Comment by souprock | Hacker News Reader

Comment by souprock | Hacker News Reader

Parent Full thread

Us low-level types don't post there.

We know the bias against defence contractors, against the south, against the non-urban parts of the USA, and so on. We know we aren't wanted around here.

The jobs can be nice though! My place is looking to hire dozens per year. We do emulators, JIT, hypervisors, stuff like valgrind, debuggers, manual disassembly, and vulnerability research. I've been here 11 years. I've worked with more than 10 different CPU architectures and more than 10 completely different OSes. I don't normally work overtime, and I get paid more if I do. I have extreme flex-time. I never have to worry about outsourcing or H1B people. I'm never expected to take work home or be on call. I get to live in a place with no state income tax, a stand-your-ground law, almost no crime, almost no traffic or commute, and houses that commonly go for $100,000 to $400,000. We're hiring in Florida, Texas, Virginia, Maryland, Georgia, South Carolina, Alabama... totally the dream for SF and NYC people I'm sure!

Email acahalan, at gmail, if this suits you. Be sure to mention this comment.

I think that's kind of needlessly confrontational and doesn't make your company look welcoming to someone who might be looking to leave SF/NYC.

That said, it's obvious to me who you work for but anyone who'd be offended won't know.

I'd love to move to Melbourne, FL to do vuln research but I'd have to convince my family to make the move first.

You're probably right. We are pretty welcoming, but on Hacker News I definitely feel like every single state we're in just gets a giant REJECT stamp from everybody. The one exception is maybe our Austin office, because Austin seems to get an honorary non-Texas label. Working for government customers also seems to earn us a giant REJECT stamp around here. Aside from this particular article, "low-level" feels like another REJECT stamp.

I happen to like all that, but I'm not the average Hacker News reader and I know it.

To convince your family about the Melbourne, FL area: you can afford 5 acres, or a house on the beach, or a commute of less than a mile, or a huge McMansion. You can surf all year long. I suspect Texas (Austin and San Antonio) and Virginia are pretty good too.

Ah, I grew up in Melbourne, FL (Palm Bay, actually).

It was pretty great. Just know that it will be horrendously muggy during the summers. I miss it though.

How could someone make them selves worth even interviewing for a job like that? I do Ruby/python and Devops with some small hobby c and Linux stuff in my free time

Follow the guide in the link. Do the Arduino stuff first; being unable to do something will drive you to learn exactly as much C and assembly as you need. Learn to write network code in C. Learn how TCP/IP works and try to do weird things, such as transmitting information with ICMP (ping) packets.

The next step (for that particular company's work) would be to actually reverse engineer some complex code and write about it on a blog.

If you want to basically guarantee yourself an interview, reverse engineer and find a vulnerability in some software, and write about it. Then apply with that information.

If you're looking for the "easier" way, just apply to DoD in Maryland or Virginia for an ultra-low-paying, but connected job that allows you to learn all this stuff on the job.

I was under the impression that a lot of stuff on an arduino was abstracted away. You mostly set gpio pins to high and low. I have a raspberry pi that can do that.

An Arduino is just a micro controller with a standard set of pinouts for easy access to peripherals. You don't have to use the IDE and high level programming language. At least for the AVR based ones you can write pure C or assembly, build it with the AVR tool chain, and upload and run it natively. I'm sure you can with ARM or Intel based Arduino clones too.

You busted me. I have never programmed with Arduino, just Atmel boards. I wrongly assumed they were similar. I guess Arduino is leaps and bounds easier.

I'll start with what you already have: There is a small value in the Ruby/Python experience. That kind of thing serves to script some of the tools, including: IDA Pro, Binja, gdb, and scons. There is also a small value in the Devops stuff I think, but Devops isn't my thing so... you mean server admin tasks? The hobby c and Linux stuff is most valuable. We write emulation in C. Most of us use Linux for everything, but we also have Windows experts who just use that.

Mixing personal projects and work and education...

Some of our people have backgrounds doing driver development and embedded system programming. An excellent background would be compiler development. We have hired people who did assembly back when that was totally normal, getting their first job around 1970. We hire some people straight out of college; Carnegie Mellon University has the best program for this. We don't actually require a degree, but most people have one, and there are a few people with the PhD. Some people have worked on cars, writing software for stuff like airbag deployment (no bugs allowed!) and infotainment stuff. We hired a former Atari 800XL game developer who was kind of famous. I had done Linux kernel development, been an embedded RTOS developer, and written the "ps" program that Linux uses. We hired a guy who wrote a TI calculator emulator. We hired a guy who got himself sued for exposing security holes in a speech at Blackhat or DEF-CON, and almost hired another person who did the same thing. (the one not hired had an awful attitude) We hired a person who wrote code to run hardware that would extract platelets from blood. Some employees have written boot loaders. A few people have done stuff with neural networks. Some have worked on radar. Some have done GPGPU and FPGA programming. We had an employee who wrote a PC demo scene boot sector (512-byte bootable screensaver) that used one of the bytes 3 ways, as data and as two distinct instructions. We have many people who participate in hacking competitions such as ShmooCon's "Ghost in the Shellcode" CTF and DEF-CON's CTF. We have people who got addicted to hand-optimizing code, vectorizing things and counting things like pipeline stalls. We have a person who worked on the JIT for an open source Nintendo emulator. We have some people with math backgrounds who take interest in automated proofs that programs will or will not do various things, and who can figure out how to automatically create program inputs to make the programs excercise various parts of the code. We hired a guy who bought his own parking meter (!!!) and then figured out how to hack into it via the pass/token thing it used. We hired a guy who hacked into a bathroom scale that had WiFi. We hired a person who did Dell's BIOS.

Yeah devops, web server admin, automation and problems developers don't want to or don't have access to deal with.

Seems like people have a lot of experience going into that field. Most of my hobby stuff isn't that interesting. I did write a mostly working chip8 emulator lol. Thanks for the info

The chip8 emulator is definitely good. That sort of thing counts. You could add a JIT. :-)

You might want to see what you can do with an interactive disassembler. Your choices are:

1. IDA Pro freeware version -- this is x86 only and kind of obsolete

2. IDA Pro demo version -- this is wonderful except that you can't save your work and it times out after about an hour

3. Hopper -- this is cheap

4. Binja (binary ninja, from Vector 35) -- mid price

Grab some firmware updates off the web, especially for things you happen to own, or some normal executables. See how well you can understand them with the interactive disassembler. You might need to decompress them; look for magic numbers that indicate compression.

Wish I could move (and ten years ago I would've in a heartbeat) but today I have too many personal ties where I am.

Thank you, though; that is a darned tempting offer.

Reply on news.ycombinator.com