Same journey, new shoes

For years I’ve wanted to do this. People who know me personally tend to think I talk quite a bit ^{citation-needed}, and I’m always open to a nice brainstorming session on whatever is interesting: security, architecture, philosophy..

And after those sessions I always think “wouldn’t it be amazing to put all those thoughts in a blog entry?”.

The journey

But thinking about doing something and actually doing something are two different beasts. Doing something requires far more time and effort, and those are always in short supply. Sometimes you need a shift in your life, so priorities shift with you..

.. and that’s exactly what happened to me last year 😅. Our whole family moved to Switzerland and it felt like a big reset. My job gave me a transition period of some months, but now that I’m about to leave I thought “this is the time to structure all those ideas and develop those projects!”.

So, you might be reading this and understandably be rolling your eyes 🙄, “ohhhh nice, yet another blog about cybersecurity from a guy who is looking for a job”, and you wouldn’t be mistaken 😅.

So why do I think you would still be interested in reading what I have to say? It all comes down to two promises.

Promise 1: A “relaxed” take on cybersecurity

Ok, I know this one is controversial. The words “relaxed” and “security” do not play well together. In fact, while brainstorming names for this website, “chill on security” always got the feedback of “it looks like you are being careless”.

Security is a serious thing! Security has to be strict, always ready to act!

The problem is that cybersecurity blogs and news are all following the same tone: the end is nigh!

And if you read the news, you will have reasons to think that is the case. In recent months we have had AI agents escaping sandboxes and hacking their way into third-party systems, the PHP2shell vulnerability wreaking havoc on the Internet, certificate authorities being reckless and generating unsafe certificates..

It all feels really daunting.. and too much. Years ago this news was the way to show your management that security IS important and you must invest and do something about it. But nowadays you should not need convincing (I hope). What you need is to cool down, see what you have in your environment and start solving the boring (but foundational) issues that you surely still have on your plate.

With this blog, I want to bring a counterweight to the overall cybersecurity industry communication, for which panic and scare tactics are a good sales strategy. Unfortunately, most of the products they are selling you are only effective when you have your basic cybersecurity hygiene covered, but that cannot be bought; it can only be patiently grown.

So that is my first promise to you in a nutshell: my take on cybersecurity will offer calm but effective advice, without the panic.

Promise 2: My own words, no AI-generated posts

If you are going to spend time reading my blog, the bare minimum I can do is to write it myself.. which, yes, feels hard and slow.

Otherwise, why would you bother staying here? I’m pretty sure you have an LLM account or subscription where you can go and ask anything you want about security.

I want this to be my authentic voice, and not a generic generated blog post. Believe me, the temptation of opening Claude and prompting “please generate a welcome blog post entry with these two main talking points” is quite strong, but even doing that and modifying the outcome would not feel like my own.

Uhm, so you are one of those “AI is bad” type of people?

Not really. In fact, this whole site has been generated using Claude (implemented in Astro and deployed on Cloudflare). I will write a blog entry about the security design choices soon.

I think AI is great at assisting you in those places where you just need to fill in the blanks, because that is not your added value. But if I were a web designer, I would make sure the site was something original that cannot be generated in a single afternoon of prompting (right now, the website itself is as generic as it can be, which is fine for my purposes).

So my second promise to you is that blog entries will be written “by hand” (and eventually consumed by an LLM, so someone else can impersonate my style as well 😅).

Notice: While the posts are written by me, you have probably already noticed that the images themselves are generated by AI.. I said “written”, not “drawn”.. you don’t want to see me drawing 😝

Example: This is what happens when you run out of tokens mid-prompt.. I guess I will need to complete the cube myself..

Putting on the shoes

So if I’ve caught your interest, bear with me and I hope you will get some good takeaways from my own journey.

And of course, any feedback is appreciated!

You can find more details about my background in About me.

Written by Marcos Garcia ChillonIndependent cyber-security consultant, working with teams across Europe. More about me