6 ms·

I just wanted to chime in quickly. I've found much of the advice given by patio11 to be plain wrong in my experience. These conversations quickly fill up with

I just wanted to chime in quickly. I've found much of the advice given by patio11 to be plain wrong in my experience. These conversations quickly fill up with Latin phrases barely copied out of wikipedia and I don't have the time or patience to discuss this with people I know nothing about. Take this as you wish, most of the stuff he says is exactly what a person looking in would THINK, but it is not the truth.

kasey_junk 11y ago
And maybe thats the difference between your experience and patio11's? He did take the time (and lots of it) to write up his advice (though if you read his earlier stuff it was much less advice and much more "here is this thing I'm doing, lets see if it works"). He also has near endless patience when discussing this stuff with others. It doesn't hurt that he is a persuasive writer, and it is a skill he has obviously and publicly worked at. I for one would love to hear an opposing viewpoint, especially if it could be as well written and the author allowed as much access as patio11 does.
tptacek 11y ago
Are you a consultant? What does your practice look like?
- sfk 11y ago
  Perhaps not like this: https://blog.sucuri.net/2009/07/matasano-com-hacked.html https://blog.sucuri.net/2009/07/matasano-com-hacked.html
  - tptacek 11y ago
    Is that supposed to be clever? "Oh yeah? Oh yeah? Well... well, your Wordpress blog got hacked once." Sick burn.
- blumkvist 11y ago
  Yes I am. I make analytics applications for sales&marketing departments. Forecasting/Simulation, Segmentation, Text analytics, etc. Typical client - establishment with 500-1000 employees. Projects are delivered to the clients as a SaaS solution, because they need maintenance. Quarterly invoices, 1 year minimum contract. Edit: more details
  - tptacek 11y ago
    Awesome. That sounds like a lucrative space to be in: presumably, everything you get asked to do is directly in the service of making companies more money, and so you can anchor your prices to the value you're providing. What part of Patrick's consulting advice doesn't ring true to you? (I spent a little over 10 years as a software engineering consultant, ending just last year when I started this new company; when the consultancy I cofounded sold, we had around 30 people on the team).
    - lawnchair_larry 11y ago
      Penetration testing is not really software engineering consulting, and security spending is about as far as you can get from anchoring pricing to value. It's closer to selling insurance, but the value is even more dubious. The exception might be in cases where a company is already spending a lot on security by doing it poorly, and you show them how to do it better. But, that is pretty much none of the market that I've seen.
      - tptacek 11y ago
        Our modal project was part of the software engineering budget of a software product company. I think you may think Matasano was more of an IT shop than it actually was. The term "penetration testing" doesn't do anyone any favors, since it means everything from "running Metasploit" (the kind of work we did not do) to "evaluating firmware". This is really neither here nor there, right; the more specialized you want to say our work does, the stronger my consulting advice gets.
    - blumkvist 11y ago

kasey_junk 11y ago

And maybe thats the difference between your experience and patio11's? He did take the time (and lots of it) to write up his advice (though if you read his earlier stuff it was much less advice and much more "here is this thing I'm doing, lets see if it works"). He also has near endless patience when discussing this stuff with others. It doesn't hurt that he is a persuasive writer, and it is a skill he has obviously and publicly worked at. I for one would love to hear an opposing viewpoint, especially if it could be as well written and the author allowed as much access as patio11 does.

tptacek 11y ago

Are you a consultant? What does your practice look like?

sfk 11y ago
Perhaps not like this: https://blog.sucuri.net/2009/07/matasano-com-hacked.html https://blog.sucuri.net/2009/07/matasano-com-hacked.html
- tptacek 11y ago
  Is that supposed to be clever? "Oh yeah? Oh yeah? Well... well, your Wordpress blog got hacked once." Sick burn.
blumkvist 11y ago
Yes I am. I make analytics applications for sales&marketing departments. Forecasting/Simulation, Segmentation, Text analytics, etc. Typical client - establishment with 500-1000 employees. Projects are delivered to the clients as a SaaS solution, because they need maintenance. Quarterly invoices, 1 year minimum contract. Edit: more details
- tptacek 11y ago
  Awesome. That sounds like a lucrative space to be in: presumably, everything you get asked to do is directly in the service of making companies more money, and so you can anchor your prices to the value you're providing. What part of Patrick's consulting advice doesn't ring true to you? (I spent a little over 10 years as a software engineering consultant, ending just last year when I started this new company; when the consultancy I cofounded sold, we had around 30 people on the team).
  - lawnchair_larry 11y ago
    Penetration testing is not really software engineering consulting, and security spending is about as far as you can get from anchoring pricing to value. It's closer to selling insurance, but the value is even more dubious. The exception might be in cases where a company is already spending a lot on security by doing it poorly, and you show them how to do it better. But, that is pretty much none of the market that I've seen.
    - tptacek 11y ago
      Our modal project was part of the software engineering budget of a software product company. I think you may think Matasano was more of an IT shop than it actually was. The term "penetration testing" doesn't do anyone any favors, since it means everything from "running Metasploit" (the kind of work we did not do) to "evaluating firmware". This is really neither here nor there, right; the more specialized you want to say our work does, the stronger my consulting advice gets.
  - blumkvist 11y ago