This thread from ~yr ago was a turning point for me. Not because the harassment stopped, but because I finally no longer dealt with all this bs predominantly alone. As illogical & irrational as it is, I think I felt shame every time I received one of these messages. 1/x
*I* must have been doing something wrong, *I* must have been less than if all these people took the effort to say these things to me. If colleagues weren’t dealing with this, then *I* must be the problem. I’m *drama*. These were the quiet thoughts. 2/x
And while each time I came out of it knowing those thoughts were incorrect, it was exhausting & took capacity to process the messages and get to that point. Capacity & energy I would have much preferred to spend elsewhere...like maybe my actual work. 3/x
I recently re-read @BreneBrown ‘s “The Gifts of Imperfection” for the first time in many years & that’s when I finally realized what was going on and what changed. She says “Shame can’t survive being spoken. It craves secrecy, silence, & judgement” 4/x
Last August, I was in a good place & thus when I received those messages, I got angry instead of sad. (Ya anger takes strength for me 🤷🏽♀️) So I voiced it, knowing others were likely experiencing it too. Unexpectedly, I found a weight lifted off my shoulders. 5/x
Your kind messages mattered. My teammates & leads showed up. I got everything I didn’t know I actually needed. I learned that when it really hits a nerve, I don’t need to handle it alone. I can rely on other people to tell me it’s bullshit & needing/wanting that isn't “weak”. 6/x
But it turns out it rarely started hitting a nerve. Despite the msgs continuing, the shame & the energy requirements became less & less. So I guess this to say: if you’re in the position, voice it--to 20k of your closest friends & trolls or just to your person--it can help. 7/x
Don’t go about it alone. I’m happy to be that for you too if you need someone. 💕 And folks who aren’t dealing with this shit, call it out. It truly does matter. Whether it’s 1:1 to your work colleague or writing a reply to a tweet. We see it, hear it, & it matters. 8/8
PS Highly recommend "The Gifts of Imperfection" by @BreneBrown
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Along with many others in infosec, I've always cautioned against any of the voice activated smart gadgets, largely thinking there's only marginal benefit for the risks of an always-on microphone.
Recovering from surgery with only one usable arm has completely changed my views.1/
Using voice control, which has required turning on the mics on my phone and home mini, has made my quality of life substantially better and even prevented physical pain. 2/
2 days post-op I was staying at family's house & had gone for a nap. I woke up & was completely tangled in the velcro straps from the sling and ice pack. Hair & a pillowcase were involved in the velcro nightmare too. 3/
Can't believe I'm voluntarily wading into this, but here we go.
When you share those full details, that's when I drop everything & get to work (and I usually pull in my teammates too 💁🏽♀️). It's not just another cool vuln, it's something being used to harm. 1/6
As an example, here's how I approach it as soon as the details are out:
-understand the root cause & exploit method
-think of potential detection methods & talk to the folks who can implement them if it's not us 2/6
-find variants that the attackers either already have (and may even be using) or could easily switch to and try to get them fixed at the same time as the original bug
-brainstorm fixes, mitigations, system improvements & share them 3/6
Dondi is a proud #HBCU graduate & attended @aamuedu, earning a B.S. in Math w a focus in Applied Stats, & as an ugrad student, published research in regression analysis & number theory. As a student, Dondi went everywhere w his TI-82 graphing calculator, which he still has.
I’m really fucking tired. On average, about every week I receive some message about how I’m “unskilled”, “P0’s biggest mistake”, “not technical”. And about every other month one of these messages is posted very publicly or emailed to my managers. 1/7
This is nothing new since I first was an intern. It’s damn clear that the comments are bullshit. That the people taking the time to send me these msgs or create the anonymous accounts are telling a lot more about themselves than about me. But it’s still exhausting. 2/7
If you’re getting these messages too, it’s not about you. I’ve quite literally done everything these folks asked: I’ve done novel research at every level between a die on a CPU and applications. I have the CVEs. Large volumes of my work are publicly available...and yet. 3/7
Lately, I've been watching talks from pre-2010. There's so much important infosec work/history out there, but you need to know what to look for.
What are some of your favorite talks, blogs, events, etc from 2012 or before that you'd recommend to those newer to the industry?
For my "learning Windows" adventure, these have been awesome
* Analyzing local privilege escalations in win32k - @mxatone (2008)
* Kernel exploitation – r0 to r3 transitions via KeUserModeCallback -@j00ru (2010)
* Kernel Attacks through User-Mode Callbacks - @kernelpool (BH 2011)
I had a conversation today w a man who manages a security team. For me, tbqh this convo was pretty upsetting, but I do think he was coming from a sincere place so hopefully this helps someone else who is also coming from a good place, but is just getting it wrong. THREAD.
The man was chatting about hiring. He said his team is only men, but he gets other women he knows in the industry to come to recruiting events w him because women are much more interested when they see another women there & don’t tend to come up to his booth when it’s just him.
I said, yes, of course. When we see another woman or someone like us on the team, it at least means we won’t be alone. I told him I thought it was false advertising to use other women in this way in order to recruit.