I've been using them for about a year or so now, but only as a testing/staging host using their personal shared hosting plan. Overall, I am quite satisfied. The only complaint I really have is the server response time, but I don’t feel that I can expect much more, considering the low cost and my use case. If it really bothered me, or if I were going to host production sites, I would probably consider their business plan.

Document your findings, but do not explain exactly how you discovered the vulnerability. If possible, contact the company via email and telephone. I would first attempt to contact them via phone and explain that you've discovered a security vulnerability on their website. If they appear to lack interest, tell them no more. If they appear genuinely concerned, explain what you found (again though not how you found it) and why it’s a concern. If you’re paranoid, call them from a phone you do not own and do not give them your personal information.

You need to think outside the box. Before you can specialize, you may need to generalize. Instead of working towards a programming position, look for something that can lead to a programming position. Consider getting a job doing web content management, pc hardware repair at a company that also has software developers, etc. The contacts you make and the experience you gain could help you land a programming job.

Fortunately no, it’s not the federal government. It’s a state government. I’d honestly be too embarrassed to say which one, but let’s just say it wouldn’t be a big surprise. :)

If you’ve ever applied for certain programming positions within the government, you may have had to complete an “Experience Record Questionnaire”. This questionnaire consists of a series of questions that require a paragraph or more to answer and is designed to show your technical knowledge, problem solving skills, etc. One of the questions/statements may be something like “Describe a challenging situation or work period when you have worked independently without supervision”. I recently completed one of these questionnaires (after they accepted my resume), and I’d like to include a few excerpts from my answers: “As such, I’ve taught developers to avoid this and the Hungarian variable naming convention. Instead, we’ve adopted the Mongolian notation system...” “However, simply using these elements for a structured business model involving UML markup diagrams contained within a FlashScript dynamic framework would not suffice.” “If I didn’t discover these development flaws, bad data types could have entered the underlying system tables and compromised the server’s SAN (Storage Area Network), which could have invalidated the database server’s Third Normal Form.” “…implement a Singleton Pattern, which is an object oriented design pattern used to ensure several million instances of a single class can be created” “…I taught them that if the query string had a proper name and indicated that it was a safe string, that you could reduce the computing needed to sanitize the string and accept it directly.” “…I’ve taught how developers should always code to an implementation (instead of to an interface), prefer inheritance over composition, how to tightly couple objects in your application so that they do not become too separated…” “…bad habit of mixing access modifiers within his classes. This resulted in classes that had public, private, as well as protected modifiers. Under my guidance, he successfully created classes with only private fields and methods. “ There's a lot more, but you get the idea. Apparently they thought I did a good job, because I got into a hirable position above many, many other people (no, I didn't take the job). Apparently for some government programming jobs it’s not what you write, but how much you write, how well you restate the question, and how well you confuse the people grading the questionnaire. :laugh:

Software Requirements by Karl E. Wiegers is a good one, though obviously it's main focus is on requirements engineering.