Full Disclosure mailing list archives
RE: Hacking Boot camps!
From: "Clement Dupuis" <cdupuis () cccure org>
Date: Wed, 23 Nov 2005 18:06:48 -0500
Good day InfoSecBOFH, Hum... It seems like you have something to settle with SANS, I really do not know what they did to get you this mad or what negative experience you had to go through but they definitively are not on your white list.
- Their training is out of date
I guess this is the growing pain. It becomes an unbelievable challenge to maintain over 20 tracks. I do not believe they are all outdated as you claim; all of tracks are usually updated a couple times a year.
- Most of their instructors are unqualified to answer any questions that are not in their training books.
Most of their classes have outstanding instructors such as Ed Skoudis, Mike Poor, Eric Cole, Chris Brenton, Jason Fosen, Joshua Wright, Bob Hillery, Marcus Sach, William Stearns, etc... These instructors will not only answer questions on security topics but have also written the training books and have been published in magazine and books as well. They are well respected in the community and very competent. If you would dare to call any of these instructors unqualified, you must have a very demanding level as far as an instructor is concerned. I totally disagree with your comment about them being unqualified, they are the best, and they are the people delivering a lot of the live classes. I have heard of some negative comments related to their other delivery mechanisms but their live classes are being done by great instructors.
- Most of their instructors will feed you with a marketing pitch for their own consulting or product companies.
Most instructors will introduce themselves within the first few minutes of the class and this is the extent of it. I think it is only fair to give your company credit as well as yourself. After all, it is your company that gives you time to attend and teach in many cases. If any instructor goes above and beyond this, they are out of line and not following their own code of ethics.
- The so called "SANS What Works" program where they endorse vendors who have products that actually work and help with infosec issues is a sham. They will list any vendor that pays their 25K "fee" to be listed.
I must agree with you on this one, people think that the products featured are endorse and recommended by SANS but this is not the case. SANS is only showcasing a company and what they have use with success or what has work in their very specific case. The company has you have said has to pay a fair amount of money to have their case and product showcased. It is people reading about it that takes for granted that the product presented is endorsed by SANS, it is stated clearly on the SANS website that it is not the case. Of course, nobody from SANS has attempted to dispel the myth (to the joy of the people who have paid to be part of the program). I guess they see no reason to attempt doing so because it is stated clearly on the web site what the program is about. The name "SANS What Works" is somewhat misleading I must admit. A bit more information could be provided on what the program really is, what it stands for, and what is the endorsement being made.
- Here is how the pyramid works. You have Northcutt and Paller on the top of things as the creators of this so called non-profit (yet they have multi million dollar homes in Hawaii). They *USE* volunteers to come up with training material and to run their "mentoring program". Then, they take the volunteer work, hand it to their close friends who also happen to be their full time instructors let them take credit for it and have them deliver the course and of course pay them very well for it. Nothing like making money for your 'non profit" on the backs of volunteers who you still charge to attend the training BTW.
Both Stephen Northcutt and Allan Paller have never claimed to be non profit because they know that they are not. Their web site and documentation does not pretend to be non profit either. Somehow there is this myth from the early days that has been going around about SANS and GIAC being non profit. On the training material side: The training material being developed for the past few years has been done by people who were compensated for their work and NOT free work as you claim. The local mentor are paid as well, they are not doing volunteer work. I have heard good comments and very sad comments about the delivery of the program. I guess you mileage will vary depending on who is the mentors. I do not know of any regular instructor who has taken someone else material and claim it was their own. There is no volunteer that I know of, producing training material without getting paid for each slide if it is being used for training. In fact SANS has one of the most generous royalty programs out there. None of the large training organization out there will pay you royalties the way SANS does and the amount SANS does. I must give them credit on that side. You are right: SANS has the best pay in the industry. Do you have a specific example of someone who has developed a course, a short class, or anything for free and the material got used and abused as you claim by SANS or an instructor or SANS? I know SANS is not perfect, they are not what they use to be as a community, but they still deliver quality training and credit must be given to them where it belong. Other training vendors are doing nothing to give back to anyone. At least SANS are giving back to the community through many projects. Take care Clement _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Hacking Boot camps!, (continued)
- Re: Hacking Boot camps! Exibar (Nov 23)
- Virus infections Geo. (Nov 23)
- Re: Virus infections Gary E. Miller (Nov 23)
- Re: Virus infections pingywon (Nov 23)
- RE: Virus infections Paul Craig (Nov 23)
- RE: Virus infections Debasis Mohanty (Nov 23)
- Re: Hacking Boot camps! InfoSecBOFH (Nov 23)
- Re: Hacking Boot camps! Koen Van Impe (Nov 23)
- Re: Hacking Boot camps! InfoSecBOFH (Nov 23)
- Re: Hacking Boot camps! Michael Holstein (Nov 23)
- RE: Hacking Boot camps! Clement Dupuis (Nov 23)
- RE: Hacking Boot camps!: certifications wilder_jeff Wilder (Nov 23)
- RE: [inbox] RE: Hacking Boot camps!: certifications Exibar (Nov 25)
- Re: Hacking Boot camps!: certifications R S (Nov 25)
- Re: Re: Hacking Boot camps!: certifications Valdis . Kletnieks (Nov 25)
- Re: Hacking Boot camps!: certifications R S (Nov 25)
- Re: Hacking Boot camps! Dude VanWinkle (Nov 23)
- Re: Hacking Boot camps! InfoSecBOFH (Nov 23)
- Re: Hacking Boot camps! Dude VanWinkle (Nov 23)
- RE: Hacking Boot camps! Edward W. Ray (Nov 23)
- RE: [inbox] Re: Hacking Boot camps! Exibar (Nov 25)