whiskers 🖤

After a really long time only focused on manual web security stuff, almost everything has started to feel like a QA checklist. There are definitely people doing novel research and dropping crazy bugs, but I think a lot of the big stepping stones require people to build really in-depth stuff (like @CharlieEriksen with @WeaselJs). When people talk about burnout, I think a lot of it has to do with the fact that there really isn’t a good narrative to tell yourself after becoming reasonably competent and working for a few years on the hands-on hacking part of security. Let me pick out a team of 3 people and I guarantee you that we could hack pretty much any non-hyper secured target in just a few weeks. Knowing this, it’s a lot less honest to put out work like “we hacked X company” because it’s surprising to no-one who actually does this stuff. It’s getting harder, sure, but it’s still beating the same drum. I think the collective work of everyone in the bug bounty/pentesting game has definitely massively improved security, but as an individual you just aren’t able to report enough individual vulnerabilities to feel good about the work at a sense of purpose level. For that reason, I really think the hacking-adjacent stuff is what really becomes important after being in the weeds for so long. I have really enjoyed seeing my friends start companies, big projects, or switch into roles with more responsibility. If you are feeling kind of burnt out with the everyday hacking, I think it’s important to explore the alternatives. This maybe isn’t super novel and it mirrors how everyone does normal job stuff, but I was stuck in this pit for a better part of this year and think maybe it could help someone. A lot of these thoughts are similar to @gf_256’s Phrack article from earlier this year.