6 ms·

Depending on what stage you are in life you could be a lot like me. I'm slowly but surely losing faith in a lot of things that I took for granted. I'm a compu

Depending on what stage you are in life you could be a lot like me. I'm slowly but surely losing faith in a lot of things that I took for granted. I'm a computer security enthusiast and it really is depressing sometimes the direction things are going. So...I have deleted most of my online accounts and starting to work on being more independent. I lost my internet connection for two weekends in a row and it was a little surprising how much it effected how I live at home. Yes I could used my cell phone for the essentials like email but for everything else everything I had set up was useless. I would recommend trying to get a physical hobby where you could create something physical. It could be carpentry, blacksmithing, hunting/ fishing, etc. The point would be to get away from tech industry for short periods of time. I think the reason a lot of older people find it harder to keep a dependable career is because their values start to change. When you are young you are willing to burn the candle at both ends to build a career and get established. When you are older you sometimes don't want to spend your entire waking day working to keep up with the Jones' or maintaining your career.

chelmzy 8y ago
Can I ask what you're losing faith in? I've just joined the infosec workforce but it's been a hobby of mine for awhile(22 y/o). I've already become jaded and bitter at this industry. I just see the industry being pillaged by profiteers at a detriment to the health of the industry.
- hluska 8y ago
  I'm not the person you're replying to, but I'm 41 and understand the notion of losing faith in the security world. I'm not losing faith with the profiteers because, if I look back at my career with open, honest eyes, I can see points where I was a profiteer and a detriment to the industry as a whole. Instead, I'm losing faith because it seems like the attacks keep getting more sophisticated, yet it's getting harder to operate as a white hat. I can't count how many times in the last year that I have suggested that researchers be incredibly careful about how they report bugs or if they should even report at all. Nor can I can count how many stories I've heard where white hats submit really juicy bugs, only to be screwed over on bounties, threatened with prosecution under the CFAA, or otherwise maligned. I can't believe that I can truthfully say this, but I feel like we have reached a point where being a white hat is too much trouble for too few potential rewards.
- Rjevski 8y ago
  My problem with security is that attacks get more and more advanced but users are just as clueless as ever, so we’re headed towards doom.
  - eaandkw 8y ago
    I think it would be more accurate to say that users are fatigued and worn out. Password fatigue is a thing. The updated password guidelines from NIST are a good start. Or the users are negligent rather than clueless. Look at the DNC hacks of Podesta.
    - Rjevski 8y ago
      Password fatigue is easily mitigated by password managers. The issue is that users are too stupid and don't care to spend the time/money to do things the right way, and instead keep on reusing the same password everywhere.
      - magduf 8y ago
        No, claiming password managers will solve everything is rather clueless. Password manager don't work across multiple systems. How am I supposed to log into some website from my work computer when the password is on the password manager on my home computer? Or what about my cellphone? (And no, my IT department would not allow me to install a password manager that syncs.) In a typical workday, I use 4 different computers, plus several VMs and other work accounts, all with their own passwords. Password managers aren't possible on my work computers and VMs. I reuse passwords as much possible.
- eaandkw 8y ago
  To quote a tweet from Brian Krebs, "Being in infosec for so long takes its toll. I've come to the conclusion that if you give a data point to a company, they will eventually sell it, leak it, lose it or get hacked and relieved of it. There really don't seem to be any exceptions, and it gets depressing." [1] Sometimes I feel like to only way to win is to not play the game. I believe that is another quote from the movie Wargames. [1] https://twitter.com/briankrebs/status/1045091640480804864 https://twitter.com/briankrebs/status/1045091640480804864
  - elliekelly 8y ago
    Or perhaps we can change the rules of the game? It's noteworthy that he doesn't consider the possibility that a company delete/destroy the data. As it stands now, its a no-brainer for companies to save as much information as they can about a person because there's almost no down side. The risk of a data breach to the individual(s) far exceeds the risk of a breach to the corporation. The incentives are massively misaligned. I'm cautiously optimistic that GDPR (with all of it's many flaws) could mark the beginning of slow a transition from corporate data hoarding to minimalism. You heard it here first: Corporate KonMari Consultant will be the trendy Gen Z career.
    - eaandkw 8y ago
      I doubt that Brian Krebs hasn't considered that. He works in information security and I would assume he is not on any corporate boards. I would however agree that even though I am not normally in favor a regulations this would be a good place to have something similar to the GDPR. There should be a balance between data being an asset vs. a liability. Right now it is only viewed as an asset so there isn't enough emphasis on security.
      - elliekelly 8y ago
        Apologies for the confusion. I simply meant that particular quote hadn't contemplated destruction. And with good reason, there's virtually no incentive for businesses to destroy data they collect. I'm certain he has given quite a lot of thought to data destruction as it relates to data security. I was trying to point out that it was conspicuously absent in his tweet.
badpun 8y ago
> When you are older you sometimes don't want to spend your entire waking day working to keep up with the Jones' or maintaining your career. And that is IMO the main reason for agism in our industry. Software jobs are incredibly demanding and draining in the long term, people (let's say) after 40 know that very well and, from what I've seen, they're often looking for a job that will let them coast at least a little bit. Also, they are already at the max of their earnings, so they have little reason to try harder. At the same time, people in their twenties are working super-hard to prove themselves and get the promotions that will get them into the top salary bracket. If I were running a business, I'd sure choose younger people over older ones. What can people over 40 do? The best strategy is to show that you're not just interested in coasting - either learn the newest technologies, do some opensource etc. Anything to show that you're not burned out yet.
- eaandkw 8y ago
  I agree. It may not be a perfect example but look at professional sports. Even boxing or MMA. A young fighter is hungry and doing everything they can to be on top. The older experienced fighter can fight just as hard but they could burn out or get injured. So they have to train and fight smarter and use their experience as an example. At some point the experienced fighter loses their edge and they lose the fight or they decide to retire and hang up their gloves.

chelmzy 8y ago

Can I ask what you're losing faith in? I've just joined the infosec workforce but it's been a hobby of mine for awhile(22 y/o). I've already become jaded and bitter at this industry. I just see the industry being pillaged by profiteers at a detriment to the health of the industry.

hluska 8y ago
I'm not the person you're replying to, but I'm 41 and understand the notion of losing faith in the security world. I'm not losing faith with the profiteers because, if I look back at my career with open, honest eyes, I can see points where I was a profiteer and a detriment to the industry as a whole. Instead, I'm losing faith because it seems like the attacks keep getting more sophisticated, yet it's getting harder to operate as a white hat. I can't count how many times in the last year that I have suggested that researchers be incredibly careful about how they report bugs or if they should even report at all. Nor can I can count how many stories I've heard where white hats submit really juicy bugs, only to be screwed over on bounties, threatened with prosecution under the CFAA, or otherwise maligned. I can't believe that I can truthfully say this, but I feel like we have reached a point where being a white hat is too much trouble for too few potential rewards.
Rjevski 8y ago
My problem with security is that attacks get more and more advanced but users are just as clueless as ever, so we’re headed towards doom.
- eaandkw 8y ago
  I think it would be more accurate to say that users are fatigued and worn out. Password fatigue is a thing. The updated password guidelines from NIST are a good start. Or the users are negligent rather than clueless. Look at the DNC hacks of Podesta.
  - Rjevski 8y ago
    Password fatigue is easily mitigated by password managers. The issue is that users are too stupid and don't care to spend the time/money to do things the right way, and instead keep on reusing the same password everywhere.
    - magduf 8y ago
      No, claiming password managers will solve everything is rather clueless. Password manager don't work across multiple systems. How am I supposed to log into some website from my work computer when the password is on the password manager on my home computer? Or what about my cellphone? (And no, my IT department would not allow me to install a password manager that syncs.) In a typical workday, I use 4 different computers, plus several VMs and other work accounts, all with their own passwords. Password managers aren't possible on my work computers and VMs. I reuse passwords as much possible.
eaandkw 8y ago
To quote a tweet from Brian Krebs, "Being in infosec for so long takes its toll. I've come to the conclusion that if you give a data point to a company, they will eventually sell it, leak it, lose it or get hacked and relieved of it. There really don't seem to be any exceptions, and it gets depressing." [1] Sometimes I feel like to only way to win is to not play the game. I believe that is another quote from the movie Wargames. [1] https://twitter.com/briankrebs/status/1045091640480804864 https://twitter.com/briankrebs/status/1045091640480804864
- elliekelly 8y ago
  Or perhaps we can change the rules of the game? It's noteworthy that he doesn't consider the possibility that a company delete/destroy the data. As it stands now, its a no-brainer for companies to save as much information as they can about a person because there's almost no down side. The risk of a data breach to the individual(s) far exceeds the risk of a breach to the corporation. The incentives are massively misaligned. I'm cautiously optimistic that GDPR (with all of it's many flaws) could mark the beginning of slow a transition from corporate data hoarding to minimalism. You heard it here first: Corporate KonMari Consultant will be the trendy Gen Z career.
  - eaandkw 8y ago
    I doubt that Brian Krebs hasn't considered that. He works in information security and I would assume he is not on any corporate boards. I would however agree that even though I am not normally in favor a regulations this would be a good place to have something similar to the GDPR. There should be a balance between data being an asset vs. a liability. Right now it is only viewed as an asset so there isn't enough emphasis on security.
    - elliekelly 8y ago
      Apologies for the confusion. I simply meant that particular quote hadn't contemplated destruction. And with good reason, there's virtually no incentive for businesses to destroy data they collect. I'm certain he has given quite a lot of thought to data destruction as it relates to data security. I was trying to point out that it was conspicuously absent in his tweet.

badpun 8y ago

> When you are older you sometimes don't want to spend your entire waking day working to keep up with the Jones' or maintaining your career. And that is IMO the main reason for agism in our industry. Software jobs are incredibly demanding and draining in the long term, people (let's say) after 40 know that very well and, from what I've seen, they're often looking for a job that will let them coast at least a little bit. Also, they are already at the max of their earnings, so they have little reason to try harder. At the same time, people in their twenties are working super-hard to prove themselves and get the promotions that will get them into the top salary bracket. If I were running a business, I'd sure choose younger people over older ones. What can people over 40 do? The best strategy is to show that you're not just interested in coasting - either learn the newest technologies, do some opensource etc. Anything to show that you're not burned out yet.

eaandkw 8y ago
I agree. It may not be a perfect example but look at professional sports. Even boxing or MMA. A young fighter is hungry and doing everything they can to be on top. The older experienced fighter can fight just as hard but they could burn out or get injured. So they have to train and fight smarter and use their experience as an example. At some point the experienced fighter loses their edge and they lose the fight or they decide to retire and hang up their gloves.