OpenSSL security exploit

[ocabj]

http://lists.grok.org.uk/pipermail/full-disclosure/2012-April/086585.html

The core of the issue is integer errors (casting from unsigned long to signed int) which can result in memory corruption (and heap overflow exploits).

You guys should definitely recompile the latest source. 1.0.1a was released this morning.

[Deadbolt]

kinda a big deal. Good of you to spread this word sir

[ocabj]

We spent a time last night recompiling OpenSSL on a bunch of Solaris boxes. Particularly anything that handled financials (credit card processing, etc) and used OpenSSL libraries/binaries.

[atto]

ocabj, how/when did you get started in your line of work?

I live in Riverside Co. and I'm majoring in CS, but I can't find any entry level positions to get my foot in. I'm scared of graduating and not having any on-the-job experience.

I'm thinking of packing up and moving to Ventura Co. Craigslist shows lots of IT jobs popping up there.

[ocabj]

ocabj, how/when did you get started in your line of work?

I live in Riverside Co. and I'm majoring in CS, but I can't find any entry level positions to get my foot in. I'm scared of graduating and not having any on-the-job experience.

I'm thinking of packing up and moving to Ventura Co. Craigslist shows lots of IT jobs popping up there.

Excellent question. I also majored in Comp Sci (and got my degree in CS).

I honestly think CS was not the ideal field for me to get into. The reason why I chose CS when I was applying to colleges is because I had no idea what I wanted to do, yet 'computers' seemed like the thing to do for me.

Anyway, during my Freshman year in college I stumbled across the notion of working in computer labs as a student employee who assisted other students using the computer labs. I parlayed that to a full time staff position as a local/departmental systems administrator (and moved on from there to doing campus wide security work) when I graduated.

During my tenure in my original dept on campus, I was constantly interviewing students because we hired students for part-time "lab consultant" positions (every quarter). I can't tell you how many times we had an applicant come in for a Lab Consultant job and they were a "Senior" (4th/5th year) with one more quarter left. We would ask them, "Why are you applying for a part-time job as a Lab Consultant when you have one quarter left?" and they said they needed "job experience". Looking at their resume, they had little to none. We would never hire those students because it would be a disservice for us (we would only have that person for 1 quarter) and a disservice for them (they should really be applying for real full time jobs in the outside world instead of applying for a part-time student job).

This is the failing point for a lot of college students, no matter what major they are in. Lots of kids simply focus on the academics and recreation while in college. Very few actually think about getting valid work experience until it's too late.

To be frank and honest, I could have majored in Art History or Comparative Literature and still be doing what I'm doing now in the field of IT and Security. Most of my skills that I use now I acquired outside of my college classes. Granted, going through a challenging Computer Science program *did* hone my abilities for programming and analytical thinking. But did I really need a Computer Science degree for that?

That said, what do you want to do? Are you focused on software engineering? Do you like application development? If so, are you into enterprise scale applications or are you looking to get into mobile application development? Do you want to get into embedded systems and bridge software and hardware? Do you want to focus on Systems Administration? Network Administration? Database Administration?

If you know what you want, definitely try to find work as a student, whether it's paid or an unpaid internship, that is in that field. If you want to get into embedded systems, defense contractors like Boeing and Lockheed still take on student interns to work on projects. Back in the late 90s, a college buddy of mine worked on the guidance software for drones for a big name defense contractor (and last time I checked, he works on encrypted communication protocols for a telecomm). One of the students that used to work for me as a sysadmin just recently got an internship with Qualcomm working on embedded systems (he's Computer Engineering major but wants to work on both software and hardware design) while he finishes his Master's.

If you're beyond that point and are very close to graduating and are actively looking for post-college employment, I suggest checking into bigger companies (such as Boeing). While these companies aren't doing as well as they used to be, they still have active projects and do a lot of different things that cover the gamut for applying a Comp Sci degree/background.

Working at higher ed as staff is one way to go, but I warn you that if you work at a college full time for more than 6-7 years, you're probably committed to working their for life. That's not to say you can't make the jump to private sector, it's just more difficult in that you have spent so much time "losing" income that you would have made in the private sector in an equivalent position (but your service credit in the University's retirement program has offset it). I'm pretty much committed to the UC system. I've got 11 years in so the disparity between what I made in previous years compared to private sector is resting in my retirement/pension credits (and 403b).

But higher ed institutions have lots of IT related jobs and depending on the college, lots of application development jobs (if they develop in-house). So definitely consider looking into the academic sector for relevant job openings. Lots of colleges have temporary/contract positions (such as a database administrator) that last for a year, too.

[ocabj]

But reiterating the whole working as a student, during my 4-years in college, I was working as a student in the computer labs for 3 years and a quarter, as a basic "lab consultant" (helping students with using the labs) for about a year, and then the last couple of years running a computer lab (maintaining and administering the lab e.g. imaging, domain server administration, supervising the lab and it's employees). So while it's not the greatest work, I *did* come out with 3+ years of relevant IT experience when I graduated.

[atto]

Thank you so much for your reply.

I am actually in my first semester of college and I, too, chose CS as my major because I "like computers". I really do, but I'm not entirely sure which area I want to focus on just yet because they all seem interesting, to varying degrees.

At the moment, being a system administrator (with strong Linux knowledge) is what I see myself doing. I'm doing my General Ed at my local CC, and then I will transfer to CSU CI for a BS in IT and minor in CS, or vice versa... haven't decided which.

Seeing as how I'm a sapling in college it shouldn't be too hard to get a position like that, since I have enough time before graduating. I saw a Web Development position but the only way to get it was to apply and get approved for Work Study through financial aid.

I'm going to get in touch with IT faculty to see if they can help me out. I started the semester with some easy classes and I have all A's. Maybe that will let them know I'm serious and will finally allow me to get my foot in the door.

Edit: If you don't mind me asking though, how do you see the (private) IT sector in Riverside Co. shaping up? I check Craigslist daily and the jobs are few and far between, while Ventura Co. has at least a dozen jobs posted everyday.

[ocabj]

Edit: If you don't mind me asking though, how do you see the (private) IT sector in Riverside Co. shaping up? I check Craigslist daily and the jobs are few and far between, while Ventura Co. has at least a dozen jobs posted everyday.

I'm not too in tune with IT in the area, but it appears to be pretty tough in Riverside considering all the applicants we get whenever we post a job opening.

There are city/county IT jobs every now and then (e.g. courts), so that's an option.

All of the medical institutions are outsourcing. For example, Kaiser used to have a huge IT staff, but they downsized most of them and outsource.

If I were to target private sector companies/business/firms in Riverside for IT type jobs, I'd look at law and financial firms. While smaller/medium businesses will outsource IT, law firms typically have hired, in-house full time IT staff, however small, since they will need to do their own background checks considering IT has so much access to client data.

It's not surprising you see more postings in Ventura due to their closer proximity to Los Angeles. More businesses and companies out there.

As far as getting an IT/sysadmin job/internship, the CS major will help you out. While I honestly feel I could have majored in Humanities and still be doing what I do now, I do feel that the CS major/degree does garner more respect (peers and management). If you can demonstrate decent programming skills, those hiring for a sysadmin job are more likely to favor you. That's pretty much how we are when we hire students for student positions. If we know you can program C, C++, or some other relevant object oriented language, we have faith you can problem solve in IT related duties.

[orchard]

I wouldn't judge jobs by Craigslist - many HR departments won't post openings there.

Try simplyhired, or Dice is all tech jobs. You can get experienceworking for a contract company doing moves and projects, may be a good fit timewise as they want people weekends and/or evenings.

Good luck!

[Deadbolt]

great advice so far. Here's something else - in lieu of being able to find meaningful entry level or even intern level work - do something. Domains are cheap and ideas are free. A lot of what "CS" majors do ( at least state side ) is conceptual stuff. Try to find simple solutions that you can implement cheaply that solves some problem or nuisance. The more local you think the better. You can grow reputation locally and if your tool becomes ubiquitous locally (like EdHat.com for some locales) - whether or not its "your million dollar idea" - it will at least demonstrate your capability to solve problems "people never knew they had"

Good luck and stay positive and never be satisfied for "doing things quickly" rather than "correctly"

[steadyrock]

great advice so far. Here's something else - in lieu of being able to find meaningful entry level or even intern level work - do something. Domains are cheap and ideas are free. A lot of what "CS" majors do ( at least state side ) is conceptual stuff. Try to find simple solutions that you can implement cheaply that solves some problem or nuisance. The more local you think the better. You can grow reputation locally and if your tool becomes ubiquitous locally (like EdHat.com for some locales) - whether or not its "your million dollar idea" - it will at least demonstrate your capability to solve problems "people never knew they had"

Good luck and stay positive and never be satisfied for "doing things quickly" rather than "correctly"

^^This is great advice. It shows that you are creative and have drive, and opens up a lot of networking opportunities as people try out and adopt your widget. Plus, idle hands and all that.

But when you do get a job, do it well and then do things that aren't in your job description, and do them well too. Employers love it when they see that someone can take on an area unfamiliar to them, and do a good job of getting something done with it. Plus as you get further down the track, it's good to have had experience in a lot of areas - the life of a specialist is a short one. Professionally, I have been a systems administrator, a software engineer, a test engineer, a QA/regulatory affairs manager and now I am head of IT security and I will probably be taking on something else new this year in addition. Branching out is the name of the game if you're looking for growth, but you have to balance that with appropriate levels of depth so you know what you're talking about.

[Deadbolt]

I disagree regarding the Specialist comment.

A more appropriate one would be "the lifespan of a particular specialization can be a short one"

The more you are exposed to the dizzying array of technologies, niches and desires of the end users ( whomever they may be ) you will find yourself gravitating towards one facet of that ecocycle or another.

For me its the web and related programming. Specializing in a conceptual / encompassing domain of tech is the Golden Egg; being a knowledge leader in a field comprised of many solutions to a question. Specializing in one platform or staunchly working in only 1 language however; is fools gold