Contributing (content) to the DFIR community

Making community software sustainableBlog posts and Twitter conversations over the last week or so — in particular an emphasis on whether programming is the most effective way to contribute — seemed awfully familiar, but I didn’t realize why until I read Harlan Carvey’s observation, “Some analysts seem to look around, see how some others contribute, and say to themselves, ‘I can’t contribute to the community because I don’t know how to program.'”

Substitute “write” for “program” and you’ll see a statement that novelists, journalists and other authors have been hearing for decades. The thing is, looking at Harlan’s list (case studies, book reviews, even asking questions), I can see how those “simple” suggestions might be just as intimidating as reading the Rob Lee post that started it all.

William Zinsser (one of my very favorite writing authorities) wrote in On Writing Well:

Take an adult chemist or physicist or engineer and ask him or her to write a report, and you’ll see something close to panic. “No! Dn’t make us write!” they say…. They were told at an early age by an English teacher that they don’t have “a gift for words.”

Which is criminal. As Zinsser goes on to explain:

“Writing, demystified, is just another way for scientists to communicate what they know…. Describing how a process works is valuable for two reasons. It forces you to make sure you know how it works. Then it forces you to take the reader through the same sequence of ideas and deductions that made the process clear to you.”

That sounds an awful lot like the standard for “reproducible” to me!

Helping the reader identify with your work

My observation is that most of the DFIR practitioners who are active on Twitter and Google+, also keep blogs; many also teach. In other words, they already communicate in a way that, as Zinsser suggests, “…take[s] much of the mystery out of science writing by helping the reader to identify with the scientific work being done.”

You can do that, he explains, by telling a story from your own experience, or someone else’s; relate your science to something the reader is already familiar with and can easily visualize; writing clearly and sequentially, pacing what you explain.

But how many are out there, reading these blog posts, thinking to themselves, “Yeah but… I can’t write”? Or feel as if they’re doing all the writing they already wish to do in their reports?

I’m going to estimate that these readers fall into two camps:

  1. Those who yearn to be better writers, more effective communicators. They’d like nothing more than to blog and tweet and write trade articles and maybe even a nonfiction book or novel that draws on their experiences. But they’re terrified of looking stupid.
  2. Those who could not care less about writing more, or they’re too busy to put the work into it… but they’d nonetheless like to contribute more to the community, although they aren’t sure how.

Communicating DFIR experience through writing

Harlan’s suggestions are right on the money, but I posit that for people who are not in the practice of writing regularly, it can be hard to figure out where to get ideas. Two posts I’ve read recently describe seven easy ways to turn old content into new content, and ten mindful ways to use social media.

These posts suggest things like:

  • making blog posts out of LinkedIn conversations
  • turning blog comments into new blog articles, or written content into video
  • knowing your intentions before posting
  • sending “random tweets of kindness” offering help
  • responding with your full attention

One article is purely about content creation. The other is about the attitude you need for creating good, valuable content. Both worth a read, and worth deeper thinking about how you can contribute.

Contributing without writing

Those of us who love the way a spirited Twitter chat rolls along have trouble understanding those who don’t just jump in, or indeed, who don’t even understand Twitter. There are plenty, though, and I’d like to see the DFIR community come together to use tools like Google+ Hangouts or group podcasts. In other words: natural conversation, for those who are more comfortable communicating by voice.

I also want to put in a plug for getting more involved with professional associations, volunteering on some level as a board member or event organizer or committee member. I know: employers can be stingy with the time you take for this kind of thing. But it can benefit them, too — corporate citizenship is a term I’m hearing more and more about, and building into some of my clients’ strategies — and can be a way for you to contribute in a way that fits you best.

Where do you feel you’ve fallen short in the community? How do you think you might improve?

Creative Commons License photo credit: opensourceway

5 thoughts on “Contributing (content) to the DFIR community

  1. Good Points, Writing, Coding, Being in the spotlight is what holds me back, although pursuing a Masters then a PhD is forcing all this to change…

  2. I do get that, Ken. This past fall I gave a presentation that fell absolutely flat, even though I had succeeded doing one in April. Very different audiences, for one. I liked how you picked apart your hesitancy in your blog post — I think that kind of self-reflection is essential.

    On Twitter last night I alluded to a book review I plan to write for my next post. That book is Uncertainty by Jonathan Fields — it’s meant for business owners, so I’m still parsing how it relates to DFIR, but he talks quite a bit about community/crowdsourcing and I do think it will be relevant.

    Thanks for the comment!!

  3. Excellent post, Christa. I’ve been thinking a lot lately about how we can create a more effective collaboration environment. We have had some good discussions on twitter, but 140 characters is limiting, and reconstructing conversations from a timeline is very difficult. The few short days we had the IRC channel going were wonderful – it was great to have a true, real-time conversation going.

    I also think you have a good point regarding writing as a part of the scientific process. Especially in the DFIR world, the documentation of the process can be as important as the results. This also reminds me of another writing hangup…overanalyzing. Maybe it’s my mathematics background, but I find it easy to get stuck in rewrites and editing, wanting to be perfectly clear and precise.

    Thank you again for sharing your insights! I think we have all gained new perspective from this ongoing discussion.

  4. Thanks Erika! Agree about Twitter, I’ve been talking about this stuff there this morning, and the character limitation has been getting annoying (more so than it used to be. Hm). That’s why I mentioned Google+, not just because of Hangouts, but the whole thing carries so much more potential for good conversations like this.

    Also: your rewriting/editing most definitely has nothing to do with a mathematics background. 😉 I do the same thing (why I don’t write daily blog posts), and honestly I don’t see a lot wrong with it. We’re living in this crazy real-time 24/7 Twitter news “cycle”, and when things like DFIR documentation are as important as the process — that’s why I specifically mentioned the word “reproducible” — the ability to analyze thoroughly is so critical and maybe even underrated!

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.