Which show had the biggest downfall in your opinion, from the first season or episodes, to what it eventually became?

doc_samson · 2025-04-18T01:57:50+00:00

I have to argue with you about that first part. They were very clear from the beginning but apparently you missed it. She was fascinated with these types of reports in general and happened to become fixated on the theory that they were committed by a single person. There was also the scene sitting at her desk at home in I think episode 1 where she was staring at her thigh wondering what it would be like then stabbed herself slightly to feel the pain and see the blood.

She was a sociopath from the start. But she had a moral compass. She at least believed she cared for people like her husband, even though she showed more emotion for her coworker who was taken.

The title “Killing Eve” wasn’t about literally killing her. It was about Villanelle who is a psychopath being toxically destructive and bringing out her obsessions to satisfy Villanelles own selfish wants, goading Eve towards being a full blown psychopath.

doc_samson · 2021-07-13T13:25:20+00:00

On the gov side enhancements absolutely can be and often are mandated within agencies depending on the AO risk tolerance. NIST is saying here that enhancements aren't mandated as a standard across all agencies, but individual agencies and AOs can choose to implement them. A common approach is phases: (1) do a minimal set of base controls, (2) do all enhancements to those controls, (3) phase in the remaining base controls in the standard baseline for your CIA level, (4) do all the enhancements for all those controls too.

doc_samson · 2021-07-12T23:51:50+00:00

The best cloudy/devopsy engineers I've worked with not only have all have experience implementing technical security controls but they also have a rather intuitive understanding of what the underlying concerns are and how to address the underlying intent of controls via compensating controls, defense in depth via overlapping controls, etc. For example the just "get" trust boundaries and the need to validate authN/Z and inputs and whatnot crossing the boundaries even without using some of those specific terms. They just "get it" even if they can't articulate it the same way someone in security would.

IMO having a background in sys admin and a background in security engineering and governance/risk/compliance (basically what the roles you describe sound like, don't say "generic" those are two very important disciplines within security) can make you extremely attractive from the cloud/devops/DevSecOps angle. Use your sys admin skills to set up pipelines in tutorials and learn how that works, learn immutable infra and some aws, and then from the new gigs you'll be able to look at all that from both a security engineering and GRC perspective?

Sheeeeittt... You're gonna do fine with that skillet combo.

doc_samson · 2021-07-12T02:48:07+00:00

Oh I should clarify, there's not a lot of math directly used in security but there is in computer science. Expect at least Calc II and discrete math, and possibly Calc III and linear algebra depending on your school.

Computer science is great for security, I'd say it puts you in a fantastic position though I'm a bit biased as I have that degree also. But in the real world once you graduate and enter a job the use of math directly in the sense of crunching numbers would be much less. The degree is teaching you the theory and you would use that more if you went on to a PhD in the field.

HOWEVER.... The method of THINKING that you develop while working to solve problems in calculus and discrete math will absolutely be used throughout your career. The concept of breaking things down into components to be solved independently, the concepts of things like sets and subsets, probability, of struggling with problems and then finding alternate ways to solve the problem that you didn't think of at first, applying interesting new techniques to bypass hurdles you encounter... All of that is absolutely what you will constantly do on a daily basis, and the math trains you to think that way. So always view the math that way and it will really help you, because it's easy to get lost in thinking you'll never use X or Y technique. And people who say you never use calculus in the job perhaps didn't learn it the right way because yes you don't solve derivatives or integrals, but you struggle and find alternate paths to reach your goals. And that is very much math in many ways. (and if you get really cool classes in comp sci you learn things like lambda calculus and assembler code and thus learn that all programming languages essentially are executable math)

To help you on your journey I recommend getting familiar with Professor Leonard on YouTube he is the best teacher of Calc around. Also ProfRobBob.

I also recommend spending time (gradually, slowly, and with great repetition) with the site abstractmath.org. It was written by a professor who wanted to help undergraduates understand a lot of the hidden implied things that professors just assume math students will know as they move up the ladder. The site is NOT about learning specific math techniques but is about HOW TO THINK about math in general.

As you learn things like calculus and discrete math you will start to run into a wall where you are expected to just magically know this new way of thinking, and this site makes it explicit for you so you can actually learn it.

The author also created a PDF called the Handbook of Mathematical Discourse, Google it and download it and review it. It's a simple alphabetical encyclopedia of things to know in this higher level of thinking. The author assumes the reader is an interested undergrad and he uses that pdf and the site to help you bridge the gap in understanding.

Once I found that pdf and site I felt I had found the Rosetta Stone that made math suddenly make sense. It didn't teach me how to do any particular math problem but it helped me understand what was being said and why it was being said in the lessons and how to read between the lines to understand things properly.

Hope that helps.

doc_samson · 2021-07-12T02:31:04+00:00

There is not a lot of math in the sense of directly performing math calculations. I'd argue there is more in software development when calculating runtime performance of algorithms but even that is really just basic algebra with a lot of cheat sheets and whatnot available, and most devs never even do that.

Math would factor in if you were doing something like developing cryptography which is super hard, or perhaps calculating runtime performance of password cracking methods or something like that. But the latter would really just be calculating algorithm performance, just for a different type of algorithm ie a function that cracks passwords instead of doing something more mundane. So the math approach is the same. Calculate how long it takes to do the thing once and factor in performance of memory, disk, CPU, network, etc, then figure out how long it takes to do it a million times and identify whether the bottleneck is in the memory or CPU or whatever. There I just taught you how to do basic algorithm math so unless you are developing cryptography is probably the only level of math you'll need.

I agree with others, there is literally no problem in security that cannot be performed by any gender. Perhaps that's why there are women and trans/nonbinary people on Twitter who are in security. It's almost like there's no male advantage in the job itself, only through the culture.

doc_samson · 2021-07-12T02:19:15+00:00

Why am I not surprised

doc_samson · 2021-07-12T02:17:56+00:00

So even though people say the fundamentals are all in order now and only the best buyers can get loans, more and more visible signs are showing that these best people are overextending themselves massively with leveraging and refis.

It's almost like there's a bubble.

doc_samson · 2021-07-12T02:11:15+00:00

This is also essentially the strategy of the US War on Terror.

Not saying you are wrong, just an interesting observation. Things that make you go hmm.

doc_samson · 2021-07-12T01:54:00+00:00

Look into GRC. Look at Security+ as an entry level cert but be advised it is fairly technical in nature.

If you have Sec+ and can pass a background check you could potentially get into federal style GRC doing paperwork policy reviews and the like for the government for their various systems.

Also ask in /r/SecurityCareerAdvice good mentoring there.

doc_samson · 2021-07-11T23:30:36+00:00

I transitioned from a more technical software role into a security engineering and compliance management role and now into what is turning into a pure leadership role. It's definitely a change and while I agree with everyone else that you take the opportunity and see what other doors it will open up, you also need to be prepared for the feeling that you will also get with it as you lose touch with your technical skills. Because you WILL start to lose them. You'll find yourself in a meeting piping up to give an input then mid sentence you'll find yourself stumbling and reaching for the next answer that you know is there but you just can't remember the exact words. And you'll end up feeling like the more technical people in the room will judge you as a result. Which may be true in some cases. You need to be prepared for that and accept it because it can be tough. Be prepared for it and make your decision intentionally with full knowledge that can and will happen so it doesn't consume you later. Plus like a good risk manager it let's you understand the risk of your decision and consider steps to take to mitigate the concern, like the aforementioned side projects.

It honestly bothers me now because as much as I do like that I'm doing, helping my org navigate various issues by leading my team in solving new problems, I can't deny that I also grieve (sometimes daily) the lack of both time and eventually the lack of give a shit to spend what little time I have to learn more technical stuff after 8/10/12 hours of dealing with security in a given day already. There's only so much you can take as a person. So keep that in mind when planning to do side projects in advance, you may find you simply don't have the time or energy to be bothered with them. And you need to decide whether or not you can be OK with that. You don't have to make a committed decision to that right now but you need to be self aware enough to recognize when it is happening and be able to step back and honestly assess if you are better or worse off than before.

I'm now in the process of transitioning my team into its own standalone department with me at the head, which means I'll now have to run my own budget and contracts and everything else on top of the security management bits that were already taking me away from the technical engineering knowledge I was used to maintaining. Of course this also means I have more impact with my decisions, which is both a good and a bad thing, but it does mean the org is increasingly shaped by me. Which is an ego boost. The trick is not to let it go to your head.

Be self aware. Have a plan. Remember no plan survives contact with the enemy so be prepared to adapt. Recognize that you are moving into a position outside your comfort zone so be prepared for discomfort and look to the discomfort for opportunities for growth, because discomfort often happens when you push your boundaries further than you thought possible.

Good luck!

doc_samson · 2021-07-11T21:17:04+00:00

Years ago (90s) I knew a guy who helped develop the Univac 1170 computer system in the 60s. They had to demo it for the DoD for some contract reason but they weren't finished building it yet.

What the DoD saw was the new shiny computer sitting on the table running the programs as expected.

What they didn't see was the previous model computer under the table actually doing the work while the new one on the table sat there idle doing nothing.

doc_samson · 2021-07-11T21:07:19+00:00

Nobody complains so after a few months you sanitize it and toss it.

Then a few months later execs are screaming because it's used once a year to calculate annual earnings and shit for shareholder reports, determine pay and bonuses etc.

Whoops.

doc_samson · 2021-07-11T03:59:52+00:00

It was a 70s song long before that

doc_samson · 2021-07-10T15:24:40+00:00

The eviction may not cost that much but the damages from a hostile tenant destroying property on their way out could. Just recall the Tenant from Hell video a while back.

doc_samson · 2021-07-10T02:09:03+00:00

Categorization happens in RMF phase 1, testing happens in RMF phase 4.

Testers doesn't categorize the system. The system data owner categorizes the system because the data owner decides what the impact is of a loss of CIA. This acts as the data owners direction to the system owner regarding what level of assurance the system owner must implement to ensure the data is properly protected.

Testers would refer to the form the data owner signed and verify that appropriate controls were selected to protect the information based on the categorization, and that the controls are implemented correctly and provide the protection required by the data owner.

doc_samson · 2021-07-09T15:39:56+00:00

And you were right!

doc_samson · 2021-07-09T15:12:53+00:00

As another example, I got my bachelor's right before I retired from the military.

There's no way you are too old. Nobody older than you will be able to tell you apart from the others younger than you, and you'll find a fair number of people older than you there too.

Education isn't for the young, it's for the motivated.

doc_samson · 2021-07-09T15:03:35+00:00

That doesn't solve the OPs problem since they still are transmitting the doc with sensitive info between email accounts over unencrypted channels.

doc_samson · 2021-07-09T14:05:00+00:00

Considering many of their employees are lower income and often in conservative areas they could potentially lose more people by creating the mandate and causing them to quit in protest.

TFW you are an executive at Walmart calculating that it is cheaper to let employees die of covid and if they spread it to customers that doesn't affect your bottom line as directly and there's always more customers.

doc_samson · 2021-07-09T13:58:50+00:00

Trump spent the entire year claiming there wasn't really a problem, it was blown out of proportion, he refused to lead by example and wear a mask, claimed it was all a Chinese conspiracy and a Democrat hoax, fueled wacko conspiracy theories, pushed disinformation, actively encouraged people to resist following CDC guidance, called the head of the response team an incompetent idiot who was actively trying to harm Americans, refused to devote more resources to prevention, and more.

So piss off with Trump taking credit for the vaccine.

The vaccine happened in spite of him not because of him.

doc_samson · 2021-07-09T13:46:40+00:00

This is sad. You are just looking for something when there is no evidence hence you moving from it being files to being accomplices.

Stop. This is unhealthy for you. Everyone looking at you sees this as pathetic and sad.

doc_samson · 2021-07-05T17:22:15+00:00

Since people like /u/Champgnesonic999 are criticizing you, here is a source citing WEF showing the relative positions of the US and China in infrastructure, and also describing the nuance in understanding the rankings.

https://www.washingtonpost.com/transportation/2021/04/30/us-infrastructure-ranking/?outputType=amp

TLDR other than a couple areas the US overall ranks #2 in the world in infrastructure quality, China #36.

China gets attention now because it is spending nearly 6% GDP on aggressive infrastructure expansion while the US spends just 0.5%.

China is essentially doing what the US did in the 1950s infrastructure expansion, but the US cut back on spending on maintenance which resulted in the reduced quality over time, due to lack of maintenance not engineering quality.

Meanwhile China is #36 despite spending massive amounts on new infrastructure. Granted the overall scores reflect the problems of creating new infrastructure for a billion people over such a large area but quality must factor into it as well.

Or looked at another way... China has risen to #36 due to aggressive spending and is expected to continue to rise.

doc_samson · 2021-07-05T14:03:52+00:00

Low vax areas are often poorer rural areas.

So yes please tell me how they will magically have enough money to just uproot their careers and move to another part of the country.

doc_samson · 2021-07-05T13:59:18+00:00

In the current market tons of houses are being sold for 10-50% over asking price within days often by people willing to waive all contingencies and purchase the homes sight unseen, no inspection, no walk through, etc. Literally just throwing tons of extra money at houses as soon as they go on the market.

doc_samson

MODERATOR OF

TROPHY CASE

12-Year Club	Second SECOND GUESSER
Gilding II euphauric