> 2. Start with application security, because it's the easiest place to get your feet wet.

This is true because of the availability of targets, however, the easiest place to get your feet wet is not the same thing as the easiest discipline and people must keep that in mind. Application security is the toughest of the discipline's in my book; far tougher than netsec, oppsec, and many others because it's a world of vast diversity of solutions. It's also a world of vast diversity in attacks from SQLi to XSS, to remote unauthenticated remote code execution, to the identification of logic errors which result in the exposure of sensitive information.

Yes, I agree, and this is a good addendum to my point. I could quibble about it being the most difficult (I specialize in AppSec and I find crypto much more difficult), but you're right.

>0. Do not pursue certifications at all.

I somewhat disagree with this statement. While I agree completely that certifications do not equate to ability, education is never a bad thing.

For example, many of the SANS GIAC courses are run by industry experts that have a lot of real world experience. For example, I took the GCIH taught by John Strand (BHS) and the GCIA taught by Mike Poor (InGuardians) with material joinly developed with Judy Novak.

This may be unique for SANS courses, but I personally found combining quality education material with well vetted instructors that have real world experience to be quite useful.

It's certainly not a substitute for having real world experience, but quality education can be worthwhile.

> 2. Start with application security, because it's the easiest place to get your feet wet.

What do you mean by that(application security) ? Can you explain me? (Sorry for bad english)

Sure. There are different disciplines in information security. Application security broadly web, mobile and desktop applications. Application security is the easiest to start working with because, as another commenter said, it is ubiquitous. You can find bug bounties for most major tech companies and their application software these days, which means there is a quite a lot to practice with.

> 0. Do not pursue certifications at all.

Why not?

Because certifications mean you can read a book and pass a test, unless the certs are similar to the OSCP ones which require some hands-on activity. Working through the Web Application Hacker's Handbook or the OWASP guides is a much better use of your time. When you're interviewing, you can talk about all the success you've had working through those projects, which shows hands-on, practical knowledge.

I'd said this is pretty accurate. A lot of the guys I work with more or less took this route.