Anyway I still trying to decide what to do with substack since I have my won blog on myameow.blog based on static site generator. (I like playing with design and CI/CD).

What gives most sense to my head is that I will use substack as an “aggregation” what interested me and what i post on my blog. So...

Mikrotik

MikroTik released new version of their RouterOS 7.23. Among bunch of stuff arround the container and apps they also added nice features as the DHCP can add dns entries and finally they added HTTP/2 support for DOH client. It’s changelog is pretty long. Check it by yourself.

From my blog

I don’t think that AI is the one who takes job of other people but more I agree with idea that Humans who can and know how to prompt AI will take jobs of those wo don’t. That’s why Humans replacing Humans

I also added CrowdSec to my public Caddy stack to test the capability of it. After couple of days I still like that idea, and I think my server is now more secure that it was ever before.

And lastly I finally saved some money by lowering subscription of my cloud storage services.

😺

And that’s all for todays newsletter. If you find this usefull consider subscribing.

Cyber Cat OFF, Good night! 🌃💤

🙀 Oh, BTW, That Humans replacing Humans almost immidietly reminds me scene from Rick and Morty 👇

I recently finished watching the film A Silent Voice (Koe no Katachi), and it left a profound mark on me. It wasn’t just because of the themes of bullying or hearing impairment, as vital as those are. It was about something much more universal: the journey of learning how to forgive yourself and starting to love yourself again.

It made me realize that the best stories aren’t the ones with a neat, “closed” ending where everyone gets married and lives happily ever after. The best stories are the ones that teach us how to think and how to look beneath the surface of a person.

🧊 From “Villain” to Tragic Hero

Take the Ice King from Adventure Time. For the longest time, he’s presented as an annoying, one-dimensional antagonist. But once you discover he is actually Simon — a kind man who sacrificed his sanity to save others — you can’t help but love him. You feel a deep sense of pity for him. He is simply a human being trapped within his own tragedy.

🤫 The Art of Looking Inside

It’s a similar story with anime like Oregairu. If you only look at the characters superficially, they might not interest you at all. But once you walk through the whole story and see their internal struggles, their fear of being genuine, and their defense mechanisms, it’s a whole different ball game. Even the characters you would have judged based on their appearance or first impression eventually become your favorites.

What these stories taught me:

1. No one is just black and white: Every “bad” attitude often has roots in pain or being misunderstood.

2. A real bond is more important than romance: In A Silent Voice, it wasn’t about whether Shoko and Ishida would start dating. It was about the fact that they saved each other’s lives.

3. Empathy is the key: Sometimes, we just need to see inside someone else to understand that their behavior is nothing more than a mask.

Sometimes stories don’t need a grand gesture to end. It’s enough when the main character, after years of self-hatred, finally “takes down the crosses” from the faces of others and allows himself to hear the world again. Because that is exactly where real life begins.

The Miqo’te are a feline humanoid race in Eorzea, distinguished by two primary clans: the Seekers of the Sun and the Keepers of the Moon. Their societal structures are diametrically opposed—Seekers are strictly patriarchal and tribal, whereas Keepers are matriarchal and more solitary.

Key takeaways include:

• Seeker of the Sun culture centers on 26 established tribes (designated by letters A–Z) led by one or more Nunh (breeding males), while all other males hold the title Tia.

• Keeper of the Moon society is matriarchal, with family names passed from mothers. Males are nomadic, and their names indicate their birth order relative to their mother.

• Physiological differences are distinct: Seekers possess vertical slit pupils (diurnal) and lack fangs, while Keepers have round pupils (nocturnal) and prominent canines.

• Naming conventions are highly structured, reflecting lineage and social status. For Seekers, dropping tribal prefixes indicates deep familiarity or kinship.

--------------------------------------------------------------------------------

Historical Origins and Migration

The Miqo’te trace their earliest known roots to the southern continent of Meracydia. Their history is marked by two major migrations:

1. Allagan Era Persecution: During the Third Astral Era, the Allagan Empire persecuted the Miqo’te, driving them from Eorzea into southern Ilsabard (specifically the region of Corvos). Some were used as conscripted laborers or soldiers.

2. The Age of Endless Frost: During the Fifth Umbral Era, much of the Bloodbrine Sea froze solid. This “Age of Endless Frost” allowed Miqo’te tribes to cross back into northern Eorzea from Ilsabard, bypassing the peaks of Gyr Abania.

3. Adoption of the Alphabet: Upon returning to Eorzea, the Seekers of the Sun found that the Eorzean alphabet contained 26 letters—exactly matching their 26 tribes. Tribal seers viewed this as a divine sign, leading each tribe to adopt a letter as its prefix.

Seekers of the Sun

Societal Structure

Seeker culture is highly patriarchal and modeled loosely after lion prides.

• The Nunh: A title for the “breeding male.” A Nunh is responsible for siring the next generation. While often the tribal leader (e.g., U’odh Nunh or M’rahz Nunh), lore suggests the Nunh is not necessarily the leader; in some cases, a female elder or a skilled Tia may lead political affairs.

• The Tia: The default title for all other males. A Tia can become a Nunh by challenging an existing Nunh to a non-lethal duel or by claiming new territory for the tribe and establishing a new harem.

• Tribal Totems: Each of the 26 tribes is associated with a totem animal meant to protect them.

Naming Conventions: Seekers

Seeker names consist of a tribal prefix, a given name, and a surname based on gender.

Keepers of the Moon

Societal Structure

Keepers are nocturnal and follow a matriarchal system.

• The Hearth: Communities are centered around mothers and children. Keeper families are typically small, and males are rare (an estimated 1-in-20 birth rate).

• Nomadic Males: Adult males do not live in the villages. They lead solitary lives as wanderers and hunters, visiting female-led settlements in “small doses” to provide game and sire children.

• Cultural Worship: They primarily revere Menphina the Lover, goddess of the moon.

Naming Conventions: Keepers

Keeper names emphasize the maternal line. Family names are passed down by the mother, and some are said to date back to the First Astral Era.

• Females: Given names are short (1-2 syllables). Surnames are the mother’s family name.

• Males: Their forename is the mother’s given name plus a suffix indicating birth order.

Male Birth Order Suffixes:

1. First son: ‘a

2. Second son: ‘to

3. Third son: ‘li

4. Fourth son: ‘sae

5. Fifth son: ‘ra

6. Sixth son: ‘ir

7. Seventh son: ‘wo

8. Eighth son: ‘ya

9. Ninth son: ‘zi

10. Tenth son: ‘tan

Example: Okhi’a Nbolo is the first son of Okhi Nbolo.

Linguistic and Social Nuances

Familiarity and the Tribal Prefix

In Seeker culture, the tribal letter (e.g., the “Y” in Y’shtola) is a formal designation.

• Close Friends/Family: It is common to drop the prefix and use only the given name (e.g., “Shtola” or “Raha”) to indicate intimacy.

• Honorifics: Teachers or elders often use the given name only (e.g., Matoya calling Y’shtola “Shtola”).

• Formal Use: To include the tribal letter when speaking to a close companion can be seen as cold or overly formal.

The “Tia” and “Nunh” Debate

While the titles are traditionally related to breeding rights, the Source Context highlights an evolving or inconsistent understanding within the world:

• Leadership vs. Breeding: In the Encyclopedia Eorzea, Nunh status specifically refers to breeding rights and does not equate to leadership. However, in the U Tribe (Forgotten Springs) and M Tribe (Peering Stones), the Nunh is the chief.

• G’raha Tia Example: Y’shtola once noted that G’raha could have claimed the title “Nunh” due to his leadership of the Crystarium, despite him not engaging in breeding duties there. G’raha chose to remain a “Tia,” viewing his leadership as a shared responsibility rather than a personal conquest.

Pronunciation

The extra “h” in names like Bhee or Pahsh represents a feline hissing or spitting sound. Because other Eorzean races (Hyur, Elezen, etc.) often cannot replicate this sound, the “h” is frequently silent in common speech.

The Mystel (The First)

On the First (Norvrandt), the Miqo’te equivalent are known as the Mystel. They do not follow the Seeker/Keeper tribal systems but use a hyphenated naming convention.

• Female Pattern: First names are 4–5 letters, second names are 3–4 letters (e.g., Riqi-Mao).

• Male Pattern: First names are 3–4 letters, second names are 4–5 letters (e.g., Mei-Tatch).

• Marriage: Couples like Dulia-Chai and Chai-Nuzz share a name element (”Chai”), suggesting a familial surname system.

I still don’t have a clear stance on some things, when it comes to AI, such as the work of juniors. I don’t know if it’s good or bad when AI replaces junior positions.

But, when I think about it, junior positions have to become more like senior positions, so it’s much more important to learn concepts and how things work. Schools have to adapt to that.

Today’s education system focuses more on who can recite the previous lesson’s material better (at least here where I live). They don’t even consider whether the student discussing it knows what they’re talking about.

Those who can only recite without understanding will be replaced by AI. They won’t even be able to do their job as juniors because the junior position will have to become closer to the senior position.

Juniors will be the ones who have to understand the problem in depth and lead the AI to do things correctly. To do that, you have to understand the principles and learn in depth.

You need to be curious.

Ever feel like we’re stuck in a Shonen loop where the villain “evolves” every arc? Phishing is that recurring boss. Just when we stack new defenses, it comes back with a mask change: QR codes, OAuth consent prompts, MFA-bypass kits, deepfake voice calls. If you’ve ever hovered over a shortened link while your pulse spiked like Tanjiro spotting a Blood Demon Art, you know the vibe.

Why phishing still works in 2025

• Humans are still the critical path. Attackers don’t need 0-days when urgency, authority, and novelty still move people. Payroll changes, shipping updates, contract renewals — the classics still land because they target business process friction points.

• MFA isn’t a silver bullet. Adversary-in-the-middle (AiTM) phishing kits intercept session cookies and replay them, bypassing MFA after the victim “successfully” signs in. That’s why you’ll see spikes in short-lived account takeovers even where MFA exists.

• SaaS and OAuth are the new supply chain. Instead of stealing passwords, attackers push users to consent to malicious OAuth apps. You “approve access” once, and the app can read mail, exfiltrate files, or silently pivot. This is increasingly common against Microsoft 365 and Google Workspace tenants.

• QR codes (quishing) are mainstream. They bypass link scanners, and on mobile the URL bar UX still hides key parts of domain names. Office posters with malicious QR stickers are real-world attack surfaces.

• BEC keeps paying. Business email compromise (BEC) remains one of the most financially damaging attack types because it exploits trust and process gaps, not just tech. Reply-chain hijacking, vendor impersonation, and invoice tampering continue to hit revenue directly.

What the latest reports are saying

Across industry reporting in 2025, a few themes are consistent: phishing volume remains high, BEC continues to be costly, SaaS-brand impersonation is pervasive, and QR-based lures are no longer niche. Training and strong authentication help, but attacker tooling and social engineering adapt quickly. If you want to go deep on the data, these analyses are worth a read: APWG’s Q2 2025 Phishing Activity Trends Report; perspectives from KnowBe4, Hoxhunt, and StationX on training outcomes and evolving lures; and roundups of technique shifts by AAG IT, TechMagic, and Deepstrike^.

Anatomy of a modern phish (and how to spot it)

• Pretext: Authority + urgency + familiar process. “Final notice: DocuSign pending,” “Updated payroll form,” “Escalation from CFO.” Attackers mirror your real workflows.

• Delivery:

  • HTML attachments with obfuscated JavaScript (launches embedded phishing page).

  • QR code PNGs that lead to AiTM sites.

  • Reply-chain insertion after a mailbox compromise — takes your guard down.

  • OAuth consent links that look legit and use the real Microsoft/Google consent screen.

• Evasion:

  • Link shorteners, open redirects (e.g., legitimate domains used as a trampoline).

  • Fresh domains with good reputation, or hijacked aged domains.

  • Geofenced payloads and time bombs (content only appears to specific IPs or windows).

  • CAPTCHAs to block scanners.

Practical defenses you can deploy this week

1. Lock in email authentication

• SPF, DKIM, DMARC alignment

  • SPF (DNS TXT): v=spf1 include:_spf.yourmailprovider.com include:sendgrid.net -all

  • DKIM: Generate keys with your mail provider; publish as: default._domainkey.example.com IN TXT “v=DKIM1; k=rsa; p=MIIBI…”

  • DMARC (start with monitor, then enforce): _dmarc.example.com IN TXT “v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@example.com; ruf=mailto:dmarc-forensics@example.com; fo=1; adkim=s; aspf=s”

  • Move from p=none to p=quarantine/reject with staged rollouts. BIMI can add brand signals once DMARC is aligned.

2. Harden OAuth and SaaS

• Require admin consent for high-privilege scopes; block user consent to risky scopes by default.

• Enable app consent workflows with justifications and reviewer approval.

• Continuously review enterprise apps: remove unused apps, alert on new privileged consents.

• Prefer device-bound tokens (token binding / continuous access evaluation where supported).

• Monitor “impossible travel,” anomalous OAuth app creation, and atypical mailbox rules.

3. Make AiTM and session theft harder

• Prefer phishing-resistant MFA: FIDO2 security keys or passkeys with origin binding.

• Conditional Access: block legacy/basic auth, require compliant devices for sensitive apps.

• Shorten session lifetimes for high-risk apps; enable sign-in frequency and re-auth on risky events.

4. Upgrade your mail filtering stack

• Open-source options:

  • Rspamd + Redis + ClamAV; or SpamAssassin for rule-based detection.

  • Feed intel from OpenPhish, PhishTank, and your MISP instance to your MTA.

• Example: Rspamd local rule for HTML attachments calling remote JS

  • local.d/multimap.conf: phishing_js_externals { type = “regexp”; filter = “body”; regexp = “script src=|window\.location|atob\(”; description = “Suspicious external JS in HTML”; score = 3.0; }

• Add ARC, DNSBLs, and URL rewrites with user warnings for external links.

5. Push safe browsing habits that actually work

• Hover or long-press to preview real domains; beware homographs and subdomain bait (login.example.com.attacker.tld).

• Open unknown links in an isolated browser profile or disposable VM session (devs: containers help!).

• Treat QR codes like unknown URLs — verify source, preview destination, prefer manual navigation.

6. Make reporting stupidly easy

• Add a “Report Phish” button to mail clients that forwards with full headers to your SOC.

• Measure “time to report” as a key metric. Celebrate fast reporting, not just non-clicking.

7. Have a BEC playbook ready

• Immediate steps:

  • Invalidate sessions, rotate creds, audit inbox rules/forwarding.

  • Check OAuth consents and revoke malicious apps.

  • Freeze vendor payouts; out-of-band verify any banking changes.

  • Hunt for secondary compromises (reply-chain victims, finance distro lists).

Security implications worth calling out

• Deepfakes meet BEC: Voice cloning raises the stakes for “urgent CEO call” pretexts. Always enforce out-of-band verification for money movement, regardless of caller voice.

• Calendar and chat are in scope: Malicious .ics invites can embed links; Teams/Slack apps can request dangerous scopes. Apply the same consent governance you use for email-integrated apps.

• Supply-chain interlocks: If a vendor gets popped, reply-chain phishing will look legit. DMARC reduces spoofing but doesn’t help if the adversary is sending from a real but compromised vendor inbox. Build vendor verification rituals and secondary controls for payment changes.

• Data exfil “by design”: OAuth consents can turn into durable backdoors that survive password resets and MFA re-enrollment. Always review and revoke app grants after an incident.

Program metrics that matter

• Report rate and time-to-report: Leading indicators that culture is working.

• Phish resilience: Ratio of report-to-click per campaign sophistication tier.

• Control coverage: Percent of users on FIDO2/passkeys; DMARC alignment rate; OAuth risky scopes blocked by policy.

• Incident containment time: From detection to session revocation and consent cleanup.

Community angle: we’re stronger together

• Contribute IOCs to MISP and share anonymized lures with peers.

• Submit samples to PhishTank/OpenPhish to improve community detection.

• Report scams to national CERTs and APWG to help the wider ecosystem.

• Advocate for passkeys and FIDO2 at your org — each deployment shrinks attacker ROI.

If you only do three things this quarter

• Turn on admin-only consent for high-privilege OAuth scopes; review existing enterprise apps.

• Move DMARC from p=none to p=quarantine/reject with proper monitoring.

• Pilot FIDO2/passkeys with finance, HR, and exec assistants — the highest BEC targets.

Final thought

Phishing isn’t a tech problem or a human problem — it’s both. Think layered defenses, assume clever social engineering, and keep iterating. Like any good anime squad, your stack needs balanced roles: strong auth (the tank), smart filtering (the scout), fast IR (the healer), and a community-fed intel loop (the strategist).

If there’s one line that still hits like a Hypnotoad flashbang, it’s Professor Farnsworth’s “Good news, everyone!”

The Hulu revival of Futurama returns with Season 13 in September 2025, bringing the Planet Express crew back for another year of time shenanigans, tech skewering, and jokes that hit you like a delivery to the Wong Ranch at 3 a.m. The returning cast includes Billy West, Katey Sagal, and John DiMaggio, and there’s already fresh footage to gawk at in the latest trailer.

As a cybersecurity nerd and open-source lifer who also binges anime on the regular, I see Futurama as more than comfort TV. It’s a cultural mirror. Every season is a chance to reflect on the weirdest parts of our tech reality—AI angst, platform wars, algorithmic chaos—and ask: where’s the punchline, and where’s the lesson?

Let’s break down what to expect, what to watch for, and how to prep your tech (and privacy) for the new drop.

What’s Official: Dates, Cast, Platform

• Release window: September 2025 on Hulu (US).

• Cast: Expect the core lineup—Billy West, Katey Sagal, John DiMaggio, and more.

• Trailer: Hulu’s new trailer is live, teasing the tone and fresh gags (avoid spoilers if you want to hit the cryo-tube clean).

• Context: This continues the Hulu-era revival that relaunched the series for modern times.

Futurama’s Edge in 2025: Tech Satire in a High-Noise Era A lot’s changed since the show first aired, but the tech curve has never been more Futurama-coded:

• AI everywhere: We’ve zigzagged from LLM hype to regulatory whiplash. Expect the show to riff on alignment fears, synthetic celebrities, deepfake dating, and “AI for everything” product pitches.

• Platform fragmentation: Streaming bundles, unbundles, and re-bundles—like a Fry microwave burrito of licensing. Season 13 living on Hulu is itself part of the bigger story of content silos.

• Space-as-a-service: From private launches to lunar tourism, space has gone SaaS. The Planet Express delivery model feels more relevant than ever.

• Crypto’s hangover: Even if crypto’s cooled, the cultural residue—DAO drama, rug pulls, “community”-as-governance—remains ripe for skewering.

Futurama’s superpower is empathy within absurdity. Like Gintama’s meta-jokes with a gut-punch of heart, Futurama pairs sharp satire with character arcs that land. That’s why the revival works: it’s not just new gags; it’s new context.

Security And Privacy: Watch Smart, Not Just Hard Streaming a new season is fun—until your account gets Bender’d. Here’s your Season 13 watch hygiene:

Account security

• Enable 2FA on Hulu. Every streaming breach starts with weak creds.

• Use a strong, unique password via a manager like Bitwarden (open source) or KeePassXC (open source).

• Audit sessions/devices before the premiere and after you share with family.

Tracking and ads

• If you’re on an ad-supported plan, be mindful of cross-site trackers in the player. Consider a dedicated viewing profile and a hardened browser profile for streaming.

• Don’t over-tweak with aggressive DNS blocking—some players break when their telemetry endpoints vanish. Use allowlists judiciously and test.

Network and devices

• Keep your streaming devices patched. Smart TVs are notorious for lagging updates.

• Segment your home network: put TVs and streaming sticks on a separate VLAN or guest network. Compartmentalization isn’t just for starships.

Spoiler defense

• Mute “Futurama” and character names on social platforms the week of launch.

• Switch YouTube autoplay off if you want to dodge trailer breakdowns and recommendation leaks.

What I’m Watching For (Beyond The Laughs)

• AI personhood and labor: If a robot can unionize or a model can replace a voice actor, what’s the line between tool and talent? Futurama has deep canon here—Bender’s soul, robot Hell—and 2025 gives it fresh fuel.

• Platform satire: A streaming parody episode feels inevitable. Imagine MomCorp Bundles+ canceling Fry mid-episode unless he watches a 2-minute unskippable ad from the Central Bureaucracy.

• Biosecurity gags: After the last few years, expect careful-but-cutting humor around outbreaks, gene editing, and miracle cures with side effects like spontaneous jazz hands.

• Data monopolies: Nibbler’s species archiving the universe pairs nicely with the modern data-hoard. Will we see a “cache apocalypse” bit?

Community Spotlight: Fans, Projects, Participation

• Fan wikis and timelines: The Futurama community is encyclopedic. If you spot continuity threads Season 13 revives, contribute citations and screenshots.

• Open tools: Aegisub remains a fantastic open-source subtitle editor if you’re translating clips for accessibility or analysis. For image upscaling of old posters and stills, try waifu2x or Real-ESRGAN models locally.

• Ethical sharing: Clip responsibly. Credit artists. Avoid uploading full scenes—support the series so we keep getting renewals. Fry’s college debt isn’t going to pay itself, but we can at least fund more episodes.

Why The Revival Still Works Plenty of revivals stumble because they confuse references with resonance. Futurama’s best episodes wield humor like a Trojan horse—get you laughing, then slide in the existential gut punch. In 2025, when AI press releases read like Zapp Brannigan speeches (bold, confident, and catastrophically misinformed), Futurama is perfectly positioned to help us laugh—and think—our way through it.

Quick Prep Checklist

• Mark September 2025 for the premiere on Hulu.

• Turn on 2FA and clean up old sessions.

• Set your spoiler filters now.

• Generate your ICS file so you don’t miss weekly drops.

• Rewatch a few favorites—try The Devil’s Hands Are Idle Playthings and Meanwhile—to recalibrate your feels.

Final Thought

Futurama has always been about humans dealing with futures they barely understand—a mood that fits 2025 a little too well. What themes are you hoping Season 13 tackles—AI rights, platform power, quantum gags? And how are you hardening your watch setup this time around? Drop your must-watch predictions and your best privacy hacks—I’ll feature the sharpest takes in a follow-up.

Opening Hook

If I had a yen every time an anime protagonist shouted “I’ll protect everyone!”… well, I’d probably be able to buy out a few zero-day exploits on the dark web. But in our world—where cyber threats are real and not stylized mechas—we desperately need more defenders. Unfortunately, we’re facing a very real problem: a major shortage of cybersecurity professionals.

I recently read this insightful piece over at ShellSharks about the current cybersecurity workforce crisis, and wow—it’s a mix of Shingeki no Kyojin levels of chaos and Gintama-level absurdity (where are all the qualified people, seriously?). The shortage is bigger than most think, and the implications extend far beyond missed patch cycles and understaffed SOCs.

Let’s break it down—what’s causing this, why it matters, and how we (yes, us, the community!) can start turning the tide.

The Cybersecurity Talent Gap: Worse Than a Server with Port 22 Open to the World

According to ShellSharks, the global cybersecurity workforce needs to grow by over 3.4 million professionals to meet demand. Yes, million. That number is staggering, and it’s growing faster than a botnet-controlled IoT army. Organizations are scrambling to find skilled defenders, while attackers are innovating and scaling like they’ve unlocked a cheat code.

Here’s the TL;DR: demand for cybersecurity is surging because of cloud adoption, IoT expansion, AI misuse, and increasingly sophisticated ransomware attacks. But the supply of talent? Static at best, declining at worst. This imbalance creates a perfect storm—one where even the best intentions won’t shield us from preventable breaches.

And let me just say this—this isn’t a matter of poor recruitment or bad job postings (although those don’t help). It’s systemic, woven into the fabric of how we educate, hire, and train.

Root Causes: It’s Not Just a Skill Issue—It’s a System Issue

A lot of articles stop at “we need more cyber pros.” ShellSharks goes deeper, pointing to systemic factors, and I appreciate that. Let’s build on that lens:

• Gatekeeping in job descriptions: “Entry-level” jobs asking for CISSPs and 5 years of experience? That’s like expecting a first-year ninja from Naruto to lead the ANBU Black Ops.

• Lack of mentorship: Many capable individuals never make it into cyber because they don’t know how to start. They might have the curiosity, but not the pathway.

• Burnout and turnover: Even skilled professionals are leaving the field because of overwork and stress. Defenders are constantly “on call,” facing mentally exhausting incidents regularly.

• Lack of diversity: Marginalized groups remain underrepresented. Diverse teams bring broader threat modeling capabilities—a.k.a., a more effective shield against unpredictable threats.

• Training isn’t keeping pace: Universities and bootcamps sometimes teach outdated material. We’re fighting polymorphic malware with static skillsets. Let’s be clear—this is not just bad for people, it’s bad for security.

Security Implications: When Your SOC is Understaffed, Your Risk Multiplies

As someone who’s worked with open-source security tools and contributed to network hardening projects (shout-out to Zeek and Snort communities!), I’ve seen what talented people can do when they have the time, mentorship, and support.

But what happens when that’s missing?

• Incidents get missed. Lack of 24/7 coverage means slower response times. One attacker can wreak havoc in minutes.

• Poor configuration becomes a norm. Proper hardening, logging, and detection require skilled oversight. You can’t just “set it and forget it.”

• Threat intel goes unprocessed. With no time for proactive analysis, orgs rely only on reactive measures.

And here’s the kicker—attacks are increasingly automated and AI-assisted. Tools like WormGPT are enabling low-skill threat actors to craft phishing campaigns with shocking effectiveness.

Let that sink in while imagining a 3-person SOC trying to monitor a hybrid cloud environment, dozens of endpoints, OT devices, and remote users. It’s like giving Sailor Moon a stick and asking her to block a meteor.

The Open-Source (and Community) Angle: A Powerful Force, If We Use It Right

Here’s where my open-source heart beats loudest. The ShellSharks piece rightly encourages community-driven action—but let’s not understate the incredible potential of the open-source world in solving this.

• Mentorship platforms like TryHackMe, Hack The Box, and CTF communities like picoCTF are lowering entry barriers.

• More projects are creating “good first issue” labels and encouraging contributions—even non-code ones (docs, threat detection rules, etc.).

• Tools like MITRE ATT&CK, Sigma, Suricata, and OSQuery are open and teach valuable detection engineering skills.

A special nod to Outreachy and Radicle as well—programs that train contributors and decentralize collaborative development.

If you’re in cybersecurity or want to be, start contributing. It counts just as much—if not more—than traditional credentials.

Anime Sidebar: Cybersecurity Needs More Dekus, Not Just All Mights

Think of the current workforce like U.A. High. We’re relying too much on the top 5 pros (aka the All Mights of cyber). But we need more Midoriyas—passionate, less experienced folks with heart and a willingness to learn.

Give them the training arc they deserve. Let them intern on internal red teams, shadow during CTFs, or contribute to open-source blue-team tools.

And maybe, just maybe, we stop scorning people who learned security via anime-themed CTFs—looking at you, people who criticized the Evangelion-themed cryptography puzzles.

Where Do We Go From Here?

Here’s what I think the next steps should look like, both individually and systemically:

1. Employers: Rethink your hiring pipelines. Hire for mindset and train the rest. Remove unrealistic barriers for entry-level roles.

2. Professionals: Mentor someone! Be the sensei. Whether you’re a blue teamer or pentester, help someone up the ladder.

3. Candidates: Don’t wait for job offers to learn. Tinker with open-source projects. Build your lab. Share what you learn.

4. Educators: Stop teaching security like it’s a 1998 Windows NT admin guide. Embrace modern tools and attack simulations.

5. Community: Celebrate all paths into cyber. Bootcamp? Self-taught? CTF-addict? Welcome them like you would a new guild member in SAO. No level gatekeeping.

Closing Thoughts (and Call to Action)

Cybersecurity isn’t just a technical field—it’s a mission. It protects privacy, infrastructure, and livelihoods. But we’re losing the battle, not because the adversaries are too strong—but because too many defenders haven’t been given the chance to pick up their swords.

We need to build bridges—between entry-level hopefuls and their first jobs, between the open-source world and professional orgs, between diversity and the hiring table.

So here’s a question for you: Are you part of the solution?

Whether it’s mentoring a newcomer, contributing to a GitHub repo, or just reworking that job description you posted last week—take a step today. The community needs you.

And hey, if you’re building some cool open-source blue team tools or writing detection rules… hit me up. Let’s make the internet a little less scary—one PR at a time.

Until then, stay patched, stay paranoid, and keep learning.

Hello friends!

This is newsletter no.1 (version 5 or 7? don’t remember) which acting jus as a “placeholder” - It takes up space on my page just so it isn't empty.

I experimented a quite with this page a bit, and tired to create my own for newslettering i keep comming back here.

So this is a small restart. Stay tuned for more.

Have a nice day!

Whole blog post you can read here: If i were eighteen again

For years, the online privacy discussion has been dominated by a vocal minority advocating for radical solutions: "de-Google," abandon all big tech, and self-host everything. I cannot imagine that they really do what they suggest for others. In the past months / years i tried many recommendations but in the end I have come to the conclusion that this not works for me at all.

Here is a list of my opinions to what interested / puzzled me the most when I read these recommendations:

The Problem with the "All-or-Nothing" Mentality

Many so-called "privacy pros" on the internet push for solutions that sound good on paper but fall apart in real-world application:

• Workflow Disruption: Big tech companies invest heavily in creating seamless, integrated ecosystems. Moving away from these often means a fragmented workflow, constant compatibility issues, and a significant hit to your productivity. As one might say, "the workflow becomes a mess."

• Hidden Costs: While some open-source alternatives are free, many robust privacy-focused services come with subscription fees. Replacing multiple services can quickly add up, making it "expensive." I was tired of basic features like the calendar view or notifications being paywalled.

• Maturity & Features: Many niche privacy tools simply lack the polish, advanced features, and extensive support found in mainstream offerings. They can feel more like "demos" than production-ready tools.

• Integration Headaches: Getting different privacy tools from various providers to work together smoothly is a huge challenge. The convenience of a unified ecosystem is often overlooked. Many times you need a 3rd provider that integrates them together and often the feature is paid.

• The Self-Hosting Illusion: You'll hear claims about "owning your files" and "having control" when self-hosting. However, this conveniently ignores the immense technical expertise required for setup, and more critically, the 24/7 security and maintenance burden. Big tech companies have dedicated teams and billions in resources to secure data; a single individual running a server from home simply cannot compete. It's a full-time job to keep a self-hosted server secure, updated, and online. I, self-host many services by myself, but nothing is critical to me. Not the end of the world if some of them breaks.

• Misplaced Trust in Small Providers: Even more alarming is the recommendation to use email or other critical services hosted by a "one-person company." While perhaps cheaper and marketed as "privacy-oriented," these tiny operations often lack the redundancy, security infrastructure, and legal recourse that even established privacy companies provide, let alone tech giants. Betting your main email, which connects to banks and medical institutions, on such a provider is a huge risk.

In the end:

First, you need to identify what you want to protect, and then apply countermeasures. For example, discussing what you will have for dinner does not require the same level of protection as sending a photo of your ID card via email. (The latter is stupid idea at all.)

You can check:

What Im reading: https://instapaper.com/p/maymeow