CleverLikeAnOx

Putting effort into being obscure is often misplaced and adds a recurring cost in cognitive overhead. Furthermore, it creates a false sense of security when people think that something is unlikely to be exploited simply because an attacker doesn't know how to exploit it. So I agree with your sentiment in many ways.

However, I read your comment to imply that the author lost credibility with their take on security through obscurity. This seems like the exact kind of harmful binary thinking the article addresses. The author presents a more nuanced take on a mantra, and for daring to do so, you dismiss them.

I had not considered a link between being against binary thinking and political-style management. Thank you for writing it, because I found it very thought provoking.

Another way to look at it is that the author isn't attacking concreteness. Instead, the author is taking generalizations and adding context for why that generalization exists. This helps identify when the generalization applies and when it does not.

Completely agree. All of the incentives are wrong for security rating companies.

Rating vendors are incentivized to have a rating for every company regardless of whether or not they have any insight.

Rating vendors cannot act like real attackers, so they must rely on passively collecting some surface level information. This is often no better than you would get by walking through a website with Burp on and checking the list of alerts.

You can pay rating vendors to help you "improve." That is to say, they are incentivized not to fix false assessment data. They can get you to pay for that.

A lot of comments are dismissing this because it doesn't provide a credential upon completion. But you don't get mad at a hammer for not putting staples in paper, nor get mad at a stapler for not putting nails in wood. This is a tool that gives empowers you to educate yourself, not a tool that gives you a credential.

As someone with a deep love of learning and knowledge, I am delighted that this exists.

How does one preemptively cancel oneself?

This resonates with me. A heuristic that often leads to success is learning the rules of our systems, both written and unwritten. Over-reliance on this heuristic shackles one to imagined limits. Many of the perceived "rules" can be broken.

As an example, many people assume you need to go to a top school to get a top job. But after several years working, that perceived boundary that so many are so hung up on seems like a joke to me.

I find it beautiful in part because I have a high tolerance for ambiguity and I enjoy loose association. The wheat section was my favorite. For me, it evokes a feeling of discontent about knowing highly abstract concepts without knowing the basics. Like, she knows about fairytales, but she doesn't know how to make bread. But it's not really about bread; separating the wheat from the chaff seems to be more about determining what is important in life. And everyone else here probably has a different take on this section.

It is thoughtfully ambiguous. It's thought provoking in part because it is unclear. You, as the reader, are an active participant in giving it meaning. What makes it "well done" is that many readers succeed in giving it meaning they find insightful or entertaining.

It is fertile soil for your imagination.

In my experience the hacker usually gives you the exploit for free, but asks for a bounty. Aggressive ones may say that you should pay them with the implication that they may name and shame you if you don't.

Others will only agree to share the exploit if you pay, but I have always assumed that it is a scam or a really lame vulnerability.

What is an EEE? I am having trouble determining the meaning from context and I am having trouble searching for it.

What is an EEE? I am having trouble determining the meaning from context and I am having trouble searching for it.

I thoroughly enjoyed "Clean Architecture." I engage with all of Uncle Bob's work in an adversarial manner: he is trying to convince me that he is right and I am playing devil's advocate. This helped me gain insight from his work, develop my own thoughts on architecture, and avoid getting too caught up in doing things the "one true way."

I think the 3.5% number is not for low risk investing. Additionally, you would need to make something more like 5.5% to account for inflation. Still a fairly conservative number for investments in equities.

There is an idea called FIRE (Financial Independence / Retire Early). The first half is having enough money to not need to earn again, so you are not dependent on work or others. Once this is achieved, then you can retire early if you would like.

The conventional wisdom in this community is that if you invest a sum of money in equities, you can withdraw a certain percentage annually without ever running out of money. That is, you mostly live off of the growth of your investments. Generally, 4% (inflation adjusted) is considered a safe withdraw rate. So if you have a million dollars, and you can live off of 40K a year or less indefinitely, then you can retire.

Obviously this is a simplification and there are more considerations. Let me know if you have any questions. This is a topic I am passionate about and happy to give my 2 cents on.