​

Hey everyone, a few months ago I posted here asking what you would do if you had a limited window of time to completely change your career and build a future in IT/cybersecurity.

Quick update: I kept going.

Since then I’ve earned CompTIA A+, Network+ and Security+, built a small homelab with Windows Server/Active Directory/Linux, continued studying Computer Science, and I’m now about to start my first real IT job as an IT technician in healthcare.

So I’ve finally broken into IT.

My original reason for choosing this field was always cybersecurity, especially Red Team/offensive security. But the more I studied the market, the more I realized that trying to jump directly into pentesting with a couple of certifications and no real IT experience probably wasn’t the smartest path.

Now I’m trying to decide what to build toward over the next few years.

One roadmap I’m considering is roughly:

IT Support → Cloud Engineer → automation/AI → Cloud/Identity Security → eventually Offensive Security / Red Team

The idea is to first build a strong, marketable and financially stable technical career, while continuing to develop security skills until I’m experienced enough to seriously pursue offensive roles.

Cloud interests me because it would force me to develop skills in infrastructure, networking, Linux, identity, Python/PowerShell, Terraform, containers and automation — all things that should also transfer well into security.

At the same time, AI is changing the industry quickly, so I don’t want to spend the next 3–5 years following a path that is already becoming obsolete.

So my question now is different from my original post:

If you were in my position today, having just entered IT, what would you build toward next?

Would you go Cloud/DevOps first and security later? Would you go directly toward security? Are there emerging areas involving cloud, AI and cybersecurity that you think will become particularly valuable?

My priorities are basically:

long-term demand + financial stability + strong technical skills + eventually getting as close as possible to Red Team/offensive security.

I’m especially interested in hearing from people who already work in Cloud, DevOps, Security Engineering, Pentesting or Red Team.

The first step was getting into IT. Now I want to make sure I choose the right direction for the next one.

been running qwen3.8-27b-instruct-uncensored-v2 (q4_k_m gguf) on my m5 pro in atomic agent for two weeks now in a role i don't think anyone else has tried: not generating the final text, but SCORING and GATING text generated by another model (claude opus via api).

the setup in one sentence: 37 twitter accounts post tweets written by opus, and before each one goes live, qwen reads it against the account's persona prompt and gives it a 1-5 score.

why i picked qwen specifically instead of mistral or phi or whatever: base instruct models flinch at that. the uncensored variant just... doesn't care. no internal debate about whether the audience will be offended. which is exactly what i want for a judge role because the JUDGE should match the voice it's evaluating, not impose its own safety layer on top.

now the technical stuff since i know some of you care:

running on llama.cpp server mode, metal backend, m5 pro 32gb:

./llama-server -m qwen3.8-27b-q4_k_m.gguf --port 8080 --ctx-size 8192 --threads 16 --n-gpu-layers 99 --flash-attn --parallel 4

memory: ~15gb weights + ~2.5gb kv cache (8192 ctx × 4 parallel) = ~17.5gb peak process. leaves 14gb for os + chromium instances. no swapping in two weeks.

throughput for my specific workload (scoring calls are prefill-heavy, decode-light):

• single call: ~500 tok in → 30 tok out ≈ 1.2s
• 50 calls with --parallel 4: ~16s wall time
• decode speed at q4_k_m + flash attn: 38-42 tok/s (doesn't matter much here since output is only 30 tokens)
• prefill: 200+ tok/s so the input side is fast

the scoring rubric i give it each call is short:

"does this sound like [persona] actually talking? would they say this in a group chat? actual opinion or hedging? rate 1-5, one line reason."

no mention of "brand safety," "audience appropriateness," or "tone consistency." those are cloud-model guardrail words that make even local models start hedging their own judgment. i specifically excluded them after watching qwen base-instruct give a 3 to a perfectly on-brand tweet because it was "slightly informal for a professional audience."

q4_k_m vs q5_k_m — i tested both for a day

for SCORING (classification task), quality difference was negligible. both gave the same scores on my test set of 50 tweets. memory went from 15gb to ~17.5gb which ate into kv cache headroom and made me nervous about parallel slots. stuck with q4.

for the occasional REWRITE task (every other day, ~15-20x/week, where qwen writes the hot-take itself instead of just scoring) there might be a slight quality bump at q5 but at 3s per call and 20 calls a week it's not worth the memory cost. if you're doing more generation-heavy workloads probably go q5.

feedback for the qwen team:

the thing i'd tell the qwen team if i were sending feedback: the uncensored variant is NOT just "less filtered." it has a different DEFAULT register. base instruct defaults to "confident professional" even when prompted otherwise. uncensored defaults to "person with opinions who happens to be typing." for a judge role that second default is way more useful because you want the judge to match the voice being evaluated, not impose its own corporate layer on top of it.

also: the model handles structured output (json scores + reason strings) reliably at q4 without any special prompting tricks. just say "output json: {score: int, reason: string}" and it does it. maybe 2% of calls come back slightly malformed (extra comma, missing quote) which my script catches and retries once. not bad for a 15gb quantized model doing 50 calls per batch cycle.

curious if anyone else has tried uncensored variants specifically as judges/gates rather than generators. feels like an underexplored use case and i'd love to hear if base-instruct models actually hold up better or worse in that role for your workloads.

fwiw this local judge / cloud writer split is built into atomic agent as fusion mode: atomicagent.io

Weekly forum post: Let's discuss current projects, concepts, questions and collaborations. In other words, what are you hacking this week?

There’s a WhatsApp broadcast channel for my school and city dedicated to public shaming (*funas*); for about six months now, they’ve been posting daily accusations against innocent minors. There have already been cases of boys and girls who were targeted and wanted to take their own lives because of the things said about them—regardless of whether the accusations were true or not. I need to do something, since neither the school administration nor the police have managed to take any action over the past six months. I need this to stop and am asking for your help to take action; I can share the channel link if you’d like—it has just under 1,000 followers.There’s a WhatsApp broadcast channel for my school and city dedicated to public shaming (*funas*); for about six months now, they’ve been posting daily accusations against innocent minors. There have already been cases of boys and girls who were targeted and wanted to take their own lives because of the things said about them—regardless of whether the accusations were true or not. I need to do something, since neither the school administration nor the police have managed to take any action over the past six months. I need this to stop and am asking for your help to take action; I can share the channel link if you’d like—it has just under 1,000 followers.

Body: Hey everyone, I'm a BCA student and I want to focus specifically on Web Application Penetration Testing. While I have basic knowledge of Linux and networking, I want to follow a focused, step-by-step roadmap to go from a complete beginner in web hacking to becoming job-ready. I want to avoid getting overwhelmed by random tutorials and stick to a proven path. For those working in the field or experienced with web pentesting: What does a complete, zero-to-hero roadmap for Web Pentesting look like? Which specific free resources or labs should I stick to without getting distracted? How should I practice to build my skills effectively? Any structured guidance would be greatly appreciated. Thanks in advance!

I am just a beginner in cybersecurity and ethical hacking and I need an AI study buddy to guide me through basic concepts, CTFs, tool usage (Nmap, Wireshark, Metasploit, and so on), and network traffic at the level of packets.

Commercial chat assistants tend to block any security-related questions and refuse to answer how something works. For this reason, I have chosen the local approach.

My hardware specs:

GPU with 12GB VRAM

System RAM with 32GB DDR5

I can put the quantized 8B to 14B models fully in VRAM or load them partially, in case it is beneficial to sacrifice token processing speed for that.

What models or fine-tunes would you recommend me that know the technical stuff but do not have overly strict guardrails?

Thank you my Latvian brothers. Except 2FA i have no idea why this is a common thing in Latvia. Maybe someone can explain.

please dont waste my time

I've done some things before using Slayer Leecher, SQLi Dumper, dorks, and OpenBullet, but I quit for years. Now I'm trying to get back into it, but I don't know how things are going these days. Things change so fast, and security gets more advanced.

I need to know what has changed, what the new tools and methods are, and if there are any good resources or groups I can join.

me surgió la duda…

Well, hello, im basically a newbie to hacking and am looking to start learning starting, well, now, to be honest ive had an intrest in it ever since childhood and looking forward to finally start learning it, so the question being uh...

where do i start? - i have 0 experience or real knowledge, but i am willing to learn and invest my own money so no worries about that.

should i switch to a linux distro? - ive heard kali has really good cybersecurity and black arch, theres also like arch made specifically with pre - build tools that i can use and reverse engeneer to figure out how they work and how they bypass stuff, or well, maybe build my own tools, but i got no idea how/why, and i dont really wanna do it on windows since well, first of all bloat larp 😭 but also secondly because i tried arch and i fell in damn love ( I STARTED IT WITH 0 KNOWLEDGE AND UNINSTALLED AFTER A WEEK BUT THATS BECAUSE I DELETED MY WINDOWS BOOT AND ARCH WAS FOR SOME REASON BRICKED IT JUST LIKE WOULDNT EVEN LET ME INSTALL FIREFOX)

are there communities on discord or telegram or forums i can visit to start getting an idea on what to try or make?

and of course, yall guys have any tips ( OR GIRLS SORRY ) and thank you for ANY reply, thanks again

Are there any courses or programs you would recommend for learning malware development?Or any good books