Notices by Lesley Carhart :unverified: (hacks4pancakes@infosec.exchange)

This is so damn good.

Just a warning, I am immediately blocking, and sometimes server blocking on, "stop posting about politics if you're a insert profession here" takes. Technology is politics. Education is politics. Security is politics. The people who work in these fields, and more, are intimately impacted by politics. Some peoples' lives, families, and livelihoods are in danger. It's all politics, stop content and tone policing if you're one of the few people who's currently insanely fortunate to be relatively unimpacted. It's asinine.

Anyway, stop making it everyone else’s problem to fix but yours. Your group or event is probably not diverse because it’s being made financially or logistically inaccessible, your members are making crappy assumptions about newcomers, being pretentious, or hitting on people, or you’re bad at informing other people you exist and are approachable. That usually sums it up.

(Saying this because I can’t say it to my dad, bless him. I kinda went off on how frustrated I am with astronomy groups in the area which are mostly made up of pushy, wealthy, older white guys. He asked me why I don’t join a board of one and fix it. It’s not like I already work two jobs, coach, mentor, am a toastmasters officer, speak professionally around the world, volunteer in the infosec space…)

I beg you not to be that conference / hobby group / profession that reaches out to underrepresented people and essentially blames them for not doing more free and emotional labor to make your thing more diverse.

If it’s not diverse, please look at why it’s not appealing or drawing people in, before asking the same people who constantly are asked to fix diversity through stomaching harassment and unpaid work to fix it for you.

Annual reminder that while many #cybersecurity professionals are also deeply invested and interested in privacy, sometimes the two align and sometimes they’re opposed to one another in practicality. Always be conscious of when you’re sacrificing your (and more importantly other peoples’) privacy for the sake of security, and be very careful and measured about those decisions. Lost privacy rarely comes back. Not in business, and not in society at large.

I’m worried about LastPass’ incident, but I’m equally worried about password managers of renown at all that have not recently disclosed any (data or code base) cybersecurity incidents. Any password manager is a huge, juicy target…

I’m also worried about all y’all going “lololol pEoPle UsE LasTPaSs” when getting just one person on a reputable password manager they’ll actually understand how to use is a massive, uphill battle.