Self-learning Myth (hint: there isn't one)

Brett Shavers recently posted about being self-taught in a blog post titled "When Being Self-Taught Goes Wrong". The core of his post:

For practitioners, “trying something new” is all well and good, but before spending 60 hours on something, spend 6 minutes to see if what you want to do has already been done before. If it has, then you can replicate it. Use that 59 hours and 54 minutes of time you just saved to improve upon your replicated process.

I do completely agree with Bret on his point as well, but I also think people should attempt to try novel things first before researching them following two rules:

1. Is the think you are doing safe? Building a nuclear reactor in your backyard is not the safest thing to do for example. See this video from Today I found out on someone who did just that.

2. Does it make sense to spend 60 hours trying to do something? For work especially, think about how much time you should spend on something before asking for help as Brett states in his post.

However, sometimes, you find that people can invent (or re-invent) technologies because their native areas are short on those technologies. One example of this is from Sierra Leone, Kelvin Doe. You can watch his story below from THNKR.

I find people sometimes, as Brett correctly points out, think that in IT or related fields we must be completely self-taught. It is true that since the pandemic started companies have been shying away from certifications and formal education but instead focusing on:

CTF and Challeng Sites

• Try Hack Me
• Hack the Box
• Range Force
• Blue Team Labs Online
• BHIS Antisyphon Cyber Range

Academies

• TCM Security Academy
• OSINT Combine Academy
• Cyber5W

Along with these sites with ofter practical (and safe) challenges, there are many other sites such as INE, Udemy, LinkedIn Learning, and more which ofter training. Some might argue that these are not "self-taught" training since you are using prepared information from someone else.

However, the first list of sites do provide challenges without any help. Take Try Hack Me's Year of the Jellyfish room.

There is zero information and you can spend hours trying to figure out how to get into to this particular room. When working on improving your skills after becoming "competent in [the] field" (as noted by Brett), these rooms give you that challenge.

Just remember these things:

1. If training, take the direction that best suits your training goals.
2. If solving a goal that needs to be completed in a measurable amount of time, understand how much time you should spend on it, then you should as ask for help or research the problem.

There is absolutely nothing wrong with asking the community for help and support to complete a task. If the task deals with classified or company secret information, then generalized it -- break it down to smaller chucks and get help on these general areas.

Honestly, though, do not be the guy spending 60 hrs on deduplicationg emails while at work using all the wrong methods. If you do happen to find a novel or improved way to solve a problem, share it out to the community.