# First Decisions, First Toys

Part 2 of an ongoing series. [Read part 1 here.](https://braindump.0x8r41nr07.xyz/day-zero)

August 2025 arrived and immediately made me make decisions I hadn't expected to make.

The first one: Notion vs. Obsidian.

My program recommended Notion for note-taking. It's the obvious choice — clean, cloud-synced, team-friendly, used by a few million people. I tried it. I spent about two weeks in it. And I kept bumping into the same feeling: I was storing my thinking in someone else's house.

I switched to Obsidian.

If you don't know it: Obsidian is a local-first, markdown-based knowledge management tool. Your notes are plain text files that live on your machine. No cloud dependency, no vendor lock-in, no subscription model holding your second brain hostage. It's flexible in ways Notion isn't, lightweight in ways Notion can't be, and — this matters more the deeper I get into security — it doesn't need to phone home to work.

It was the right call. My vault is still growing.

* * *

The second decision was bigger: I'd enrolled planning to pursue CompTIA A+. It's the standard entry-level IT certification — the thing everyone says you should have first if you're coming from outside the industry. Logical starting point.

I looked at what A+ actually covers. Then I looked at what the Google IT Support Professional Certificate covers. Then I looked at what I already knew — 30 years of working in environments with IT infrastructure, troubleshooting my own systems, managing production workflows at scale — and I made a call.

I didn't need A+. I needed something that would build on what I had rather than certify what I already knew. The Google path moved faster, covered more ground that was actually new to me, and led directly into the Google Cybersecurity track I was already planning.

Dropped A+. Never looked back.

* * *

Then there were the toys.

I bought a USB RubberDucky in August. If you're in security, you know what it is. If you're not: it's a device that looks like a USB thumb drive and acts like a keyboard the moment you plug it in. It executes a pre-programmed payload at typing speeds no human can match — and it bypasses most endpoint defenses that are looking for software threats, not hardware ones.

I bought it to understand it. That's how I learn: I want the thing in my hands. I want to know what it feels like to hold a tool that can walk through a front door and own a machine in under a minute. Understanding offense is how you build defense.

Also: 2600 and PHRACK started showing up in my inbox again. Two publications I read as a kid — 2600, The Hacker Quarterly, and PHRACK, the underground technical e-zine — back in my hands forty years later. Different world. Same curiosity.

The C64 kid was starting to remember who he was.

* * *

TryHackMe kept moving. More rooms, more depth. The basics were done. The intermediate levels were starting to show their teeth.

September would be quieter. Until it wasn't.

A classmate hadn’t checked in on our cohort chat for three months—not a single post, not a single reply. But when he found it difficult to grasp the course material in a structured way and was struggling with it, he asked us if he could join our group of three so we could show him how we study. I stepped in and said that the three of us had already found our rhythm and wanted to stay just the three of us—and that he could have reached out much earlier.

That scumbag then tried to slander me at the Masterschool—I was able to clear things up with the Masterschool; they were understanding toward ME. And I never exchanged another word with him.