Sharing Vulnerabilities

Sharing Vulnerabilities

Speaker: Clint Gibler

Conference: BSidesSF 2025 — April 26-27, 2025, San Francisco

YouTube: Watch the full talk

Reading time: ~8 minutes

TL;DR

In his fifth BSidesSF talk, Clint Gibler — security researcher and author of the TLDRsec newsletter — makes a case that interpersonal skills, emotional intelligence, and the willingness to be vulnerable with other people can meaningfully improve both career trajectory and personal relationships. Through personal stories about failure, encouragement, friendship, and family, he argues that showing up as a whole person rather than a professional resume is one of the most impactful things a security practitioner can do.

Introduction

Security conferences are, by tradition, technical. People come to learn about threat models, exploitation techniques, detection engineering, and defensive architectures. Clint Gibler's fifth BSidesSF appearance breaks that tradition deliberately — and justifies doing so.

His talk, formally subtitled "Emotional Intelligence Isn't Just a Coping Strategy for the Logically Impaired and Other Lessons I Should Have Learned Earlier," opens with a direct acknowledgment: he chose this topic over another technical talk because he believes it would have meaningfully improved his own life if he had encountered it five to ten years earlier. The security community has no shortage of technical talks. It has a shortage of talks that help practitioners be better humans to one another — better colleagues, better friends, better partners.

The talk is structured around personal stories, each illustrating a principle. It is not a soft-skills lecture. It is a senior practitioner publicly sharing failures, embarrassments, and experiences of grief, in a field that often rewards projecting competence over admitting uncertainty.

▶ Watch: Introduction and Clint's thesis on interpersonal skills (00:00)

The Origins of the Problem: How We Learned to Prioritize the Wrong Things

Gibler traces his own de-emphasis of emotional intelligence to its roots. Raised by results-oriented parents who expected A's and measured success in achievement, 16-year-old Clint described their parenting style to his guidance counselor as "results-oriented" — and his parents were delighted with the answer. This upbringing, he argues, shaped a worldview that prioritized academics and career outcomes in ways that were deeply useful professionally but slower to develop interpersonal awareness.

He frames this not as a criticism of his parents but as an invitation for the audience to examine their own formation: what did your childhood instill in you about what matters, and are all of those beliefs worth keeping?

The broader observation is that STEM education — and security specifically — systematically rewards analytical thinking while providing no framework for emotional intelligence. Most practitioners arrive at emotional intelligence late, if at all, and often only after enough interpersonal failures to force the issue.

▶ Watch: Background on what shapes our values and priorities (08:00)

On Failure, and Why Sharing It Matters

One of the talk's structural choices is foregrounding failure. Gibler lists his: rejected by most PhD programs he applied to, most conference paper submissions rejected, zero-for-three on Google job applications ("which you can check my math, but I believe is a zero percent success rate"), and a 2020 Forbes quote predicting that machine learning in security wouldn't be significant — an opinion he reversed in a subsequent BSidesSF talk.

The point is not self-flagellation. The point is that success is non-linear, failure is universal, and the most successful people in any field have failed repeatedly. Presenters at conferences look like they always win; the reality is that everyone at the front of the room has eaten a significant amount of humble pie to get there.

Gibler's message: "You are enough. Wherever you are right now, whatever you know — that's totally fine and we're all in this process and learning and growing together."

▶ Watch: A catalog of Clint's failures and what they teach (10:01)

The Power of Encouragement: A GitHub Actions Supply Chain Story

The talk's most concrete professional story involves Adnan Khan, a researcher who discovered a vulnerability allowing him to backdoor GitHub's hosted runner base images — a finding that, if exploited, would have enabled a supply chain attack against any GitHub customer using hosted runners. Gibler covered this work in his TLDRsec newsletter and cheered from the sidelines as Khan, John Stiwinski, and colleagues went on to find a cascade of related vulnerabilities, eventually presenting at Black Hat and DEF CON.

When Gibler and Khan met in Las Vegas that summer, Khan told him that being featured in TLDRsec had meaningfully motivated the team to keep pursuing their research arc. Stiwinski confirmed the same thing: community recognition convinced Praetorian to allocate more research time and helped the team build confidence to develop new tooling.

Gibler's takeaway: he had no idea that an offhand newsletter mention was doing this work. Encouragement compounds in ways that are invisible to the person offering it. The principle he draws: choose an area, go deep, apply that expertise at ecosystem scale — and tell people when they're doing great work. Earnestness, he argues, is underrated in a professional culture that often valorizes being aloof.

"You don't need permission to be awesome, but if you think you do, this is me giving you permission." — Dan Kaminsky, quoted by Gibler

▶ Watch: The GitHub Actions supply chain story and the power of encouragement (12:01)

Showing Yourself: Finding Your People

Gibler tells two stories about authenticity as a discovery mechanism — how being yourself draws the right people toward you and filters out mismatches.

The first involves his friend Tanya, a keynote speaker and bestselling author who was struggling to find a life partner because she felt her accomplishments were intimidating. Gibler's advice: lean into it. Don't dim your light to attract someone — find someone who is drawn to the light. She followed the advice, found a long-term partner, and eventually got engaged.

The second is a story about meeting a stranger at AppSec California. A woman named Tanya (the same Tanya) simply walked up and said hello. That casual conference hallway moment became a lasting friendship spanning conferences worldwide. The reminder: conversations you have at BSidesSF today could be with someone who becomes a close friend or colleague in five years. Gibler's suggested opener: "What's something cool you've been working on recently?"

▶ Watch: Showing yourself and finding your people (18:01)

The Vulnerable TCP Handshake: A Framework for Deeper Connection

Gibler introduces what he calls the "Vulnerable CP Three-Way Handshake" — a deliberate riff on TCP's SYN/SYN-ACK/ACK:

1. Share something vulnerable — something slightly uncomfortable to disclose
2. The other person mirrors it, or at least acknowledges what you said
3. A deeper level of trust and connection is established, enabling a richer communication channel going forward

This framework appears across two personal stories. In the first, Gibler realized he was struggling in a romantic relationship and — feeling genuinely awkward about it — reached out to professional colleagues he barely knew, asked for their stories about relationships and their feedback. Nearly all of them said yes. They shared candidly. He felt less alone. Those professional acquaintances became closer friends because of a conversation that felt vulnerable to initiate.

In the second, at Daniel Miessler's house, Gibler admitted he was irrationally jealous of the close friendship Miessler had with Jason Haddix. Miessler's response: he was, unbeknownst to Gibler, feeling the same way about a different friendship of Gibler's. Mutual admission of an embarrassing feeling made both of them feel better and deepened the friendship.

The principle: someone has to go first. Vulnerability is asymmetric in initiation but symmetric in benefit.

▶ Watch: The vulnerable handshake framework and friendship stories (28:02)

On Family, Time, and What Actually Matters

The talk's final section is the most personal. During the summer before Gibler's last year of graduate school, he learned his father's lymphoma had returned — a recurrence after years of on-and-off treatment stretching back through high school and undergrad. Faced with uncertainty about how much time remained, Gibler ended his internship at Lookout early and delayed returning to grad school to be with his family.

Both his manager and his advisor were understanding. He describes this as one of the decisions in his life he is most glad he made.

What he did with that time: interviewed his father over dozens of hours, asking about his childhood, his motivations, how he saw the world. His father's response was to prepare a dense two-page Excel document organized by year. ("No paternity test needed," Gibler notes.) In a few weeks, Gibler says he grew closer to his father than in the prior twenty-five years combined.

The practical exercise he offers the audience: find someone in your life you want to know better — a parent, a mentor, a friend — and interview them. Ask not just what they did but why. How did they think? What drove them? Record it if both parties are comfortable. The finiteness of life, visualized through the Wait But Why "Your Life in Weeks" framework referenced earlier in the talk, makes the case for doing it now rather than later.

▶ Watch: The family stories and what they reveal about what matters (34:02)

Notable Quotes

"I think the most successful people also fail a ton, and failure is not permanent." — Clint Gibler at 12:01

"By being yourself, you can help find your people. And conversely, if you don't show yourself, how will your ideal person or company know when they've found you?" — Clint Gibler at 20:02

"What's the best use of my time, my life right now?" — Clint's father's card, quoted at 46:04

Key Takeaways

• Analytical skill and emotional intelligence are not in competition. The security field systematically develops one and neglects the other; the practitioners who cultivate both tend to have more impact and more satisfying careers.
• Encouragement compounds invisibly. A brief mention in a newsletter or a word of acknowledgment can change the arc of someone's research or career without you ever knowing it happened. Telling people when they're doing great work is a high-leverage action.
• Being authentic attracts the right people. Performing a curated professional identity filters out the very people who would value you most. Leaning into what makes you unique — including your non-security interests — is how you find your community.
• Vulnerability initiates connection. Someone has to go first. Sharing something slightly personal gives others permission to do the same, and the resulting conversations tend to deepen relationships more than years of professional interaction alone.
• Not all time is equal. Medical emergencies, family milestones, and keystone moments in the lives of the people you care about have a time-limited claim on your presence that no professional obligation can fully substitute for. Prioritize accordingly.