Posts

How I went from an overengineered Docker + Tilt.dev setup to just running Hugo directly, and why sometimes simpler is better.

You probably won’t be interested in this article, so feel free to scroll on. :) I’m about to write a boring, possibly lengthy story about my current challenges in brand building. I’d like to better introduce GoSecNinja OÜ and the Curious Minds Collective. This surely won’t be an important lesson for you. Whenever I show someone my personal website, where I’ll publish this article first, this is one of the first questions I get: How did you create it? ...

In my latest post, I discussed a potential pricing strategy and related services. Links are provided at the end of the post. Now, it’s time to communicate this. Sounds simple, right? Well, it’s not as straightforward as it seems. Before we make any assumptions, what I’m about to discuss may be particularly useful for associations of fewer than five people, but it can also serve as a reference for larger companies. ...

As I embark on the task of creating landing pages to showcase my service and pricing, I’m exploring a few cost-effective and time-efficient solutions. These include ready-made templates and website builders that require minimal coding. However, while these options are relatively quick and cheap, they still demand a certain amount of time and effort. This brings to mind the first law of pretotyping (yes, pre, not prototyping): How can you try out something with the least amount of resources? Creating a landing page is not exactly that… But more on this in another post. ...

In a previous article, I shared my biggest failure in cybersecurity. If you’re curious about the article, you can read it here: My biggest failure in cyber security. In short, it was about our lack of awareness regarding secret management and how, as an information security professional, I failed to impart this even to my own family. However, I overlooked the fact that it might not even be necessary. Believe me, it’s quite challenging for me to write about why one doesn’t need to deal with password management, considering it’s partly what I do for a living - helping others secure their valuables. But still, I will give it a try with the help of the Observability pattern. ...

I recently received a reminder from a service I use that my next annual subscription installment is due soon. (Of course, when I first wrote this thought and when it was published are completely different questions.) This reminded me of my biggest failure in cybersecurity, which I had to endure. Throughout my career, I have faced numerous difficulties and failures, but I managed to overcome them. For example, when I wrote a web application firewall rule, instead of the expected mass catches, we only had one-off catches. Or when the software I wrote caused a kernel panic. Of course, it wasn’t my fault. On a certain version of a certain operating system, if a certain application was installed and a certain request was sent…, then indeed, the system would crash, and it affected more than 200 servers. (These stories are also worth telling. :)) ...

After I presented an internal training session about proxy chains and how we could solve the issue when bad actors visit our sites through trusted sources, I received a feedback note: “It’s unbelievable how quickly you become an expert in anything you delve into. You should give a lecture on this sometime.” Now, I try to reveal my secret. I love to see the world as Lego boxes. :) We have never invented anything new, but we have found many clever ways to use it. When it comes to the digital world, we like to come up with new and catchy things. This is partly because we genuinely created something new in concept and partly because it’s a bit of marketing. Do you know the saying? If you want to be successful, be the first! And how else could you be the first, if not by inventing a new category or perhaps a concept… or even a new abbreviation? ...

In my previous post, I mentioned that I was preparing for BSides Transylvania. This was my first trip alone to a foreign country where I didn’t speak the language, to a city I had never visited before. It involved a private corporate setup I had not used in this form before, leaving me uncertain about what expenses I could claim. It was an event that had never been organized before, where I had only online acquaintances, not in-person friends. Yet, the purpose was exactly that: to meet the community in person and make friends. I hope I can now call the community members my friends. :) ...

Not so long ago, I saw on LinkedIn that one of my acquaintances, Klaus, posted about an event called BSides Transylvania. Don’t worry, we’re not going to visit Dracula. But I think he could tell us a lot about security techniques. Just imagine an old castle where the master of manipulation and persuasion is surrounded by young students willing to learn about Social Engineering. He teaches them how to identify potential targets and find out where they live, how to find out what they are interested in, and how to get into their place without notice. And the end, how to suck out their blo… I mean data as proof of a successful test. ...

In my previous posts, I discussed the concept of the metagame - the game about the game. And how my blog post itself is part of this metagame. But then, what is the game? This is a great question. What is your game? Have you realized that you’re participating in a game whose rules were never explained to you? In fact, very few even guess its essence. And among them, I too do not understand most of it. ...