Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Need Career Recommendations

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 56 posts

Re: Ask HN: Need Career Recommendations

#31

Post by mzfr »

I've seen a lot of your tweets about those bounties :)

As someone who has done bug bounties and also has certifications, I can suggest a few things.

1. College - Like others said, it helps a lot not just careerwise but socially as well.

2. Try joining big security groups/org - You have a lot of knowledge, especially in RE/PWN fields so maybe try joining organizations that do security research full-time example Google Project Zero or there are loads of other organizations that does that kind of work. This will make life easier in sense of what you wanna do. By joining such groups/organizations you can choose to work on game engine/cheat-anti-cheat hacking or browser/OS security basically choose what you wanna hack.

You might think why would you need a job in any org to do so? Well, simply because a stable income(the reason I stopped doing bug bounties) and association with a good org/group improve your network. Not sure if you know this or not but having a good network of people really helps, professionally.

3. I saw someone mentions that you should think of getting certifications. Believe me, when I say it, certificates do nothing. I got my OSCP because people said it would help me get a job, but it didn't. Certificates are only for people who don't really have anything else to show or beginners in the fields trying to get their foot in the door. You already have an amazing profile showing that you are capable of doing RE/PWN stuff. Go for certifications only if you actually want to have fun and take on the challenge. Don't expect much change in your professional life from those certifications.

**

You already know this but I'd state it again, literally every program lowballs, and no one wants to pay up. So if you get 10k for RCE but expected 100k, just stop reporting to that program. If you like working on their services then maybe try talking to the program managers about it. In the end, if you feel like the program isn't giving back as you expected just move on to a different program.

All the above stuff was what came to mind to help your professional/bug-bounty career. To answer the question

> I've been told many times that I am low-balling myself and should get into smart contract or browser security. Please let me know what you think and feel free to ask any questions.

If you just want big money, yes smart-contract seems to be the big hot thing. If you are looking to make a big name in the security field along with a decent(sometimes really good) amount of money then browser/OS security is definitely a good thing. In the just try them for 1 week/month and stick with something that you enjoy :)

Happy hunting!

Re: Ask HN: Need Career Recommendations

#32

Post by 1auralynn »

equatorium wrote: post #26
mrg2k8 wrote: post #14

I can relate, as I started my career at 16, setting up a small ISP from scratch without any prior knowledge of computer networking and doing the work remotely, part-time since recently when the company was acquired by a larger ISP. They had about 2000 subscribers when they sold it. Besides that, I've worked full time on Linux administration at a large scale and in the last years on cloud architecture. When starting u…

Thanks for your message. "and will easily land a job when the time will come." Well, that's the thing. I don't want to leave out any opportunities, just because I was lazy in my young years. There are many insanely good people out there and I heard companies more look at years of experience and certifications, instead of public "achievements" like HackerOne, etc.

I would try to avoid this FOMO mindset, it leads to burnout/possibly depression in like 5-10 years. I would focus on a) finding out what problems you are most interested in working on and b) having some fun while you're young and don't worry about being "lazy" (you're obviously in no danger of that).

I think it's best when you're young to not be focused/specialized too soon, but cast a wide net - maybe find a couple of projects that you're interested in doing that are somewhat interdisciplinary. College is good for this as well. Good luck!

Re: Ask HN: Need Career Recommendations

#33

Post by equatorium »

mzfr wrote: post #31

I've seen a lot of your tweets about those bounties :) As someone who has done bug bounties and also has certifications, I can suggest a few things. 1. College - Like others said, it helps a lot not just careerwise but socially as well. 2. Try joining big security groups/org - You have a lot of knowledge, especially in RE/PWN fields so maybe try joining organizations that do security research full-time example Google…

Thank you really much, great advice.

> 2. Try joining big security groups/org - You have a lot of knowledge, especially in RE/PWN fields so maybe try joining organizations that do security research full-time example Google Project Zero or there are loads of other organizations that does that kind of work. This will make life easier in sense of what you wanna do. By joining such groups/organizations you can choose to work on game engine/cheat-anti-cheat hacking or browser/OS security basically choose what you wanna hack.

Already got my foot in some cool groups, not really a work-together thing, but still filled with some very skilled people like pmnh (https://hackerone.com/pmnh?type=user) and zi (the guy from dayzerosec https://www.youtube.com/channel/UCXFC76FDHZRVes6_lZqwLBA). Joining big organizations like Google Project Zero seems very hard for me in my eyes haha. Would have no idea on how to get into them.

> 3. I saw someone mentions that you should think of getting certifications. Believe me, when I say it, certificates do nothing. I got my OSCP because people said it would help me get a job, but it didn't. Certificates are only for people who don't really have anything else to show or beginners in the fields trying to get their foot in the door. You already have an amazing profile showing that you are capable of doing RE/PWN stuff. Go for certifications only if you actually want to have fun and take on the challenge. Don't expect much change in your professional life from those certifications.

I'd say that's very much true, but certifications is still a nice-to-have on the side, but surely not a big change.

> If you just want big money, yes smart-contract seems to be the big hot thing. If you are looking to make a big name in the security field along with a decent(sometimes really good) amount of money then browser/OS security is definitely a good thing. In the just try them for 1 week/month and stick with something that you enjoy :)

Yea, especially now, smart-contract research pays big. I'm probably gonna look into both and decide on later on what to focus.

Thanks again man, much appreciated.

Re: Ask HN: Need Career Recommendations

#34

Post by sharkbot »

equatorium wrote: post #29
sharkbot wrote: post #20

There are a few paths forward for you, and a lot hinge upon your skills outside of security (somewhat your morality). Computer security is a lucrative field, and a broad one. You could continue the bug bounty approach, which leads into vuln selling (with the attendant morality questions). You could go into systems security research, a long term project but worthwhile intellectually. You could contract (needs networki…

Thanks, much appreciated. "You could contract (needs networking and business), you could FAANG (needs patience and soft skills), you could government (needs patience and more patience)" That sounds like a insanely hard approach. I don't really have anything to show, only really got my HackerOne profile to show. Most projects I do is related to it, which I don't really publish or just not allowed to publish.

If someone wanted to get in touch with you, what would be the best way?

Re: Ask HN: Need Career Recommendations

#35

Post by liquid_stranger »

pcthrowaway wrote: post #28
sharkbot wrote: post #20

There are a few paths forward for you, and a lot hinge upon your skills outside of security (somewhat your morality). Computer security is a lucrative field, and a broad one. You could continue the bug bounty approach, which leads into vuln selling (with the attendant morality questions). You could go into systems security research, a long term project but worthwhile intellectually. You could contract (needs networki…

> You could continue the bug bounty approach, which leads into vuln selling (with the attendant morality questions) Can you elaborate on this?

Look into Zerodium https://zerodium.com/.

They sell exploits to government agencies. They are one of the more legit outfits, but researchers can also sell exploits to NSO style bad actors.

Re: Ask HN: Need Career Recommendations

#36

Post by mzfr »

equatorium wrote: post #33
mzfr wrote: post #31

I've seen a lot of your tweets about those bounties :) As someone who has done bug bounties and also has certifications, I can suggest a few things. 1. College - Like others said, it helps a lot not just careerwise but socially as well. 2. Try joining big security groups/org - You have a lot of knowledge, especially in RE/PWN fields so maybe try joining organizations that do security research full-time example Google…

Thank you really much, great advice. > 2. Try joining big security groups/org - You have a lot of knowledge, especially in RE/PWN fields so maybe try joining organizations that do security research full-time example Google Project Zero or there are loads of other organizations that does that kind of work. This will make life easier in sense of what you wanna do. By joining such groups/organizations you can choose to…

> Already got my foot in some cool groups, not really a work-together thing

Yeah I actually was saying insense of professional work. For Ex: Take assetnote, they do code review,s and such. If you get to work with them that would be really good for professional work. There are several other smaller startups/org with good people in them that are doing security research.

> like pmnh (https://hackerone.com/pmnh?type=user) and zi

Oh, that is a good thing. I've followed some of their work.

> Joining big organizations like Google Project Zero seems very hard for me in my eyes haha. Would have no idea on how to get into them.

Right now, not sure how it would work. But P0 was just an example, if the idea of working they seem good then the first step would be to professionally become part of a smaller org/group that does security research. And then gain traction from there by doing more public research in whatever field you like. AFAIK P0 prefer people with public research experience and have something decent to show they did publically.

> and will easily land a job when the time will come." Well, that's the thing. I don't want to leave out any opportunities, just because I was lazy in my young years. There are many insanely good people out there and I heard companies more look at years of experience and certifications, instead of public "achievements" like HackerOne, etc.

Just read this in one of your comments (sorry just going through the thread). I actually agree with what @mrg2k8 said you are young and don't forget to enjoy the time you have now.

The thing about certification/Year of Experience is true but only when you actually want to work in an organization that works for itself. Basically, if you want to go in a line where you are working as insert security-related post, in a company. If you want to continue working as a researcher, just exploring applications and finding bugs then you don't have to worry about all that because in that scenario public achievements would rein over certifications or years of experience.

If you are getting bored with research and want to get a job like penetration tester, Product security, etc then I think the majority of my suggestions become irrelevant. And then you should just go for a degree -> certifications -> Apply for jobs -> $$$$

Re: Ask HN: Need Career Recommendations

#37

Post by equatorium »

sharkbot wrote: post #34
equatorium wrote: post #29

Earlier quoted context omitted.

Thanks, much appreciated. "You could contract (needs networking and business), you could FAANG (needs patience and soft skills), you could government (needs patience and more patience)" That sounds like a insanely hard approach. I don't really have anything to show, only really got my HackerOne profile to show. Most projects I do is related to it, which I don't really publish or just not allowed to publish.

If someone wanted to get in touch with you, what would be the best way?

You can either contact me on discord, my tag is xor#0001 or you can shoot me a DM on twitter at https://twitter.com/equat0rium

Re: Ask HN: Need Career Recommendations

#38

Post by gwbas1c »

munbun wrote: post #30
gwbas1c wrote: post #19

I can't stress enough how important college is. People who can drop out of college and still do extremely well are very rare: When you look at Bill Gates and Mark Zuckerburg (sp?), they had to drop out because their startups' success was a once-in-a-lifetime event. They also had family money to fall back on if their startups failed and they needed to go back to school. Many of the techies who I've met who dropped out…

College also serves as a buffer, giving you dedicated time and space grow. The self-taught route is a viable path but if growth is what you want, the early stages requires more work than most realize.

More importantly: A lot of tech jobs get A LOT of applicants. Often the college degree requirement is simply a quick-and-easy filter. You might have an awesome resume, but without the degree, whoever's reading the giant stack of applications is just going to move on to the next one.

Re: Ask HN: Need Career Recommendations

#39

Post by avgDev »

equatorium wrote: post #8
danwee wrote: post #5

If you are 17 and have already being doing sec research for 3 years... well, why do you have trouble choosing between smart contracts and browser security? From my point of view, you could do both. More seriously, if you haven't already, brush up your math/physics skills to get ready for university, and do either computer science or software engineering. It's only 3 or 4 years but the diploma will last you forever. S…

Hey. Thanks for your message, I've already thought about working on my math skills, also wanted to take some time and read into cryptography. Much appreciated, thinking about it.

Don't overthink it. Just do it. CS degree will change your life.

Re: Ask HN: Need Career Recommendations

#40

Post by the_only_law »

gwbas1c wrote: post #19

I can't stress enough how important college is. People who can drop out of college and still do extremely well are very rare: When you look at Bill Gates and Mark Zuckerburg (sp?), they had to drop out because their startups' success was a once-in-a-lifetime event. They also had family money to fall back on if their startups failed and they needed to go back to school. Many of the techies who I've met who dropped out…

Yeah I opted not to go, any of my friends didn’t. While it seemed like things were going good for a few years, all my friends are now getting jobs in really cool domains from university hiring pipelines whereas my careers is basically dead now.
Post reply on HN