more-famous research as his second job. Folkman had to spend a lot of years gathering data before other researchers were convinced that he wasn't just another surgeon with delusions of grandeur. But, as it happens, he wasn't.

In the end, you've got to show the data, and it has got to survive real criticism. That's the metric.