Nobody Learns Alone

The founding image of this field is a person alone at a keyboard (usually in the dark, wearing a hoodie), and it has always been a half-truth. Before the course catalogs existed, the learning ran through rooms: bulletin boards and IRC channels, mailing lists where a well-formed question earned an education and a lazy one earned silence, zines passed around like samizdat, con hallways where someone showed someone else how the trick worked. The autodidacts this profession celebrates taught themselves from materials other people wrote, in communities other people kept alive, and the myth of the solitary hacker survives mostly because the rooms were invisible from outside. Habit five is the deliberate use of what those rooms have always provided, plus the exploit hiding inside them: the fastest way to learn a thing is to owe someone else an explanation of it.

The scholarship here begins with an anthropologist and a computer scientist watching apprentices. Jean Lave and Etienne Wenger's 1991 study of situated learning followed midwives in Yucatan, tailors in Liberia, quartermasters, butchers, and the sober members of Alcoholics Anonymous, and found the same structure everywhere: newcomers learned by what the authors called legitimate peripheral participation. The apprentice starts at the edge of the community doing small, real, low-stakes work, absorbing technique along with everything around it: how practitioners talk, what they respect, what a good day's work looks like, which failures are survivable. Competence and membership arrive together, because they were never separate things. Wenger's later work gave the structure a name this field has since adopted without reading the book, the community of practice: a group defined by mutual engagement, a shared undertaking, and a common repertoire of tools, stories, and standards.

It is hard to name a profession that fits the description better. The security community's institutions are communities of practice with the theory left implicit: the local BSides where a first-time speaker rehearses in front of forty people, the DEF CON villages organized around a shared repertoire if ever one existed, the OWASP and ISACA and ISC2 chapters, the open-source projects where a newcomer's first triaged issue is legitimate peripheral participation in its exact technical meaning, the Discord servers where a tier-one analyst can watch a senior reverse an obfuscated loader in real time at 11 p.m. The theory adds two things the folk version misses. First, lurking is legitimate. Peripherality in Lave and Wenger is a position of learning, and the months spent reading a community's write-ups before posting are participation, provided they trend toward the center. Second, the moves toward the center, the first answered question, the first published walkthrough, are the visible forms of skill acquisition itself, which is why a resume of community participation reads to insiders as a competence document.

Then there is the exploit, the part of the habit with laboratory numbers attached. Teaching, it turns out, is a learning technology aimed at the teacher. In 2014, John Nestojko and colleagues told half their participants they would later teach a passage to another student and the other half to expect a test; the would-be teachers, who never taught anyone, recalled more and organized what they recalled better, especially the main points. The expectation alone had changed how they read. Follow-up work by Logan Fiorella and Richard Mayer separated the components and found the expectancy effect fades within days, while participants who taught, on camera, to an audience they never met, held their advantage a week later. The meta-analytic summary, from Kobayashi's 2019 and 2024 syntheses of several dozen experiments, puts the combined preparing-plus-teaching effect near half a standard deviation, with two conditions that carry practical weight: the benefit concentrates where the teaching is interactive, real questions from real learners, and teaching with no prior expectation of it produces roughly nothing. Knowing you will have to explain changes how you learn; explaining, and fielding the questions, finishes the job. Teachers have reported the experience informally forever: you never learn a subject so well as the year you teach it.

The reason this works is visible in the week's earlier editions. Preparing to teach is retrieval practice with stakes, Sunday's habit under social pressure. The learner anticipating questions probes their own gaps, Wednesday's calibration performed preemptively, because an audience is the one fluency illusion no one sustains for long. A student's question arrives from an angle the material never covered, forcing the reorganization that researchers call elaboration and practitioners call "finally understanding it." The five habits are separable on paper and keep turning out to be the same discipline wearing different clothes.

Paulo Freire, who has run through this week like a watermark, built his entire method on the refusal to separate the two roles this habit joins. The heart of Pedagogy of the Oppressed is the dissolution of what he called the teacher-student contradiction: "Through dialogue, the teacher-of-the-students and the students-of-the-teacher cease to exist and a new term emerges: teacher-student with students-teachers." In his classrooms the teacher taught and was taught, the students learned and instructed, and the group held joint responsibility for a process in which, as he wrote, all grow. bell hooks, his sharpest American inheritor, carried the idea into university teaching under the name engaged pedagogy, and stated its premise in a sentence that could hang over any security Discord worth joining: "Freire's work affirmed that education can only be liberatory when everyone claims knowledge as a field in which we all labor." Her book's title names the stakes, Teaching to Transgress: Education as the Practice of Freedom, the last phrase borrowed from Freire directly.

Set the theory beside the field's actual culture and something clarifying happens. The write-up norm, where the person who solved the challenge publishes the path for strangers. The walkthrough, the con talk, the code comment written for whoever comes next, the senior engineer who narrates their reasoning on a bridge call because narration is how juniors become seniors. The mentorship programs, and the loose apprenticeships that never get the name. This is dialogic education, teacher-students and students-teachers, operating at scale, built by people who never read a word of critical pedagogy. Tuesday's edition noted that no peer-reviewed literature applies Freire to cybersecurity education. The stranger fact is that the field never needed the instruction; it grew the practice wild, and calls it culture.

The habit, then, in operating terms, arranged from periphery to center. Join the rooms and read them; lurking is a learning position, provided it points inward. Answer one question in public each week, in the Discord, on the forum, under a colleague's post, because composing the answer is the retrieval practice and the reply that says you missed something is the feedback. Write the walkthrough of the thing you finished, the CTF, the lab, the migration, and publish it where a stranger can find it; Tuesday made it the reflection half of praxis, and today it doubles as an act of teaching with an audience of unknown size. Volunteer the brown-bag on the subject you want to learn next quarter, and let the scheduled date do what deadlines do; the expectation effect begins at the moment of commitment. Take the mentee, the intern, the new hire, on the evidence that the mentor profits measurably from the arrangement. And when the old doubt about belonging arrives on schedule, Wednesday's rule applies: it is a self-report from an uncalibrated instrument, contradicted by the room that keeps answering you back.

A profession that reprices itself every 7.4 minutes cannot be learned alone, and never was. The rooms are where the field keeps its living knowledge, the part that has not yet been written down, and the price of admission has not changed in forty years: show up at the edge, do small real things, and start explaining what you learn to the next person through the door.

Sources

Fiorella, L., & Mayer, R. E. (2013). The relative benefits of learning by teaching and teaching expectancy. Contemporary Educational Psychology, 38(4).

Freire, P. (2000). Pedagogy of the oppressed (M. B. Ramos, Trans.; 30th anniversary ed.). Continuum.

Gamblin, J. (2026, July 1). CVE mid-year 2026 check-in.

hooks, b. (1994). Teaching to transgress: Education as the practice of freedom. Routledge.

Kobayashi, K. (2019). Learning by preparing-to-teach and teaching: A meta-analysis. Japanese Psychological Research, 61(3).

Kobayashi, K. (2024). Interactive learning effects of preparing to teach and teaching. Educational Psychology Review, 36.

Lave, J., & Wenger, E. (1991). Situated learning: Legitimate peripheral participation. Cambridge University Press.

Nestojko, J. F., Bui, D. C., Kornell, N., & Bjork, E. L. (2014). Expecting to teach enhances learning and organization of knowledge in free recall of text passages. Memory & Cognition, 42(7).

Wenger, E. (1998). Communities of practice: Learning, meaning, and identity. Cambridge University Press.