What does a developer advocate do?

[Exadra37]

@dimitarvp

What does a developer advocate do for a living? I mean, what is it that you are paid to do?

To do this:

@Exadra37

I mainly work in creating and maintaining the Approov quickstart integrations for each backend language and sometimes also do some work on the Android side. I also create and maintain some demos to show how the Mobile App Attestation from Approov works and/or how it can be easily integrated in a mobile app to lock it down to the API server.

I though it was clear, but I will try to rephrase:

• I code in many programming languages as needed to create Approov QuickStart integrations,
• I code as many demos as need in any programming languages.
• I create blog posts about quickstarts, demos and educational content about Mobile API Security.
• Sometimes I also give technical support for clients integrating Approov.
• I present Approov demos on scheduled live calls.

@dimitarvp

I’ve seen your description below but it doesn’t tell me much. Could you elaborate?

If you are interested in working in Mobile API Security then please send me a private message so that we can talk further.

This is not only for Developer Advocate, it may be for a mobile sdk developer, for a DevOps, for quality assurance(testing like an hacker), for technical marketing, technical writer, etc. .

I was hired just because the recruiter sent my CV for a DevOps position, that I told the recruiter I was not a good fit for, but they liked my CV and created the Developer Advocate role to get me in

So basically the company is always interested in people with good skills in mobile and API security.

@dimitarvp

There are some people who believe Android devices are remotely pwned by default and Google and the OEM vendor can take a peek at any moment they want.

Do you have any links?

I know this type of theory of conspiracy for computers, TVs, but I think is the first time I see a mention about mobile phones… Anyway I am not admired this believes exist for any kind of device connected to the internet, after all even the 3G, 4G cell towers have so buggy software, and with insecure protocols from the 70’s, that I am not admired that state actors or even private ones can do a lot of snooping through them.

Some links about how the mobile infrastructure is flawed by design, specially due to the SS7 hack:

SS7 hack explained: what can you do about it?

The Critical Hole at the Heart of Our Cell Phone Networks

Opinion | Our Cellphones Aren’t Safe (Published 2018)

@dimitarvp

So not sure what security could even exist on such phones?

Are you thinking that we are trying to do something like RASP?

Runtime application self-protection (RASP) is a security technology that uses runtime instrumentation to detect and block computer attacks by taking advantage of information from inside the running software.

RASP technology is said to improve the security of software by monitoring its inputs, and blocking those that could allow attacks, while protecting the runtime environment from unwanted changes and tampering.

We are more about Mobile API Security in the terms of locking down the mobile app to the API server in away that the API server will have an high degree of confidence that the request comes from a genuine and untampered version of the mobile app uploaded to the Google Play Store or Apple Play Store.

Some are saying that Android Security may be better then iOS one:

Android is now claimed more secure than iOS

iOS 13 vs. Android 10: Which OS is more secure?

WTF?! Study finds Android is actually safer than iOS

https://onezero.medium.com/is-android-getting-safer-than-ios-4a2ca6f359d3