Communities

So, I'm pretty new to this whole security thing (1.5 years) and I'm getting tired of simply consuming netsec info. To cut to the chase, I need to find some communites where I can discuss security with people in the know. Any recommendations are greatly appreciated

>>4412 There's none. Enjoy your hivemind of /r/netsec or infosec twitter.

>>4416 He's right, sadly. Linkedin maybe but its a lot of spam.

>>4416 >infosec twitter. That sounds like an oxymoron. People who are engaged in information security, yet they don't secure their own information.

"Infosec twitter" is a toxic cesspool of virtue signalling, self-promotion, general bs, and unfunny "jokes". You won't actually learn a thing from reading these people. Go look up old papers, conference presentations, books, etc.

>>4418 >That sounds like an oxymoron. People who are engaged in information security, yet they don't secure their own information. The whole point of Twitter is self promotion not keeping secrets. There is a balance to be struck though. People who spend too much time on social media obviously won't have enough time left over to actually do soykaf worth hearing about. So quality tends to be poor.

Local 2600 meet Probably someone in your local hack/makespace Any local B-Sides Or are we just discussing non-meatspace?

>>4424 There are some vuln researchers who are actively posting on twitter. I agree that most of "infosec twitter" is self promotion soykaf, but not whole

IRL you find security enthusiasts in commie and anarchist places, at least here in Italy. You have to search tho

>>4412 Tor and Debian mailing lists. ArchWiki, wikis of other distros and mailing lists for software projects you're interested in. For absolute starters, I'd suggest to watch videos from DEFCON, FOSSDEM, Chaos Computing Club events for last 3-4 years to have enough relevant info on things around this world without going into obsolete archaics. For participating yourself, any sort of discussion community not easily accessible by a layman, e.g. IRC channels, mailing lists and XMPP conferences. Don't forget to read this before asking your dumb questions: http://www.catb.org/esr/faqs/smart-questions.html http://mywiki.wooledge.org/XyProblem Also learn to use search engines by reading their dorks documentation first.

>>4452 >FOSSDEM I have never seen a conference with such consistently awful quality recordings year after year. As if the fact that half the speakers can't speak english isn't bad enough.

>>4424 I can vouch for this.

>>4424 https://twitter.com/tarah case in point what a toxic community

>>4424 This, its full of people just trying to flex on normal people about how much they known about sec and showing it of to the rest of twitter to not fuarrrk with them. Plus they end up sharing their political, ethical views as well which drives people off.

>>4621 >flex on normal people about how much they known about sec these are the same guys who haven't found or created anything new in their whole fuarrrking career!!!

>>4456 never trust someone who hates cabbage

>>4621 >Plus they end up sharing their political, ethical views as well which drives people off. That's a problem with social media. It's people oriented not topic oriented. Then people get confused and everything gets blured together and you get retards who refuse to use Tor or Rust or whatever because some of the developers are vocal about political opinions they disagree with.

>>4642 >People I disagree with are passionate to a fault about what they believe in and dag nabit that just ruins the mood. If you can't be passionate about something it isn't worth talking about save for small talk. Driving people off is only bad if you are trying to create an organization who's only purpose is discussion in the public sphere. If you are actually getting something done then the less people who aren't busy as fuarrrk the better. I've been working a job similar to the Rust/Tor programmers (very technical combined with public exposure) for the better part of a decade and this is what I've learned: - If the topic does not have passionate voices on both sides than it isn't important. - If you have an opponent in an important topic spend less time debating them and more time making your opinion the reality To elaborate on the second point, being a software engineer, I often run into conflicts where someone else thinks we should use X framework, or Y pattern, or Z technology, and they push it hard. Instead of arguing my position, I just develop a working version, then showcase it working. Guess which one gets put into production. Thing is, if you think you have the right idea regarding some problem, shut up and make your idea reality. If your opponent is busy flapping their gums about how good their idea is you have plenty of time to bring your concept to reality.

>>4654 How has this got anything to do with the post you're responding to? Just because you put your strawman in green doesn't make it valid.

>>4654 The point of >>4642 is that people are advocating specific technology (.e.g. Tor) and specific politics (.e.g. worship of non-white people) in the same context. That makes other people feel like they can't use the technology without also accepting the politics, which is bad for everyone.

>>4656 and the conclusion is...? They shouldn't have both opinions publicly at the same time?

>>4658 >and the conclusion is...? People should compartment their interests, especially politics. And social media platforms like Twitter which mix all aspects of a person's life into a single context are flawed by design. The only result will ever be a toxic drama mill. Great for keeping people addicted and selling ads. Bad for meaningful discussions and building a productive community. Twitter communities being a prominent theme in this discussion. You'd know that if you actually read the thread instead of dropping an irrelevant strawman out of nowhere and grinding your ax on it

>>4659 >compartment their interests, especially politics. >social media platforms like Twitter which mix all aspects of a person's life into a single context are flawed by design No, I don't think it is a "flaw" but a feature (with side-effect). I've talked about it before but the thread was gone, in short the social media is created to solve the "filtering" problem of the forum: once a forum, even single-topic has gone big enough, it is almost impossible to communicate. Social media solved the problem by exploiting the network of human relations - now what you see depends on who you know. You follow the people according to you interest, and the social network itself can effectively spread useful messages and start some interactions on the local scale, instead of the a forum that works on the global scale. This is like the Blockchain vs. Lightning Network. Unfortunately, your problem is a serious side-effect of the social media, and nobody expected the social media to totally replace online forums, but it happened... I still wonder what is the next generation of medium of Internet community after social media...

>>4673 >No, I don't think it is a "flaw" but a feature (with side-effect) Ok I guess design is relative to requirements and intent. >in short the social media is created to solve the "filtering" problem of the forum: I don't think so social media is just a forum centered around people instead of topics. The only filtering it might provide is by virtue of people not being very deeply interested in other people so threads are shorter and involve fewer participants. >social network itself can effectively spread useful messages and start some interactions on the local scale, instead of the a forum that works on the global scale. I don't see how broadcasting your every thought to the whole world in a Tweet considered "local"? Just because 99% of people don't care and don't respond. And again, the problem with that is people spew absurd racist/sexist opinions which are perfectly acceptable to whatever extremist Left/feminist/sjw acquaintances they have but those messages get mixed up into completely unrelated discussions and communities because people are the common link instead of topics and that causes huge drama and slapfighting which spills out of social media and has real world consequences. All this bullsoykaf code of conduct cancer currently eating up tech communities would not be happening if Twitter didn't exist.

To answer the OP's question: Pick a security sub-genre and find where those people hang out online. The "general" communities suck. The specialist communities are better, but there will be less people. There are great IRC channels for reverse engineering, hardware hacking, etc... much better than the generalist versions. Mailing lists are big deal. Honestly though, the "good" hackers tend to be anti-social and any group of "good" hackers is going to follow the "put up or shut up" ethos. When you start submitting patches, and making exploit PoCs, then people will start talking to you. >>4418 It's just there for self promotion. Also for reason there's a bunch of frauds walking around pretending to be in the industry, but they aren't. >>4431 >>Local 2600 meet 2600 is a great place for hacker culture, hacker nostalgia, and conspiracy theory exchange. It's for community. That said, I have met maybe 3-4 people tops in many years of going there who had the slightest idea of what the fuarrrk they were talking about. Last time I attended, someone tried to hire me to lay down cat-5 cable. 2600 went this way because the mag started publishing more freedom of speech / EFF / politics stuff than tech stuff. I think they realized it was a problem, and have gone a little bit the other way but the community still has more tin hats than hackers. >>Any local B-Sides Man, no. Not unless it's your last resort. Let me fill you in on some nomenclature. It's called "B-Sides" in reference to the "b-side" of a record. As in the people who couldn't get into the big cons. At B-sides you will see the worst of resume padding, empty suit, hype indulging portion of infosec. There will be some good people, but the ratio is bad. Last year in Vegas (their largest event!), they let a guy on stage to teach people who to maximize the number of certs to collect in a year. That is not 1337 folks. That is just lame. >>4448 I will make a sweeping generalization and say that illegal hackers tend to not have the same level technical sophistication as white hats. White hats can focus on technically proficient all the time, black hats have to divert some of their resources to stealth and law enforcement behavior. >>4621 I never see that, I see the opposite. I see people who can't even begin to hack trying to flex as if they know what's up.

>>4456 In case you didn't know, she's the wife of a well known lock picking expert, which is the source of her twitter fame as far as I can tell. Hilariously, they supported Marcus "BUY MY WARES ON HACK FORUM" Hutchins during his "unjust" and "brutal" house arrest by buying him gaming laptops and letting him stay with them rent free. I really want to see what their faces were like when it dawned on them he was a blatant malware salesman on hack forums.

>>4681 I remember that "tragedy." People jerking off to some poor bastard who "unjustly" got cuffed in vegas... who also did, like you said, blatantly illegal soykaf that he got arrested for. >>4680 About the political nature of 2600 (publication), yeah. It's kinda annoying tbqh. I get the whole "hacker image" and anti govt thing but I expected 2600, in publication, to be a lot more technical than political. It's a lot smaller in my area which is like kicking dead whales down the beach, because honestly, I'm just looking for more friends. Regarding bsides, though, or b-sides.... Either way, some cons have large populations of soykaf content. Some years are better than others, yadda yadda. Non-capital city b-sides are usually poopy corporate events with one or two talks. I go just to hang out with people and do any events they have. Now, some talks are awesome, but BsidesLV is a turd. Local b-sides tend to be a lot more chill. I just hate vegas and non-tech talks. For the love of Christ, no more intro to pentesting or "I made this in 5 minutes" talks, please.

>>4685 Correction: Local cons tend to be more chill