Community & Signal Chat

Signal group chat (the async one)

This is the answer to "I have a cloud security question on a random weekday afternoon — where do I ask?" A small, vetted Signal group chat run by the same people who show up Friday. End-to-end encrypted, low-noise, members-only.

How to get the invite

Two paths, both deliberately low-friction-for-humans, high-friction-for-bots:

• Email admin@csoh.org with the subject "Signal chat invite." A one-line note about who you are is appreciated but not required. We'll send the invite link back.
• Or join the next Friday Zoom — the invite link gets dropped in the Zoom chat at some point during the session. Show up, copy the link, you're in.

What it's for

• "Has anyone seen this GuardDuty finding before?" / "Why is this IAM policy not behaving how I expect?"
• Sharing breaking news, vendor advisories, and links worth a quick look
• Asking the kind of "I feel dumb asking this" question you wouldn't open a Zoom for
• Loose discussion of upcoming Friday topics, recent breaches, certs, jobs

What it's not for

• Vendor pitches or recruiting blasts (we'll remove and ban without warning — it's why we keep the chat off the public web)
• Sharing confidential customer data or internal incident details from your employer
• Anything that would violate the code of conduct

Friday Zoom (the live one)

The original CSOH surface and still the best one. Every Friday, 7am PT / 10am ET. Free, vendor-neutral, no marketing. Half presentation, half open discussion. It's the easiest way to meet the regulars and become one.

Register on the CSOH mailing list to get the calendar invite, or visit the sessions page for details and the recording archive. Recap notes for past sessions live on the meeting recaps page.

Mailing list (the broadcast one)

One-way: we send you the Zoom calendar reminder and occasional updates. We don't send marketing and we don't share the list. Sign up here.

GitHub (the contributor one)

The site itself is open-source on GitHub. Open an issue, file a PR, or just lurk.

• Suggest a resource: see the add a resource guide — no coding required.
• Improve content: typo fixes, broken links, better explanations — all welcome via PR. See the contribute overview.
• Build a feature: the site is plain HTML/CSS/JS with no build step. A great low-friction first open-source contribution if you've never made one.

Conferences & meetups (the in-person ones)

Cloud security is a small field; you'll keep running into the same faces if you go. We keep a curated conferences directory with the events most CSOH regulars attend — fwd:cloudsec, BSides cities, DEF CON Cloud Village, RSA, Re:Invent's security sessions, and the relevant SANS / Microsoft / Google events.

Community etiquette

Same on every surface, lightly enforced because the community polices itself well:

• Vendor-neutral. Pitches, sales follow-ups, "have you considered our solution" comments — out. Discussing tools you've used and how they performed is in.
• No recruiting blasts. Sharing a specific role you're hiring for is fine occasionally; using the chat as a sourcing channel isn't.
• Don't share employer-confidential data. Anonymize details; describe the shape of the problem, not the customer.
• Be kind to beginners. Most of us were new to cloud security less recently than we like to admit.
• The full code of conduct applies.