Yvan Seth's Hole in the Internet

Some time ago I wrote about the GSSP-C exam. Being a certification non-believer I thought it would be interesting to have a poke at a certification. The one in question being the, at the time, new GSSP-C (GIAC Secure Software Programmer in C.) It seemed at least relevant to my work (mostly C/C++ back then) and my industry (the dirty world of infosec.) In general I was impressed by the practical resources and also by the message the people behind the exam (SANS) were trying to get across. Afterall… many software security issues are caused by bad programming, the GSSP-C seemed a worthy attempt to address this.

Here's the amusing thing, the GSSP-C has been quietly retired already. Or, perhaps, "become a victim of infanticide" would be more accurate?

As of 10/27/09, the GSSP-C Certification has been retired. This is a business
decision GIAC has made due to decreased demand for the certification, and the
need to focus our efforts and resources on higher performing certifications. 

While this does not invalidate the skill sets that you have or the GSSP-C
credential you've earned, we just cannot support the exam's maintenance moving
forward.

You are still free to use the GSSP-C logo on your personal correspondence
(signatures, business cards, etc) 

It's short and to the point really: we were in the for the money, but the money ain't there. No surprise! I just love the language in the email text above, it illustrates so much of what's weird about the certification world. How on Earth could this "invalidate the skill sets that [I] have" anyway? The measure of a "high performing certification" is "more people take it" which translates to "makes us more money."

I'm enjoying the thought that this whole situation is a statement on the mindsets of different groups within the tech community. The GSSP-JAVA.) has not been retired as far as I can see.

1. The Java crowd are more into certifications (most of the Java population work for big old banks and similar institutions, there's also more of them of course)
2. The certification crowd are an insecure lot (haw haw haw!), they need their certifications to validate their "skills"
3. In the C world, especially amongst any C/Systems level programmers I've known, certifications are anathema. They're for "programmers in suits"!

I wasn't sure at the time of doing the certification (which I safely acquired by the way) whether or not it had any inherent value. I think that we can now say the answer is no – for the time and money involved the value for the majority is probably negative. For me, the value was in the experience of the certifications world and this retirement of the certification increases the value even. Then again, I just did it for a bit of a lark in the first place.

I'm reminded of a time just before the exam when I received an email from some SANS bigwig (as I imagine every GSSP-C victim did.) The email asked what we thought about this particular SANS campaign, and generally solicited feedback. I fed-back of course, questioning the validity of the certification route and its likely ineffectiveness at improving the world's C-coding standards. I never received a reply of any sort :) surprised? It would be been good to get one though. I was genuinely interested to know more about this. I wondered how they were going to take this to the sorts of programmers who really need it. I imagine those few of us who sat the exam while it existed were already quite security aware, we'd have to be to have even heard of the exam in the first place! In other words, we're the people least in need of sitting the exam. (I did learn a couple of interesting C gotchas in the process though!)

Will I ever touch a certification again? Certainly not out of my own time and pocket, and unlikely even if someone else is footing the bill and paying me for my time.