CrankySec

More Hands

I am an idealist. For the longest time, I thought that common sense and logic would always prevail, even if a little bit of convincing was needed. In my clearly stupid mind, I should aways operate under some guiding principles. Things like “don’t overcomplicate things”, “don’t reinvent the wheel”, “say what you mean and mean what you say”, “more hands make light work”, etc. Basically: look for ways to make things better. And that’s the dumbest approach to a corporate job you can possibly have.

It is a great way to approach your own stuff, however. Perhaps your own business, your personal life, your relationships, your hobbies, and all that. Just not a corporate job. Not necessarily because “capitalism bad!”, but because there are things at play that you don’t understand.

You don’t understand it because you’re not a psychopath. You know it, but you don’t understand it. You’re not hardwired to seek the understanding of those things. You don’t care about those things.

You care about doing a good job, and you want to leave things in a better shape than when you found them. And you are going to suffer the consequences of these beliefs and principles that were drilled into your head from day one: be nice. Share. Reward good behavior. Don’t be a cunt.

You suffer because doing a good job is anathema to most businesses. You suffer because the reward you expect is not there.

Since we’re preaching simplicity, functionality, and transparency, let’s not reinvent the wheel. This shit has a name, and that name is the Shirky Principle:

Institutions will try to preserve the problem to which they are the solution.

Even if you’re unfamiliar with the term, you know it to be true empirically. Every time your suggestions for efficiency gains get shot down without much of a reason. Every time a process improvement idea is ignored. Every attempt to make things better for yourself, for your co-workers, for your clients goes directly against those “things at play that you don’t understand.” And you do acknowledge that those things exist: you just firmly believe that not trying to make things better is undesirable. What you don’t understand is how people don’t share this belief. And that’s the disconnect.

If you put on the “I’m a piece of shit” hat, it kinda makes sense: if solving the problem would net you 100 now, and perpetuating the problem would net you 1000 or 100 every month until the heat death of the universe, why would you do it? That’s why people jump from one thing to the next without dealing with the first one.

Take, for example, ransomware. We have plenty of solutions to this problem. Like, right now. Readily available. Yet, it keeps happening. You won’t see, say, Crowdstrike come to your dumbass of a CISO and tell him “You know what? If you think about this for 5 minutes, you’ll see that a YubiKey and not having your endpoints acting as load-bearing infrastructure can reduce this particular risk quite a bit, and that would lower your Crowdstrike bill.” Replace Crowdstrike with any cybersecurity vendor, and this will most likely hold true because they are not looking after you. They just take care of number one, and number one ain’t you. You ain’t even number two.

This also holds true in different scenarios. Trying to improve things internally necessarily means that the status quo is sub-optimal, and that will make someone look bad, and that someone is usually the “number one” in this particular instance. Corporate culture will never be bLaMeLeSs. Your process improvement will save the company a few thousand dollars a year? This begs the question “why were we overspending in the first place if not overspending is so simple?”, and that’s a bad question to raise.

So, we’ve somewhat established in a very contrived way that the key to success here is to correctly identify who “number one” actually is, and make them happy. It’s never the client. It’s never your co-workers. It’s never even “the company”. It’s always the shareholder. The investors. Your manager. Your CISO. Never, ever you. Unless...

Unless you reach a point in your life with some risk appetite still left in the tank, the kind of life where taking such risks is possible, and a “fuck this, I’ll do it myself” attitude to start your own thing. This way you get to decide who’s number one. It doesn’t even need to be you: it can be you, but it also can be your clients, your colleagues, your friends, your family, your community. It’s a different approach, but no one can change things by doing exactly the same shit that’s being done already. And that’s what we here at Crankysec are going to do. Stay tuned.

Want to know more? Want in? Come over, and let’s figure this out. More hands make light work.