Stop dabbling like an amateur

I get a lot of DMs that look something like this:

"Hey Luke, I've been doing bug bounties for a few months but I haven't found anything yet. I'm also halfway through a web dev course, and I'm thinking about pivoting to AI security because that's where the money is. What do you think I should focus on?"

The person asking usually thinks their problem is that they haven't picked the right thing yet. It isn't. Their problem is that they keep picking.

The same pattern happens in every discipline that I can think of:

• Learning a musical instrument
• Learning to code
• Dating
• Learning a new language
• Starting a business
• Investing

Why we dabble

You can't know in advance how anything will turn out. You don't know if the bug bounty grind will pay off, if the startup will work, if the tool you're building will get any users, or if the blog will get read by anyone other than your mum.

That uncertainty is uncomfortable, and our brains deal with it in a sneaky way: we hedge. Instead of committing to one path that might fail, we put a little bit of energy into five paths. It feels safer. It feels smart, even, like diversifying a stock portfolio.

Except skills aren't stocks. A portfolio of five half-learned skills is worth roughly nothing, while one deep skill can pay for your whole life. In most things that matter, the payoff isn't linear. The first 80% of learning gets you almost nowhere because thousands of other people have done the same 80%. The value lives in the last stretch, where nearly everyone has already quit.

Dabbling means spending your whole life in the crowded part of the curve.

The hunters who actually make money

Bug bounties are the clearest example of this I've ever seen.

The stereotype of a successful bounty hunter is some genius who knows every vulnerability class in existence. In my experience, that's rarely it. The hunters who consistently pull six figures are the ones who pick a target, or a niche, and become annoyingly obsessed with it. They read the JavaScript. They map the whole attack surface. They know the application better than the developers who built it, and they notice when a new endpoint appears at 2am because they've been watching.

Meanwhile the dabbler signs up to fifteen programs, runs the same tooling everyone else runs against all of them, finds nothing, and concludes that bug bounties are dead.

Bug bounties aren't dead. The middle is dead. If you show up with the same shallow effort as ten thousand other people (and now, a swarm of AI agents), you get paid like ten thousand other people, which is to say: you don't.

The part where I take my own medicine

When I left my job to start my own business, I had no idea if it would work. I remember genuinely wondering whether I was making the dumbest financial decision of my life. There was no spreadsheet that could tell me the answer, no amount of research that would remove the uncertainty. I just had to decide, and then make the decision correct through sheer volume of effort.

Looking back, the decision itself mattered less than the commitment that followed it. Once there was no plan B quietly running in the background, my brain stopped spending cycles on "should I be doing something else?" and spent all of them on "how do I make this work?" That question is a thousand times more productive.

A plan B feels responsible, but it functions as a pre-written permission slip to quit. The people I know who've done exceptional things all share this trait: at some point they made a decision that would have been embarrassing to walk back, and then they didn't walk it back.

Failure is cheaper than you think

The obvious objection: "but what if I commit to the wrong thing?"

You might! I've committed hard to projects that went nowhere. Tools nobody used, ideas that seemed brilliant at midnight and stupid by morning. Every one of those failures left me with skills and relationships that fed directly into whatever came next. Two years of obsessive focus on the "wrong" thing beat two years of cautious dabbling on paper every single time, because the obsessive years compound and the dabbling years evaporate.

The failure case of commitment is that you become excellent at something adjacent to what you wanted. The failure case of dabbling is that you stay mediocre at everything, which is the exact outcome you were hedging against. Dabbling doesn't reduce your risk. It converts a possible failure into a guaranteed one, slowly enough that you don't notice.

What commitment actually looks like

If any of this stings, here's what I'd do:

Pick one thing. Not the perfect thing. There is no perfect thing, and you can't know which option is best anyway, so stop trying to compute the incomputable. Pick the one that you can imagine being obsessed with on a random Tuesday when nobody is watching.

Give it a real timeframe. Six months minimum, ideally longer. Long enough that you'll pass through the miserable plateau where everyone else quits. Write the date down. You're not allowed to re-evaluate before then, no matter how shiny the new thing on Twitter looks.

Kill the side quests. Actually kill them. Unsubscribe, archive the repos, tell people you've stopped. Every open loop you keep "just in case" is a leak in the fuel tank.

Decide in advance that failure is acceptable. Not the goal, obviously. But if you need a guaranteed outcome before you'll commit, you'll never commit to anything worthwhile, because nothing worthwhile comes with a guarantee.

The uncertainty never goes away. I still can't tell you how any of my current projects will turn out, and neither can anyone who's honest with you. The pros feel the same uncertainty you do. They just stopped letting it set their schedule.

Pick your thing and get obsessed.