The Good, the Bad, and the Bye Bye: Why I Left My Tenured Academic Job

Sat, Oct 3, 2020

The news is out: I left France, I'm no longer a professor at EURECOM, I joined the Malware Research Team at CISCO Talos, and I moved to beautiful Vienna. Big change :-)

I have been a professor for a bit more than three years, but I have had conflicted feelings about the "prof job" for a long time (even before finishing my PhD), it took me a couple of years to realize that I would eventually have needed to move on, and it took even more (mental) effort to actually make the call and leave. Despite being very excited for what's next, oh boy, this was tough :-) But independent of the concrete next step, it was time to move on. Even if Talos realizes the mistake and kicks me out next week, I'm still confident that moving on was the right call.

Especially when it comes to making big decisions, I tend to obsess about trying to stay rational, and I spent years collecting notes on the various pros/cons. Many of these thoughts often started surfacing as "feeling something is not right", without consciously understanding what was going on. But by keep thinking and writing notes down, patterns of thoughts started to emerge and I was eventually able to pinpoint some more defined thoughts on what kept me at the current job and what pushed me to change. Once these reasons were clear, it was much easier to make the decision.

This is a very long blog post, and I don't expect more than a very few people to actually read it. I wrote it mostly for selfish reasons: before changing to a new life, I wanted to wrap up all these notes in something more structured. I can't be certain I made a good decision, but systematizing these thoughts allowed me to move on with enough confidence to know I'm likely taking a step forward.

With that being said, I know that someone may be actually interested in hearing these thoughts and my experience. When I was a PhD student and I needed to make the notorious academia vs. industry decision, I would have paid big bucks to read more thoughts on the various pros/cons. One of the stupidest things you can do is to make big decisions based on what other people do and think, but reading about other people's thought process has helped me a lot. It is time I do my part.

The target audience for this post is, other than myself, PhD students / postdocs who are about to decide what to do next and junior profs that somehow feel that "something is wrong". I also expect some senior academics and industry people to read this post, but I guess they will find themselves skipping directly to the academic rant part and mostly agree with much I have to say :-) Anyways, I tried to stay away from the "very known things" (e.g., 👀-level BS when writing proposals, generally "more limited" immediate impact of your work, different compensation level, etc.), and I tried to focus on thoughts I have not seen much discussed around (at least not in this depth).

So, if you feel clueless and you want to hear more from an equivalently clueless random dude on the Internet, here we are :-) If you think this is the blog post that will make everything clear, I have bad news for you: it's all about tradeoffs and in my opinion there is no clear-cut winner. And, unfortunately, the problem with tradeoffs and balancing many aspects is that figuring out which one to weigh more is yet another very personal decision in its own way. So, you will not find any answer in this post and you will eventually need to figure this thing out on your own, but I hope this will help you form your own opinion.

This post is organized in three parts:

• Part 1: The Good — What pushed me to keep the job
• Part 2: The Bad — What pushed me to leave the job
• Part 3: The Bye Bye — The decision to leave

Enjoy!

Mandatory disclaimer: I have no idea what I'm talking about, and these are personal takes/opinions anyways. Unless you are a bad person, please don't take anything personal. Please feel free to reach out, ping me on twitter, or shoot me an email: I'm of course happy to share more thoughts if you have any questions. And if you disagree with something, bring it on! I love to argue, especially with people with strong and different opinions :-)

Part 1: The Good — What pushed me to keep the job

Before I discuss why I left, I want to touch on what pushed me to keep the job. I want to make sure it's a balanced post despite the upcoming mega rant, so that my overall opinion is more closely reflected. And I really don't want to discourage anyone to take this path, I still think it is a great one.

Note that some of my "reasons to stay" are good, but some are bad. Also note that many of these refer to my personal situation at EURECOM, working in the field of systems security, and not all these points can be generalized to all universities. As they say, your mileage may vary.

It's a very good job

The first pros is... 🥁: "it's a very good job". At first, I was shocked to find out that it's an actual job. When I joined this prof thingy I thought that this would be a "job" (note the double quotes). But, while it's true that you don't have a direct boss that tells you what to do, at the end of the day you need to deliver, and you actually work very hard: If your PhD students are in trouble or your teaching sucks, you will run into problems. This doesn't necessarily mean "they kick out", but if you value being a professional (and I do), failing at your core tasks will make you feel bad, even without additional pressure from your superior, and even if you have tenure.

And now that we got this "it's an actual job" out of the way, I can tell you: it's a very good one. There is a lot of freedom in what you do and how you structure your time. Research-wise I felt very free (but you eventually work on what your students like to work on — as it should be), and the department values the right things (I've heard some BS in other schools where, in the context of systems security research, they pressure you to "publish more journal papers..." 🤦‍♂️). I really like teaching and mentoring, and there were many opportunities to do so. They let me create and teach my own class on mobile security, MOBISEC, and the teaching load is overall very low (1 or 1.5 classes per year). I love playing CTFs and I was even encouraged to spend time and push for NOPS, the EURECOM CTF team (after winning HXP CTF 2018 and after being referred to as "probably a top team" we are mostly enjoying our eternal and well-deserved glory).

The environment is extremely relaxed, informal, and friendly. You are surrounded by top-skilled colleagues and humans, from MS students to profs. I felt in a family from day 1. Last very good point: since in France positions come with tenure, there were not even problems in terms of pre-tenure stress, a real luxury. And in this aspect, EURECOM delivered: I never felt any sort of pressure (but: I did work my ass off... so if you stop doing anything, bad things may happen :-)).

[BTW, EURECOM is frantically trying to replace me, you should apply :-)]

You are surrounded by students

When I made my decision to remain in academia, my top reason was for teaching and mentorship. Probably the best perk of the job is that you are surrounded by people eager to learn, from MS to PhD students to postdocs. It is extremely fulfilling and rewarding. Working with my students has been the highlight of my time at EURECOM, from traditional teaching, to suffering through the various rejections, to celebrating defeats of Reviewer #2, to cluelessly getting CTF-close in many stego CTF challenges. I feel very lucky that during these years we found enough interesting ideas that we enjoyed working on together, and that my next job will allow me to keep advising them until they graduate. As a prof, I believe the net output of my work is to see students becoming independent researchers, not the actual papers — I can't wait to see the bright careers I'm sure they will have :-)

I have deep respect for the role of "profs" in society, and it felt great to be one

I somehow have a profound admiration for the role that professors have in society and that had in my life. For their hard work, knowledge, passion, patience, and ultimately their service to the community. I'm referring to all teachers and mentors (from elementary schools to universities), who spend their life helping others, while at the same time often being asked to do many useless things and being massively underpaid. I admire and deeply respect these efforts: my most sincere thank you to all past, present, and future profs!

And, to be frank, it felt great to be one. I have been in love with the idea of being a prof for many years. In part, I think it is because some of the people who impacted me the most are professors, and I wanted to do my part in helping others. And after all the uncertainties that one has during a PhD, I think I was even more in love with the idea of having finally found my place in society. [Narrator: LOL, this clueless dude did not find his place. [Answer to narrator: But I've surely found it now!!1!]]

Overcoming all these positive emotions and feelings attached to this job was likely the biggest challenge I faced in coming to terms with the several problems and cons I did have during these three years. As mentioned, I have no intention of giving up on this teaching/mentoring thing (taking the time for this long blog post is part of this!), but it will surely not be the same thing. I'm very grateful I had a chance to try this job out. Thanks to all who made it possible, from family to advisors, colleagues, and students ❤️. I owe you big time.

[Of course, being a prof does not necessarily make you a smart or great person. Some profs I know are some of the dumbest people I have ever met (by far) and they would not survive one day in the real world. And some profs I know are the most asshole, selfish, egomaniac, and delusional humans I have ever heard of (Are you pushing your students to stay in the lab until 10PM, work during the weekends, and have no paid vacation? ✔️ Do you treat your students like cheap labor whose only task is to implement your visionary research plan (LOL)? ✔️ Do you come up with ridiculous excuses to put yourself as first author even when the student did all the work? ✔️ Do you engage in sexist/homophobic/racist behavior of any form? ✔️ Huge congrats, you are a terrible person and a disgrace to the academic community. No matter how many papers you have or whether you have a wikipedia page or a statue that looks like you, the only place I have for you is on my shit list 💩📝. You think you are one of them? Shoot me an email with your achievements and let's find out! 😈)]

Many of my friends are academics, I will miss them :-(

[OK, this is likely less rational than it should be.]

I've been part of the academic circus for about 10 years, which is a significant portion of my adult life. I do have very good friends in industry, but in terms of numbers, I of course have many more friends in academia. And one non-obvious aspect that made my decision difficult was the fear of losing contact with these friends if I had to make the move. Most of my friends do not live where I live, but I thought I at least would have a chance to catch up at various conferences or when serving in PCs. Leaving academia, these occasions will likely be less frequent. Sadness ensues :-( Being more rational, I don't think this will be a huge problem, and moving to industry I'll be significantly richer anyways and I can even pay for conferences without having to write grant proposals ;-) But still, you get the point: I fear I'll miss my buddies even more than I do now. We'll see how it goes. :/

The social pressure (a very bad reason to stay!)

It took me a lot of time to admit this to myself, but here it is: the social pressure "you are crazy if you leave a tenured prof job" is real, and I think it affected me as well. I perceive the prof job as very prestigious, and for a while it was insane to even consider leaving it. When people, from students who foolishly challenge you at ping pong to uber drivers, ask you "So, what do you do?" and you can answer "I'm a professor" without lying, well, that feels very cool.

Here there are other variants of "the pressure": "after a PhD, the smart kids become profs" or "you want to make your advisor proud? then become a prof". Nobody said these things to me explicitly, but I need to admit I felt them.

Needless to say, these are absolutely bad reasons to stick with the job. But even if I've always recognized these reasons as bad ones, actually really getting rid of them and avoiding that they clutter your mind when making decisions, well, that has been a real challenge.

You want to be a real "smart kid"? You want to make your advisor proud? Great: then find something you truly like and stick to it! If "making your advisor proud" == "become a prof no matter what", then your advisor is likely a dumbass (please let me know so that I can update my list).

As an advisor myself, I just wish for my students to find something they truly like and be the best possible version of themselves. I would personally be much prouder of a student who has the chance of being a prof but says "fuck it" and starts cultivating tomatoes vs. a student that sticks to the prof job just because it's cool or prestigious (I'm not kidding, and I would envy him/her a bit).

So, let me tell you: The prof job is a job like any other. Yes, it's competitive to get a position, but the vast majority of the smartest people are very far from being academics, and I can assure you that some profs are very, very dumb. So, this prof thingy is not a very good filter for smartness anyways.

And don't get fooled by the "I'm good at this, so I must do this" or "I was born to be a professor". Really, chances are that you are not "too good" to not be a professor. The key question is: do you like it or not? Don't get trapped by some weird stories that many academics push forward. There are many more good candidates than open positions. Nobody is irreplaceable. And if you think you are, stop being delusional. You are not. Which is good news! You do not owe anything to anyone, and you have the freedom to start enjoying your life the way you want!

I have friends who I believe are stuck with the prof job and torturing themselves with this pre-tenure madness just because it's cool. I'm convinced this "the job is prestigious" is making many smart humans losing many years of their lives.

If any of these thoughts sounds somehow familiar, maybe it's time for you to sound the alarm bell. If you need some wise words as a wake-up call, here is the best I could come up (don't worry, I wrote them before leaving the job, so they come out of infallible prof wisdom):

Our days on this planet are counted. And the days of whoever you are trying to impress are counted as well. So what's the point? Really, it's not worth it, life is too short, and you get only one. Find something you like, regardless of how prestigious it is, strive to be the best version of yourself, and enjoy the ride! 💥

Part 2: The Bad — What pushed me to leave the job

There are many things I don't like about academia, and they are definitively too many to fit even in a mega blog post like this. But since I do not think it would be particularly useful to aim for a comprehensive list of the problems, and since a lot of people already rant about academic issues, this post is more about some aspects for which I did not find much discussion online (at least not in this depth), and a bit on the why, in my very personal opinion, some things are as bad and as frustrating as they are.

I also discuss a bit how, even with a tenured position, I was not really able to ignore (some of) these problems. This may very well be a personal failure rather than a "it's not possible to ignore them".

Once again, please keep in mind that this is a personal blog post, and it does not have any pretense other than being a "clean" snapshot of my thoughts — especially for the last two aspects I discuss, some people may consider them a "pro" rather than a "con".

Publish or perish: the incentives are ~~~fucked~~~ "not good"

The academic community has profoundly perverse incentives.

I am a firm believer in using incentives as a proxy to determine the health of a community: incentives are what motivate people to do what they do, and they are the basis to select who should move to the next step of their career, whether they are PhD students on the academic job market or whether they are profs trying to get to a higher level of the academic food chain.

The biggest incentive that personally affected me the most is the absolutely insane and unhealthy obsession for publishing. You heard about the "publish or perish"? Yeah, it's real. I initially thought "tenure can save me from this", but I don't think it does (more on this later).

Publications are not the only aspect that count, but I believe they have a disproportionate amount of importance for an academic career (at all stages), especially when compared to the net value that some "papers" actually contribute to society and the overall research field.

I believe this papers' insanity is the root cause of many problems we have, and it ultimately distracts from what should really matter — expanding our knowledge and sharing our successes and failures with the community.

I think these incentives are the root cause of a number of problems, which I discuss next.

[Weirdly enough, while I really don't like this system, I do have profound respect for most of its members. Please don't take anything of this personally — it's a systemic issue. I'm guilty as anyone else and I'm definitively part of the problem.]

Problem 1: We write papers that do not deserve to be written

The obsession of having to write a full academic paper about everything causes us to spend so much time writing papers that sometimes barely qualify even for the "quick blog post" bar.

I believe this has a net negative overall contribution for the community.

You may ask: How can an additional paper hurt?

For each peer-reviewed paper, there is an insane amount of overhead to actually write it, going through (often multiple rounds of) reviews, preparing the presentation, attending the conference, etc. The community also spends significant time, by reviewing the paper, discussing it, etc. That's a lot of time and resources.

Now, you could tell me "but there is value in writing a well-structured academic paper". Yes, there may be value. But "there is value in X" != "it makes sense to do X".

Is this "value" really balancing the insane amount of time we lose to make that happen? Is there really a net positive overall contribution for the community? Is it worth it?

I think we seldom ask ourselves this question, and I think in many cases the answer is "no".

Or, more precisely, I think the incentives are set to actually make it "worth it", but for the wrong reasons. I'm criticizing that often "it's worth it" to write papers for the mere sake of publishing papers and padding our CVs, and not because we truly believe it's worth doing so to share our knowledge with the community in the most effective way.

Now, there are unreasonable people that exploit these tricks, and there are entire conferences and journals whose mere existence is justified and sustained by this publishing obsession. And as long as the incentives remain the same, and as long as we have "pokemon venues" ("going to catch/accept them all", got it?), people will still lose time writing these papers.

[Combine this obsession with crazy schemes of "collaborations"... and you can see CVs with 60+ papers published in a year (More than one per week... let that sink.)]

It is definitively possible to avoid the super shitty venues and it is possible to focus on the bigger ones where the quality is definitively higher... but with me getting old(er), however, my (very subjective!) bar for "it is worth writing a full academic paper for X and fight to death to get it accepted somewhere" is getting higher and higher :-)

[Note: I of course do not let these personal thoughts interfere with my judgment when I serve on PCs. If I feel a paper is above the bar (which is very relative depending on the venue), then I surely fight for acceptance, even if I may not agree that it was worth it to do the effort to write the paper in the first place. Actually, when the paper has been already written and submitted, sometimes by being positive and accepting "marginal" papers we are saving the authors and the community a lot of time.]

With that being said, there are a couple of categories of papers that, in my opinion, we should not lose (much) time writing and submitting, but for which the incentives push us to write and submit anyways.

Category A: good projects that did not work out

Let's say you had a great project idea, but it did not work out. Now, in general, negative results may have value, and it may be worth sharing them. You could write a negative result paper (I think they are valuable). But wait, most conferences don't like those! Shit. So what do you do? You could write a blog post — as detailed as you want, no page limits, etc. you are the boss! — and move on with life with something better? But wait, blog posts "don't count" (more on this later). And in many environments, "no paper" == "I completely lost my time from the eyes of the public"...

... and that's what pushes us to write full academic papers even for projects that were objectively a failure: we go on a quest to twist reality to sell something as "this is great/novel", to respin the negative results as "some positive results", and to build a convincing story around them. And what does this usually lead to? Oversellings and overclaims, which the academic community is often accused of (and rightfully so).

We lose so much time fine-tuning every single sentence of our papers to make sure to have a chance to win the peer-review lottery (and these papers are usually submitted many times before getting accepted, losing even more time of the overall community). But since "publishing papers" is so important, these aspects are now a normal and accepted part of the deal. Argh.

Category B: bad projects

These are then some projects that should not even be started... But that are rewarded anyways by the current incentives, as long as they are publishable!

There are two variants that seem to be recurring:

Variant 1: "there is no paper on this topic"

Mario: We could work on XYZ.

Luigi: Mmm... but what would be the point? Isn't XYZ obvious? Doesn't everyone know?

Mario: Yeah... but I didn't see any peer-reviewed paper on this, it could be publishable! 🤩

Luigi: 👀

Don't get me wrong, there definitively are well-explored areas of works that would benefit a lot from a systematic overview that an academic paper can provide (I'm a big fan of Oakland's SoKs). I just get mad when I hear people pushing forward a "paper idea" with the sole argument of "there is no peer-reviewed paper on this". The real question should be: "would a paper on topic XYZ be a big-enough contribution to the community that makes my time well spent, regardless of its "peer-reviewed" status?" Asking this question? HERESY!

Variant 2: "it's a step forward"

Mario: We could work on a new defense mechanism XYZ.

Luigi: Mmm... but that looks easily bypassable in all realistic threat models... and it feels very brittle anyways...

Mario: Don't be so negative. Remember that scientific progress is incremental by nature. XYZ is a step forward, so it could be publishable (and thus it's worth working on it) 🕶️.

Luigi: 🤯

[Note: "new defense mechanism" is just an example, I've seen this variant even with ridiculous attack papers.]

Once again, don't get me wrong: I'm all in favor of supporting people who truly believe they got an idea that, against all odds, may eventually be successful in the long-term future — this definitively fits in my "great research" bucket! But I often see papers for which I'm ready to bet that even the authors themselves don't believe their proposal would actually work in practice or be relevant/valuable in the real world.

I'm upset that we often hide ourselves behind the "we do a step forward" or the "it could be useful in 100 years" arguments just to find an excuse to work on ideas that even ourselves don't believe in, other than believing in the vastly more important "it could be publishable" aspect.

---

Please, I beg you: the next time you start a project or start writing a full-fledge academic paper on something that did not work out as expected, ask yourself: is it really worth it to spend so much time on that? And is it worth it asking the community to lose time on it?

Unfortunately, I'm quite confident that in most cases, the answer would be: worth it 'for the science'"? No. Worth it for my career (or for the career of my students)? Yeah, sorry :/

As a direct consequence of this point, conferences — even so-called top conferences — are overwhelmed with submissions, most of which have really marginal contributions.

Marginal contributions are great and valuable, but is it really worth it to write 12+ pages for a result that could be summarized in a couple of paragraphs? And is it really worth it to ask 3/4 reviewers (for each conference the paper is submitted to!) to write a full-fledge review on that? And is it really worth it to have PC discussions, rebuttals, re-submissions? And once these papers get accepted (at maybe a minor conference), is it really worth it to organize conferences and have 20-minute presentations on these contributions?

Once again, we sometimes hide ourselves behind the "there is value" and we forget that this value should be balanced vs. the efforts it requires and time we lose.

Problem 2: We optimize papers for the referee, not for the (intended) audience

With "too many submissions" comes the problem of not enough experts to properly cover all submissions in all research areas. Chances are that your paper will be reviewed by someone less expert than you are in your particular area, or someone who is completely clueless. If you consider that this someone may also be very tired by the insane PC load (and that's understandable), and that it's much easier to reject a paper than to accept it, and that systems security folks seem particularly nasty... well, this game sucks.

And what do we do when the game sucks but we must play it anyways? We adapt to the rules of the game and we optimize for the only thing that matters: paper acceptance.

Instead of just writing papers for our "real" target audience (the community), we go all-in with "defensive writing" and we start iper-optimizing every single sentence to make sure it can't possibly be misunderstood even by the dumbest reader. Papers can't just be "clear" for a benign reader: they need to be bulletproof against capricious people who are ready to reject things for random reasons.

Maybe it's just me, but I personally spend an enormous part of my writing time for these optimizations. Same goes for the time spent in teaching and providing feedback over these aspects. Now, is defensive writing a good skill to acquire? Yes, I think so. But does it make sense that we are forced to use it for every single paper. No, I think it's madness.

There is a mismatch between the "whoever needs to say 'accept'" and the real target audience. We lose so much time optimizing for the "wrong" readers. And I hate it.

And you know what I'm most upset about? That I actually love writing. For example, I truly enjoyed writing this blog post, and I really missed writing just for the sake of organizing some thoughts and speaking my mind. Unfortunately, I can't say the same thing for most research papers I wrote so far.

I wish we could write academic papers with the candor of, say, phrack articles. After 10 years of academic writing, I find myself enjoying that "direct" style so much, regardless of the topic I'm reading about: "here is what I got, here is what I had in mind but didn't have time to try / didn't work, and here is all my code / etc. so that you can start playing on this as well".

Wishful thinking, I know...

Problem 3: We move away from (potentially) very cool stuff

In my naive mind, academia would provide a "low-risk" environment and safety nets for academics to work on "high risk" projects, or on projects that may be very valuable but may not necessarily lead to a short-term impact.

The current incentives are not aligned with this spirit, and we find ourselves, once again, needing to optimize for the wrong things: papers.

I've seen many making the argument that, yes, pre-tenure, that's exactly the case: the only focus should be to publish and get tenure. And thus many make the argument: "tenure is there exactly to allow academics to work on high risk projects". I understand this argument, but I don't buy it. In most cases, profs are too busy to do the actual research, and that's why they get PhD students and postdocs to do the research for them. PhD students and postdocs have much more time than profs, but guess what they don't have? Tenure. And the cycle begins: it's again very risky to work on risky projects, maybe not for the prof, but for the students.

And it becomes difficult (and maybe immoral?) to try to convince students to work on project X when we know it may not lead to a publication, or when we know it may take a very long time to see the light. Considering that PhDs are 3-year long in many European countries... well, that sucks.

Another variant of the same problem: Given a project X, the rule of thumb is to do enough work to get to a good paper, but not (significantly) more. Once the paper is accepted, "that's it". There is no incentive to keep working on it or to maintain a tool. Unless you have enough material for another paper, it's better to move on. And having "enough" material for a follow up is usually tricky, because the "novelty" factor is gone. (BTW, this triggers another unhealthy optimization: "maybe it's better to leave some results out of paper #1 so that I have more material for a potential paper #2?")

One potential trick to escape from this madness would be to get tenure and then have only very few students so that you have time to do the "big shot" research yourself. But not many students usually lead to not many papers, which leads to not many grants, which, in some schools, leads to higher teaching load / committee work (AFAIK, that's not the case at EURECOM), which leads to less free time. Argh.

Note that this does not categorically prevent academics to do great work — some groups definitively do amazing stuff! But these groups do that despite the current incentives, not thanks to them. And when the incentives don't align with what should be the overall goal, well, that makes me sad, doubly so when thinking that these incentives are some self-imposed "counting papers" madness... and for what? Padding our CVs? Seriously, what's the point?

Problem 4: Non-peer-reviewed resources are often unjustly dismissed

It's so competitive to publish in peer-reviewed venues and it takes so much time that we somehow feel entitled to unjustly dismiss non-peer-reviewed resources.

A classic example when dealing with related work? "Oh, but that's just a blog post."

This mentality gets me mad.

It's true, many blog post "just" propose an idea and "just" scratch the surface of a given topic. But some blog posts are solid work and they are more thorough and more fairly evaluated than many peer-reviewed publications.

I get mad when we judge existing resources merely based on the "peer-reviewed" vs. "non-peer-reviewed" status. The question should be "is this good work?", not "on which platform has this been published?"

I wish we would start valuing resources for what they actually are and for what we actually think of them. Does "resource-published-on-napkin" offer a systematic exploration of problem X? Does it fully solve the problem? Is it properly evaluated? Does it have a good comparison with related work?

If the answer is "yes" to all these questions, why shouldn't it count as much as a normal paper? "Peer-reviewed" should be useful to act as a filter. But once you read a blog post and you think it's good, then it should be considered as a good resource, independently from how it was published.

But I'll tell what you would hear in academic circles: "it's not fair, publishing blog posts is much easier, they don't need to go through the crazy peer-review process, etc.".

Funny thing? I agree. It's not fair to compete against them. If only we would stop being obsessed with this "not peer-reviewed => doesn't count" madness... If only even our blog posts would start counting more... oh wait.

We somehow ended up using the "peer-reviewed" bit as a proxy for "is this good work?", when we ourselves know that the process is deeply flawed, with so many false positives, false negatives, and various degrees of randomness. It's a very sad state of affairs.

[A quick parenthesis on arxiv. A while ago I accidentally (👼) started a mega flame on arxiv vs. not arxiv. Let me clarify once for all: my intent was to bring up the problem that some people follow the spirit of double blind and some people just follow "what's written in the CFP", which technically allow them to publish on arxiv and talk to journalists to hype it up (thus deanonymizing themselves). I don't know what's the best way to combine blind reviews and arxiv, but, in principle, I really like arxiv and the freedom it grants you. Big fan!]

Tenure does not save you from the publishing pressure

So, did I discover the problems above only recently? No, I was aware of most of them before joining the prof job.

But I thought: French positions come with tenure, I'll do what I want!!

Yes, I genuinely thought that, LOL. I thought I would be free from the insane publishing pressure. But that's not really the case.

The first problem is that I want to be professional. If I'm hired to do job X, I want to do job X. I don't want to keep the job "to scam the system". If the job is about publishing academic papers, then I want to deliver. I don't like it? Then I should move on.

The second (and more pressing) problem: I chose this job for mentoring students. And what do students need to successfully defend their PhD and have a chance to aim at an academic career? Papers. So many papers.

So, I guess you see where I'm going with this: I personally don't care that much about papers anymore, but I do profoundly care about the success of my students. I was super lucky to have two advisors who cared for me, and I want to do my part.

And so here I am, getting stuck playing the reviewers lottery game over and over again, deadline after deadline, CCS rebuttal after CCS rebuttal. It's very different than when I was a PhD student myself. Working hard with students, getting papers accepted, making sure the presentation is top-notch, etc.: it's actually fun and it's great to see progress and share successes together. But rejections still hurt, especially the pointless ones. They hurt in a very different way than when I was a student, but they do hurt. It could be that I feel this pressure particularly because of the short "3-year PhD" that we have in France, but I'm not sure. [For reference, I started actually publishing around my 2.5th year (out of 6-year PhD). It takes time to skill up.]

In sum: if you chose academia for the students, I think it's very difficult to "get out of the system". It's a different game and it's not terrible as when you are PhD student, but the game never ends, and the "pressure" doesn't leave you alone.

Too many tasks, no time for tech stuff

The "work freedom" is real, but not in the way you may expect. You have a lot of flexibility in deciding on what to work on as research subject. But during these three years I have always felt as "always too busy". There is an incredible high number of different tasks to juggle, and I feel I spent most of my time playing "catching up" rather than enjoying what I was doing. And I need to admit that, sometimes, the "advertised academic freedom" felt like a lie. I managed to do some technical work for papers during my first year or so, but I needed to work crazy hours to juggle all the tasks. I think I can do it. And it's cool to be able to do it. But I don't enjoy the unhealthy juggling anymore.

I realized I'm the most happy when I can take a hard technical problem and go all-in trying to solve it. I deeply miss the luxury of focusing. Now, I understand that when people progress in their career, the focus and tech portion of the job is usually reduced. I get that, and that's OK. All I need is just a decent tradeoff — and this prof job really doesn't look like it.

More in general, with all the tasks and the weird incentives (for you and the students), this job ends up being "about tech", but not a "tech job". Most of these tasks are about technical stuff, but they rarely are actual technical tasks. Nowadays I find myself spending hours discussing (very interesting!) technical things with students or reviewing papers about technical things, but I don't see much technical stuff myself anymore.

And between the many tasks and mostly non-technical nature, I found it challenging to keep up with the gritty tech details I used to like the most. I know that some colleagues work 60/70/80 hours per week to keep up with everything. But I categorically refuse to accept that to stay up-to-date with the tech knowledge I'm passionate about I need to work that much. (If you manage to stay up to date without working that much, respect!)

I value work/life balance, I have a life outside my job, and I have no intention to give that up.

And I think, with time, my interests are changing. I love more and more building things and engineering, even if there is no paper at the end (!!!). Unfortunately, as a prof, the time you are expected to spend in this direction is very very low (so far I used my "DEFCON CTF org" card many times to justify investing time in "tech stuff", but that doesn't last forever :-)). My bet is that I'll be happier with a job that incentives me to dig deeper on technical stuff, rather than just scratching the surface and change as soon as there is paper (if any). The academic job does not look like such a job — luckily my next one seems a pretty good fit.

I guess that by moving to industry I will be learning many more things, but the number of public works/papers with my name on it will likely be much lower. So be it: I prefer to know many things, than being known by many people.

So much travelling, not a fan anymore

I used to enjoy travelling, but I think I burned out. The combination of attending various conferences, giving talks, serving on PCs, going to PI meetings for grants, and my long-distance relationship really took a toll on my quality of life.

Then COVID hit and I got stuck at home for six months. You know what? I really enjoyed it. The biggest pro of having a calm life? After years of failed attempts, I finally managed to establish many new healthy habits: I started eating in a healthier way, I lost 10kg+ (and I was not particularly overweight), started new hobbies, and I've managed to study two new languages every single day for more than six months (no, don't worry, French is not one of them :-)). I look forward to go back to the occasional trips, but having the "I'm at home" as the new norm is absolutely fantastic. Yeah, I'm getting old 👴.

The location

The last of my main issues: the location. This is tricky... many universities are in some random places in the middle of nowhere... Eurecom is on the beautiful French riviera... And yet, I'm finding ways to complain... oh well :-)

This really is about personal taste. There are many people that love the area (for many good reasons), but it turns out it is not for me.

There are many nice "nature"-related things to explore (which are great!), but I prefer a bigger city with more balanced "life".

One other problem I had is that I don't speak French, and I never took the time to learn it. As long as you stay around the school or in other "tech places", everyone speaks English and it's all good. But when you need to do "normal life stuff"... yeah, you may be able to survive without knowing French, but you will have a tough time. (I saved myself because my mom and my brother both speak French very well, but I have no idea how I would have bootstrapped my life there without them. <3)

The last aspect I was worried about: the so-called "French attitude". Truth be told: the vast majority of French people I interacted with are actually super nice and helpful :-) BUT: if you need to send/receive a package or if you need to open a bank account: RUN. A farewell message to Chronopost and BNP: from the core of my heart, I hope one day you will experience the arrogance, the profound unprofessional attitude, and your overall torture-level customer service that you seem to be proud of. May all your baguettes turn out curved and burned!

Part 3: The bye bye — The decision to leave

... and after three years of thinking about the pros and cons, it's time for me to move on :-)

It was a very difficult decision to make and I spent an enormous time thinking about it (not as much time as shortening CCS rebuttals into the words limit, but quite close). I have last few additional thoughts from my introspective journey on how I approached this decision and how and why I eventually decided to leave.

Life freedom vs. work freedom

One important aspect for me has always been to find a good location. French riviera didn't cut it, and Vienna seems a "good" alternative... ("#1 city in livability world-wide"-level "good"). I'm also extremely lucky to have found a very smart, beautiful, and unrealistically patient woman, and I have always been absolutely against the idea of making "one way" decisions (as in "decisions that only optimize for one of the two"). Staying in Vienna looks like a great fit for both us, for many reasons.

I have always aimed at "work freedom" to be more free in life and enjoy it more. But "work freedom" lately started clashing with "life freedom", and I picked the latter. Having the best job to then be somehow limited in life serves no purpose (again, that's my subjective opinion). This was enough for me to decide to leave — the other reasons (cons of the current job / pros of the future one) just made it much simpler.

Industry vs. academia: it is not a black / white choice

Industry vs. academia decision is not as black / white as I once thought. There are many alternatives and shades out there. For example, I primarily chose the academic path for teaching and mentoring... but is academia really the only choice if you want to contribute on teaching/mentoring? Of course not.

With time passing, "traditional profs" have less and less "exclusive access" to vast pools of smart students. Examples? I started learning "security stuff" with blog posts from @corelanc0d3r (around 2009/2010), not in university. And I learned most of the things I know from public online resources. Another example closer to me is about my MOBISEC class: Each year I had around 50 students in class, but by putting everything publicly online I've reached more students in 2 years than I would have reached with 1000 years of traditional teaching. Sure, the "impact" I have on these online students is much less "deep" than when you have them in class, but some of these online students (whom I have never met) did actually end up reaching out for suggestions/advice (even outside mobile security... and I love it! Please keep these random emails coming :-)). And that's how the "tradeoff" keyword kicks in: it does not need to be black and white.

And in this direction, I have great plans for the future. First off, watch this space for some MOBISEC announcement :-) Second: I have so many blog posts in the pipeline for a wide range of topics, from whether to do a PhD, to advices for PhD students, to how to pick a good research topic, or a very long list of technical/CTF-related things I've collected notes about. I also plan to keep serving in some PCs, time permitting.

This is my way of finding a personal tradeoff between the two worlds I like, but I'm sure there are many others. Find what you like and try to make it fit in the current position you have! And if it doesn't work for you, well, yeah, maybe it's time to move on to something else :-)

In our field, industry looks damn attractive

Confession: I have secretly (?) envied my industry friends for many years, and not for their money. I envied them because they could seemingly have some work/life balance and at the same time spend their time on something technical and used "for real". There are many jobs in industry that I consider exceptionally interesting. In academia, in those occasions in which we do something that may be useful, we often need to hope that someone else "picks it up" and builds something on top of it... and even if that happens, in most cases you will never know if something changed specifically thanks to your work.

It's not about being able to brag. It's about saying "OK, I spent so much time on X, and that was useful". For several things for Android, I have seen some things getting fixed and some permissions on the "deprecation path". Was it also thanks to my work? I guess so? I would pay big bucks to know it was. Again, it is not about bragging, it's about knowing that my work did have value. I found this aspect quite frustrating.

On the industry side, I would expect that I would feel my work to be more directly useful, even if my name will not be there when the thing goes public (if it ever goes public). And again, so be it.

Last: I have been told there is a lot of BS in industry as well, and I think (?) I'm ready to deal with it. If industry manages to win against some BS I've seen for some European proposals or Reviewer #2 madness, wow, "Respect". :-)

Final thoughts on making big decisions

I tried to make the tone of this blog post "light"... but it was a tough decision and I had some rough years while figuring these things out. The trickiest point for me was the feeling of getting stuck and overwhelmed by the SO many orthogonal aspects to balance when making such a decision.

I spent a lot of time trying to figure out which specific combination of them would have been my ideal one. I think that's a good exercise, but my suggestion is to be more pragmatic.

Instead of exploring the full combinatorial space of possibilities, the vast majority of which are only available in an ideal world, I suggest you to start from some concrete instances.

This is what I would suggest: 1) list the aspects for which you are not very flexible; 2) list the aspects that are important but for which you are flexible, and the ones that are very minor points; 3) look around and try to find concrete possibilities. That is, instead of exploring the entire combinatorial space, try to find 3/4/5/6 reasonable candidates: it will be much easier to choose "just among them".

The other thing you can do is to read about other people's experiences. The good news is that there are a lot of resources on the topic, and some of them are really helpful and offer in-depth perspective. If I need to pick one, I would suggest you to check the blog posts from Matt Welsh. Many of the things he wrote ringed very true, and I envied him when he found the guts to leave his tenured position at Harvard (!!!). These are some of his interesting blog posts (among many others): The Secret Lives of Professors, Why I'm Leaving Harvard, and The Fame Trap. I somehow felt he was right when I was reading about these things many years ago, but I wanted to try this prof job myself... and it turns out he was definitively right on many things... I guess lesson learnt: always trust the advice of a prof, infinite wisdom FTW! :P

But kidding apart, it's very difficult to make these decisions especially because you don't have much data about them. So, my general advice is: are you in doubt? Do you think you may like it? GO AND TRY! If I could go back to 3 years ago, I would totally and surely do it again. Unless you are absolute sure that, for example, you hate teaching, nobody can really tell you if you would be a good fit. Worst case, you can quit after few years. Really, nothing is forever...

Best of luck for your decisions, and enjoy the journey! ... and as "the dude" would say, take it easy :-)

Arevuar!

#GTFO