For a bit I considered learning web development, and doing that freelance during college, but now it appears I've drastically underestimated how much skill it takes to compete in a field over-saturated by third worlders. I'm a Finance guy and this was always a part-time thing, but I still want to double major in both Finance and Computer Science
What should I learn, is Cyber Security or Hacking worth getting into. I don't know if I should abandon computer science altogether or really delve into something like that.
There aren't any Cyber Security or Hacking threads, partially because its probably just edgy autists like me who talk about it, but why not have one.
I actually think there should be a Cyber Security general thread, there's programming/web dev/linux ones, so cyber security isn't too out of the picture.
Jordan Lewis
Yeah, that doesn't sound like a bad idea. I might do it if I get into this stuff
Jackson Sanchez
if web development is too much for you cyber security is out of the question
Aiden Perry
It's not that its too much, its that by the time I learned I'll likely already be on Wall Street and it will be useless to me.
I want a computer science based skill, and cyber security, at this point, sounds more useful. I know very little so I'm at a crossroads.
Robert Baker
it sounds like you want a hobby outside of your passion am i right?
Caleb Howard
Pretty much. Maybe something between a hobby and an actual full time profession
My passion however is politics, not Finance or Comp Sci. Comp Sci would be a skill that is hopefully both useful and a resume booster (wall street and similar places love people with double majors in business and something like comp sci or physics).
The primary goal is to make money and gain knowledge, so I can pursue my passion later on.
Michael Kelly
Ya OP Currently the cybersec world is heavily unemployed, so it is very useful to know.
Liam Turner
Underemployed*
Justin Rivera
Webdev is easy to learn, compsci & info sec are two different worlds that take up a lot of time.
Nathan Reed
>Hacking Anything that says that is a meme
>Cyber Security It's worth learning about but unless you're dedicating yourself to it don't waste too much time. It's extremely, extremely specialized and you have to be at the top of your game constantly.
Austin Williams
Any good resources / blogs for getting into infosec? I can't tell where to start.
Also read Web Hacker's Handbook. If you take Finance CompSci meaning you're doing Stochastic calculus and the like, a lot has aspects to security as a lot of modern security is done with SAT solvers and other 'higher' math
Thomas Anderson
The Finance and Comp Sci are totally unrelated, separate degrees but thanks for the pic and links, I'll definitely look into it.
Jace Hill
cybrary.it < free courses, decent for starting compsec
Hunter Brown
This, it takes more skills and time to get into cybersec then webdev
Andrew Turner
>my passion however is politics
Can already tell you're not gonna make it
Jonathan Ortiz
The problem is there are too many of these types of people Yes I know that post was intentionally ironic, but there are unironic faggots posting shit like that all the time WITHOUT the presence of a cyber security general. It would only get worse for you guys.
Charles Brooks
thanks mr shark
William Miller
>politics Let me give you a hint: most sensible programmers/developers/hackers/engineers hate political bullshit and will actively shun anyone who even thinks about pushing around such things. The tech industry values meritocracy more than anything, you can politically bullshit your way into whatever position you want but if you can't live up to your big talk you'll either get canned within a few hours or destroy an entire business and become totally hated in the industry. Political weasels don't survive very long in this line of work.
Now, if you're really serious about learning computer science just teach yourself, most universities are absolutely hopeless at CS/programming. Having a degree in something else can really help if you want to specialise.
Netsec is an okay place to start because it forces you to vivisect and understand complex systems (a skill that is applicable to many problem domains). Don't expect any career opportunities to come from it though, the netsec industry relies on desperate NEETs working for chicken tendies.
Another hint: STAY AWAY FROM FREELANCING SITES! They're a scam. If you want real business you'll have to put in a little effort. Start a blog, write about things that will make potential clients think of you as valuable, put some ads out and do your businesses in meatspace. The people who complain about third worlders stealing jobs are all mediocre brainlets who think opportunity should just fall into their laps because "I'm smarter than everyone else, I deserve money for doing nothing". Such people would rather victimize themselves instead of working hard so don't be one of those people. In this day and age there is no reason why you shouldn't be able to find local work even with only basic programming skills.
Angel White
Even worse they show up to all the conferences too making security into a joke industry full of sperging trenchcoat wearing fanboys.
If anybody is actually interested in this the sole best way is this method: and going on NoStarchPress and looking at all their latest 'hacking' books like Bootloader Malware reverse engineering or network stack hacking. Then get a job as a Jr Analyst at some big security corp (NCC group, Crowdstrike, ect) they will train you in-house on modern exploit payload packing and delivery, GPU living polymorphic malware that encrypts itself, exposure to secret nation state malware ect. It's a graduate level study in exploitation and methods so you can quit and become a contractor yourself, so can charge more money and have more free time to do independent research such as finding 0day and selling it, or publishing papers so you are actually respected instead of just scripting Metasploit modules and wearing sunglasses.
Another method is simply create your own job. Apply as a crud developer somewhere. While building CRUD or maintaining legacy code, start testing it with your own security tests (Learn how to do this by reading GrayHat Python). Read the Art of Software Security Assessment too. Search for open university calendars on automatic bug finding cs.cmu.edu/~emc/15414-s14/index.html and search Arxiv plus prominent CS journals for the latest in bug finding and program verification methods.
Do all this at your crud job. Somebody will notice the work, and promote you to 'security team lead'. Then keep reading, get all the books you can on secure software engineering best practices and keep bug testing software, buy a copy of BurpSuite and start attacking your own companies application (of course, the offline test version). Now you will be promoted to head of security, or even Chief Security Information Officer. You wear a suit to work, get paid $200k+/year, and your job is to attend IEEE conferences.
Ian Hall
Unfortunately politics is very active esp in security with all the radical libs involved in it.
Such as Bruce Leidl, he's one of the premiere experts on building secure software but his twitter feed is full of annoying politics twitter.com/bleidl?lang=en same with of course TPtacek who is a flaming liberal and never stops talking about it. So if you like politics you're getting into the right fields kek
Ethan Johnson
thanks mr shark
Jacob Parker
I don't like this pic. Though it does suggest some good books, it totally just tries to spoon feed people as if there were ONE TRUE WAY to learn this shit. What's even worse, it just wants to induce a linear sequence without a decent sense of order, and it makes a shitload of omissions. Even more, it pretty much assumes that everybody will find all these books relevant, or that everybody is interested in suck topics. And on top of that... fucking 1000 page books here and there with either irrelevant information or much too dense and technical for someone who's starting to learn. For example the Norvig book, and fucking precalculus for what at all? CS:APP is only relevant if you want to be an expert C programmer, and TAOCP isn't a [set of books] you read linearly (and if you were to do that, it'd be pretty much the only work you need for a couple years). I mean, I could do that as well, pick up a bunch of subjects that I think are relevant, pick the best books in the field, and put them all together in a pic saying "READ THIS". I mean, if he fucking puts CS:APP there and precalculus I'm in a perfect good position to make mine with: Coexter's Geometry, Polya's "How to solve it", Hacker's Delight, Starting Forth and Thinking Forth, it'd be much better in my opinion. But of course I'm not just going to shove you my favorite books and say "This is what you do"
Austin Garcia
Thanks mr shark
Josiah Butler
Holy fuck forgot to mention Number Theory. Now, with only Number Theory, Geometry, How to Solve it, and Hacker's Delight I believe I have enough of a good set of books that are entertaining and actually relevant and provide a narrow enough domain instead of trying to cover everything and failing loudly at it. I should make one such infographic really.
Aaron Gutierrez
make an Infographic already
im interested
trying to get into this shit from a rather normie perspective
help me senpai
Ethan Harris
yeah, look at google's management, it is going to be completely full of politics
James Torres
thanks mr shark
Nolan Clark
>can't even into web programming, the most babby of tech fields >wants to become a le ebin haxxor
Here comes a thought: hack your neck until your head comes off.
Aaron Gutierrez
Book series is from actual university curriculum on core courses, this is what they use, for computer science. Note: Computer Science, not programming. It's a recommended way not a 'true' way just a simple recommendation. The reason you need to do a lot of exercises as a self learner and extra chapters, is because you don't have tests or homework to do or projects given to you by professors.
That Precalc book teaches you Sigma notation/series, you're going to need that doing any kind of computer science theory. You're going to need how to do basic algebra if you're going to do Linear Algebra.
TAOCP is absolutely a set of books you can read linearly, that's why Knuth has the chapters like 1.2, 1.3, 1.4 across the series. If you don't read the first chapter in Vol. 1 on math preliminaries then you won't understand what's happening in the rest of the series, you won't understand MIX (MMIX now) either.
CS:APP is relevant if you want to learn computer hardware, like CPUs/Level3 cache/VM/ect not be an 'expert C programmer'.
Hacker's Delight 2 on the other hand is exactly a book exclusively dealing with C programming mainly tricks to manipulate the C standard so you can write efficient algorithms. It's a fun book, but not a computer science book.
TAOCP is a huge book, though I won't argue that it *can* be read linearly. But it's motherfucking dense, that, the amount of excercises, and that it provides it's own mathematical background and programming language, is why I said it's all you need for a couple years. Sigma Notation is something you can look up in wikipedia, you don't need a whole book to know sigma notation, hell, it comes in just about any book that has mathematics in it. It's fucking addition. CS:APP may teach you computer internals, but it is tooo C idyosyncratic. Petzold's CODE would be a better choice, and entertaining too (not nearly as dense). On a side note with density. The books being dense is not a virtue. It's an overwhelming of information and even if you go through all the excercises, you're just following along without context and sometimes without any interest in the subject, you'll just forget the details. Hacker's Delight is certainly not a C only book. It's a computer arithmetic book, it's more relevant that CS:APP to the average programmer. and what's more, it's entertaining. and there is no dedicated book to Number Theory even though I believe it should be (along with geometry) the actual cornerstone for a mathematical education. But that's just me.
Now I understand you meant "Computer Science", in which case... AI? Calculus? Details of computer hardware (caches, etc), Too much information is also a waste, you know? I'd go for the rock solid rather than the mountains of text. I'd drop some of those books and instead add at least a Category Theory or Type Theory, as an introduction to current trends of research in the field.
In my case, I was aiming to narrow myself to the numerical / problem solving aspects of programming/computer science (sorry if the cursing comes out as me being a sperg like some 4chen illiterates)
Gavin Jones
We've tried this a million times and it always fails.
I'm playing with Go's crypto library and having a great time.
Camden Diaz
[cont] Also Lisp in Small Pieces would be a great addition, and I didn't mention it in the context of my other replies, but The Little Schemer series. But it comes down to we both have very different opinions on what a neat curriculum would be, the one in the pic I was complaining about evidently weights more on the value of information, while mine tries to be more, say, "interactive" so that concepts can be internalized better. At this point the charts would just converge in a couple books.
Ethan Ward
what are you doing with it?
Zachary Russell
I was talking about sensible people who get shit done. Do such people really seem sensible to you? IMO people who'd rather waste time with politcal bullshit are usually somewhere on the totally useless end of the autism spectrum.
Jordan Stewart
I wrote some ransomware in it that's cross platformable between windows, linux, and OSX. It's fun stuff.
Angel Murphy
How are you going to get running on other people's computers?
Jackson Harris
Number Theory, Geometry, Category Theory, Type Theory, it's all in there lol. Harper covers Monoids, Type Theory and finite limits in sets ect. He covers current trends in research in the Parallel algorithms design book and his other book in there which attempts formalization of functional and imperative languages.
CS:APP is your typical hardware systems course that every single undergrad takes in every university. It uses C because every single OS out there still uses C (and the following books also use C as examples, like Skeina's Algorithm Design Manual) It gives you just enough understanding of assembly too so you can not only do a book like TAOCP later, but you can reverse engineer binaries, you can understand abstraction layers, and CPU branch prediction, optimization, the memory hierarchy, pipelining, floating point pitfalls ect. All of this needed if you're going to ever grok how dbms like Postegres or MemSQL works. And the best part is it's all done in x86-64 so you as the home student can practice yourself without needing access to some lab for ARM or custom VM running imaginary architecture. If you ever want to hack around a network stack, you're going to need this book too.
These aren't mountains of texts either, I did 4 of them all at once in one semester of my undergrad. Yes, we did the whole texts.
The most important subject there is Graph Theory. Because everything in "regular programming" is a graph. Git? It's a Directed Acyclic Graph. If you know what a DAG is you know git it's that simple. A network is a graph. A website is a graph. Every programming language is an Abstract Syntax Tree abstracted into a graph. The big push right now is to replace REST with GraphQL. You know Graph Theory you know GraphQL. Also, Little Schemer is covered by SICP/EoPL. Lisp in Small Pieces is also not particularly introductory or conceptual - that's a hardcore compiler optimization text.
Elijah Jackson
thanks mr shark
Grayson Ortiz
Also this curriculum was just shilled because somebody asked me what exactly they would need to replicate an undergrade in CS, not how to program but real undergrad in rigorous CS that would equal the rigor you would get in university so you could pursue such things as advanced linear algebra, HoTT, algorithm research like creating a custom graph transformation and writing a paper for it ect. It's really hard to get the same breadth without physically going somewhere and doing a ton of exams and homework/labs which challenge you on a daily basis but these books do, and were what we used so I included them.
I also showed asked our Dept Head what he thought somebody who couldn't go to school should use and he went over this list.
If anybody here just wants to learn to program, go pick up Land of Lisp or something and hack away or go to a code school/bootcamp thing
Ian Brooks
Fair enough. I still have some objections but as I said in , our goals are certainly different. I do have to say though: you really seem to misunderstand badly some of the books I mention. In particular, LiSP is not a compiler optimization book, I'd say it is rather close in scope to EoPL. I still object to Precalculus, it has no place there, certainly not for teaching addition. And I never objected to either of algorithms, graph theory or linear algebra. They are pretty much essential.
Justin Ramirez
>finance
Uh, why not pick something related? Like machine learning for stock predictions and HFT? Security and pen testing are completely unrelated to what you are doing.
Lucas Lewis
I'm not. I just wrote it for fun.
Hudson Diaz
Sometimes there's /netsec/, but my favorite is unsecured webcam threads.
Grayson Walker
Lisp In Small Pieces covers how to implement byte code compilers, macro systems, compilation to C, it's well known as a compiler text so you can make your own DSLs it contains a wealth of information on all applied aspects of implementing a lisp interpreter/compiler which you can also translate to writing functional language compilers in general. It's a good book but not sure it belongs in there as an undergrad core considering SICP introduces compilation and interpreters EoPL goes into depth, and CS:APP even further covers that area.
The precalc book is there because you will need it to do any Computer Science math. If you already know precalc, don't read it obviously. You will need it for doing operations on generated functions in discrete math like the The Derivative Rule, for understanding Lang's Algebra book, so you remember how to do square roots so that when they show you the proof that Sqrt2 is irrational as an example in Complexity Theory you understand what's going on ect.
Thomas Turner
Benis Cuckleflow
Dominic King
>I want a computer science based skill, and cyber security
You have no idea what you are doing. I guess this is the averages persons involvement with computers.
Jaxon Nguyen
what the fuck
Justin Rodriguez
mom no
Colton Ortiz
>falling for JPG malware Lol, have fun.
Jason Green
>I'm in a perfect good position to make mine with: Coexter's Geometry, Polya's "How to solve it", Hacker's Delight, Starting Forth and Thinking Forth, it'd be much better in my opinion.
THEN DO IT, and make a little text explaining WHY you chose those books
this meme book lists are really good man
Andrew Perry
would you like a website full of "how to get into" lists?
like people weighting in votes to assemble """curriculums""" for self-learning any kind of shit?
coursera.org/learn/build-a-computer Don't skip over that because you know how to 'build' a computer aka put a computer together from parts; it is a course about building a computer from literal scratch aka: starting with logic gates, not a course on how to 'build a sweet gaming rig' or something.
khanacademy.org/math/algebra (Linked to the Algebra 1 but of course start at the level you are comfortable with; I would start on a level you are actually pretty knowledgeable on but might need a 'refresher' instead of going right into a level you know nothing about, to get into the swing of things again if it's been a while)
Also I just got pic related last month, did I do good Sup Forums?
Ian Gonzalez
would learning c++ be a good precursor for cybersecurity? as opposed to other languages like python, java, pearl etc
Thomas Walker
Just learn a language, that's the bottom line. People spend FAR too much time figuring out 'what language to learn' especially for security stuff.
Once you learn a language then other languages are easy to pick up and in security you are going to have to know more then one and be able to figure out the basics ANY language quickly just by reading source code.
That being said the reason I say Python is because knowing a scripting (ie: non-compiled) language that you can bang things out in fast is a very important (pretty much essential) skill to have as well as Python being native on many systems you will be attacking.
But really just stop messing around with 'researching what language' or whatever else people always spend WAY TO MUCH TIME doing and just get going. That's another reason I said Python just because you can literally go on code-academy right now, start and be done by tomorrow (or a couple of days) instead of screwing around.
Xavier Brown
hey, not him, but is Gray Hat Python worthwile? I have that and Violent Python here, i want to start one of the two
Eli Green
is knowing networking important? stuff like, the structure of the protocols, how is data sent, etc
or does cybersecurity involve higher level stuff like monitoring with wireshark and other tools and having a good knowledge of linux?
how much do we need to know about linux? what commands and programs count as "necessary"?
Luis Turner
Violent is networks, Gray Hat is reverse engineering
Justin Stewart
kinda like the navy seals of computers. webdev is like basic training
Robert Baker
thanks mr shark
Josiah Lopez
>is knowing networking important? stuff like, the structure of the protocols, how is data sent, etc
Very. You should have at the VERY LEAST a Comptia Network+/CCENT level of knowledge (not saying you need the cert, just that it is the level of knowledge you need).
>or does cybersecurity involve higher level stuff like monitoring with wireshark and other tools and having a good knowledge of linux?
It involves this as well.
>how much do we need to know about linux?
An extremely high knowledge level of Linux is necessary.
>what commands and programs count as "necessary"?
To difficult to answer this question to be honest; do you have any specifics in mind? Do you mean what tools and such (again this depends on the mission at hand)? As said above you should have a very high skill and comfort level with Linux of all different distros.
The bottom line is that for security (I am speaking of penetration testing mostly here) you need to be a 'Jack of All Trades, Master of Many...and Able to Become a Master of the Rest When Needed'.
I hear great things about both but the one I have worked through is Black Hat Python (the same author as Grey Hat Python) which is great. I will read the other two soon though as I know they are both worthwhile. You are going to want a good base in Python before jumping into it them though (even though I believe all three cover the basics of Python you will get a lot more out of them if you cover the basics first so you can concentrate on progressing).
The answer to questions like that is usually "read them both/all" and that is something that will not change; you constantly have to be becoming the best you can possibly be. This is an industry that requires an EXTREMELY high level of skill in an HUGE amount of fields which is very daunting at first, I know. Always be progressing.
Caleb Campbell
Turning on a nick to continue answering questions. Sorry if it's annoying. I think it's fine in this situation.
the gist is learn C and a scripting language like Python or Ruby since pretty much all existing tools are written in those two languages.
you learn C because everything like operating systems is still written in it and you need to learn how C abstracts memory so you can mess with said memory when attacking a Node.js stack or something.
then you pick up NoStarchPress books on security, and watch the hackallthings vids here: Finally, go practice. Get BurpSuite and go hunting for bug bounties. Enroll in a security CTF, there's one like every month.
Gray Hat python also teaches you how to write your own security test suite, this is vital to being any kind of credible haxx0rs. If you get anything from that book, that's what you should get out of it. These suites cost tons of money and if yours is any good one day you can sell it like BurpSuite or MetaSploit ect.
Jonathan Ramirez
that's great info, good to know, thanks
>Too difficult to answer this question to be honest; do you have any specifics in mind? Do you mean what tools and such (again this depends on the mission at hand)?
yes, tools
so we should know bash scripting and a plethora of commonly used commands and other specific commands that are relevant to security, integrity, availability, etc?
should we know any type of programming? python? C? I'm guessing that we should also know database languages, js and html/xml so we can detect SQL injections, xss, etc
also, if you want to get hired, does the classic way work? (general projects on git, a decent 1-page CV, etc) or do we need something more? can it be as simple as "pass this tough interview tests and you're hired"?
Nolan Miller
>Black Hat Python looking for that one rn
>The answer to questions like that is usually "read them both/all" I will eventually, its that i was going to go for Violent before even opening this thread but i read someone mention Gray Hat here and i thought i might as well ask someone who has read it to tell me which one's more exciting
Yeah Gray Hat is kind of making me harder, i don't know a single thing it talks about in the index
Bentley Anderson
I read about the rowhammer bug and wondered, should we also know hardware engineering and OS architecture at a general level? because sometimes errors/bugs can appear at the HW layer
Thomas Barnes
>should we also know hardware engineering and OS architecture at a general level?
Yes and on more then a general level (not extreme expert or anything but beyond the basic). You should be able to understand what is going on in assembly if presented with it, how things act on the stack, how compiled languages are translated to/from assembly, etc.
This is absolutely essential for writing exploits, malware analysis, reverse engineering, etc.
This is obviously more related to the goings-on inside CPUs and how that relates to architecture and such but knowing how hardware works and how this all fits together is also something that should be in your skillset (and the nand2tetris course I linked covers that very, very well in a hands on fashion).
Again it comes down to knowing as much about computers on all levels as possible so that you can know what is happening in all situations over all platforms/systems when you come across something. It's about being able to figure things out/make things happen in a non step-by-step/formulaic environment and having the skillset/mindset to do so.
do you recommend any books about CS/cybersecurity or IT in general? or any other types of books that you consider have had a substantial positive effect on you
At a general level it would still be good to know because there's all kinds of fun things you can do like place your malware in a protected area of a drive or bootloader, so no matter how many reinstalls the victim tries they can't get rid of your malware. No Starch Press has books on this coming out soon if you check their site for Bootloader attacks ect.
You would also want to know it if going for browser bug bounties and trying to escape sand boxes. One easy method is of course exploiting the Native Development Kit in any browser plugin, that allows you to break out of the sandbox quite easily just to practice.
Security is all about learning everything there is to know about $THING and then finding ways to exploit it.
Christopher Nelson
Yup, I posted three to get people started here:
Also picture related. 2600 captcha, hah.
Blake Murphy
should i buy this or is it a meme?
Sebastian Walker
Woops, I actually didn't look up rowhammer before answering your questions. What I said still stands in general but is a more direct answer reguarding Rowhammer. I didn't realize what exactly Rowhammer entailed and how it is literally partially related to the physical construction of DRAM.
Liam Edwards
The Dragon book is mainly a theory book on parsing, specifically building parser generators. They basically expect you already know how to write a compiler and are reading it in order to learn how to optimize your compiler. It's also very out of date, badly written, and incomplete.
You still however will indeed learn a ton from reading that (huge) book and some of it has aspect to security, such as Chapter 9 when Control Flow Graphs are introduced because these days we extract those from binaries and run SAT solvers on them to find errors.
A good beginning would be to read the first version of EoPL (because the chapter about compiling via continuation passing style was removed in later versions and it's awesome) and papers on applied compiler instruction before jumping into theory scheme2006.cs.uchicago.edu/11-ghuloum.pdf
You can go on libgen.io and just search for compiler theory too, like Appel's Book which is modern yet also difficult and assumes you are well versed in SML
Matthew Evans
How easy is it to use rowhammer for anything practical? I have mucked around with similar attacks and found them very hard to use. I always assumed most hardware level attacks where only used as a topic for research papers.
