Recent submissions

Comment · 5 years ago
Comment · 5 years ago
I'm going to assume you're interested in network penetration testing in large traditional-IT enterprises:

It's very common for folks to enter the security testing field mid-career with a background in something else. This is almost preferable. The domain knowledge you have from your other experiences will serve you well when trying to understand [and find] security issues in related areas.

1. A potential path forward: Don't try to sell yourself as a penetration tester. Sell yourself as a developer who can support penetration testers/red teamers.

Modern ethical hacking requires a lot of coding to write new tools and customize existing ones. Even if you don't know much about how to get domain admin, escalate privileges, etc.--you can provide a lot of value just by the ability to ferret through MSDN and turn around C or .NET code that reproduces someone else's research or techniques for a team's internal use.

Rewriting existing stuff is really important as a lot of defenses are developed and tuned to public POCs or samples without much imagination for how the technique can vary with a little effort.

2. The Red Team Ops and Adversary Simulation community has a great culture of open research and code. Contribute to an existing project or start your own collection of interesting stuff to demonstate you have the chops to contribute as a developer.

3. If you're looking for the right "foot in the door" qualification, get the Offensive Security Certified Professional (OSCP) certification. It's hands-on and very well respected by the practitioners in this field. While the course will not turn you into a penetration tester, it demonstrates you can tackle the types of technical problems and concepts required to succeed in this work.

https://www.offensive-security.com/

4. Daniel Duggan's Red Team Ops course is good exposure to the concepts and workflows a lot of red teamers/penetration testers work with today:

https://www.zeropointsecurity.co.uk/red-team-ops

Comment · 11 years ago
When I was in high school and early on in college--I didn't enjoy math. I always thought of math as the drone of memorizing formulas and plug+chug.

I later took a class that used a textbook, Laboratories in Mathematical Experimentation. The book and that class were the first time math became play for me. A big part of that class was digging into graph theory.

Really fun stuff.

Comment · 12 years ago
I launched Feedback Army on HN in 2008. It's consistently paid my part of my Washington, DC rent for years. I gave some details about how I marketed it on its blog and in the side projects book someone put together awhile ago. Sadly, I can't find a link to the side projects book or I'd post it here.

http://blog.feedbackarmy.com/

I owe a lot to Feedback Army. It was the first thing I made where I made money without putting an hourly value on a unit of my time. I learned to think of my business as a system for fulfilling what I promised and collecting money from customers. This side project was a great way to cut my teeth on some business and service fundamentals.

Comment · 12 years ago
I am a one-man shop and sell software in the enterprise space. I also have competitors and while I see my product as very different, a lot of my work goes into educating my market about why.

Most of my customers are household names and they're not averse to dealing with my one-man shop. It doesn't even come up. Their staff wants my software and they work their process to buy it. That's it.

I have not had to answer any of these objections (thankfully). I'd probably pass on the customer if they came up.

Comment · 12 years ago
Re: CS Secret Handshake--years ago, I found the Programming Interviews Exposed book. I own the first edition. It's a lot of concise explanations of different Computer Science topics. The authors focus on things that are likely to come up in an interview. The book provides a few tricks and an orientation to topics that are worth looking at further.
Comment · 12 years ago
I've lived in DC for nearly five years and I run a software company here. Here are my thoughts:

1. The quality of life here is very high. I believe this is probably one of the best places in the US for young professionals (its reputation hasn't caught up with it yet).

* We have a strong bike sharing program and decent biking infrastructure. I'm not a biker and I use this most days now.

* I recently got rid of my car. I simply didn't need it. I can walk in four directions to neighborhoods with great restaurants. I also have several grocery stores within walking distance.

* The North West part of the city is very clean.

* I don't own a car. So long as I live here--I will not need a car.

* When I want to go running, Rock Creek Park is nearby. Same for the National Mall. If I want to go Kayaking on the Potomac, it's a longer walk, but I can hit a Dept. of Parks and Recreation boathouse and get a kayak.

* DC has a short-ish winter. We get one and it gets cold. Some days we get snow the city doesn't know what to do with. Overall though, January and February are the worst of it. Sometimes we get hints of Spring in March. April, Spring is usually here full bore. Spring and Fall here are beautiful. I'm from MI and I lived in Syracuse, NY. I judge weather through this lens.

2. DC is very expensive. I incorporated in DC and I suspect the city took a cue from the Spanish government in terms of forms and prerequisite forms and licenses one must acquire to start a business. They claim they're pro-startup. I don't see it. I just see a bureaucracy that nickels and dimes small businesses. Taxes are high too.

3. For my sector (cyber security) and the types of customers I have; DC is the perfect home base. I'm close to my customers and potential strategic partners. We even have a cyber security related accelerator in Northern Virginia. I see the concentration of folks and businesses in my industry as a big plus.

4. I travel a lot for my business. If I need to go to NYC--I take the Accela and I'm there in three hours. If I need to get into the suburbs of MD, I use the MARC train. If I need to fly, I have three airports to choose from. The closest airport (Reagan) is a 15-20 minute cab ride.

5. We have had a massive growth of startup and coworking spaces in the past two years. I don't know where they all came from--but it's insane. If you're looking for semi-affordable office space co-located around other startups--you'll find something here, probably walking distance from where you live.

6. DC benefits from a flood of ambitious folks who want to change the world and start their career here. When I moved here, I expected a scene of lawyers, lobbyists, politicians, and their hanger-ons. It's not like that at all here. This is a very ambitious city with people who work very hard to make things happen. I like its energy and this is probably where I will stay.

Comment · 12 years ago
Comment · 12 years ago
I run a business selling penetration testing software that I develop. It's completely bootstrapped. I do very little services work (I actively send this type of stuff to friend's companies). Right now, it's just me, although that's probably going to change. By most of my own definitions and the one you posted here... it's successful.

How did I get started on this? Sort of by accident.

I was working for Automattic after an acqui-hire thing. After a year there, I found that I missed working in security. I found a full-scope penetration testing gig three blocks from my apartment.

In my spare time, I started to tinker with a few ideas and released them as an open source project. Said project saw a lot of interest within the hacker community very quickly. I didn't expect this. Folks formed an opinion on it pretty quickly. Some people hate it. Others love it. Of those who know it, very few are in-between.

I left my pen testing job with a decent amount of money saved up. I didn't know exactly what I would go and do afterwards. I spent some time tinkering with Android, just for giggles.

I was very reluctant to start a business that used my "successful?" open source project. Partially because it leverages another open source project owned by another company.

I was at a conference in 2011 and someone from a US government agency asked if I was selling anything. I said no. He said that was too bad, because he had end of year money, and he liked my open source stuff. It was then that I decided to look at expanding my open source kit into a commercial product.

April will mark the two year anniversary of my first customer. My customers are well known organizations and they trust my software to assess how well they protect their networks. I'm constantly in awe of this.

Comment · 13 years ago
> Value gets us paid.

Working as an engineer, I'd probably pull a similar salary between a company like Apple or a high-end consulting firm. The profit per employee between these firms is drastically different though. We're not paid in proportion to the value we generate. We're paid in terms of market forces with a slight bump if our company especially values us. We don't see the upside of our efforts, the companies we work for do.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton