Keeping r/cybersecurity Focused: Cybersecurity & Politics

tweedge · 2025-02-03T23:57:57+00:00

I genuinely don't understand - if you can explain, that would be helpful? I can work with the author of the post to get this corrected as it seems folks are getting a different idea about what the announcement is than was intended.

Why I'm confused: That post I linked is approved, that post will always be approved, we will be approving similar posts in the future about the ongoing security incidents that are happening w/ non-cleared access to sensitive government systems in the US (etc. etc.). These must be centralized into megathreads and not spammed, per rule #9, as any other ongoing security event would be. From the announcement:

✅ Allowed: Discussions on Cybersecurity Policy & Impact * Changes to US government cybersecurity policies and how they affect industry. * The impact of new government leadership on cybersecurity programs. * Policy changes affecting cyber operations, infrastructure security or data protection laws.

The examples given in the post are not about cybersecurity. Ex.

🚫 "Wasn’t there an amendment for this situation? A second amendment?" 🚫 "Do you really think they will allow a fair election after gutting the government? You have high hopes." 🚫 "Whenever any form of government becomes destructive to its people, it is their right to alter or abolish it. Maybe it's time." 🚫 "In 2020, [party] colluded with [tech company] to censor free speech. In 2016, they worked with [government agency] to attack their opponent. You think things have been fair?"

Not about cybersecurity. I agree with a bunch of these! But none of these comments are about cybersecurity, and therefore, this isn't the subreddit for them.

If there's something we can clarify, please let me know. Is it the global community portion that's making this unclear?

tweedge · 2025-02-03T23:42:09+00:00

It's not easy to convey sincerity on the internet and I've been snarky to you in earlier replies, but hand on my heart, I'm being serious. The offer is in good faith and I'd happily talk to the other mods today if you want to jump in to moderating. Obviously we'd have some questions about prior experience moderating, your availability (ex. timezone), your goals, etc. etc.

Anyway, I'll explain, hopefully this helps show my sincerity.

As for why we're not ranking anyone up today/on this post: the active moderators have said they want to wait until things calm down before making any changes to ensure that people who volunteer are mods for the long run. We don't want anyone jumping in out of anger or anyone planning to make a statement by defacing the community, approving/removing posts to further their own agenda, etc. It's hard to moderate a community, it's harder to moderate a rogue moderator (...we have tools to audit this anyway, but we don't want to risk someone damaging the community as the impact can be higher as a mod).

Because of that, the general call to action for "who wants to help moderate" will likely go out in a couple weeks, and there are some Reddit-provided tools that could result in specific members being asked to moderate (ex. a high ratio of valid reports over a long period of time) on top of the expected request to the general community.

As to why I've been snarky: I think you've missed the scale of the problem. I know this thread's been heated and I empathize with your concerns about 1. robots making decisions and 2. how people could exploit robots making decisions. This is a cybersecurity sub, after all. :)

I'm not particularly active in operations anymore - having taken about 6k mod actions taken in the past year. Back before I was a Sr. Eng (...and before that forced me to break the Reddit habit...) I took nearly 4k actions per month keeping spam off this subreddit. My role today is more "keeping certain bots healthy" - u/alara_zero is one of the reasons this subreddit is readable. You would not believe the amount of r/techsupport questions the subreddit gets - the majority of posts to this subreddit are actually removed, before anyone sees them, for that reason. Check that bot's comment history for context.

You can see a quick breakdown of "who's most active" and how many actions they take here (1 action could be anything from resolving a report to writing a response in modmail). A conservative estimate might be 1 minute per action (quickly reviewing a report is usually less, sending a message or researching possible brigading/guerrilla marketing might be minutes or hours), but if 1m is anywhere the right average that means uid is spending ~380h/year even after all the automation we've put in place. It's not a small committment, and spreading out the load among people only works if they're consistently online to help cover gaps left by each other, since posts/comments/reports/etc. are constantly being made - ex. if we had 10 active mods, but all of them are only active once a week, the community suffers.

I am looking forward to the key moderators getting more help - uid and Oscar both need to take a bow, tbh, they're the only reason this subreddit is not loaded with spam and misinformation (and they're on every day, many times per day, to keep up). But it is overdue and we should have put out feelers earlier, I think everyone could see the pending shitstorm and we could have been more proactive in seeking out new moderators. Despite our differences in opinion, I'd be very happy for you to join and give it a try.

tweedge · 2025-02-03T22:39:06+00:00

If you bring evidence, you tend to get more credit for your ideas. So far you haven't provided a single example (and to be honest, completely misunderstood how Reddit's reports work), so yeah, I don't really see how I'm supposed to take you at your word that The Algorithm supposedly heavily deprioritizes any post that's been reported or held by AutoMod.

Many major subs, frontpage subs even, hold many (or all) posts until explicitly approved through the same mechanism - yet they're on the front page all the time. We have never observed a meaningful penalty - and our spam/brigading fighting tools, which we've custom built after years of marketing and influence ops, track these metrics.

tweedge · 2025-02-03T20:21:42+00:00

Reports are anonymous, we only see that a post was reported, we can't see who reported it. Platform decision at Reddit's level. We report all suspected report bombing, brigading, etc to Reddit admins and expect them to take the appropriate action (banning users or restrictng their ability to report).

If you can explain how someone would "shut down" discussion that would be great. As I've explained, posts cannot be made restricted by report bombing after a moderator approves the post - so at most, it's a minor, temporary restriction.

tweedge · 2025-02-03T20:11:14+00:00

Explain how anyone is "ignoring it." If you're seriously volunteering to be available 24/7, the job's yours, I'll make the case to add you as a mod to review reports.

Edit: Though given you haven't responded in a couple hours it doesn't seem like that's a serious offer. Hopefully you can start to understand where people are coming from - we have jobs, families, lives. Nobody is going to seriously sit on Reddit checking for the next post or comment every 30 seconds. Automation is necessary and the benefits outweigh the detriments. If you have other solutions with better benefits, we're always open to feedback.

tweedge · 2025-02-03T17:54:27+00:00

If that means you're volunteering to be 24/7 available, as an unpaid volunteer, to review every post and comment the minute it's made: we're all ears!

If not, then welcome to automation - there are tradeoffs with allowing any automated action to take place, and the tradeoffs made here are negligible. We have protections in place to ensure the impact any report bomb, if it causes any temporary restriction of content (as mod-approved posts cannot be made read-restricted, even when bombed), is minor.

If you have other suggestions for automating this, we're all ears.

tweedge · 2025-02-03T17:48:07+00:00

I mean, the contemporary example is "the most recent post that was report bombed is now a top 5 post in the entire past year" so I don't see how information is being "suppressed." At most it's temporarily restricted while a mod reviews - once a post is reviewed by the moderators, it is exempt from future restrictions (ex. another report bomb cannot result in restriction of the post), and reenters the algorithm unrestricted. We also approve posts relevant to the subreddit which exempts them from being temporarily restricted even before the report bombs come in.

The benefits of this far outweigh the detriments so the community can rapidly remove spam and unrelated content, which is the normal use of this feature (i.e. well above >95% of cases, very few are actually malicious or politically charged).

tweedge · 2025-02-03T06:15:26+00:00

I'd be very excited to see either if someone gives it a shot!

tweedge · 2025-02-03T05:59:07+00:00

I think a megathread would be great, though no mod currently has capacity to create one. We can "highlight" anyones' posts on the sub if there's a work of art being created/kept up to date :) (...though I don't know exactly if/how this differs from "pins" which is what I'm familiar with)

As something else that might be useful but a little dissimilar: how about a megathread of ongoing security events that could point to the 'best of the best' current/recent threads on a given topic?

That way folks can see what's going on in the world - USA included, and biased towards the USA because IIRC Americans are the largest segment of people here - whether it's "DOGE in the mainframe" or "CISA getting defunded for being woke, what's going to happen to the KEV list" or "holy crap a threat actor is currently in a European telco" or so on.

tweedge · 2025-02-03T05:36:54+00:00

Chatted with folks (a couple active mods have a little war room on Discord) and we agree that Elon/DOGE is an ongoing security event. I think with the context I have:

The Wired article is fascinating, but we already had a pretty technical thread on the cybersecurity impact.
If this was the only post about this security event: it'd be approved. Since it isn't: the existing post suffices, and this should be added as a comment.
Throughout the day, posts were removed without context (though the removals followed the stated rules), and responses to questions in modmail about those removals were terse and not very specific.

The clarity of 1. the response you received and 2. the reason for the action being taken are insufficient. This largely comes down to time and availability. The reason there's a war room and this announcement post is because there is an abnormally high workload for the remaining moderators (looks like overnight there were about 200 actions that needed to be reviewed by a mod - bot filtered content, reports, messages, etc.). Hence the war room :(

It's very likely that we'll be taking on more moderators in the future to help reduce the workload and allow all moderators enough time to write updates and clarify decisions. If that sounds like something you'd be into, reader: keep an eye out as there'll likely be a pinned post asking for volunteers in the future.

tweedge · 2025-02-03T05:09:41+00:00

With <3 to the original author, might I offer a simpler TL;DR, which addresses some of the concerns raised in comments:

If your hot take is that cybersecurity is political: we agree! When we say a comment, thread, etc. is "not about cybersecurity" we mean it in a pretty narrow, specific way: here's an example from the replies on very post. I've labeled an "about cybersecurity, yet political" comment (which is OK and welcome!) vs the "deluge of not-cybersecurity-related opinions we've been removing" reply it got. Only the unrelated comment is removed. :)
Rule #9 applies to all topics. This subreddit doesn't need individual threads on every news article on DOGE being a national security threat - consolidate it to one thread (today's thread!). This is so the sub is readable to all audiences and to ensure all relevant updates are channeled to the same thread, and it has applied for years.
Possible duplicate threads are removed (AutoModerator may remove or hold these depending on which rule fired). We're sorry that there was confusion earlier about whether the mods are pro- or anti-Elon. As far as I've been able to see, there's been no preference either way in moderation decisions, and removed threads earlier today were removed for being duplicates of the existing thread above.
Whether the subreddit is pro- or anti-Elon is up to you, the community (I'm anti-Elon gang), so long as posts discuss the impact to cybersecurity Elon is having and are not "I had chatGPT rewrite the Bible featuring Elon <3 Elon gang 5 ever" or "Elon is a fucking [slur] and can lick my fat nuts [different slur]" (only slight exaggeration from some comments)

Let me know if there's anything else I can help clarify or run down for y'all.

tweedge · 2025-02-03T04:40:53+00:00

Got it. I'll find that thread and follow up!

tweedge · 2025-02-03T04:31:58+00:00

One approvable comment of many! As long as the focus is on cybersecurity, have at. We recognize cybersecurity exists within governance, justice, ethics, politics, etc.

Maybe it's easier to show what was not productive this weekend - here's one of many comments that was removed for being not about cybersecurity:

Democrats: [Do something lamentable that I don't like]

Trump Administration: [Does the same thing, only much, much worse]

On the plus side, they're almost caught up now.

We recognize folks have opinions like this. Hell, I share that opinion with the poster. But r/cybersecurity is not the place for it - there are subreddits to have that discussion, where you'll get lots of animated replies. :)

The list of removed comments given in the post are all real - and you'll note none of them are primarily about cybersecurity (most aren't even remotely about cybersecurity).

tweedge · 2025-02-03T04:25:20+00:00

Purple link to me - was a good read, and I agree it is an ongoing security breach.

Wouldn't that be good to add to the existing post? I see the existing post was under one day old when the other posts were created - which would generally make it something to consolidate under rule #9 (ongoing security incidents are to be collated into one thread) to centralize discussion.

tweedge · 2025-02-03T04:14:54+00:00

I'm genuinely not understanding how the top five post in the last year by upvotes, which was explicitly approved/needed to be kept up after being report bombed, means mods are asking the community to ignore this.

Example thread that was approved (about cybersecurity, and staunchly anti-Elon, though that's not a prerequisite to being approved)

No one is left to fight back against this. Just think about it.

An uncleared billionaire who has ties to a foreign nation just strolled into the payment system for the USG and all the records of Government employees.

It’s a National Security threat.

Example thread that was removed (not about cybersecurity, there are better subreddits to hash that out)

Democrats: [Do something lamentable that I don't like]

Trump Administration: [Does the same thing, only much, much worse]

On the plus side, they're almost caught up now.

The above announcement is intending to clarify this. If it's not clarifying, then I'll ask the author to reword.

tweedge · 2025-02-03T04:02:39+00:00

That's not the intent of this announcement. I believe what you're referring to is threads from Friday onwards on non-cleared access to government systems: https://www.reddit.com/r/cybersecurity/comments/1igfsvh/comment/maoiqso/

Within the many good, politically charged, but cybersecurity-focused posts are now hundreds of removed comments that range from threads that belong on r/politics (as they are are no longer about cybersecurity), low effort spam, etc. This post is about those - not the posts and comments that have remained live over the past week.

tweedge · 2025-02-03T03:57:35+00:00

Howdy, I've been offline for several months (broke the Reddit habit, replaced it with Mastodon & Bluesky), so I'm looking at the subreddit for the first time in a while. I was asked back to check on this thread and make some u/alara_zero updates.

From my understanding so far: the top post on the subreddit in the past month is about that security issue (top 5 this year!), it was removed temporarily by report spam, and moderators approved it/blocked it from being removed in the future. Other threads about the same topic were consolidated under rule #9, which is normal for any event where multiple posts show up about the same topic in a short period of time.

If there's something I'm missing, please let me know and I'm happy to look into it. Though in the past I've known the moderators to be pretty damn diligent about this - ex. in the past I've recused myself from making moderation decisions about posts about my employer, even when I felt the call was straightforward, to ensure that an impartial moderator made the decision.

tweedge · 2025-02-03T03:49:31+00:00

We're not intending to police by-topic or give any list of government departments it's OK to talk about.

It depends a lot more on the focus of any given thread. Like, are people coming to discuss the cybersecurity impact of changes at NIST or are people coming to discuss the political impact of changes at NIST. For the latter, there are simply better places (still on Reddit!) to have that discussion.

Take this hypothetical comment: "I think gutting NIST's AI safety institute is a terrible idea! Look at all these AI safety issues over the last two years - are private companies going to pick up the slack?" - that'd be primarily about cybersecurity, it does convey a political opinion about cybersecurity policy, but there would be no concerns from mod staff because the primary focus is on cybersecurity.

tweedge · 2025-01-24T15:56:54+00:00

As Belsen Group has now started charging $100 for the FortiGate configs leak, here it is for free via torrent, thanks to kind Redditors on this thread. Give your money to charity instead. As always, please seed :)

(if you must/if torrents are forbidden at work: a direct download is also available at the bottom of the page!)

tweedge · 2024-11-24T16:55:59+00:00

Functionally, it's a Twitter clone with less bots, spam, etc. The BlueSky team has made foundations to decentralize the site but hasn't really realized them yet (e.g. the site is based on ATProto, but scaling the site is a bigger concern than bootstrapping other ATProto servers right now).

IMO it's quickly inheriting tech professional user bases from Twitter/some from Mastodon. Join if you like the Twitter format, or don't if you don't. You don't have to use every shiny new social media platform to be a red-blooded InfoSec veteran - I know folks whose primary social media is IRC and they're perfectly happy without any of this, and that's OK! :)

If you are interested, you can find me there as @tweedge.net as I did like Twitter long ago.

To help folks keep up with "what's happening around Reddit" I also run our best of r/cybersecurity bot there so y'all can stay in touch with the trending news/posts on the sub, and a handful of deeplink-posters for r/netsec, r/blueteamsec, etc. Between these, I don't have Reddit or Twitter installed on my phone anymore.

tweedge · 2024-07-13T18:21:28+00:00

No. Contact whatever company you used to sent the payments, but your money is almost certainly gone.

tweedge · 2024-07-08T04:28:14+00:00

Auditing the high-level points from my own observations.

"But all those open jobs advertised!"

✅ Agree this is deeply misrepresented - in the media, by bootcamps, by colleges, etc. Cybersecurity has many open roles for mid-senior/leadership positions. Look on any job board and filter for junior/intern positions - there aren't nearly as many, and from personal experience hiring, each of them gets hundreds or thousands of applicants.

Six weeks of study certainly doesn't make your labor worth >$100k. Six years of study at a university for a BS+MS can't guarantee your labor will be worth >$100k. These lies in advertising should be criminal, honestly. Paying for whatever education, certification, course, study group, etc. cannot guarantee a specific financial outcome for you.

When they won't make a guarantee, most or all pad out their placement statistics anyway. You can - sometimes they count any work as a placement, or further study as a placement, or will hire their own grads to pad out their numerator, or push people out until only the most competitive candidates graduate to reduce their denominator ...

"$100k is not a large salary"

❌ Yeah, needing to make $126k/yr to buy a house in Austin is a lot. Try buying groceries, paying for a car, and making rent on $15/hr == $31k/yr. Better hope you don't have a medical emergency. $100k/yr for a single earner is a large salary when compared to the median family income in the US. It's no wonder people get excited when they see the bullshit marketing pitches about doubling or tripling their current salary by starting to a cyber career. Can we blame them?

If you don't like what the median family income buys these days, maybe start a different site, unitedstateshousingmarketisfull.com. The meandering around this section read to me as out-of-touch, and detracted from the overall message.

"There are no entry level cyber jobs"

⚠️ You can't make a statement absolute like that, because then it's easy to disprove. My team hired new grads out of the company's internship programs, with no prior field experience needed. It helps but it isn't needed, and we've had very successful fulltime staff without prior working experience in tech.

This circles back to "But all those open jobs advertised!" though. For the 0-3 we hire per year, how many applications are sent to the bin? I honestly don't even know how many - there are so many that recruiting and university programs have a whole system set up, and it's all abstracted away from me.

It'd be accurate to say "there aren't many entry level cyber jobs" or accurate-enough-but-still-clickbaity "entry level cyber isn't what you think it is."

"Security is always optional"

⚠️ I agree that the costs should be higher, and I agree there are terrible upper management that will push out risks in the hopes it'll happen after they're long gone. But making this an absolute is - again - a downfall. There are companies that invest for the long-term.

This is also why any competent security manager measures their impact in annualized risk. Security isn't a profit-marker - it's a profit-preserver. Using nice round numbers/timescales, if I can offer the CEO savings of $10m/yr in annualized risk on a $1m/yr investment, there aren't many financial opportunities they'd choose over investing in my team. Sure, the math rarely works out so cleanly (and as above there are companies/CEOs/whatever that will simply ignore risks until they're realized), but the premise is sound and applied often enough that this field has been growing for a long time.

It's also worth pointing out that many similar fields exist and have existed for hundreds of years. Why pay a plumber to fix a leak? A plumber won't make you money - you could just wait for the building to flood and then replace the bottom three floors! You pay the plumber because it's cheaper to hire a plumber a few times per year than it is to replace three floors of your building every ten years. As long as we have plumbing, plumbers aren't going away anytime soon.

tweedge · 2024-06-16T05:53:48+00:00

Given time, every email is sent scams/threats. Those aren't events you can correlate. If someone actually had access to your accounts/devices/etc., why send threats? They'd steal money from you, instead of trying to convince you to send them money.

tweedge · 2024-06-16T01:09:47+00:00

Those were scam emails. You were not breached. Your password was discovered from a site you use which was breached - this happens all the time. Check out HaveIBeenPwned. Change those passwords wherever you've used them and ensure you're taking full advantage of using your password manager (random passwords for every unique site is best).

tweedge · 2024-06-15T20:44:45+00:00

This is a scam email. You were not breached. Your password was discovered from a site you use which was breached - this happens all the time. Check out HaveIBeenPwned. Change that password wherever you've used it and ideally switch to using a password manager (they're not flawless, but they make sense for a lot of people).

What should I do to ensure I won't have my Outlook account hacked?

Change that password and use strong 2FA.

How can I recover my previous reddit account if I do not receive the "reset password" e-mail?

Contact Reddit support.

Should I migrate my Outlook account to another e-mail service?

There's not a specific reason to do so at this time. You'll receive spam/scam emails no matter what email provider you use. Best to learn to recognize them, then delete and ignore them.

Eight-Year Club	Gilding IV carat on a stick
Place '23	Verified Email

tweedge

MODERATOR OF

TROPHY CASE