4 ms·

Send them to a small teaching-focused college. Institutions that are large, focused on graduate students, and/or focused on research have an incentive structure

by lmkg 13y ago

Send them to a small teaching-focused college. Institutions that are large, focused on graduate students, and/or focused on research have an incentive structure that puts a lower priority on the care of individual students. I went to a <1000-student college, and when I had some trouble at home I had an hour-long session with the school counselor, who referred me to a nearby professional. I was also on a first-name basis with some of the deans, and they were able to help accommodate me. tl;dr Go somewhere that you're a person and not a statistic.

deleted 13y ago
[deleted]
haberman 13y ago
It's really interesting to notice the trade-offs. I went to a small-ish, teaching-focused college (The University of Puget Sound: http://www.pugetsound.edu/ http://www.pugetsound.edu/). And just as you say, I found that the faculty and staff was really supportive and concerned with our well-being. And while the faculty was very strong, I sometimes felt jealous of friends from the University of Washington (the nearby Huge Research Institution) and what seemed like a more extensive CS program with more resources. I heard about some of the classes my friends took that our program didn't really have any equivalent for. I would read about some of the problem sets that sounded amazing, like a security class where you're given a VM image and the problem set is to compromise some of the programs inside the VM. Advanced curriculum like that seems difficult to develop without a lot of grad students around. A part of me has always pined for that experience I didn't get to have. I guess it's hard to have it all.
- tptacek 13y ago
  As someone who has done a pretty serviceable job of building those kinds of courses for systems security: I wouldn't be jealous of that at all; the fundamentals of CS are what matters. If that's something that's still interesting to you, check out http://microcorruption.com http://microcorruption.com.
  - haberman 13y ago
    > If that's something that's still interesting to you, check out http://microcorruption.com http://microcorruption.com. I was very excited to see that for just that reason. :) I think I peaked at #24 on the day it was announced, but I'm sure I've slipped quite a bit since then. Fundamentals are important; agreed, but the difference between knowing the theory of buffer overflows and having actually exploited one is a huge to me. Now I can say that I have actually done that, thanks to you having packaged everything up so nicely on microcorruption.com, but even that isn't 100% of the experience I would like to have, because the environment is a lot different than what I program on day-to-day. For example, I know that I shouldn't map any memory wx (and I explained this rule in my article about JITs: http://blog.reverberate.org/2012/12/hello-jit-world-joy-of-simple-jits.html http://blog.reverberate.org/2012/12/hello-jit-world-joy-of-s...), but I don't really know why. I don't actually know what an attack would look like where having wx memory around makes an exploit easier.
    - pbsd 13y ago
      If you can control what gets written to the wx memory, then all you have to do as an attacker is rewrite a function pointer or return address to that memory. Better yet, if you can rewrite a return address, you can "return" to a read call (or some fancier ROP chain) that will read the rest of your shellcode into the wx memory and execute it. In either case, having that kind of memory around can only make things easier for an attacker, while by itself not being exactly a vulnerability.

by lmkg 13y ago

deleted 13y ago

[deleted]

haberman 13y ago

It's really interesting to notice the trade-offs. I went to a small-ish, teaching-focused college (The University of Puget Sound: http://www.pugetsound.edu/ http://www.pugetsound.edu/). And just as you say, I found that the faculty and staff was really supportive and concerned with our well-being. And while the faculty was very strong, I sometimes felt jealous of friends from the University of Washington (the nearby Huge Research Institution) and what seemed like a more extensive CS program with more resources. I heard about some of the classes my friends took that our program didn't really have any equivalent for. I would read about some of the problem sets that sounded amazing, like a security class where you're given a VM image and the problem set is to compromise some of the programs inside the VM. Advanced curriculum like that seems difficult to develop without a lot of grad students around. A part of me has always pined for that experience I didn't get to have. I guess it's hard to have it all.

tptacek 13y ago
As someone who has done a pretty serviceable job of building those kinds of courses for systems security: I wouldn't be jealous of that at all; the fundamentals of CS are what matters. If that's something that's still interesting to you, check out http://microcorruption.com http://microcorruption.com.
- haberman 13y ago
  > If that's something that's still interesting to you, check out http://microcorruption.com http://microcorruption.com. I was very excited to see that for just that reason. :) I think I peaked at #24 on the day it was announced, but I'm sure I've slipped quite a bit since then. Fundamentals are important; agreed, but the difference between knowing the theory of buffer overflows and having actually exploited one is a huge to me. Now I can say that I have actually done that, thanks to you having packaged everything up so nicely on microcorruption.com, but even that isn't 100% of the experience I would like to have, because the environment is a lot different than what I program on day-to-day. For example, I know that I shouldn't map any memory wx (and I explained this rule in my article about JITs: http://blog.reverberate.org/2012/12/hello-jit-world-joy-of-simple-jits.html http://blog.reverberate.org/2012/12/hello-jit-world-joy-of-s...), but I don't really know why. I don't actually know what an attack would look like where having wx memory around makes an exploit easier.
  - pbsd 13y ago
    If you can control what gets written to the wx memory, then all you have to do as an attacker is rewrite a function pointer or return address to that memory. Better yet, if you can rewrite a return address, you can "return" to a read call (or some fancier ROP chain) that will read the rest of your shellcode into the wx memory and execute it. In either case, having that kind of memory around can only make things easier for an attacker, while by itself not being exactly a vulnerability.