Chris

Months ago, pre-CV, my bosses helped me phrase a thing about myself: that I'm good at finding edge cases, which makes me great at testing and security, and crap at work relations sometimes. (This is not doom; I freely own this.)

At some point pre-CV, we at work were supposed to sign a new version of the handbook. In it was a phrase like: "$company does not condone retaliation based on reports made in good faith."

Me: "...what if they're made in bad faith?"

So I asked our HR folk. I went through three different HR folk and ended up on a call with one of them because they had no idea what I was asking about.

In retrospect, I'm more concerned that there are at least three different HR folk who aren't used to autistic testers... 👀

My coworker in sysops has a nephew who just graduated high school and is interested in cybersecurity, and he asked me what I'd recommend. I write it down here so that I don't forget for later.

Note: This is my take. Others have their takes.

There are many different aspects to cybersecurity. Some of them: risk and compliance, security operations, application security, ethical hacking/bug bounty hunting, pentesting (code, networks, social situations)... probably more that I'm forgetting. Start by exploring those aspects to see which one appeals the most. Or ones; no one said you have to pick only one forever.

Whichever path you choose, definitely learn the surrounding environment as well. For example, we at work might be called on to help engineering stand up a set of load balancers. We'll be way more effective at securing that if we know anything about load balancers and how they work. For another example, application security means knowing about OOP principles would be super useful. You don't have to be a full-blown expert, but the more you know about what you're securing, the better you'll be.

If the path is computer-focused, try taking a security-focused certification path for a specific system, such as the security training path laid out in Cloud Guru for AWS. Most security-path system-specific trainings will involve the basics of how the system itself works, which is useful.

Having soft skills is essential. The weakest link in every system is the human involved. Learning how to communicate effectively so that the layfolk understand what the problem is and how to not perpetuate it is a very important skill to have.

Another useful skill is to develop a security mindset. What are ways that something could be compromised? Go through the steps to secure your own devices: where did you draw your own lines between security and availability? What are some things you do today for security, even basic things, and how could they be subverted? Or improved upon?

Reassurance time: If you go whole hog on one path, then change your mind at any point, it's all fine. I know one person who became an actual lawyer, who then gave that up to become a developer. I know another person who was halfway through their psychology degree, who then switched it up to be a film music major. It's all good.


In conclusion, cybersecurity will only be more important as time goes by, until there's a nuclear winter, at which point we'll all have different priorities anyhow. Hooray!

For the new year, spend some time going through your known online accounts and password manager¹ and close out accounts you don't need or use anymore.

If you can't find easy instructions for closing or canceling your account, try checking out AccountKiller. If they don't know the service, you can submit some basic details and they'll look into it.

1: Surely you're using a password manager, yes?

"It's like my skin is a bottom and its kink is being scratched."
--me, describing my quasi-seasonal allergies

It was in my head, and now it is in your head.

At work, we’re setting up dashboards for vulnerability metrics across a couple different kinds of areas. For servers, one dashboard each; for office workstations, one roll-up dashboard for all of them.

Every time I woke up last night, I felt like I’d made a single office dashboard, and I had to go back to sleep to incorporate it into the roll-up dashboard.

My brain on being sick, i suppose?

(Context: I go by "Ina" and Rose goes by "Zo" for parent-names for Kit. Josh remains "Daddy".)

I've been trying to teach Kit about the link between "I want a thing" and saying “please”. I'm currently eating potato chips, and Kit reached out for one in that I-want way.

Me: "What do you say when you want something?"
Kit, after a pause: "i-a" ("Ina")
Me: "OKAY HAVE ALL THE CHIPS"

I'm watching DS9 S7E23, "Extreme Measures".

( Spoilers, probably. )

nano doesn't come with highlighting on macOS, unless I'm dramatically missing something. So, notes for myself for later:

Source links:

* https://stackoverflow.com/questions/9642617/nano-syntax-highlighting-in-mac-os-x-10-7-lion
* https://github.com/scopatz/nanorc

Steps:

1. Download a .zip file of the repo here.


2. Extract all files from the .zip file.


3. In Terminal, run: mkdir /usr/local/share/nano


4. In Terminal, run: mv ~/Downloads/nanorc-master/*.nanorc /usr/local/share/nano/


5. In Terminal, run: nano ~/.nanorc


6. Add a line like this, for whichever language you want:
   include "/usr/local/share/nano/python.nanorc"


7. Save your file.


8. Quit out of Terminal and reopen to use the shininess.

Note: Apparently nano for the Mac doesn't recognize the header keyword on line 4 of the .nanorc files. You'll have to comment that out with a #. (For more nerdy shit on that, go here.)

A poem. TW: description of child abuse in the middle of it.

( 'Good Bones' by Maggie Smith )