roam/just-talkingconversations.org

:PROPERTIES:
:ID: f9d8a4b3-8842-45f8-ad62-5f4cf237aacf
:END:

#+title: just-talking/conversations
#+filetags: :project: :knowledge: :conversations:

* just-talking/conversations
Running log of conversations with Aner. Most recent first.

** 2026-09-29 — Cybersecurity Terminology: Gap Assessment + Study Methodology

*** Topic
Follow-up to 2026-09-28: defined how to actually close the terminology gap before the 2026-10-28 start date. Ran a self-assessment, learned a critical detail about the startup's actual product domain, and agreed on a study methodology.

*** Key Facts
- **Startup secures networks of utility companies** — this is OT/ICS/critical-infrastructure security, a distinct specialization from general enterprise security, with its own vocabulary (Purdue Model, Modbus/DNP3, NERC CIP, SIS), case studies (Stuxnet, Ukraine grid attacks, TRITON), and vendor landscape (Claroty, Dragos, Nozomi Networks — not CrowdStrike/Palo Alto). This reorders study priority significantly.
- Ran a category-by-category self-assessment (attack lifecycle, defensive stack, identity, cloud, vuln/offense, IR/forensics, frameworks/compliance, vendor landscape). Full results logged in [[just-talking/cyber-terminology-ramp]].
- Two corrected misconceptions: IOC/IOA were backwards (IOC = reactive forensic evidence, IOA = proactive behavioral signal); Kerberoasting was misunderstood as attacking the KDC rather than offline-cracking a service account hash from a legitimately-issued ticket.
- Biggest blank spots: IR/forensics, frameworks/compliance, most of the defensive stack (EDR/XDR/SIEM/SOAR/NDR etc.), cloud security beyond self-taught k8s.

*** Decision: Study Methodology
Hybrid, not one method for everything — full detail in [[just-talking/cyber-terminology-ramp]]:
- Conceptually rich + blank domains (OT/ICS fundamentals, IR/forensics, frameworks/compliance, defensive stack) → conversational deep-dive, one section at a time.
- Pure vocabulary/naming gaps (vendor landscape, acronym expansion) → quick reference pass, no deep discussion needed.
- Reordered plan to start with OT/ICS fundamentals first, ahead of generic enterprise defensive-stack coverage, since that's the actual job domain.

*** Status
Assessment and methodology done. Next session: OT/ICS fundamentals deep-dive (Purdue Model, ICS protocols, NERC CIP, OT vendor landscape, canonical attack case studies).

** 2026-09-28 — Job Accepted, Cybersecurity Terminology Ramp-Up, RSS Feed Aggregation

*** Topic
Follow-up to the 2026-09-07 relocation counter-offer entry: Aner accepted the Index-backed cyber startup offer after a further negotiation/reoffer round. Starts in ~1 month (target ~2026-10-28). Also started building a daily-reading RSS aggregation habit.

*** Key Facts
- Offer accepted; company reoffered and renegotiated to terms Aner is satisfied with (specifics not detailed in this session).
- Interview process surfaced a terminology gap: Aner didn't know "RAT" (remote access trojan) or "C2" (command & control server) when the team used them, despite having real cybersecurity background (8200 SDR/protocol work, Gita Technologies WiFi/Bluetooth security research per 2026-08-31 entry) and understanding the underlying concepts.
- Self-assessment: concept knowledge is solid, but current industry *terminology/lingo* has drifted or was never fully absorbed — needs a deliberate vocabulary-building push before start date.
- Has ~1 month before starting; wants to build a study strategy (not yet defined — flagged as next step).

*** Action Taken This Session
- Built a curated list of 8 cybersecurity RSS sources for a daily aggregate reading feed, verified live via HTTP check:
  - Krebs on Security — https://krebsonsecurity.com/feed/
  - The Hacker News — https://feeds.feedburner.com/TheHackersNews
  - BleepingComputer — https://www.bleepingcomputer.com/feed/
  - Dark Reading — https://www.darkreading.com/rss.xml
  - SANS Internet Storm Center — https://isc.sans.edu/rssfeed.xml
  - Schneier on Security — https://www.schneier.com/feed/atom/
  - The Record (Recorded Future) — https://therecord.media/feed
  - CISA Advisories — https://www.cisa.gov/cybersecurity-advisories/all.xml
- Recommended weighting Krebs + SANS ISC + CISA advisories highest for terminology acquisition specifically, since they use jargon densely in real sentences rather than as a glossary.

*** Status
Job accepted, not yet started. Next steps (not yet done): (1) define the month-long terminology/lingo study strategy, (2) possibly turn the RSS list into an OPML file for import into a reader.

** 2026-09-07 — Startup Offer Reopened: Relocation Counter-Offer

*** Topic
Aner had said no to the Index-backed cyber startup offer (see 2026-08-31 entry), citing that he wants a relocation job. Founder countered with a "possible" US relocation tied to the company's client strategy.

*** Key New Facts
- Founder's framing: "there's no startup if we don't have clients in the US, and if we have clients in the US, then you're going to go there" — relocation is logically tied to company survival, not a separate perk.
- Company has already relocated someone to Europe (not yet the US) — some relocation precedent exists.
- The role is shifting from pure "claude-first developer" IC work toward a client-facing "solutions" role — broader scope than originally discussed.
- Aner has customer-facing experience as an engineer but doesn't consider himself an expert at solutions/sales-engineering work.

*** Analysis Given
- Equity: 0.5% for employee #4-5 is low-to-middling for that stage/seniority. Estimated 70-85% chance the grant ends up worth $0 — driven not just by startup failure rates (50-75% of seed-stage companies never return anything) but by liquidation preference stacks that can zero out common equity even in a nominal "exit" if the sale price doesn't clear the preference stack. Framed as: treat equity as a free lottery ticket, not part of the compensation plan.
- Risk mitigation: tie personal go/no-go checkpoints to concrete external milestones (Series A target Nov 2026 / March 2027 + buffer), ask directly for real US pipeline data rather than intent, watch for early-hire turnover as a leading indicator, get the relocation trigger condition specified concretely (e.g. tied to signed client / ARR threshold) rather than left as goodwill.
- Given broader "solutions" scope than originally discussed, flagged that 0.5% equity may be worth renegotiating upward if the role mandate is genuinely expanding.
- Interview prep for solutions/client-facing role: reframe existing customer-facing engineering stories, get a product demo ahead of time, practice mock discovery calls, be upfront about the sales-process gap while leaning on engineering credibility as differentiator.

*** Status
Reconsidering the offer given the relocation counter — not yet decided. Next step is presumably an interview/conversation for the solutions-facing role.

** 2026-08-31 — DevOpsDays TLV Talk Prep: NixOS Homelab CFP

*** Topic
Preparing a CFP submission for DevOpsDays TLV December 2026.

*** Key Facts
- Target event: DevOpsDays TLV, December 22, 2026, David Intercontinental
- CFP closes: September 25, 2026 (~25 days from conversation date)
- Talk subject: NixOS homelabbing on a Raspberry Pi, based on ~/projects/selfhosted/homey

*** Research Findings on Past TLV Talks
- No Nix or homelab talks have ever appeared at DevOpsDays TLV (confirmed via 2025 full lineup and 2024 searches)
- 2025 topics: Docker keynote (Solomon Hykes), AI agents in DevOps, Kubernetes AI/ML inference, serverless patterns, Crossplane, cloud costs
- 2024 theme: "engineering horror stories" / postmortems
- NixOS+homelab talks exist globally (FOSDEM 2025, Grazer Linuxtage 2024) but not at DevOps-specific cons — the topic is fresh ground for TLV

*** Talk Framing Decisions
- Framing: "enterprise benefit → homelab translation" at each stage — connects to what the audience cares about daily
- Rejected "GitOps" label: Aner's setup is declarative IaC; only qualifies as GitOps if his pipeline does continuous reconciliation (not just build/test)
- Rejected "for free!" and other clickbaity language
- Five core NixOS benefits to cover:
  1. Reproducibility + no drift (two sides of same coin — rebuild identical system; nothing silently diverges at runtime)
  2. Reproducible environments (dependencies declared, pinned, baked in)
  3. Atomic rollbacks / generations (broken upgrade reverts in seconds)
  4. Single-command deployment (any configured target, one place)
  5. Deployment flexibility (package anything, patch external deps at build time)

*** Final Abstract (agreed)
A Raspberry Pi on your desk is a terrible production server. It's also one of the best learning environments you can have!

NixOS is gaining ground in developer and Linux communities, but its core properties map directly onto problems DevOps engineers deal with every day: reproducibility, declared dependencies, atomic rollbacks, and zero configuration drift. This talk introduces NixOS through the lens of homelabbing. After running real services on a Pi for several years, I've found that even on cheap hardware I can host with enterprise standards, without the overkill.

At each stage, I'll connect a NixOS feature to its enterprise equivalent and show how it plays out on a real home server:

- Reproducibility and no drift — rebuild any system from config; trust that what's running matches it
- Reproducible environments — dependencies declared, pinned, and baked in
- Atomic rollbacks — every change creates a generation; a broken upgrade reverts in seconds
- Single-command deployment — configure once, deploy any target from one place
- Deployment flexibility — package anything, patch external dependencies at build time

Whether you're curious about NixOS for home use or evaluating it for production, this talk gives you a concrete mental model and a working example to start from.

*** Title (pending)
Not finalized. Leading candidate direction: "Declarative Homelab: Self-Hosting Everything on a Raspberry Pi with NixOS" or similar. Needs to be under 100 chars.

** 2026-08-31 — Career Visibility: Using Unused Talent, Audio+ML Project Scoping

*** Topic
How to advance career using underutilized skills; scoping a side project for visibility.

*** Context
Aner decided (99%) against the startup offer. Wants to get ahead at current job or via a strategic move, without high-risk startup path. Has kids, can't trade stability for uncertain upside.

*** Career Advancement Strategies Discussed
- Set a 6-month deadline at Applied Materials for a concrete outcome (Tech Lead title, scope expansion) — if it doesn't happen, start looking.
- Build external reputation: LinkedIn posts, Israeli ML/AI meetup talk, one published piece.
- Target "Head of AI" or "AI Lead" roles at 50–200 person Israeli companies — filled via network, not job boards.
- Get a formal "led X people" line on resume: lead interns, own a cross-team initiative.
- ML + LLM systems fluency is differentiating in Israel; Applied Materials industrial ML background is exotic to most conference audiences.

*** Conference Topic Options Identified
1. ROLL thesis → talk or paper (AUC maximization under label noise)
2. ML in industrial/semiconductor manufacturing (small datasets, real-time, class imbalance)
3. SDR + ML intersection (unique combination from 8200 + Gita background)
4. NixOS for reproducible ML environments

*** Side Project Scoping
Explored several audio+ML project angles (SDR ruled out — hardware import issues in Israel):
1. Ultrasonic protocol detection/classification (18–22kHz, SilverPush/SoniTalk) — interesting but likely too academic, not enough wild deployment to study
2. Acoustic anomaly detection with label noise robustness — extends ROLL thesis to industrial audio
3. Audio-as-SDR platform using sound card (0–96kHz at 192kHz sample rate)
4. Keyboard acoustic side-channel (done to death — Harrison et al. 2023 got 95% accuracy; 2025 papers add LLM typo correction)
5. **Simlish-style procedural speech synthesizer** ← selected

*** Simlish Project (Selected)
- Goal: phonetically plausible speech that sounds like a language but isn't intelligible
- Application: trmn (/home/aner/projects/apps/trmn) — "The Truman Show" as a procedural low-poly life sim
- trmn already has: TinyStories-1M ONNX for character dialogue, SVG mouth/face sprites, deterministic PRNG, Nix packaging
- Simlish fills the missing piece: characters that audibly "speak" with emotion-appropriate prosody
- Technical approach: prosody extraction from LLM text → fake phoneme inventory → formant synthesis WASM vocoder → emotion conditioning from character traits
- Size target: <1MB WASM, browser-native, no server
- Research angle: "Procedural character voice synthesis conditioned on LLM output and character traits" — trmn as the demo
- Status: not started, scoping only

*** Key Facts About Aner's Background (newly documented)
- MSc thesis: ROLL — novel AUC-maximizing loss under label noise (KDE-based, published-quality)
- 8200 IDF: built SDR infra and wrote the GNURadio curriculum for the intelligence corps
- Gita Technologies: WiFi/Bluetooth protocol security research, ML for cross-network target correlation
- Homey: production NixOS self-hosted home server (serious infrastructure project)
- Strengths pattern: rare breadth (SDR + cyber + ML + systems), full end-to-end ownership, teaching instinct

** 2026-08-31 — Career Decision: Applied Materials vs. Cyber Startup

*** Topic
Whether to leave Applied Materials for a first-5-employee offer at an Index Ventures-backed cyber startup.

*** Key Facts Discussed
- Current: Applied Materials, 39k NIS/month + ~30k USD/year RSUs (4 years). ML/DL researcher role. Unhappy with day-to-day and org visibility, but stable.
- Offer: Cyber startup, employee #4-5. 46k NIS base + 0.5% equity. Role titled "claude-first developer."
- Startup: $10M seed, majority from Index Ventures (turned down other top VCs). Series A targeting Nov 2026 or March 2027. Founder is trusted friend, former VP. Co-founder established in cyber field.
- Index Ventures raised $2B across coordinated seed+venture+growth funds in 2026 — structured to follow on into Series A.

*** Key Points Reached
- Financial delta is smaller than it looks: 39k + ~9k RSU equivalent ≈ 48k effective vs. 46k offered. Salary "raises coming" are promises, not contracts.
- 0.5% after dilution through A/B/C rounds realistically lands at 0.2–0.3% — still meaningful at $1B exit.
- Seed→Series A base rate is 15-20% in 2026 market, but Index's coordinated fund structure meaningfully improves those odds if they lead the A themselves.
- "Claude-first developer" concern is legitimate — but the title on resume is "founding engineer at Index-backed startup," not the internal job title.
- The real red flag: role feels like a step down AND Aner wants management, not more IC dev work.
- Fastest path to management is early startup that grows — not Applied Materials where management is blocked.
- Even if startup fails: founding engineer at Index-backed company is a more interesting resume than 3 more years at Applied Materials with no visibility.

*** Career Path Discussion
- Aner wants engineering management. Has informal experience (project leadership, task delegation) but no formal title.
- Cold-applying for manager roles is hard. Better paths: Tech Lead role as bridge, mid-size Israeli company with real promotion track, Head of AI at small company.
- AI orchestration / LLM systems architect salary now comparable to ML researcher at senior level in Israel (~38-55k NIS/month). The gap has closed since 2023-2024 LLM demand surge.
- Aner's ML/DL background is additive for AI systems roles, not a liability.

*** Action Item
- startup-talks-prep.md created in project directory with questions to ask in next founder conversation.