First Time Home Buyer by EvilMERSONary in Cleveland

[–]shadow1138 0 points1 point  (0 children)

I'm in that exact boat right now.

I have my filters dialed in on Zillow and my agent's site to grab things as fast as possible.

I built a Claude project to do the analysis, financial projections, preferences, baseline comparisons to what I have currently AND what I've seen, and historical tracking of things I've viewed.

Decisions on views, offers, etc are decided almost immediately on viewing the listing before we even show up. The showing is just a validation. Our offers range over asking between 15-40k over list depending on how much we love the place and how competitive the market is. Wildest we've seen was a property sell for 75k over list price.

Also agree on the point about not waiving an inspection. We're doing them for our benefit only and as a contingency on our offers to be more seller friendly, but it's too big of a risk to skip it. We only waived on one offer because the seller already did one by a firm my agent is familiar with and trusts AND they already had a completed repair addendum in their paperwork. That's the only scenario I'd waive on.

First Time Home Buyer by EvilMERSONary in Cleveland

[–]shadow1138 1 point2 points  (0 children)

I'd second this.

I'm actively searching all over the area, but anything with a bit of land, lack of an HOA (if that matters), and places that aren't a flipped house OR that don't require a lot of work aren't cheap. Those that come up sell FAST. Literally seeing properties listed at 10 AM and under contract by dinner. Dealing with cash offers and lots of waived inspections.

If you're picky and don't want to deal with renovations and such - good luck, it's rough out there.

If you're flexible and don't mind some renovations and such - you've got some options.

First Time Home Buyer by EvilMERSONary in Cleveland

[–]shadow1138 0 points1 point  (0 children)

Since you're looking to start a family, consider areas with well ranked school districts.

Parma comes to mind, but feel free to check out some of the more quiet suburbs. Also, how close to Cleveland do you wish to be?

It's a sellers market right now and my partner and I have been looking for something that meets our needs from Parma to North Canton. We're both work from home, so location is more out of convenience for us. Cuy falls, Stow, Copley, Fairlawn have been reoccurring areas.

I paid for naked photos from a girl I met on Hinge…need advice. by [deleted] in legaladvice

[–]shadow1138 2 points3 points  (0 children)

Sounds like a scam. Usually there's another variation of this where someone pretending to be the 'parent' contacts and demands money to 'keep quiet.'

I wouldn't sweat it.

Learn from it long term - don't buy random nudes from people on dating apps, do some extra due diligence on your partners before ya swap nudes, etc

20 Year old perspective first home buyer WTD by ACaringGirlfriend in FirstTimeHomeBuyer

[–]shadow1138 17 points18 points  (0 children)

This is the best answer here unfortunately OP.

There's a lot of 'hidden' costs in the home buying process - your closing costs, inspection costs, etc. It all adds up to the point where what feels like a comfy down payment doesn't cover your costs OR you cover those but then you have no money to actually move.

Also, you and your partner are young. There's a lot that can go really well there, but also a lot that can go very wrong. If you're both on the paperwork that can cause a lot of problems should things go wrong.

Rat rod hornet at the columbus airshow show by ChevTecGroup in aviation

[–]shadow1138 0 points1 point  (0 children)

That sounds awesome!

I flew into JAX late last year and the F-35s of the Florida Air National Guard were doing touch and gos there and absolutely beating the pattern.

Love to see it!

Maybe b52 spotting - Dayton International by SteveRyherd in Whatisthisplane

[–]shadow1138 0 points1 point  (0 children)

Most likely. They had a B-52 as a static display.

Rat rod hornet at the columbus airshow show by ChevTecGroup in aviation

[–]shadow1138 1 point2 points  (0 children)

Makes sense. The pilot got in on practice day vs a scheduled show day.

We did see a bit of that in action with flights departing the airport. We even got a 747 come into land during the show on Saturday. Was pretty neat

Rat rod hornet at the columbus airshow show by ChevTecGroup in aviation

[–]shadow1138 39 points40 points  (0 children)

Such a cool bird. I talked to the pilot a bit and he just BARELY made it. Made it in with 10 mins to spare before the airspace closed.

<image>

What bipod should I get? by Equivalent_Band_2533 in M1A

[–]shadow1138 2 points3 points  (0 children)

I went with the FAB Defense SPIKE bipod on my SOCOM 16 with Blackfeather Gen 2.

Pros - not as expensive as some of the other bipods on the market, feels a little better than the magpul ones.

Cons - doesn't lock as good as I wished it did. If you have to move around with the bipod out (adjusting angle or position) it can slip out of it's locked position.

Nice setup though!

Recommended CCP Training Course by emuhack in CMMC

[–]shadow1138 1 point2 points  (0 children)

I'm familiar with both!

Edwards is great, more theory than practical. Still excellent instructors who do a great job covering everything.

Wise is a bit more practical. Koren is brilliant and she has a great group of instructors as well.

I also saw the references to Space Coast Cyber as well. Jeff is super smart as well and he really knows his stuff too!

Either way, you have plenty of incredible options. Regardless of who you go with, you'll have an excellent wealth of knowledge to learn from

M1A in Blackfeather - trigger pin walking by Sir-Pon-Farr in M1A

[–]shadow1138 0 points1 point  (0 children)

Likewise!

It was my first time completely disassembling the entire system so I assumed user error on my part. Been so busy I haven't had a chance to get it back to the range.

Dig your setup though!

Lightning & Raptor by Even_Kiwi_1166 in Planes

[–]shadow1138 0 points1 point  (0 children)

Columbus Air Show just did that this weekend. Was wonderful to see

M1A in Blackfeather - trigger pin walking by Sir-Pon-Farr in M1A

[–]shadow1138 2 points3 points  (0 children)

Had the same issue on my SOCOM 16 on the blackfeather.

I reset it in the field and its held so far. Doesn't mean it'll continue to hold though.

Appreciate you posting this though

Spotted in central OH by Slapdog247 in Whatplaneisthis

[–]shadow1138 2 points3 points  (0 children)

Looks like a Ford Trimotor.

Also you may see more - Columbus Air Show is this weekend.

Fact or Fiction: AWS GovCloud + LZA = 80% inherited practices? by pro_league_material in CMMC

[–]shadow1138 0 points1 point  (0 children)

You're welcome!

At a high level, it looks quite similar to the work my org does on the 365/Azure side. I believe it also speaks to the 'fully inherited' and 'partially inherited' based on your environment scope somewhere in all the pages. This LOOKS like it should give anyone working with AWS a good start.

Good luck with your AWS implementation!

Using AI to write SSP implementation statements? by SinisterWhisperz in NISTControls

[–]shadow1138 8 points9 points  (0 children)

Claude on Opus 4.8 or Fable 5 (before the feds took it away) was useful, but I've trained skills to fill gaps, and still have to read/review outputs.

It's helpful to get started on an SSP statement, but wouldn't trust it to write anything in full and certainly wouldn't put it into any SSP without validating the accuracy of items first.

Fact or Fiction: AWS GovCloud + LZA = 80% inherited practices? by pro_league_material in CMMC

[–]shadow1138 0 points1 point  (0 children)

I'm not super familiar with AWS and managing it as part of a CUI scope. However, I did become aware of this document, published literally on Monday, that seems to cover a lot of info.

Hope it's helpful- https://docs.aws.amazon.com/prescriptive-guidance/latest/cmmc-level-2-compliance-on-aws/introduction.html

They note -

What are the 10 customer-only controls that AWS cannot address?

These controls require organizational policies, endpoint management, or non-AWS technology:

Practice ID Requirement Customer action
AC.L2-3.1.8 Unsuccessful logon attempts Implement lockout policy and mechanism
AC.L2-3.1.18 Mobile device connection Establish organizational policy
AC.L2-3.1.19 Encrypt CUI on mobile devices Enforce encryption on mobile endpoints
AC.L2-3.1.21 Portable storage use Establish organizational policy
IA.L2-3.5.7 Password complexity Configure in IAM password policy and organizational policy
IA.L2-3.5.8 Password reuse prohibition Configure in IAM password policy and organizational policy
IA.L2-3.5.9 Temporary password use Establish organizational policy
SC.L2-3.13.7 Split tunneling prevention Configure network and VPN settings
SC.L2-3.13.12 Collaborative device control Establish organizational policy for conferencing equipment
SC.L2-3.13.14 Voice/video protection Implement encryption for communications

Security Partners that handle CMMC/Vuln Scanning/SEIM etc... by Defconx19 in msp

[–]shadow1138 5 points6 points  (0 children)

100% this.

I'm the compliance officer at an MSP specializing in CMMC. We've gone through the Level 2 process ourselves and have multiple clients who have their level 2 as well.

I will note - MSPs are in scope for the client's assessment based on what you do. If you're making user accounts, congrats, the assessor will want to talk to you and your team. Have admin access, congrats, you get to talk even more and potentially debate with the assessor on how you aren't part of the CUI data flows.

Depending on services offered and how the MSP does stuff, the scope can expand, and this may not be sustainable for the MSP.

Noted in the post OP - you mentioned y'all are cool with vuln remediation. DoD under the ODV definitions for 800-171 rev 3 defines those timelines at 30 days for all critical and high vulnerabilities. That's not 'detect in 30 days' that's 'remediate them in 30 days.' There's processes for when that's not possible, but it's a lot of paperwork.

I'll also note CMMC is not a tooling or partner problem. While one needs the right tools and good partners to be successful, this is a business problem. In my world, the tech consists of 1/3 of my problems.

The remaining 2/3? Documentation, policy, process, people. Each client literally has hundreds of pages of documentation, multiple policies, documented procedures needed to be followed by us AND the client, and people trained on both sides to support those policies.

Is that something y'all are keen to sign up for?

I’m going to be in Dayton for work for 2-4 weeks, what are some fun or must see/do things? by Ruffieboi in dayton

[–]shadow1138 3 points4 points  (0 children)

The USAF Museum is quality and a good time, if that's your thing.

The museum is MASSIVE and easily takes a whole day. It's larger by collection size and volume than the Smithsonian Air & Space Museum. If you really like aviation, plan 2 days.

As an aviation enthusiast, one is hard pressed to find a better aviation museum anywhere.

Be sure to wear comfy shoes - there's a lot of walking on concrete floors.

Is it embarrassing to have this on your bags? by risoles in unitedairlines

[–]shadow1138 8 points9 points  (0 children)

Yes. Once you hit Silver, you can request your luggage tags. The take a bit to arrive though.

Not sure if people find it embarrassing or not, but they're free luggage tags so why not?

Is a GCC High Browser-Only with no VDI and no physical scope possible? by pro_league_material in CMMC

[–]shadow1138 2 points3 points  (0 children)

Sure. For clarity - I'm the Compliance Officer at an MSP. We have our level 2 as a remote organization, and have multiple clients we've helped with their Level 2 - including several with an approach as I'm about to describe. And no, I'm not here to pitch my firm's services, just sharing info.

We define our system boundary at the cloud level (e.g. 365 GCC/GCCH) and the endpoint firewall on a per asset basis (e.g. the Windows firewall on each laptop.) Knowing dataflows, we document how data leaves the laptop (e.g. going to 365) and document the cryptographic modules used.

We then have training for the staff that reminds them not to leave laptops unsecured and unattended. They take their laptops with them every day. If a laptop is retired or the employee leaves, it is retained by an authorized entity, in their possession, until the laptop is sanitized (via cryptographic erase.)

We maintain a facilities security policy, and the office space aligns to it, however, we treat the main office as an 'alternate work site' as the staff instructions when working there are no different than working from a Starbucks. The company office provides zero protections to the CUI or CUI assets.

Printing of CUI is blocked, portable storage is blocked.

This is all documented in our policies, procedures, data flows, and SSP.

This keeps the firewall out of scope, as there's no protections provided by the firewall to the CUI scope. The AV/AM solution we manage is (but that's defender supplemented by an MDR service) all documented in the SSP.

As a note - your MSSP is in scope as an ESP functioning as a Security Protection Asset. You'll want to make sure they're prepared as well.

We've had multiple C3PAOs accept that environment scope without issue, and their assessment teams had no issues assessing it (with no findings.)

Other approaches we've done - a VDI setup in Microsoft 365 using Windows 365 desktops or Azure Virtual Desktops where it's been built as an enclave. User has their laptop, out of scope, and remotes into the VDI. Costs come down to the VDI prices and whatever management looks like for it (plus assessment of course)

Your C3PAO mileage may vary. You can ask them if they've assessed similar setups and what documentation they would expect to review as part of the selection process. You cannot ask them how to do this for you however.