Root Causes 250: 250 Episodes of Root Causes!

Hosted by

Tim Callan

Chief Compliance Officer

Jason Soroko

Fellow

Original broadcast date

October 26, 2022

It's Root Causes episode 250! In this episode Tim and Jason indulge themselves in podcasting about podcasting. Hear about setting up a podcast, choosing topics, why we don't rehearse, why we have so few guests, and how we reacted the first time someone asked us for a media kit.

Podcast Transcript

Lightly edited for flow and brevity.

Tim CallanJason, this is an exciting milestone episode. This is our Episode 250.

Jason SorokoIt is, in true honesty, mind boggling. Holy Moses. You hear sometimes actors talking about 250th episode or whatever it is and you look at the real, genuine shock on their face. Like, I don't know how I got here. And I think for you and I, it's just, that's been a lot of conversation between the two of us. It just, it has felt so natural that maybe that's what makes it so surprising. It's just, who knew that we'd get here, but here we are.

Tim CallanHere we are., if you haven't already figured it out, listeners, this is going to be a podcast episode about our podcast. In general, I become a little suspicious of blogs about blogs or TV shows about people who make TV shows. Because they can get really inward looking and, at best, it's insider baseball. At worst, it's abject narcissism. So let's aim for insider baseball instead of narcissism. Is that okay, Jay?

But we talked about this and we both thought that that's a lot of episodes, and maybe it's worth just one look at how is it? What is it? What did it turn out to be? How did that compare to what we thought? And then I think you had an excellent suggestion, Jay, is also a little bit of sort of pragmatic, how do you actually get it done? If other people want to get it done? And that's a lot of good stuff to cover. So, with that, I don't know, where do we want to begin?

Jason SorokoWell, Tim, what was the conversation that sparked this off?

Tim CallanThe conversation sparked this off. That's a great place to start. How did this start to begin with? So, you and I were at some kind of strategic planning session, both in leadership at Sectigo, and whenever we got together in the same place, we would always just kind of riff and go deep on these sort of ultra nerdy topics that we don't really have a chance to talk about and you said to me, you said, gee, I wish I was recording this because this would be a great podcast.

And I said, well, I'm going to take that as a promise. I had no idea what to do. So, we went out, we bought ourselves a couple prosumer mics, and some pop screens and swivel, scissor booms. I don't know if you're still using the scissor boom I mailed to you, but I am. Then we just kind of worked out the pragmatics of how to do it. And it was all poking at things. You're a good sound editor. So, I think you enjoy that. I think you think it's kind of fun. So that part was handled. Because you just, you do that naturally with software you have and skills you have. I had to figure out how to publish it and I just sort of looked around and with not a whole lot of research landed on SoundCloud and my rationale was it seemed to have the basic functionality we were looking for. It could do RSS feeds, so it could get to a lot of other places and it was popular and well-reviewed. And I was like, ok, let's try it. And SoundCloud has been great to us. The RSS feed has been great. We know we definitely get listeners from other places like Spotify and Apple Podcasts. So that means the RSS feed is doing what it needs to do. We just started making episodes.

Jason SorokoThat's right. It really came down to, hey, let's choose some topics. And right from day one, we always said let's make it organic. We don't want to be overly polished and I don't think anybody listening to these podcasts would accuse us of being overly polished. And the thing is, I think that what's interesting is you literally are listening to two industry guys having a conversation and you as the listener, you're the person in the chair just sitting in front of us.

Tim CallanAnd we say spontaneity a lot. Like part of what we do is we'll agree on a topic, but then we won't say what we think. And when we go into this, I don't know if you're gonna agree with me and sometimes - - often you do. Probably mostly you do. Sometimes you don't. And sometimes we have a different take on it, or we have a different angle, or one of us knows things the other one doesn't know. And that is deliberate, I think, because I don’t know, I liked the spontaneity of these and the freewheeling nature of these conversations that we were having back when you said, let's do a podcast of this and we didn't want to lose that.

Jason SorokoCorrect. And so just for this opening part of this podcast, that's the biggest part we wanted to share is we choose a topic, we certainly do ahead of time, but the script beyond that is, it's literally a conversation where sometimes when Tim is talking, I am absolutely learning about these things for the first time. That is the truth. I think it goes back and forth like that.

A lot of times the root of the reasons why we agree more often than we don't is because we've been around for an awfully long time and we repeat subjects a lot. Certificate lifecycle management is one of those topics that it comes up often, for obvious reasons, and Tim and I are gonna have a hard time disagreeing on a lot of those topics. But there's a lot else that we get into, especially in terms of when we're getting into real root causes of cybersecurity events that we need to call out and we're just trying to figure it out amongst ourselves. That's true organic conversation happening there.

Tim CallanAnd sometimes these things are breaking. So probably the best example of this is quantum cryptography because it all keeps moving. And as a consequence, we keep moving. So, if you go back and listen to one of our episodes from our first 50 episodes, we're going to be explaining things that are much more rudimentary than we're talking about now, because the world has continued to progress. And now we're talking about the things that are current. And that's kind of nice because every podcast is a point in time. And so that's ok because it nails them down to a point in time and if future events change what you said at the time, I think probably we can get away with that.

Jason SorokoExactly. So, Tim, for those of you listening who made the egregious error of thinking that we are professional podcasters. We are absolutely not. And I'll tell you what Tim, I didn't go to broadcasting school. I don't think you had a stint in radio. No. I've watched WKRP in Cincinnati but that's about as close of an education I got in radio that anybody would have.

Tim CallanBut what's funny about that is, and this isn't something I think we've ever mentioned on the podcast, but we get pitched. This is what I love. PR professionals from agencies or internal corp comms people send me pitches where they want to put their executives on our podcast. And I always send those to you, Jay, and we always have a good laugh because they clearly think we have a different attitude and approach toward this than we actually have.

Jason SorokoOne way of saying that is obviously people who want to do a pitch, that's one of our biggest turnoffs. In terms of sales pitches, we definitely have guests. We’ll get into that in a minute. But in terms of professionalism, I want to address professionalism first, and we are not monetizing this. This is not going to YouTube with the monetizing button checked. Tim and I get a thrill from looking at the number of listens that we get. And that's about the extent of feedback that we think about in terms of just how is this doing and what are the end results to us. This is literally just we are sharing a conversation. And that's about as simple as I can put it.

Tim CallanI want to touch on one thing you said real quickly, but then I want to riff on what you just said a second ago and carry that forward. So, when you talked about we are not professional podcasters, my favorite one actually is when I get requests for media kit, which is just hilarious. No, I don't have a media kit. I don't do this. But we do have an audience. What's interesting is this thing that you and I do, at least to some degree, is working for somebody. I don't think I've talked about this on the podcast either, but I write fiction and poetry and I publish in literary magazines and what I decided to do when I started doing this is I said, I'm going to just write for myself. I'm going to write for the audience of me. I'm going to write what I want to read and if nobody else wants to read it, then ok, whatever. And it turns out that there is some set of people in the world who want to read that and so, that winds up, - - And so we did a similar thing here. We decided, we're going to have the conversation that we would want to listen to and if nobody else wants to listen to it, then that's how it is. And it turns out that there's some group of people who do want to listen to it.

Jason SorokoThat's it, Tim. Thank you. It's great. So we're glad for you, we're glad for the audience and we're glad that people want to tune into it. We are fully aware that this is a niche subject. It's one of these things where we do go into adjacent areas of interest. Sometimes general cybersecurity. But we typically always bring it back to PKI. We always bring it back to digital certificate, certificate lifecycle management. We really try our best to bring it to that. As much as we branch out, we keep it tight. And that is niche as heck, Tim, and yet, you and I debated whether or not there'd be an audience, it turns out there is, at least at this point in time. And thank you. Thanks for tuning in for that subject. It's great.

Tim CallanI remember in the beginning some of the questions we had, in addition to like how the heck do we do this technically was, is anyone gonna listen was one. And another one was I don't think you ever had this concern, Jay, but I did, was are we going to run out of things to talk about? I was afraid we were gonna do 15 episodes, and then sit on the phone and stare at each other. But didn't happen did it?

Jason SorokoFar from it. And in fact, you and I right now, our list of things that we're thinking about doing is growing all the time, and new stories are constantly breaking in, in multiple subject areas. So, it's a very rich area to talk about.

Tim CallanSo, let's see. Some of the other format decisions we decided to make. We talked about spontaneity. It's two voices. That means sometimes we talk over each other. I think we try not to. We try to let the other guy say what he has to say, wait for him to take a breath before we jump in. I sometimes step on you, I apologize for that. And I think we also try to give the other person a chance to talk. If I realize I've been monologuing, then I shut it.

Jason SorokoYes. Tim, I think we in a more natural person sitting in front of another person scenario. In other words, if we had a multitrack recorder that we were sitting in front of with a mic, like think about, your favorite podcasts, it's on a video where people are sitting in front of each other. Body language, and just your breathing will indicate to a person when it's time to like, hey, I want to throw in an idea. And so, talking over each other is much less. When you're doing this in the kind of format that we do, the risks of talk over are high, especially when you're talking about two guys who do a lot of talking.

Tim CallanAbsolutely. And of course, I, that becomes interesting. You and I know what we're doing and we're ok and no one's going to be offended if the other guy accidentally cuts him off. I think for our guests, we try to coach them a little about what the format is, encourage them to listen to an episode or two so they know what they're getting into because when we do have the guests on, certainly, I love having guests for starters because they have a different perspective. And they know things we don't know and, we are having somebody on to talk about what they're expert in that we're kind of not. But then the other thing about having the guests on is it just gives it all a different flavor and feel to have that other person on the podcast and I'd love to have more guests, when you're not a professional podcaster, and you do have a day job and your day job is a very busy day job, you and I putting out a podcast is like 1/10 the work of you and I and a guest putting out the podcast.

Jason SorokoIt's very true. It's very true. Especially in terms of organization, the pragmatic issues of recording that we'll talk about in a moment and also as much as you and I have semi-perfected the idea of riffing on a topic, other people like to be a lot more prepared. And it's because they want to show their best face. And I don't blame them. The problem is - that's not our formula.

Tim CallanNot my forte. They have one kick at this can or maybe a few kicks at this can. You and I have to 250 kicks at this can. So, if I say something not quite accurate, I can always correct the record in the future, and somebody else can't. So, in that sense, you get why they do want to be buttoned up. But it is great. Like and I would have more guests, it’s just as it is and this comes in another interesting topic - - when we started to do this, and we started to get an audience and like put up some reasonable numbers, one of the things that happened was a bunch of people, kind of in the corporate comms and social media world that I work with, all the sudden got really excited about it and tried to change it. Like I remember people saying you need to have more guests because people with guests get more. I remember being told, oh, you guys need to do this in video. Like you need to put cameras on and record yourself talking and we need to see your faces because those get more traffic. And my response to those and other suggestions that came up like that is, you know what, we have a thing that works. We didn't know if it was going to work. I'm not going to break it. And all of these suggestions sound like things that are going to break this thing that we know works.

Jason SorokoAbsolutely, Tim. And we've also heard things that were contradictory. It should be only 5 minutes; it should be 25 minutes. It's like, it's funny how we've stuck to our guns, Tim. And we've actually really stuck to the guns since the beginning on these matters and it was intuition that drove us to well, what would I like to listen to? Or?

Tim CallanI agree and so length. You bring up length. If you listen to this podcast and you paid attention, you'll see that it's widely variable. We've had episodes as short as like eight minutes and as long as maybe 35. So that's like a lot of range. On the other hand, there haven’t been any that are an hour and a half. And there haven't been any that are two. So, we're at least putting ourselves into a certain ballpark and I think we talked about sort of shooting for 20 minutes-ish.

Jason SorokoWe are not a digest podcast that covers multiple topics over a period of an hour. We're not a variety show. We are a one topic conversation. And so whatever is natural.

Tim CallanAnd make the podcast the length of the conversation. This is one of the things I think we had to learn early on. If you go back and listen to our early episodes, we had a few where we had something we wanted to talk about, but it felt short. So, we would put two or even three into a single episode. And I didn't like that. We stopped that pretty quickly because I thought, well, why would we do that? Why wouldn't we just say what we have to say and be quiet, and then do another one and be quiet. That way you can grab what you want. So, if you're really interested in hearing what we had to say about a certain article in the news, and it was sandwiched in between two other things, that's less accessible. That's less easy for the listener to use. And so, we decided, well, heck, let's just make them and if they're seven minutes long, they’re seven minutes long. Whatever. I think that was a good innovation. If we'd known that in the beginning, we would have done some of those early episodes a little differently.

Jason SorokoI think we learned it quickly. I also think, Tim, in terms of the counts of episodes we have, I'll ask you why we're off by one in a minute. So the audience can understand, including me, the thing is I think one of the other things we've done here, which leads to the count of episodes is the aspiration to do one a week or two a week. That's part of the aspiration of how we got to the number that we are.

Tim CallanSo we talked about some things. Again, we're not professional podcasts. We do have very busy day jobs. So as a consequence, I was very reluctant to put a cadence on it. In the beginning, you don't hear us saying, your weekly podcast, blah, blah, blah, because I thought, well, what if there's a week when we can't get it done? Now, we're not doing your weekly podcast anymore. So in that regard, we got around the cadence. Early on, in the beginning, I used to say the number. This is our podcast number 23. And the trouble with that is it nailed us down to a certain discrete order. And what happened was there was a breaking news item that we just wanted to cover, we wanted to podcast it quickly and get it out there. Just because it was such a gee whiz moment, and just wow. And it was when Kazakhstan was attempting to take over its country's trust through this root. And so, we did this Kazakhstan episode. But we had recorded like four episodes that were yet to be posted. And we're like, are we really going to wait three weeks to put this out? And so, we decided not to. So we did a special episode with no number.

And so, subsequent to that, I've had this problem like, how many episodes do we have? I think I said it right in the beginning. I think I said this is our episode 250, Not it’s our 250^th episode. Now, I don't remember. But it is our episode 250 but it is not our 250th episode. It is our 251st episode. And then we've talked about truing it up by skipping a number, but then it's going to look like there's something missing. And I don't know what to do.

Jason SorokoWell, Tim, let me put it this way. Maybe it's true nerdism in that maybe we're just using a starts from zero. Zero as the origin rather than one as the origin. So there you go.

Tim CallanThere you go. I like that. That's great. I'll go with that. And so who listens? Who does listen to us, Jay?

Jason SorokoI've had the most incredible conversations. You go to conferences, you talk to people, and folks that I really respect, folks that sometimes it's come out of the blue. It's people in the industry. I've had a lot of students reach out, say, hey, I'm learning from your podcast. That's great. People who should be in the industry or are about to be. That's great.

I also think, though, that there are also some people from general cybersecurity who tune in because of the fact that hey, man, I don't live in the PKI world, but you sure helped me to keep up to date. And it's great. I think the combination of tried, true and old veterans who I might have thought, oh, this is kind of old hat to them. Why would they? It turns out, they actually are very curious and they want to hear other people's take on the subjects. And they even like the idea of the news breaking stuff. It helps them to stay up to date. And Tim, this is the one I've heard the most often, the people who are listening, one of the things they like, is this idea of the root causes where we really do give a take. We quite often rip from the pages of technical journalism, but we get down to what was important on paragraph 15 that you needed to know.

And especially from a PKI perspective, and I think from the question of who's listening, it’s people who want to hear that.

Tim CallanIn a way, that was kind of a happy accident. Because we were trying to talk about what to name it. And I just liked Root Causes because it was a pun. And we had other puns. I don't remember them all. I remember we thought about Root 66. And then what happened was you liked Root Causes because you felt that it was a good message. Let's talk about root causes. And then that just solidified it. Then that was it. That was our name. And there was no going back on that one.

Jason SorokoAnd I still use it to guide us in the conversation. So it has a point. It has a purpose. And that's great.

Tim CallanSo are we gonna keep doing this do you think?

Jason SorokoI'm gonna. And with you. So it's good. I'm glad that we have this body of work. I'm glad that it's going to continue. I think, this is one of those rearview mirror episodes. It's not going to be common for us. Maybe we'll do it at 500 or 1000.

Tim CallanThank you for indulging our narcissism. I doubt that we'll do this again before Episode 500. I think when we get to 500, it’s probably worth taking another look and seeing how we've evolved again.

Jason SorokoTim, I want to address something real quickly. For those of you who are the ultra nerds, just step in. For those of you who aren't, well bear with me. But there is a technical aspect to podcasting. I want to share with you the fact that Tim and I, of course, are recording on individual tracks, audio tracks, that we are recording with those semiprofessional mics that we had talked about at the top of this episode. And we also have a synchronization track that is used with typical video - -

Tim CallanVideo conferencing.

Jason SorokoBasically work from home software that everybody is used to.

Tim CallanWhich is how we hear each other and can have a conversation at all, because otherwise that'd be quite a trick.

Jason SorokoThat's how we hear each other. And it's also what I use to synchronize our individual tracks. And so, once I have our multi tracks then I go to work. Which is I have to admit, I don't do a ton of cleanup. There is some minor, minor editing, just for the fact that I got to clip the ends. Clip the front, clip the back. Just simple, simple stuff. But I have been asked questions such as, hey, what are you using for your equalizer? And what are you using for? I gotta tell you, everything I do is incredibly gentle, because I do not want to make our voices sound unnatural. No auto tune. And so here it is. It's a really simple voice EQ that I put on extremely delicately and then as well - and this is an interesting one for you, Tim. I do clip certain amounts of silences. So, if there is a break. Let's say Tim or I are thinking for a long time. Well, that's of no value to you. So I am clipping some silences. And I find it interesting, Tim, people have spoken to me about this - A very common podcasting feature is not to listen to the podcast at its natural rate.

But to increase it to 1.25 I, I know a guy who listens to us at two times. And we don't quite sound like chipmunks two times, but boy, do we ever go by quickly.

Tim CallanWe're probably squeaky though, to some degree.

Jason SorokoI just wanted to mention that to those of you who are interested in that. I think what it comes down to, Tim, is our goal is good and listenable audio. We want our voices to sound pleasant enough, just like it would be in a conversation.

Tim CallanOn a specific topic that is very authentic and very genuine. And that's always what we went for. And no matter all these lessons we learned, and these things were doing differently, and I wouldn't put multiple episodes and all together. That's the stuff that hasn't changed. That was always the vision and that's always what we've done and I don't see any reason why that's not what we'll keep doing.

Jason SorokoIf we ever wanted to change it, I would almost suggest we would have an entirely different venue. This works. The listeners are here with us. Thank you so much for being the audience members and what you see is what you get, and we're going to continue to deliver that kind of content to you guys that’s information dense I think is the way they call it nowadays.

Tim CallanAll right. We're gonna do our best or at least dense. If I'm not informational dense, I’m dense. Well, that's probably a great spot to leave it on. So this is our episode 250, which is not our 250th episode and thank you very much, Jay.

Stay informed with expert insights

Subscribe to Root Causes for engaging discussions on PKI, digital security, and best practices for protecting your organization's critical assets. Don’t miss an episode!