3 ms·

I've already made a couple posts on FD, but usually I just send pull requests when I find issues in open source projects and don't really seek fanfare for anyth

I've already made a couple posts on FD, but usually I just send pull requests when I find issues in open source projects and don't really seek fanfare for anything. (I haven't evaluated any closed source stuff.)

tptacek 12y ago
Of all the career paths you have right now, information security is the thorniest. There are four big reasons for this: 1. Hiring managers on the defensive side of infosec tend to have an "us vs. them" attitude towards attackers. The people in the trenches in this field are young and open-minded, but management can tend towards grey-haired and conservative. 2. Infosec is closely tied to risk management. Nobody is allocating enough resources to security to properly mitigate threats, and everyone's acutely aware of that. Lots of large, smart firms are going to avoid hiring people with criminal backgrounds simply to avoid the possibility of an own-goal. 3. Relatedly: even firms that spent nosebleed amounts of capital on security are going to have high-profile security events, and when that happens, the rest of the organization is going to look to the infosec team for someone to blame. The backgrounds of everyone on the team will be relevant in those finger-pointing exercises. 4. Finally, and as I've said elsewhere: the offensive side of security is dominated by contractors, and contracting clients tend to background check as a matter of course. You can nurture an interest with software security as a developer, by being the developer on your team that knows the most about software security; you can keep doing the security stuff you like now without necessarily holding out for a role with "security" in the title.
- sarciszewski 12y ago
  Yeah, I've been aiming for developer roles rather than security roles... mostly because exploitation is not my greatest strength.
  - tptacek 12y ago
    You're also very young. At some point in the not too distant future, it's likely that your entanglement with the law is going to stop mattering at all.
    - sarciszewski 12y ago
      I certainly hope you're right. That happened in 2011; it's already 2014 and the clock's only going to continue to move forward. Nothing can be gained from being stuck in the past forever. :)

tptacek 12y ago

Of all the career paths you have right now, information security is the thorniest. There are four big reasons for this: 1. Hiring managers on the defensive side of infosec tend to have an "us vs. them" attitude towards attackers. The people in the trenches in this field are young and open-minded, but management can tend towards grey-haired and conservative. 2. Infosec is closely tied to risk management. Nobody is allocating enough resources to security to properly mitigate threats, and everyone's acutely aware of that. Lots of large, smart firms are going to avoid hiring people with criminal backgrounds simply to avoid the possibility of an own-goal. 3. Relatedly: even firms that spent nosebleed amounts of capital on security are going to have high-profile security events, and when that happens, the rest of the organization is going to look to the infosec team for someone to blame. The backgrounds of everyone on the team will be relevant in those finger-pointing exercises. 4. Finally, and as I've said elsewhere: the offensive side of security is dominated by contractors, and contracting clients tend to background check as a matter of course. You can nurture an interest with software security as a developer, by being the developer on your team that knows the most about software security; you can keep doing the security stuff you like now without necessarily holding out for a role with "security" in the title.

sarciszewski 12y ago
Yeah, I've been aiming for developer roles rather than security roles... mostly because exploitation is not my greatest strength.
- tptacek 12y ago
  You're also very young. At some point in the not too distant future, it's likely that your entanglement with the law is going to stop mattering at all.
  - sarciszewski 12y ago
    I certainly hope you're right. That happened in 2011; it's already 2014 and the clock's only going to continue to move forward. Nothing can be gained from being stuck in the past forever. :)