Both. Currently I work in supply chain security with a focus on Ruby. I also spend a lot of time cooperating with others in OpenSSF working groups.

I'd had in mind to write about CVSS for some time. I wrote a few paras and created the first plot, but that's as far as I got for about a year. One Saturday morning about 2 months ago I started thinking about it again and got the itch to finish it. It kept growing as I went because I kept finding more to write about.

Edit: the original ambition for my site was more about applying what I have learned about statistics, psychology and economics to general software development and ops. But now that my dayjob is mostly thinking about security it has veered off in that direction instead (for the moment at least).