Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Hacking the Novel: “I’m a technical person, therefore I create.”
Guest:
Ryan Rutan
Published:
Updated:
Duration:
24 min
Episode summary
Ryan Rutan has worked in tech support, as a computer repairman, application developer, software engineer, entrepreneur and head of community… and most recently, fiction writer. Listen to this episode to hear what inspired Fork This Life, a novel that follows the life of a teenager growing up with the early internet of the 90s who eventually gets into hacking, and how it relates to today’s cybersecurity challenges.
Get the inside story of how working in tech support informed Ryan’s career in cybersecurity.
Nerd out on nostalgia about the nineties tech scene.
Pick up tips for developing your creative voice.
Get tips for how you can help spread a culture of good security hygiene.
Secure your inner circle Ryan says people who understand security should pay it forward by getting friends and family to use password managers, check links before clicking, and ignore calls from unknown numbers.
From sledgehammer to a thousand cuts He contrasts 1990s threats with today, where any of countless websites holding your data could be the weak link that exposes your identity or damages your credit.
Security is still a bolt-on Ryan argues the industry will not reach herd immunity from insecure software until most builders design security in from the start, using the secure libraries now available and knowing where their dependencies come from.
Accountability drives better behavior He wants organizations that knowingly leave a security problem unsolved to be held accountable, and incentives such as tax benefits to help small and medium businesses adopt security services.
Topics covered
Synack Red Team
Thought Leadership
Notable quotes
I would say this book is 99.9% nostalgia with a couple of adverbs.
I'm a technical person. Therefore, I create and I create… they just go hand in hand.
…it's a death of a thousand cuts from a million different websites…
…we're not going to have herd immunity from insecure software and development until most people will bring and build secure software from the beginning…
Questions this episode answers
What is Fork This Life about?
It is a novel set in the 1990s about a teenager growing up with the early internet who gets into hacking. Ryan describes it as part technology book, part romantic comedy, honoring ISP tech support workers of that era. Read this section
What was the tech environment like in the 1990s?
Ryan says it was even more fast-paced than today, with versions released quickly and few ways to spread information beyond IRC, Usenet, and Slashdot. He argues many self-described experts were faking it until they made it. Read this section
How can security professionals help ordinary users?
By helping the people they influence follow simple best practices, such as using a password manager, double-checking links, and not answering calls from unknown numbers. Read this section
How do we get developers to build secure software?
Ryan favors accountability for organizations that knowingly ignore security problems, plus investment and incentives that make security services easier for small and medium businesses to adopt. Read this section
About the guest
Ryan Rutan has worked in tech support, computer repair, application development, software engineering, and entrepreneurship, and at the time of recording led community at Synack. He started programming at 13 and as a teenager worked as a BBS sysop and in ISP tech support in the 1990s. He is the author of Fork This Life, a novel about a teenager growing up with the early internet, and previously wrote a children's book.
And I'm Jeremiah Roe. Today, we're talking to someone we know pretty well because we work with him. Ryan Rutan is the director of community at Synack, but he's not here to talk about that. Ryan has a new book out called Fork This Life that follows the life of a teenager growing up in the Internet in the nineties who eventually gets into hacking.
Yeah. It's a really great read. I will admit that I didn't, necessarily have the same experience growing up as the main character in this book, but it was really cool to talk about those days of hacking and how an entire generation got into cybersecurity. Who knew that working at a tech support helpline was so influential? This episode is gonna be really fun. But first, here's a quick word from our sponsor.
WE'RE IN is brought to you by Synack, the premier crowdsource platform for on demand security expertise. Synack delivers twenty four seven testing, intelligence, and vulnerability management from a global network of researchers whose work is enhanced by smart technologies to accelerate your critical cybersecurity missions. And now here are your hosts, Bella and Jeremiah.
We're excited to talk a little bit more about Ryan's book, but we're also excited to learn a little bit more about you. You know, I understand you've been in this industry for a bit. You've got a lot of experience. You wrote a book. Tell us in your words, who is Ryan Rutan?
I I would say, you know, to almost quote Jonathan Moxon from Varsity Blues, I would say, I'm just one man. No. There is a... I like movies. I think the biggest thing for me is I'm just all about technology. I started with computers around eight years old, started building my first one around 11, started programming at 13. By 15, I had kind of earned a reputation in a small town as being one of a handful of teenagers who knew what these computers could do and what they... You know, how to fix them and whatnot. You know, as a result of that, I got a job as a software manager in town. So again, it was kind of weird being 15 years old, but also being kind of at the heartstrings of where all software was bought in town at the time. So it was kind of an interesting thing. From there, I pivoted to like a BBS sysop role, the local BBS, which ended up turning into an ISP, which I ended up being tech support, web admin network support.
We just being thrown in at, you know, '16, '17, helping grow that business. You know, from there, I went to college, where I was my, I was with a roommate. We were fortunate enough to find someone in our same apartment who actually ran a similar startup ISP in the town that we were moving to, and they needed some help. So we jumped in and did the exact same thing there, picked up more sales, more front end stuff, learned some more languages, did, you know, NAT firewall, custom intranets, network sidery. Mean, all these things that I had never really been taught how to do. I just kind of picked it up and ran with it, given instruction manuals, and
I did not. You know, I... I'm actually a pretty decent chef. If you put me in an instant partner room, there's some good magic that comes from that. But I
work in tech. I consider myself pretty technical and not very creative. And I think that's something that I've been exploring myself as well. And thing that I'm trying to reconcile is like, how do our creative brains and our tech brains... Where do they meet? And it seems like you might know a little bit about that.
The biggest thing for me was leveraging my strengths, which is in in the modern... I don't think if I if I was born twenty years earlier, I would probably have written a book because the the ability to write a book, the barriers to entry into that was was substantial. But given the way the marketplace was, you know, in 2015, I actually wrote a children's book back then as a kind of like a pilot proof of concept just to see if it, you know, if it made sense. And the technologies were there, and I knew that if five years later, they would be a little bit better. And I was like, well, if I'm going to do this, might as well do it now. You know, you need to tap into the, you know, the creativity as a byproduct of who I am as a technical person because most of the technical... Or actually, I would say they're reciprocal. I create because I I... I'm a technical person. Therefore, I create and I create... You know, they just go hand in hand.
How did you go from, you know, computer repairman, IoT inventor, software engineer, and now head of community to writing a children's book and a and a novel?
I think it was something around the the the element is I really wanted an outlet for my creativity that I wasn't getting from a technical side. You know, when in a theater production or, you know, you're in a cast or whatever, you have a lot of scheduling conflicts. There's a lot of things where you have to work with other people's schedules, and my schedule just wasn't very flexible. So I was seeking an outlet that would allow me to be creative, but also kind of work in the way that I could. And so for me, the book was a very easy thing. I was the the sole author, the sole ideation person for it, and I was like, I can control when it goes out, if it ever goes out. So it was just one of those things that started out as a, hey. Wouldn't this be funny if... You know? But ultimately, when it when it kinda all came down to it, I think it kind of was a result of... This last one was a result of a midlife crisis. I I was turning 40, and I kind of always thought as a kid, there were some things that I thought I would always do in my life.
One of them was become a published author. At the time when I made those high level goals, you know, as a joke, I kind of thought, oh, that's gonna be a technical manual. That's gonna be an O'Reilly book or or whatever. And it never dawned on me that it would ever be something creative like this. In high school, I was not a fan of English. It was not something I would ever consider myself doing as a recreation activity. But to be honest, I was coming up on the forty forty mark, and it was passively in the back of my mind that I wanted to write something bigger, something that's a little bit more, you know, substantial. And I actually just read Ready Player One from Ernest Cline, who's an Austin author. And it was a book that was really interesting. The tone of the book was written in a way that I thought was very approachable. It resonated with how my mind liked to like to, you know, articulate out thoughts, and I just really liked it. And so after I read it, I got really excited because I didn't...
I don't read a whole lot. I read technical manuals more than I read for pleasure for the most part. And so I thought I would write about this really pivotal time in my life where because of what I was able to capture and what I was able to understand and just the opportunities of where I was at the time and happened to slip into, oh, hey, here's this cool ISP that needed someone with exactly my skill sets and was willing to pay me a decent rate and, you know, and they were able to benefit, and I was able to benefit. Those things happen still, but at that time, that was really, really difficult. So, yeah, I liked romantic... I like romantic comedies, and so that was... I wanted something that was a technology book, part romantic comedy. I worked at, like, a radio... Video music software store, so I kind of always did that Empire Records. High Fidelity theme always kind of resonated with me. So I really wanted to write a techie book that was a montage to that era that highlighted the ISP tech support people who, if you've ever been in ISP tech support back in the nineties, there's bad...
There's, like, you know, medals of honor that need to be, you know, given out to some people because it it was not a great time and not a great profession. And so I figured this would be a really fun topic that, you know, nerds would really get and those who lived it would appreciate the detail that I was willing to put into it.
So you you keep referencing, you know, the nineties, your childhood, and and you mentioned earlier that you got into tech at a very young age. And and I think, you know, the nineties is... The nineties tech scene is definitely centered in in this book. Can you tell us a little bit more about what the tech environment was like in the nineties?
I was a member of it, and I didn't know it at the time. I was kinda just doing my thing. And then I found out I kinda backed into realizing, oh, I'm a technology professional. But I would say fast paced. I would say even more fast paced than today only from the fact that, you know, today, like, if a new technology is released, you can always learn... Lean on the older technology, right, because it's out for a while. Back then, one... It was one point o, 1.1, two point... Like, they were rolling out so fast. There was no mechanism to get the information out. I mean, most of us were... You know, I was on IRC or Usenet following, you know, finding the people that I followed all the time, and they were the ones that I... They had the pulse on... The finger on the pulse on what was interesting and what was good. And so you'd, you know, listen for them or, you know, Slashdot was, you know, amazing at the time, but there was... In terms of, like, all the mechanisms we have today to get information out and make people aware, no one really knew.
I would I would argue that most people back then who said they were experts were just faking it till they made it because at the end of the day, they just had to be good enough to not have people realize or call them on it that they didn't know.
No, it was just great. I mean, again, like I really... Again, if I was born a couple of years earlier, was older a little bit sooner, I probably would have had a different trajectory because it would it would have been so easy to get caught up in in, you know, making making, you know, interesting, odd mistakes, right, that you would think, oh, wow. This is hilarious. This is fun. But technology was evolving such a fast pace. You know, people were trying to sell it. People were trying to build it and sell it, and the... And there was no consumer expectation for it. It was just like, I need a computer, but why? I wanna get online, but why? And no one... Everyone knew they needed it. They knew they wanted it, but they didn't know why. It was just because the other person had it. And when you mix all that together, you just get a bunch of a bunch of people running around pinging each other online, and and they... It's it's it's really interesting.
There's no one character in a book that is any one person. I've taken stories and experiences and traits of people, and I've mixed and matched them to make compelling characters and to make characters that I feel have a good amount of depth. And so trying to provide those those oddities in a way that helps me tell the better story. But most of the details, if you look at some of the rants that I go on in the book where, you know, that are just odd things, that you would imagine, why is there why is there six paragraphs on some, you know, subtle detail around the 1990s song that came... Like, there's a story back there, and there's a reason why I'm going into that depth because there was a nuance element that really made that just imbue itself in my memory.
So as I was listening to you discuss a lot of the background around Fork This Life and how it transpired and some of the processes behind how you hacked the process of writing the book. Inside of your blog post, you discussed your voice and how you how you really focused on your voice. I was wondering if you could maybe touch on a little bit of that.
Telling a coherent story that's this long was going to be a big endeavor. But I think to do it successfully in a way that I felt was authentic to the way that I experienced the nineties was to be in a way that really had, you know, embraced time jumping, embraced like sub narrative thought, and overall just it didn't create a linear... Like, I didn't wanna start the book linearly and just kind of go. I wanted it to jump around because to be honest, like at no point in the nineties did I ever feel that I was on any one path. I was simultaneously running down six, seven, eight different things at any given time, whether it was a creative focus in theater, whether it was, you know, ISP support, whether it was trying to start a business, whether it was trying to, you know, work at a software store. Like, all these different aspects of my persona were being ripped apart, and I was trying to hold on and just seeing which one of them would win out.
You know, for me, it was... It ended up being the tech pioneer, entrepreneur type spirit that kind of let out. And over the years, I kind of assembled the pieces of that persona back. And so for me, I wanted to make sure all of those were represented in the book.
All of the ISP support stuff, the two that come to mind right away, there's a scene in there or there's a a segment in there where I talk about a tech support person calling... Someone calling tech support and trying to get online, being on the phone for hours with this person, trying to get them connected. They think they're on a computer the entire time, and in fact, they're on a WebTV. And it was something that was brand new to the time, you know, regardless of how many times I... And this one actually is I can say was me. Every time I asked the person, are you sure you're on a computer? Are you sure that you see the click the start button? Are you sure you this, like this? And it was just one of those things where, like, I could not believe, and I was so frustrated. My... The my... The guys that were in the room with me, they were just laughing at me. And what was really cool about that story was, you know, it is true that everything about that that interaction, you know, she she signed up.
She prepaid for three months. We tried to get her set up. I spent three or so hours on the phone, couldn't get it to work. And we finally figured out why and respectfully said, okay, thank you. Here's your refund. And then ushered her off to a a WebTV compliant provider. And I think about four months later, this woman walks in. I had never seen her before, but she walks in, and I mean, her voice just sent chills in my brain. I was like, oh my god, this is a triggered moment. It was like, oh my gosh. And I knew exactly who she was. And she came in and said she wanted to buy a year's account. And she went and bought a brand new computer and she had gone to try this other ISP and they just weren't as patient. They weren't as nice. And she came in and she said really nice things about me to my boss. And it really made me feel good. To be honest, it's one of the, you know, I've had a couple of experiences similar to this, but this is one that stands out to me is I always try to have as much empathy and patience as possible.
I like to move fast. I like to get going really fast, but you never know whatever someone else is going through. You don't know their story. Both, that was a moment to me as a kid, I was 17 or 18 at the time, I did not have a very deep empathy well to pull from. I was very much like, oh my gosh, you know, you're either you know or you don't know. And those were the worlds that existed.
When I started using the Internet, the things that I was exposed to, I didn't have to tinker with and try to understand. They were made for me. They were made to be used by like the average person. And it's it's been it's it's really interesting to sort of compare those experiences.
Yeah. I I would I would agree. Like the internet, when I remember my first... I can still remember. I went to shakespeare.com. That was my first website I ever visited. My friends and I were trying to figure out how to do TCP/IP setup for our ISP. We'd just gotten all the boards set up. We were dialed in and we were trying to get it going. I had a Popular Mechanics magazine next to me, and that was advertising that website. And you go there, and it was just all the works of Shakespeare. And and at the time, was like, oh, this is cool, but it really didn't do much. It was an... It was information, and that was as good as it was. There wasn't ecommerce. There wasn't all this stuff. So it was the e commerce and all the things that we have today came in drips and waves. Whether it was good or bad, it came. And so there was a lot of people having to adapt themselves to what the Internet could provide as the Internet providing what they needed. So it's very, very different frame of mind.
You have seen such a broad range of technology over this time period. What is it now that tech is like we said, at our fingertips everywhere, ingrained in every part of our lives? What are the implications for the people that work on securing technology?
It's getting harder every day in terms of... For me, at least, it's very... It's becoming more and more difficult to try to keep pace. So, I think for me, the the biggest importance that we have today is that the people who know and understand what it means to keep things secure, to keep things protected, it's an incumbent upon them to kind of pay it forward as much as possible. Like, I'm a big fan of, like, you know, secure your inner circle. Find your people. Find the people that, you know, that you have influence over that will jump when you say jump and make sure that they are doing the, you know, the best practices that are available. You know, the the simple ones. Use a password use a password manager. You know, use double check links before you click them. Like, don't open... You know, answer calls to crazy... You know, from crazy numbers that you don't know. So, like, there's some basic things you can do, and I think if everyone did that, I think it would... The world would be a lot better. I think, unfortunately, like, we are in a world right now where security back in the nineties was much more like, you know, your your death was gonna come from a swift sledgehammer to the head, and now it's just a, you know, it's a death of a thousand cuts from a million different websites that you never know that you you never knew that that was going to be the weak link that took down your identity or that, you know, ruined your credit score or whatever.
So in my mind, like I said, it's... I don't think it's anything necessarily super nuanced. I think that it's just incumbent upon everyone to make sure that they have, you know, have that experience. I think the... I always joke, but Mad-Eye Moody's constant vigilance is the thing that I always think about. You know, it's common sense in getting that to proliferate out to everybody.
Yeah, I just finished that book a few weeks ago. And it's interesting that you talked a little bit about like, you know, what did you say, death by a thousand cuts from a bunch of different websites. I like that a lot. And I think that really is the kind of world where we're in. There's so many maybe minor threats, but all over the place. You talked a little bit about getting kind of average people, citizens to understand how to secure themselves. With all of that in mind, what do you think is the future of cybersecurity as this continues and as technology changes?
I think the future is really going to be interesting. Would say that where we are as an industry and technology is we're in a precipice in a transition where security is is being acted on as a bolt on. It's like, we're going to build software. Oh, wait. Oh, we need to make it secure. Okay. Let's do that. And I think that there are, you know, the leading technology innovators out there who have already switched, but it's not going to be a solution until majority of them. Like, we're not going to have herd immunity from insecure software and development until most people will bring and build secure software from the beginning, like, you know, making sure that, you know, they make... That they don't capture PII if they don't need to, that they secure endpoints and encryption at rest, and they do all the basic things that are now available, like, off the shelf. Like, it's not like you have to... You know, I hate to go back to the nineties. The nineties, you had to build almost everything. Right? Everything... There was no shared libraries out there.
If there were, they were very... You know, they were only in certain languages, whatever. But now, like, every library has a suite of of libraries that are out there. Every programming language has a suite of libraries that are out there that you can pull from or standards that have been involved and baked into the OSes. So just, you just gotta use them and then mind your supply chain attack. Like, know where your dependencies come from. I I think that's the big thing that needs to happen is that we need just... We need a a title shift in the industry for people to take seriously what it means to build secure software from the from the go and making sure that that is is part of the the origination of this new tech.
While we're on this super big topic that the three of us probably can't solve in this one episode, any ideas on how we push for that shift? Because you said there are solutions in place. There are libraries, secure libraries. How do we make you know, developers use them?
I'm a big fan of accountability. If someone willingly is introduced to a security problem and they actively do not solve it and it becomes a problem, that needs to be an accountable offense. You can't just say, oops, sorry. I didn't know. Here's your LifeLock annual, you know, whatever or something like that. That can't be the go to. Right? I think that there needs to be an accountability aspect for if you're going to participate in this space where, you know, where you hold consumers' information and are kind of being trusted entrusted with it, you need to be able to be held accountable so that when those things happen, that there's a precedent. Right now, there's... The precedent is very, very weak, and it's only on the massive scales of things. And again, I think part of this is investing in these these solutions and services that can be proliferated out to the, you know, small and medium business owners that are the millions of cuts of places where, you know, some of this information gets squirreled away and make it easier for them to uptake it, you know, whether it's incentives or, you know, tax benefits or whatever, finding ways to bring them up.
So obviously, we want to give you an opportunity to plug the book and to detail some information where we can hear more about you, maybe hear more from you. What's next in the future? What does Ryan have happening?
Do you want to check out stuff at the book forkthislife.com? For me, that's pretty much the the start and stop. I curate all the things there. I don't update the site that much mainly because of time to work on it. But in terms of what's next, I do have a second version of the book that is... Or second volume to the book that I'm working on or that I've kind of got a story arc laid out for. How soon I write it will be a function of time and interest. So, I've hidden an Easter egg in the first book for anyone who finds it. That'll kind of give you a hint of what that second book will be. The more people who find it, the more interest will, you know, more priority that'll get. But Fork This Life, there's a potential I may actually turn it into a podcast of some sorts where, just as a brand to talk about random things about technology, educate people on various topics.
Thank you so much for your time. I know I've enjoyed reading the book and everyone else needs to go out and buy five copies like today. But that being said-
And find the Easter egg. That's pretty fun to do. If looking at your profile on LinkedIn, right? What's what's something that we don't know something that makes Ryan who Ryan is without us looking at your LinkedIn? It's not on there. We would never guess it. We have no idea. What what would that be?
Would. I mean, to be honest, I mean, so I have a lot of little little factoids squirreled away. I remember in 2000, I actually registered to become the Reverend Ryan Rutan. So I have a certificate of that. So that's something at one point I I almost officiated a wedding, in the in the in the early two thousands. I think the big one... The big ones is my theater background. I don't really tout it that much on LinkedIn. I don't have the professional accolades, but I I did over eight years of theater in high school, middle school, and community theater afterwards. It's... Was a source of great joy for me in terms of having camaraderie, you know, telling stories and really, you know, playing... Finding ways to explore life through another person's experience or through a story that someone else wrote. And so those are some things that I felt were, I think, I'd take with me. And I would say probably most of the benefits that I have today around public speaking, you know, being comfortable, like, you know, confident in talking and telling my story and just being open and authentic come from the vulnerability that comes from doing stage performance.
And again, there's... I'm not saying by any means that I was the world's best person. I was definitely... I had a lot of fun. I had a lot of great friends. It was something that we did really well together, but it was definitely an experience that opened my... I think opened the doors for me from being just a closet nerd.
Do you know the difference between a Red Team and a Blue Team? Which has a higher signal to noise ratio? A crowdsourced security testing platform or a scanner? The Enterprise Security Testing one zero one guide breaks down everything security testing related. Download it at synack.com. That's synack.com, or check out the show notes.
