Notes
Quick thoughts, links, and pictures. RSS
I work in pre-sales in cybersecurity. I want to just throw out some advice if you are buying software. I will have a few of these over time, so these are just a few items off the top of my head. This will help you have a good experience in your buying.
- Have a real project. This seems obvious, but I regularly talk to folks that tell me they want to have demos and do POCs and then don't have any real project or budget. This is infuriating for the seller team, but more importantly, it's a waste of your time. Make sure you have a real project.
- If you decide to POC a product, have success criteria for what you're going to actually test. This is the simplest way to make sure you're capturing real value from the product and comparing different vendors in the market.
- RFIs are only marginally useful. Understand that sales teams are incentivized to say yes to everything in an RFI up front, with the expectation of clarifying capabilities as you go along.
- Make sure you understand what you really want out of a product. There are a lot of cool features in products, but if, on the other end, it doesn't solve the real business problem you have, you're just wasting money.
- This is selfish for me, but don't be a jerk to the sales teams. I get it; we can be persistent and annoying in trying to get you to talk to just us, but once we're in the process of working with you on a deal, understand we're human and we didn't build the product. No product is perfect. I talk to lovely people all the time, but occasionally there are some dudes out there that have a real axe to grind. I'll put on a happy face because I want to get paid, but know that it only makes life harder and can cost you discounts on the backside if you're a real jerk.
- Have a real project. This seems obvious, but I regularly talk to folks that tell me they want to have demos and do POCs and then don't have any real project or budget. This is infuriating for the seller team, but more importantly, it's a waste of your time. Make sure you have a real project.
- If you decide to POC a product, have success criteria for what you're going to actually test. This is the simplest way to make sure you're capturing real value from the product and comparing different vendors in the market.
- RFIs are only marginally useful. Understand that sales teams are incentivized to say yes to everything in an RFI up front, with the expectation of clarifying capabilities as you go along.
- Make sure you understand what you really want out of a product. There are a lot of cool features in products, but if, on the other end, it doesn't solve the real business problem you have, you're just wasting money.
- This is selfish for me, but don't be a jerk to the sales teams. I get it; we can be persistent and annoying in trying to get you to talk to just us, but once we're in the process of working with you on a deal, understand we're human and we didn't build the product. No product is perfect. I talk to lovely people all the time, but occasionally there are some dudes out there that have a real axe to grind. I'll put on a happy face because I want to get paid, but know that it only makes life harder and can cost you discounts on the backside if you're a real jerk.
I take the middle ground on this position. AI companies should be doing more traditional security, and security pros often overestimate their abilities here. There are a lot of very smart people who understand core security very well, and just because they don’t carry the badge as everyday security pros doesn’t mean they are ignorant.

x.com
David Shapiro (L/0) (@DaveShapi) on X
If you want to understand why I stepped back from AI discourse, the Dwarkesh virality is archetypal of everything wrong with it.
Actual cyber security experts have classified the OpenAI and Hugging Face incident as an epic security facepalm.
These morons literally just let it keep going. They d…
When my son first started reading, I made the decision to buy him any reasonable book he asked for. One time at a bookstore, I leaned over to him and said, “I won’t buy you a toy every time you ask, but I’ll buy you a book.” He smiled, and he’s taken me up on it ever since.
I won’t share his reading scores, but suffice it to say he’s reading well above grade level.
I won’t share his reading scores, but suffice it to say he’s reading well above grade level.
Image set1 image · open to inspect
You can disagree with someone and still be civil. You can find someone's views on a matter objectionable and still acknowledge when they make meaningful arguments or impacts in a field. It's not necessary to go after someone endlessly when you've raised your objection.
Your argument is either compelling or isn't, but mobbing a person won't change the quality of your argument. We should treat people the way we want to be treated even in the midst of disagreement.
I have lost respect for many a colleague in this field who held "right" views simply because they were jerks in the process. How you disagree matters.
Your argument is either compelling or isn't, but mobbing a person won't change the quality of your argument. We should treat people the way we want to be treated even in the midst of disagreement.
I have lost respect for many a colleague in this field who held "right" views simply because they were jerks in the process. How you disagree matters.
Image set1 image · open to inspect
Cub Scouts starts back up again this week. We had our first time back after the summer.
Tonight we set up stations and had the kids walk through them in their dens. My wife and I did a first aid station.
Each student built their own first aid kit, which is one of the 6 requirements they have. It was a great success, and the kids were super engaged and got to take home a first aid kit of their own.
Tonight we set up stations and had the kids walk through them in their dens. My wife and I did a first aid station.
Each student built their own first aid kit, which is one of the 6 requirements they have. It was a great success, and the kids were super engaged and got to take home a first aid kit of their own.
Image set2 images · open to inspect
My son wants to try deer hunting this year. We decided, on the advice of a family member, to go with the .350 Legend to extend hunting season a little longer. It falls under the same time as muzzleloaders since it's a straight-wall cartridge.
For the rifle, I went with the CVA Scout 350 Legend in stainless.
We also went with the VX-Freedom 3-9x40 Hunt-Plex glass.
We will see how this goes.
https://www.tn.gov/twra/hunting/tennessee-hunting-seasons-summary.html
For the rifle, I went with the CVA Scout 350 Legend in stainless.
We also went with the VX-Freedom 3-9x40 Hunt-Plex glass.
We will see how this goes.
https://www.tn.gov/twra/hunting/tennessee-hunting-seasons-summary.html
Image set3 images · open to inspect


