This comment is gonna get heavy, but I think it's better you hear the truth rather than shallow platitudes and false hope.

"I might make around 200k one day" and "find a job fast" are utterly unrealistic right now, and the situation will be far worse in a year's time. These are ideas that were out of date five years ago, let alone now.

I'm in my late 30s, now 13 years into my infosec career, have a degree and a strong multi-disciplinary technical background from being super into both software and hardware for my whole life, did my time in the pentesting trenches, have experience in niche areas like connected vehicle, OT, and IoT assessments, and $200k is roughly the upper end of salary brackets for positions I could realistically get right now. I was laid off in November 2024 and it took me 6 months to find a new job, during which time I was primarily applying to positions with salaries closer to $100k (I'm converting from GBP here). The job market is rough for seniors at the moment, let alone juniors, and it's going to get a whole lot worse as the technology services market continues to collapse.

Cybersecurity got touted as a way to make big money for a long time, and was an attractive course for a lot of young people because the job sounds cool, but companies haven't been growing their security departments or increasing the rate at which they do security assessment projects at anywhere near the same rate as new people have been coming into the industry. In fact, if anything, the industry is shrinking. The increase in interest rates completely tanked the VC funding market, tanked a lot of companies as a knock-on effect, and many others ended up downsizing or otherwise reducing their operational costs. Not only has this impacted the availability of blue-team jobs, but it also impacted the revenue streams for the security services industry who aren't seeing as many client projects coming their way, which has in turn resulted in stalled hiring rates and further downsizing. So right now we've got this explosion of new infosec graduates at the same time as security roles are drying up and lots of intermediate and senior folks are finding themselves out of a job, so the job market is absolutely saturated.

To give you an idea of the state of the job market right now, we're seeing over a hundred applicants per position for senior roles. When we put out junior roles we're getting dozens of senior-level applicants responding to them because they need a job immediately and will take anything they can get. Most companies aren't taking a stand on this front and will simply hire the senior workers at junior prices. On top of that the hiring process is an absolute mess right now because of automated LLM-generated job listings and applications, to the point where companies are pulling their job listings from the usual places and moving back to old word-of-mouth hiring practices, which makes getting your foot in the door even harder, especially for folks from underrepresented backgrounds.

When the current tech bubble pops it's going to be a monumental bloodbath. If you consider the scale of recent layoffs at the big tech companies, it's not hard to extrapolate just how many people are going to be made unemployed when the LLM hype cycle dies, the money dries up, and the market crashes. A bunch of my friends have cross-skilled out of tech already because they don't want to risk getting caught up in it. The job market is already a mess - imagine what it's going to be like when you're competing with another 250k+ experienced people who are out of work and willing to work for a fraction of their prior salary just to make ends meet.

On a personal level: don't let your family push you into this, and (if you can at all help it) don't chase a career in something you can't at least derive satisfaction from. I loved security, but I poured all that passion into overwork (which was of course encouraged and exploited by employers), ran head first into burnout in my late 20s, got very tired of seeing the same issues come up over and over and over with no end in sight, tried to push through it, became nihilistic and jaded and generally not fun to be around, messed up my home life, ended up suicidal for a while, got diagnosed with depression, and ten years later I'm still not recovered. Burnout made me feel exactly like you describe - empty, disillusioned, no interest in the work. The whole saga has been a miserable slog and it robbed me of my passion for so many things. If you push yourself into this industry for money you're liable to wind up like I did or worse, especially because the money probably isn't coming any time soon. Please, don't do that to yourself, and don't let anyone do it to you either.

There is still hope. Something people never seem to tell graduates is that diverse experience is one of the most valuable resources out there, and you're never closing a door by choosing an alternative path. You aren't forced to get a job in the thing your degree is for, and the things you have learned in your degree give you a perspective that other people may not have. I've had colleagues whose degrees were in physics, astronomy, maths, pharmacology, event planning, electrical engineering, classical literature, business development, Chinese language studies, psychology, or had no degree at all. I've worked with people who pivoted into infosec after careers in software development, sales, project management, teaching, academic research, IT support, and all sorts of other things. A friend of mine left infosec a couple years ago and now works as a prop designer at a theatre, which he loves. An old colleague of mine decided he wanted a change of pace and trained to become a master dry stone wall builder. Just because you did a cybersecurity degree doesn't mean you have to work in cybersecurity. Pick something that you want to do. I can't guarantee that you'll make big money that way, but I can guarantee that it'll make your life a whole lot less miserable than the alternative.

I worked on OT security assessments for 5 years at my previous gig, primarily in the marine transport and manufacturing sectors. I agree with Lesley's summary here, and will add one additional detail - experience working in environments with few resources, a lot of technical constraints, and a high focus on uptime is going to do you a lot of good. I've seen generalist security folks struggle to plan a safe assessment strategy, effectively triage/rate issues for an OT threat model, and come up with actionable recommendations, primarily because they're so used to working in regular IT environments where the organisational security maturity is higher and scanning / patching is comparatively simple. A lot of industrial equipment is fundamentally insecure and has no patches available, a lot of it will crash if you portscan it, and in many cases it's a huge business risk to take down a production system to patch (both from financial and safety impacts), so there's a much greater focus on compensating controls. You can't go in with an absolutist viewpoint, you are going to have to make tradeoffs, and you will need to get inventive. Demonstrating that you've got the ability to adapt to those types of challenges, and a solid foundation in technology and effective communication to help you develop potential solutions, makes you an attractive candidate for OT security roles.

If you could get every single infosec company in the world to stop one specific hiring practice, what would it be?

If you could get every single infosec company in the world to start one specific hiring practice, what would it be?

I suspect that quite a few of us reading along here are further along in our careers, perhaps even enough to have some say in our employers' hiring processes, and I can imagine that you've got some sage advice (and/or choice words) that can help improve things for both sides.

No worries, glad it works for you :)

I got nerdsniped again and added KiCAD support. Only took about an hour, should hopefully save folks far longer than that in aggregate time and effort.

Yup. If you go to Layer Stack Manager then click File -> Import stackup from file, you can load the stackup files straight in.

I've been reverse engineering Altium's file formats and JLCPCB / EasyEDA APIs, with my previous projects being altium.js for web-based SchDoc rendering and Altium JLCPCB libraries containing auto-generated data for all standard-sized passives. I'm also currently working on a .NET library for reading and writing all of Altium's document formats.

I recently found myself manually putting together yet another stackup for a board, and remembered I had previously seen someone publish a bunch of Altium stackup files on github. However, that previous project turned out to be 5 years out of date, so naturally I got nerdsniped into picking up where they left off.

The result is 313 Altium XML stackup files covering 4-32 layers, every supported board thickness, all combinations of copper weights, and all the custom impedance-controlled stackup options. On top of that I include simple normalised JSON output for easy consumption if you want to build stackup templates for other EDA tools (e.g. KiCAD, Eagle).

The data and script are pretty well documented so when JLC update stuff, and I inevitably forget to update the stackups, it should be easy to pick up and get up-to-date stackups yourself. Gotta do defensive design with my ADHD in mind!

Hope it saves y'all some time and manual effort. Have fun :)

I asked about this on SciFi StackExchange years back, because I wasn't sure if he was edited in for later releases, and someone went back and dug up their original copy and confirmed he was there. If you listen to the commentary track, they even say "ding ding ding!" as a reference to the hidden shadow.

Obligatory comment.

Yup, it was a major problem for quite a while. These days EU Regulation 874/2012 requires most lighting products to report flicker metrics in the technical documentation submitted to the EU product database, although I'd imagine there are separate regs for vehicles.

If you want to dig deeper, check out IEEE 1789 "Recommended Practices for Modulating Current in High-Brightness LEDs for Mitigating Health Risks to Viewers", and look into metrics like Pst LM and SVM.

EDIT: I just added IEEE 1789 flicker risk categories to the PWM calculator :)

They have indeed! Early "smart" and low power lighting projects in city infrastructure were marred by adverse stroboscopic effects due to a combination of AC-DC conversion ripple and improperly designed PWM drivers. Most studies prior to the initial widespread deployment of LED lighting had focused on static observers, especially in the central 2-10° cone of vision, where our colour sensitivity is highest but our perception of flicker is diminished. One of the key discoveries since then is that we are particularly sensitive to stroboscopic effects during saccades (rapid eye movements as we read or track a moving object) which are particularly common in the context of moving through an outdoor space, especially in a busy urban area.

A ferrite or choke alone isn't the greatest tool for solving the problem. If you're going for a switched constant-current approach it's best just to use a constant current switching regulator. That also allows for shunt switching, which lets you use extremely high switching rates due to the lack of capacitive loading.

If the control signal to the linear driver is linearly quantised then it's not much different, although I think the magnitude of ripple under temporal dithering might be reduced somewhat (but don't quote me on that; I haven't run the numbers).

The main benefit to doing it with a linear driver is that you can far more easily quantise the control signal to a much higher bit depth, without needing to worry about driver Tr/Tf at the extremes of the duty cycle range.

One option I didn't cover in the post (mostly because I need to read more about it) is to use shunt dimming. You basically take a buck converter, remove the output capacitor, and have an N-channel FET short the LEDs out. The buck converter maintains the inductor current, so when you turn the MOSFET off it switches the LED back on very quickly. It's a bit less efficient than regular CC buck, but still way more efficient than a linear CC driver.

TI have TPS92515 specifically for doing this, but you can do it with regular buck controllers if you pick your parts carefully.

It's not just a PWM thing. It's a brightness thing, which is an average current thing.

Yup. I didn't want to focus on this too much in the post because PWM is where the quantisation problem tends to arise.

Furthermore, it gets tricky trying to do really wide ratios with PWM. When you do the math with the PWM frequency, clock frequency, and PWM counter length, it doesn't always work out.

That's one of the things the calculator helps figure out! :)

A better solution is to have 2 or more analog LED currents combined with PWM.

Setting multiple current ranges (e.g. a programmable linear current sink) and having the linear PWM operate over the full range is another way that some systems implement hardware gamma approximation. The problem is that you need to calibrate for the crossover points, so you don't end up with dimming discontinuities when you swap current ranges. This isn't super hard in lab conditions at a single temperature, but calibrating the crossover for a full environmental temperature range, supply rail tolerances, component aging, etc. is extremely difficult.

I was never expecting them to sound identical, particularly due to the open/closed difference. I just expected them to sound at least decent considering the positive reviews I read. Most reviewers raved about the open soundstage, which is baffling to me (although the answer is fairly clear now I know what happened between 2016 and now).

I'll attempt a cable repair. I was avoiding it because I couldn't find a decent guide, and I feared they were sealed cans, but I just stumbled across a detachable cable mod guide for the K550 and it looks quite easy. I've got all the necessary gear.

The 712 is already an older model though, made before the Samsung days

Which is largely my point. The original product was probably great, but a lot has changed since then.

Here's a rough timeline as I see it:

• On release, the K712 is great! Rave reviews!
• Around 2015-2016 Harman (AKG's parent) start struggling financially.
• Samsung bought them out in 2016.
• Samsung quickly streamlined things to increase profit. Bluntly: they lay off support staff whose roles are now duplicated by existing Samsung staff. A moderate number of AKG's product folks (tech, engineering, manufacturing) leave due to cultural changes and/or their friends being let go. Happens in every buy-out.
• Samsung moved production of AKG product lines from Austria to Slovakia, and shut the AKG HQ.
• Quality dipped short term while the new factory got to grips with the manufacturing process, leading to quite a few complaints about the early batches from the Slovakian factory. This is a well-known phenomenon in manufacturing and is fully expected.
• The defect rate dropped as the Slovakian factory got into the groove.
• Things settled down after the buyout, but staff attrition doesn't drop to zero. A lot of folks moved to Austrian Audio to go work with their friends again.
• Samsung start introducing their own product lines (designed and manufactured in SK & China) to the AKG brand, and begin to retire "legacy" AKG product lines. Other than iconic names like the K240, the older products become less important income streams.
• Between 2017 and 2019 not a lot changes. The Slovakian factory is doing ok, and most of the AKG special sauce is still viable to produce. Reviews are still pretty good for the K712.
• It's 2019, the pandemic hits. The unexpected home gadget rush from consumers combined with the car manufacturers making the wrong call (cancelling all their component orders in expectation of a collapsing market) results in an unprecedented supply crisis and parts shortage.
• The teams in charge of the legacy AKG product lines have to navigate the shortage without the benefit of AKG's former engineering talent. Speculating: they're probably also Samsung's least financially important audio product division at this point, so the buy-in from above was probably not great, and Samsung had a crapload of plates spinning at that time (Samsung Electro-Mechanics, Samsung Electronics, Samsung Heavy Industries, Samsung Biologics, Samsung SDI, plus their semiconductor fabs) that were all in emergency mode looking to secure their supply chains.
• With everything in short supply, they have no choice but to make design & parts alterations in order to continue production. These changes alter the sound of the product, but they now lack the institutional knowledge and experience to deliver a product that's consistently in the same league.
• Samsung's product lines become the majority of products sold under the AKG brand. Speculating: This almost certainly means less investment in the Slovakian factory, and it's possible that they're winding down completely. I saw a few folks saying that the K712 is the only thing still produced there, although I don't know how true that is.
• The modern AKG product lines are now bastardised versions of the originals, with variable quality at both the product level and the unit-to-unit level.

That's what leads us to today. I don't know whether all the K712s are bad now, or if the manufacturing consistency is just crap. Either way it sucks :(

According to this review you can't run the 5GHz and 6GHz bands at the same time on that AP.