Why I don't write more security posts

Published on Sep 21 2021

If you know my background, you might expect this blog to be packed with write-ups on threat detection, log analysis, CTFs, bug bounties, etc.

Well, it isn't. And that is deliberate.

The short answer is simple: I like my sanity, I like my boundaries, and the internet has enough generic technical content already.

The longer answer comes down to a few basic realities.

1. I enjoy the the clock stopping at 5pm

I do cyber for a living. I spend forty-plus hours a weeks doing _cybersecurity_. It can be demanding, high-context work that requires focus.

When I shut down my laptop at the end of the day, I want my brain back. Keeping my mental engagement with enterprise infosec isolated to working hours isn't a lack of passion on my part.

It's really just self-preservation. If your entire identity is consumed by the exact problems you solve for a paycheck, you may be on a fast track to burnout.

2. The twenty-four-seven lifestyle has an expiration date

Early in my career, and especially back in college, I was that guy. I lived and breathed it. I ran a small home lab, followed dozens of security researchers on social media, and treated every spare weekend as an opportunity to build another tool or study for another exam. I was grinding, and that's okay. That's how you get your start.

A lot of people in this field stay in that gear forever, and if that works for them, fine. But as I’ve gotten older, I respect mental boundaries a lot more.

Life gets bigger. Your responsibilities shift. There are other things worth building, reading, and exploring.

I have a friend who is an extraordinarily talented cyber professional. They log off at 5 and pursue woodworking, bushcraft, and hunting. That extreme distinction between how they spend their time is likely what enables them to be so talented in the first place. A respect for the work, and knowing their own brain and its limits for single topic focus.

3. The employer tightrope

Security is an inherently sensitive domain. The moment you start blogging in-depth about real-world scenarios, tooling, architecture, or operational tradecraft, you are walking a line next to your employer.

Even if you sanitize everything, change hostnames, and speak in broad generalities, there is always the lingering headache of corporate risk.

One poorly phrased sentence or overly specific write-up can trigger a conversation with legal or HR that nobody wants to have. Worse, you give your adversaries important information about your enterprise. Keeping my professional life separate from my public writing simply eliminates that worry and friction entirely.

4. AI killed the generic tech blog

Let’s be honest: the era of the fun, quirky technical blog post is in steep decline.

If you want an explanation of how a specific persistence mechanism works, a script to parse a tricky log format, or a breakdown of an API, you don't need my blog. Modern LLMs can generate that on demand, customized to your exact environment, in about two seconds.

Writing technical tutorials today feels like a bad use of my time these days.

This site is far more enjoyable when I use it to explore things an algorithm can't necessarily spit out on command: weird creative projects, book reviews, game design, miscellaneous projects, or personal reflections. Those represent actual human perspectives, which is what blogs are supposed to be about.

5. I still love the work

None of this means I have fallen out of love with cybersecurity. I still find the field fascinating. I still spend some time off the clock tinkering with things, digging into odd cryptography problems, or generally consuming cyber related news.

The difference is that those things are just there to scratch an itch. Most of them are half-finished experiments, rabbit holes, or personal curiosities that simply don’t warrant becoming a polished, public-facing article.

I am very appreciative of bloggers that still have a passion for the subject that enables them to make meaningful posts. I'm just not sure I'm in that camp.

At the end of the day, this site is not a resume. I do security because it's fun, important work, pays the bills, and challenges my brain during the day.

But when I come here to write, I’d rather talk about other things.

¯\_(ツ)_/¯