Do developers necessarily make good penetration testers & vice versa?
The reason I ask is that I find I have much more of a knack for figuring out how an existing piece of software works and can be manipulated than actually designing and developing things myself.
I can program and I'd say I have an intermediate level of expertise but I have a hard time going from idea to finished project. I'm much more motivated and feel like I'm much more in a mental state of flow when trying to reverse engineer how something I have in front of me is working.
I think it's kind of the same idea as a writer or painter who talks about that anxiety of looking at a blank page. I feel like when working backwards from an existing piece of software there are constraints and context already there that gives me something to latch onto mentally. Whereas when developing software that 'blank page' and all the possible ways of designing and implementing something make my mind spin up and analyze every possibility.
I've seen this discussed in security circles as builders vs. breakers. The idea that some people are just wired more for building stuff with the traits that favor that and others for pointing out what's wrong with it.
In your experience is this a real thing or just a false dichotomy?
How essential are development skills for penetration testing?
I definitely really enjoy learning about how things are implemented and I'm not shy to read the source to figure it out. I like writing smaller scripts and tools that have a specific purpose but big full on programming projects with a lot of architecture abstractions I find I often end up losing interest and momentum.
How much should I let this bother me if my goal is pen testing rather than an actual development position?