JohnsNotHere

So, any #infosec folk here have experience with the new OSAI course? I'm looking for thoughts and opinions before I spend some time and money upgrading my skills.

@jerry@infosec.exchange A modern funding pitch I see.

Never doubt your worth, and don't let anyone else dictate what it is or diminish your value in yourself. Find allies to validate your thoughts, but first and foremost stay true to yourself.

I'm not going to lie, there are days I miss working with coworkers or just having close friends I can talk to about work stuff. I do have my wife, but she's off visiting family, and I'm not going to bug her. Ah well, I'm old enough to know I can wait a few days, but reality is a bitch sometimes and some things can't be shared on the wider Internet.

To be fair, I'm looking at this stuff form a pentesters perspective, not a corporate security perspective, so my use case is different and I'm not installing agents on my client's machines. Also this is just one part of the process, I don't take any vulnerability scanners results as the final word, but it does help speed things up if it's accurate. When stuff is missed, I have to do a deeper dive with manual checks, which just takes time that I don't always have.

Remember, Joey is not an addict. #hackers

Looking at my electric bill, I'm also using significantly less energy with this heat pump than I was with my AC. I understand that the bill will be higher in the winter due to the increased usage, but my gas bill will be lower too, so it's a bit of a wash. Honestly, I'll take the savings as is. I won't say that heat pump is great for everyone, but for me I'm feeling good about my particular choice. Oh yeah, and for my fellow Canadians, fuck Reliance.

@marcotietz@infosec.exchange Yeah, he started strong but faded fast. Not going to move forward because of it. Lots of talented drywallers around, so I'm not worried.

Don't blink first. That's the rule. Wait it out and trust your instincts.

I had a general contractor admit to me that he completely forgot about my request because he had other jobs on the go. Nothing major, just some roof flashing that needed to be repaired and some drywall on my garage ceiling that had some water damage from the rain due to the flashing. He couldn't find a roofing contractor willing to quote the job because it was too small. So I found my own roofer to fix it, and now he wants to do the drywall, but can't get to me until August because he's busy with his other 2 clients. No quote yet either. I may just find someone else because my faith in him is not high. I understand being busy, and I've had my share of dropping the ball on prospects, but this is something else entirely. Not a great sense of professionalism. Not a young guy either, he's older, likely past or close to retirement, but apparently still wants to run the business. Whatever. I'm looking elsewher I think.

Man there are gatekeepers everywhere. I'm part of a few vCISO groups, joined back when I offered vCISO services (it didn't work out, but that's a longer story). One of these groups had a meetup in a nearby city, so I decided to go. This was last year, but it still bothers me. I knew only a few folks, but it was essentially a giant group of strangers for me. I did meet some folks, but the one big thing I noticed was the cliques and established barriers to conversations with other people. When I said I ran a pentesting company, it was if I was a leper. "Oh, how interesting!", then getting ignored and the group closing off. It was such a group of elitists who were staying with their former CISOs hanging out acting like they saved the world. I get it, I'm just part of that world, but I did spend a few years as a CSO for a company and spent a fair amount of time doing the hard work before I started my company. Don't get me wrong, I also met a few very kind folks who I still stay in contact with, but that was the minority in a group of posers. This isn't the community I embraced nearly 20 years ago. I understand that executives think different and CISO gigs are hard, but if you're selling fractional services or vCISO, I would have thought having more contacts would be better. But no. I no longer participate with these groups. I don't try to sell my services to members, but in the past I would reach out if someone asked. It was good for the most part, and I have one vCISO who I've worked well with for a few years now. It just sucks to see the "larger, more famous" former CISOs acting like their the new prom king/queen and ice people out. Sorry, feeling ranty today.