Facing the Vulnpocalypse with lcamtuf

WEBVTT
00:00:00.000 --> 00:00:15.367
Either the most interesting time in the history of InfoSec or the second most interesting after their arrival of the West, Hello.
00:00:15.367 --> 00:00:17.586
Welcome to Security Cryptography, whatever.
00:00:17.646 --> 00:00:18.067
I'm Deirdre.
00:00:18.750 --> 00:00:19.620
I'm David.
00:00:20.539 --> 00:00:21.320
Thomas.
00:00:21.719 --> 00:00:22.820
and And I'm Michael.
00:00:22.850 --> 00:00:23.449
Yes.
00:00:24.440 --> 00:00:25.739
Sorry, that's okay.
00:00:27.001 --> 00:00:28.153
You That solves the.
00:00:28.454 --> 00:00:28.910
I think that.
00:00:29.640 --> 00:00:33.030
this is the first time, I think that's actually happened in, in almost three years.
00:00:33.329 --> 00:00:35.399
We have a very special guest today.
00:00:35.640 --> 00:00:42.042
Uh, you may know him from the internet as, oh my God, I say tu, Yes, look.
00:00:43.975 --> 00:00:47.880
but, you have like a, you know, a, a real world human name.
00:00:48.149 --> 00:00:50.729
Uh, Michael Leski.
00:00:52.078 --> 00:00:57.252
God, That I, I know we were all hung up on the, we were all hung up on the first name.
00:00:57.911 --> 00:00:59.286
can't believe you were hung up on the second name.
00:00:59.588 --> 00:01:01.838
That, that, that, that was absolutely terrible.
00:01:01.838 --> 00:01:02.198
Yes.
00:01:02.497 --> 00:01:02.921
sorry.
00:01:03.012 --> 00:01:03.551
Yes.
00:01:03.878 --> 00:01:04.477
no, that's fine.
00:01:04.718 --> 00:01:10.058
Uh, yeah, the, the Polish pronunciation is miky, but I, I usually just go by Michael and, yeah.
00:01:10.522 --> 00:01:11.061
Oh my God.
00:01:11.061 --> 00:01:12.412
I pronounced the w wrong cwe.
00:01:12.471 --> 00:01:14.391
Nevermind you, you're, you're justified.
00:01:14.391 --> 00:01:22.498
I'm, I'm just as wrong as you are is, this is, this is the most disappointing podcast I have, you know, ever done in my life, we'll get so much worse.
00:01:22.504 --> 00:01:24.799
Don't worry, we is commits so worse.
00:01:25.099 --> 00:01:25.250
right?
00:01:27.177 --> 00:01:37.528
we thought right now was a good time to talk because of all of the AI vulnerability discovery stuff that's going on.
00:01:37.918 --> 00:01:49.558
And I feel as if we would have a very easy time finding people to talk to that were all lit up about vulnera, like agent based vulnerability discovery.
00:01:49.798 --> 00:01:50.938
I'm one of those people.
00:01:51.147 --> 00:02:07.317
Um, but it's trickier to find somebody who is both, skeptical might be the wrong word, but like on the exact same page as everybody else, and who also has your track record in the space particularly, and I said this a little bit earlier, like.
00:02:08.217 --> 00:02:12.927
90% of what I talk about here is just me exercising demons from Hacker News.
00:02:13.168 --> 00:02:26.127
And like one of my, like one of my continual irritants on Hacker News is that anytime a story, um, from one of the Frontier Labs comes up, um, like three people always say Fuzz at all this stuff already.
00:02:27.027 --> 00:02:31.711
And like the problem is that Google isn't running Fs or Apple isn't running Fs or Yeah.
00:02:32.337 --> 00:02:40.348
uh, yeah, so you're the author of American Fuzzy Lop A FL, which is like the defacto standard tool in that space.
00:02:40.377 --> 00:02:53.668
So I kind of wanted to get like your perspective, not right away on the AI stuff, but just basically on the trajectory of how we've been doing, um, you know, automated vulnerability assessment, let's call it.
00:02:54.009 --> 00:02:56.574
Uh, so that is, that is a.
00:02:58.617 --> 00:03:00.147
That is a very open-ended question.
00:03:00.147 --> 00:03:09.027
I think, uh, know, like most of vulnerability research is being done automatically, and, and it's been like that for a, for a, for a long time, right?
00:03:09.027 --> 00:03:17.397
If, if you look at the browser space, I would wager that 80 or 90% of what's actually found and fixed is a product of automated tools.
00:03:18.207 --> 00:03:33.177
At the same time, you know, though it is automated, you can have dramatic sort of, you know, step improvements or, or sort of, you know, like revolutionary shifts in the tooling that we are using.
00:03:33.177 --> 00:03:36.508
And I think LMS do represent such a shift.
00:03:37.258 --> 00:03:46.768
so I'm not gonna take the, the, you know, the contrarian position of all this, All, of this sucks and it's the same as fuzzing and, you know, time is a flat circle.
00:03:47.217 --> 00:03:54.147
But, um, but at the same time, I do have fairly, you know, complex thoughts about the.
00:03:55.129 --> 00:03:57.560
Impact of the, of the AI angle specifically.
00:03:57.560 --> 00:04:02.930
And I can sort of, you know, get into that now, are, are we gonna, get there more gradually.
00:04:03.889 --> 00:04:09.319
but yeah, sort of, you know, to to, to directly answer your question, I think this is, this is a very interesting time to be in.
00:04:09.319 --> 00:04:13.009
I think we are seeing a very fundamental shift.
00:04:13.039 --> 00:04:14.330
The technology is real.
00:04:14.360 --> 00:04:18.439
Real, it's amazing, and you should be using it as a part of your workflow.
00:04:18.589 --> 00:04:19.295
I think that's the bottom line.
00:04:21.951 --> 00:04:25.762
Yeah, so I think the, the, the first thing I wanna like.
00:04:27.360 --> 00:04:47.819
I have like my own personal experience using like, kind of fuz arrangements of various kinds to do projects, but I've never done the, like the at scale work that like, you know, Google did in like the 2010s, um, you know, so like large farms full of things doing, you know, profile guided, you know, a FL coverage and all that, right?
00:04:47.819 --> 00:04:57.480
So I have a mental model of like fers as tools of like, they're like literally things that I would build as like shop tools, um, to get like, you know, individual projects done.
00:04:57.810 --> 00:05:08.670
Um, but like of these, like one of the worries I always have when people say like, FERS, that all this stuff is like my, um, like my advanced fuzzer knowledge is not all that up to date.
00:05:08.670 --> 00:05:21.060
I understand exactly what the tools are doing, but like the difference between that and actually finding vulnerabilities with them, like actually having the field experience with them and seeing where like the, you know, the sharp edges are or where they were, they're really, really effective or whatever.
00:05:21.240 --> 00:05:23.250
I feel like I have less real world experience.
00:05:23.370 --> 00:05:25.410
So if I said that like.
00:05:26.264 --> 00:05:31.454
the way I wanna get into this is just to like make a, make a a claim that it's probably gonna be wrong, but I'll make it anyways.
00:05:31.454 --> 00:05:32.774
It's just so that you can tell me that I'm wrong.
00:05:32.774 --> 00:05:33.134
Right.
00:05:33.463 --> 00:05:47.324
Um, my like experience of this is that Fs are a really good way of getting a, a pile of, you know, variably quantified or variably qualified crashes in programs.
00:05:47.324 --> 00:05:47.744
Right?
00:05:47.983 --> 00:05:55.574
Um, and that like people that run large scale fuzzing, um, you know, quickly get adept at, you know, building mountains and mountains of crashes.
00:05:55.843 --> 00:06:04.934
Um, and in those crashes I think there's like a general understanding that there are vulnerabilities, but the work is going from that pile of crashers to actual vulnerabilities.
00:06:05.113 --> 00:06:07.634
And if you're not doing that work, you're not actually solving the problem.
00:06:07.807 --> 00:06:18.848
Yeah, I think, you know, a large portion of, of, of running furthers at a scale and actually getting pulmonary diabetes fixed is the automation around the actual sort of, you know, permutation engine.
00:06:18.848 --> 00:06:19.117
Right?
00:06:19.117 --> 00:06:19.598
Like, it's how you.
00:06:20.543 --> 00:06:22.824
Uh, how you get projects on board in the first place.
00:06:22.824 --> 00:06:26.124
That's a, you know, a major bottleneck for, for open source.
00:06:26.124 --> 00:06:39.413
And I think, you know, quite often you have to do it yourself, and then it's gated on the capacity of software engineers to actually instrument code, plug it in the right place, make sure that the right functionality is being exercised.
00:06:39.834 --> 00:06:44.184
And then the really difficult part is, you know, crashes are open good enough.
00:06:44.213 --> 00:06:48.533
Like I think open source developers don't necessarily need an exploit.
00:06:48.533 --> 00:07:01.043
They don't need a very detailed write up, but they want a repeatable crash and you need to bring it to them using the workflow that they prefer, you know, in a, in a fashion that works for them.
00:07:01.254 --> 00:07:09.024
Some of them have their own, you know, pet peeves and uh, uh, sort of, you know, complex ideologies that you have to.
00:07:09.824 --> 00:07:13.783
Work with to, to, actually make sure get fixed.
00:07:13.903 --> 00:07:15.913
So I think it was always bottleneck, profiling.
00:07:16.213 --> 00:07:18.793
Not all of this goes away with agents.
00:07:18.853 --> 00:07:23.949
I think interactions with open source developers continue to be.
00:07:25.408 --> 00:07:33.208
A very challenging touch point that you can't really automate with, with an LLM and expect good results.
00:07:33.399 --> 00:07:33.507
Right.
00:07:33.610 --> 00:07:33.910
Right.
00:07:34.858 --> 00:07:49.918
yeah, I think, like, again, I, I think, uh, the way I've, I've been describing this, and that goes way beyond vulnerability research, is that, you know, most of problems really boil down to text comprehension at a scale, but then faces on scale, right?
00:07:49.918 --> 00:08:03.867
Like, we never have enough resources to actually at every event generated by an enterprise, you know, detection pipeline or to sort of, you know, look at every line of code that that's, that's being written.
00:08:03.867 --> 00:08:09.836
And I think LLMs really profoundly changed the game on a number of fronts, Yeah.
00:08:11.103 --> 00:08:15.033
Let me, like, let me try really quickly, just like, I mean two things, right?
00:08:15.033 --> 00:08:16.324
First of all, cards on the table.
00:08:16.324 --> 00:08:23.973
My interest in all of this stuff is, um, like almost purely on the capability side, right?
00:08:23.973 --> 00:08:31.653
Like what vulnerabilities are we finding is a much more interesting question to me than how, um, how this works as an engineering process, right?
00:08:31.653 --> 00:08:34.864
Like how we solve the open source, metabolizing these things, all that stuff.
00:08:34.864 --> 00:08:37.653
Those are really important and valid problems that I have.
00:08:38.879 --> 00:08:39.809
Passing interest in.
00:08:39.840 --> 00:08:40.470
Right.
00:08:40.529 --> 00:08:44.519
But like, I'm, I'm really focused on like the raw capability side of it.
00:08:44.519 --> 00:08:44.879
Right.
00:08:45.090 --> 00:09:06.000
And then like with respect to how fuzz of have traditionally worked, I have like a radicalizing moment a couple years ago, like maybe a year and a half ago, where like, um, an engineer in our team, um, who, uh, is amazing, um, once a week he was finding game over vulnerabilities in our platform and like, you know, resolving them.
00:09:06.000 --> 00:09:11.370
And one of them was, um, this wasn't a game over vulnerability, but it was a really good concern that we hadn't thought about.
00:09:11.610 --> 00:09:16.049
We, we run farms of virtual machines for our customers, multi-tenant on the same hardware.
00:09:16.120 --> 00:09:16.389
Yep.
00:09:16.799 --> 00:09:26.159
um, at, at, at in, in some corner of our system, we were doing file system maintenance, um, for VMs on the host side.
00:09:26.340 --> 00:09:29.129
So like we do like file system repair before backup or something like that.
00:09:29.129 --> 00:09:29.909
It was like, whatever.
00:09:30.768 --> 00:09:33.467
current equivalent of F disc is or whatever, but we'd run that.
00:09:33.738 --> 00:09:43.307
Um, on the host side, he's like, well, you know, the file system obviously is controlled on the guest side, so you now you're exposed to the entire kernel surface for whatever this file system is.
00:09:43.307 --> 00:09:44.298
That's a really good find.
00:09:44.298 --> 00:09:45.677
We, we solved that pretty quickly.
00:09:45.977 --> 00:09:49.727
Um, but like we're, trying to figure out how big of a deal it was.
00:09:49.758 --> 00:09:52.937
He's like, I'm just gonna go to SIDH collar and find Crashers and run them through it.
00:09:52.937 --> 00:09:54.857
And like there were crashes for it.
00:09:54.857 --> 00:10:03.467
Like he was immediately able to repro, um, you know, don't, you know, you can't call it a memory corruption vulnerability just'cause it panics or whatever.
00:10:03.707 --> 00:10:07.967
But like, you know, things where if we had found them ourselves, we would've gone and investigated them.
00:10:07.967 --> 00:10:15.427
And like I have now this perception that there is just a mountain of his collar things that are just sitting there and like, somebody should my dad's.
00:10:15.738 --> 00:10:18.918
But like, are they vulnerabilities or are they not vulnerabilities?
00:10:19.758 --> 00:10:19.878
know.
00:10:20.118 --> 00:10:21.738
We're in a state of uncertainty about them.
00:10:21.768 --> 00:10:22.187
Right.
00:10:23.340 --> 00:10:23.519
no.
00:10:23.519 --> 00:10:26.429
So I, I think that's a, that's a, like a fundamental change, right?
00:10:26.429 --> 00:10:41.434
And, and again, it doesn't matter as much as people sometimes claim, but I think it does matter, especially if you have like, you know, Heisenberg, that you don't really, you know, you can't immediately decide what's causing this.
00:10:41.580 --> 00:10:43.529
It doesn't reproduce consistently.
00:10:43.529 --> 00:10:48.120
It happens in a weird place that maybe, you know, miles away from the original fault.
00:10:49.080 --> 00:10:59.250
so look like, again, in terms of technical capability and how it the game for, for InfoSec, I'm not actually a contrarian at all, right?
00:11:00.299 --> 00:11:04.620
my contrarian position lies somewhere else.
00:11:06.299 --> 00:11:15.299
and it's, it has more to do with how we as an industry think about vulnerability research in the first place, right?
00:11:16.799 --> 00:11:17.309
And.
00:11:18.964 --> 00:11:24.994
I should say, like, I'm saying that my interest is in X, Y, Z, but like, I don't speak for David, you or Deirdre.
00:11:25.203 --> 00:11:28.323
I think I'm a, I'm a weirdo in this, in this one thing, right?
00:11:28.323 --> 00:11:36.994
Like, I find vulnerability research really very motivating, um, as a reason to learn pretty much everything I've learned about technology and math.
00:11:37.083 --> 00:11:38.823
Um, but that's just me, right?
00:11:38.823 --> 00:11:42.333
Like, I think you're right to like, call out the, the industry.
00:11:42.394 --> 00:11:48.153
You, you just said something interesting that I've heard you say before, which is just like, um, how the industry kind of looks at vulnerability research.
00:11:48.153 --> 00:11:56.014
And you've said in other places, like, I get the impression that you generally feel like we way overvalue vulnerability research as an intrinsic good.
00:11:57.611 --> 00:12:08.081
So, know, maybe let me answer that in, in the form of a, of a run and, and I'm, I'm, I'm gonna get to like a very precise AI related point on the line.
00:12:08.081 --> 00:12:23.172
But, uh, yeah, I, I, I I've come to, you know, to test InfoSec punditry on some level because I think we, we consistently get fixated on things that are not really representative of what actually matters, uh, day to day.
00:12:23.172 --> 00:12:38.442
And, you know, you mentioned Hacker News and I, I actually checked Hacker News today and there was someone talking about how InfoSec sec, uh, information security has already ceased to exist as a field, as a consequence of, you know, AI vulnerability discovery.
00:12:39.912 --> 00:12:42.392
and, and I That was not me for the record.
00:12:42.615 --> 00:12:45.902
me let me call my boss real quick and let her know the field doesn't exist anymore.
00:12:47.124 --> 00:12:50.844
so, you know, and, and, and, and it's not just that I think, you know, like, uh.
00:12:52.500 --> 00:13:01.529
when you think about what arguably changed enterprise security the most in the past 15 years, it's not the stuff that people present at Black Hat or that we, you know, sell at our RSA.
00:13:01.529 --> 00:13:03.809
It, it was the one thing that we all love here.
00:13:03.809 --> 00:13:05.460
I think Bitcoin, right?
00:13:05.460 --> 00:13:15.120
It used to be that ransomware was this niche thing that basically was constrained by how much money you could move through Western Union, which was not a lot, right?
00:13:15.330 --> 00:13:23.190
And now it's this like global economic powerhouse that funds hostile regimes and really is the one thing that keeps most CSOs up at night.
00:13:23.580 --> 00:13:27.120
And, you know, post quantum cryptography doesn't I, I'm, I'm sorry to say that, right?
00:13:27.179 --> 00:13:29.490
And, and yeah.
00:13:29.580 --> 00:13:39.750
And, and so in, in my mind, you know, the, the discourse around AI vulnerability discovery kind of fits that mold, although not, again, not in the pe in the way that many people claim.
00:13:39.809 --> 00:13:44.940
And, you know, ma, many folks think that the technology itself is hype or, and, and it isn't, right?
00:13:44.940 --> 00:13:47.399
Like, again, it's real, it's impressive and you should be using it.
00:13:48.690 --> 00:13:49.620
but, um.
00:13:49.908 --> 00:13:55.217
Uh, and, and, and again, as I, as I mentioned, right, I think most of security is text comprehension at a scale.
00:13:55.307 --> 00:14:00.048
And now we have a, and, and we were really severely constrained by scale.
00:14:00.048 --> 00:14:03.633
And now we have a tool that largely removes that constraint, and that's.
00:14:04.532 --> 00:14:08.251
That's amazing, that's transformative and it's absolutely gonna change the practice of InfoSec.
00:14:09.572 --> 00:14:16.711
but to get to, to my actual point, I, I think, you know, our industry has long overstated the practical importance of vulnerability research.
00:14:16.772 --> 00:14:23.912
And, and I think it's part par, partially because it's sort of, you know, our origin story and then it's a part of our collective identity.
00:14:23.912 --> 00:14:30.542
It's how we can, you know, it's what we can bring up to show how clever we are and why we need to be paid more than, uh, everyone else.
00:14:31.292 --> 00:14:40.951
has cool ties to spycraft and, and all the other things, but, fundamentally, you know, like zero days were generally not how enterprises get popped.
00:14:41.042 --> 00:14:48.062
And, and having five times as many zero days or 50% less doesn't really change the nature of the game.
00:14:49.471 --> 00:14:52.892
and, and part of it is, you know, sort of physical constraints too, right?
00:14:52.892 --> 00:14:55.081
Like the technology is not magic.
00:14:55.081 --> 00:14:57.991
It doesn't give you an endless play of, you know, zero days in openness.
00:14:57.991 --> 00:14:58.892
SH for example.
00:14:59.682 --> 00:15:08.668
gives you some respectable numbers of new findings in software that was already kind of busted and had exploitable bugs every Yeah.
00:15:09.139 --> 00:15:16.309
And, and, you know, and, and that you probably have somewhere in your enterprise in a version that's five years behind, right?
00:15:16.490 --> 00:15:35.059
So we, we were always kind of operating in that reality and, and we have far more basic problems that we can't quite solve or couldn't, you know, inventory, patching human behavior that are adding up to a much larger and less tractable attack surface that actually keeps biting us in the back over and over again.
00:15:36.019 --> 00:15:47.690
and this is actually where LLMs are absolutely amazing and are gonna change the, because like all of sudden you can actually reason about every single thing that's happening within your enterprise, quite possibly, right?
00:15:48.529 --> 00:15:50.000
you can take action on that.
00:15:51.649 --> 00:16:00.019
And, on the offense side, it's kind of, you know, the same thing that like the attackers can now afford to pull on every single door handle within your enterprise.
00:16:00.860 --> 00:16:03.320
they can do that more quickly and they don't have to care.
00:16:03.320 --> 00:16:07.490
Like, you know, if you're using an agent, you have to worry about it deleting your production database.
00:16:08.365 --> 00:16:08.966
They don't.
00:16:09.115 --> 00:16:09.355
Right.
00:16:09.355 --> 00:16:13.076
Like, if it messes up, well that's a shame, but that was your data not theirs.
00:16:13.076 --> 00:16:13.346
Right.
00:16:14.635 --> 00:16:20.515
so, uh, so I like, again, I think there's a lot of interesting wake up calls for, for security.
00:16:20.605 --> 00:16:24.596
Uh, that and, and things we need to reckon with, and things we need to start building.
00:16:24.596 --> 00:16:30.865
But like, you know, the vulnerability research side amazing and it's, you know, on some level it is.
00:16:33.011 --> 00:16:40.991
Depressing to me that, you know, this is the, the one thing that I always enjoyed and, uh, you know, same as Thomas, right?
00:16:40.991 --> 00:16:49.601
Like, it really motivated me to learn now, you know, there's a computer that can do it better, the same or better and, and, you know, for a lot less.
00:16:50.861 --> 00:16:55.871
but yeah, I that, that's sort of, you know, the genesis of my skepticism here, right?
00:16:55.871 --> 00:17:08.652
I think the, the AI apocalypse in the industry or the day of reckoning is coming, but it's probably not the, you know, v apocalypse right angle specifically.
00:17:08.951 --> 00:17:11.738
Yeah, I, I, I wanna, you go, sorry.
00:17:12.084 --> 00:17:15.624
Uh, I, no, I, I mostly, uh, agree with you.
00:17:15.713 --> 00:17:28.763
Um, the way that I would put it is that, that it seems like ex, like zero day exploitation is or let's see, pre AI was not supply constrained at all.
00:17:28.884 --> 00:17:30.294
It was demand constrained.
00:17:30.683 --> 00:17:46.644
Um, because like for the most part, works in the sense that it is like not a good career option for anyone on this call to decide to like go into exploitation.
00:17:46.644 --> 00:17:52.794
And if they do like actual, like computer exploitation, not like vulnerability research.
00:17:52.943 --> 00:17:57.294
And if they do, like you said, you're probably just gonna go after unpatched things anyway.
00:17:57.743 --> 00:18:03.923
It's not clear that increasing the number of available zero days results in more like actual.
00:18:04.882 --> 00:18:07.672
Operationalized, uh, uh, exploits.
00:18:08.019 --> 00:18:08.289
Yeah.
00:18:08.692 --> 00:18:11.271
I, to, to, be and it seems like it won't.
00:18:11.470 --> 00:18:14.019
I, I think, you know, that there are quantitative differences, right?
00:18:14.019 --> 00:18:16.210
Like I'm, I think it lowers the bar, right?
00:18:16.210 --> 00:18:17.695
And sort of, you Absolutely.
00:18:17.799 --> 00:18:20.920
think, you know, it's gonna alter the market dynamics, right?
00:18:20.920 --> 00:18:22.134
Like, if you wanna Yeah.
00:18:22.433 --> 00:18:23.829
maybe you're gonna be able to buy it for less.
00:18:24.130 --> 00:18:27.685
Yeah, we may have the Jevons paradox It's for, for.
00:18:27.986 --> 00:18:31.630
qua qualitative versus quantitative, I think is the distinction.
00:18:31.630 --> 00:18:31.990
I see.
00:18:32.289 --> 00:18:53.183
Yeah, so I, I think there will be, there is like a risk that like in like, let's say Southeast Asia, not to rag on them, that are currently running like tech support scams, um, may find that it is now economical to run subset, subset of like AI driven exploitation things on some subset of users.
00:18:53.970 --> 00:19:07.913
But but I back would look different kind of in the same way that like reading music got replaced with like listening to Spotify versus like everyone just started paying 99 cents a song.
00:19:08.564 --> 00:19:11.503
Like I, so I, I, I think I'm like the, the, the resident.
00:19:12.403 --> 00:19:15.824
Vulnerability research and AI maximalist in this conversation.
00:19:15.824 --> 00:19:16.124
Right.
00:19:16.364 --> 00:19:25.423
And I do think that the, like, the emphasis on, um, you know, the, the first tier targets like Chrome and iOS and all that, right?
00:19:26.354 --> 00:19:31.453
feel like mostly a competitive thing, if that's the right way to put it.
00:19:31.663 --> 00:19:34.064
It's mostly kind of like a, it's, it's tournament logic, right?
00:19:34.064 --> 00:19:37.153
It doesn't have that much to do with making things more secure.
00:19:37.453 --> 00:19:49.124
I, I feel like when we talked to, uh, mark Dow about like the markets and vulnerability research, I didn't come away from that with the sense that like they were lacking for possible vulnerability avenues to chase down.
00:19:49.423 --> 00:20:01.124
Um, and like there's a, like, there's a persistent logic that, you know, state level actors or whatever are stockpiling vulnerabilities, which turns out not to be true, like it's a software product, like every other software product.
00:20:01.124 --> 00:20:08.923
And they're literally more concerned about paying maintenance costs for vulnerabilities and exploit kits than they are with like, you know, having 15 different backup vulnerabilities.
00:20:09.104 --> 00:20:09.794
So.
00:20:10.582 --> 00:20:17.511
you could look at the situation and say, okay, the fact that it's gonna get cheaper to find Chrome vulnerabilities, like a chrome drive-by or whatever.
00:20:17.811 --> 00:20:23.031
Um, and that won't change that much because everybody that you cared about having Chrome drive-bys already had 'em.
00:20:24.126 --> 00:20:25.981
or already a market that makes that work.
00:20:26.057 --> 00:20:29.731
already an they really needed and no more.
00:20:29.731 --> 00:20:29.791
Yeah.
00:20:30.915 --> 00:20:41.488
and I, An early Uber investor a few weeks ago was saying, oh, I don't know why we didn't give Mythos like to the US government and then use it to hack China, like before announcing it.
00:20:41.488 --> 00:20:44.728
And it's like, well that's'cause that's not how any of this can works.
00:20:44.907 --> 00:20:46.258
Like we're not short.
00:20:46.438 --> 00:20:53.188
The reason that like the US military can or cannot get into something in China has nothing to do with like a shortage of exploits.
00:20:53.332 --> 00:21:00.142
The, the, the other reason why I, I'm kind of skeptical about the vulnerability situation specifically is that I think there's like inherent symmetry to it, right?
00:21:00.142 --> 00:21:06.561
Like any tool that the bad guy can use, the, the good guys can use exactly the same way, right?
00:21:06.892 --> 00:21:14.001
So if Chrome or you know, Microsoft or whoever Apple want to.
00:21:15.316 --> 00:21:19.996
Sort of, you know, much the increase in the availability of zero days.
00:21:19.996 --> 00:21:28.516
You know, they, they have a simple lever to pull and they can sort of, you know, get where they want to be to restore the, the, the, the previous equilibrium.
00:21:28.846 --> 00:21:29.175
Right.
00:21:29.415 --> 00:21:30.465
Or even go beyond.
00:21:30.645 --> 00:21:34.185
I think there are many other areas in security where that symmetry doesn't hold.
00:21:34.516 --> 00:21:34.726
Right.
00:21:34.726 --> 00:21:52.306
Like the, the, the, the example I mentioned, like, you know, the defense versus offense on the, on, on the, on the, on the enterprise side this, as symmetry baked in, it's a a lot easier to crank out hyper targeted spear phishing emails to exec than to detect and stop them reliably.
00:21:52.365 --> 00:21:52.726
Right.
00:21:52.756 --> 00:21:53.566
Even with ai.
00:21:54.316 --> 00:22:01.695
And so, uh, I, I think that's where the, the AI gives the bad guy is a lot more.
00:22:03.188 --> 00:22:06.607
Advantage that is more difficult to counter Right.
00:22:08.137 --> 00:22:14.887
you know, we were fing chrome before, now we are also gonna, you know, throw some l LMS at it.
00:22:14.887 --> 00:22:15.248
Right.
00:22:15.307 --> 00:22:22.837
And, and that's kind of, you know, the eternal struggle between good and evil.
00:22:22.843 --> 00:22:22.913
Right.
00:22:23.334 --> 00:22:32.544
It changes things operationally a lot for all of the reasons that like Thomas doesn't care about, um, which are, I think the ones that are interesting to, to me.
00:22:32.574 --> 00:22:32.963
And so like.
00:22:34.612 --> 00:22:35.961
You, you have a question?
00:22:35.961 --> 00:22:49.192
Even like right now, had people come to me at Chrome who like work on other parts of Chrome and are basically like, aren't we just drastically overinvesting in basically like anti exploitation things.
00:22:49.551 --> 00:22:51.652
And if you look at it like by the numbers, right?
00:22:51.652 --> 00:22:55.132
There's like not that many people whose chromes get popped every year.
00:22:55.251 --> 00:23:04.642
So in some sense we are, other hand, like what we're really doing is, is like we're winning sort of for some definition of winning.
00:23:05.031 --> 00:23:11.751
And like if we stopped doing all of this, it will go back and it would look like two early 2000 or the late nineties again.
00:23:11.991 --> 00:23:15.412
And so we just kind of have to do all this work to run in place sort of.
00:23:16.221 --> 00:23:27.051
then like what, like AI bug finding has done, has, I think in many ways like just validated things that a bunch of security people already knew.
00:23:27.051 --> 00:23:31.731
Like for, for platforms, basically like let's ignore the open source projects, which is like.
00:23:32.733 --> 00:23:33.334
interesting.
00:23:33.334 --> 00:23:33.693
I agree.
00:23:34.088 --> 00:23:37.114
I, I agree with everyone else that I don't really care about.
00:23:37.213 --> 00:23:49.903
How about, about like small open source projects and instead, like, let's just talk about like things that previously were targets for exploitation, which is like client side platforms like browsers Let's not talk about stuff like XZ, right?
00:23:49.903 --> 00:23:50.804
Like who cares about that?
00:23:52.301 --> 00:24:02.622
Um, I mean, in practice, uh, um, in practice, like, uh, I, I would just, I would quote Hermione, um, and, and say, you know, when that turns out, when that happens, we're pretty good at catching it.
00:24:02.951 --> 00:24:05.561
Um, uh, but.
00:24:06.644 --> 00:24:23.983
Like the deluge of AI bugs has created, like has magnified all the things that were already stupid about bug bounties, which was that like a bug bounty is like the worst possible way to prioritize security work because it's entirely interrupt driven.
00:24:24.463 --> 00:24:32.983
And so instead, what you have is you have just deluge of bugs that were basically validating everything the security people said, which was like, your code's full of memory safety vulnerabilities, and these are the areas that are the worst.
00:24:33.673 --> 00:24:39.973
then people are like, oh, you know, I don't know, like, and security people are bad at their jobs at getting people to change anyway.
00:24:40.784 --> 00:24:45.374
And so all these bugs show up and then you have this operational question of like, how do we deal with that?
00:24:45.463 --> 00:24:57.973
And you have to deal with it, even though the like impact of increased exploitation might not be that bad because eventually, like if we just chose to not deal with it, we'd be back in the two thousands again and we don't want that.
00:24:58.124 --> 00:25:04.273
So you have to figure out how to deal with it and like, yeah, you get the AI tools to help you deal with the problems that the AI solved.
00:25:05.006 --> 00:25:22.615
Um, but again, I think it is a little bit harder for defenders because like if, if you're an engineering team, you need to like make sure this stuff is repeatable and can either run on every commit or you have like a consistent way of using a harness to find bugs and patch them and prevent them from coming back.
00:25:23.036 --> 00:25:36.746
Whereas if you're like selling exploits, even if you're operationalizing it, what you need is a fuzzer you can run for a few months that pops out a big enough backlog and then a couple months later you need to be able to do that again.
00:25:36.836 --> 00:25:44.786
I'm kind of, I haven't actually worked for an offensive firm so I don't know that for sure, but there's a difference between finding a lot of bugs once and then like actually solving a problem.
00:25:45.445 --> 00:25:49.256
And again, the people working on the platforms actually have to solve the problems again.
00:25:49.461 --> 00:25:53.215
And, and that just always sucks 'cause you're, you know, doing the work.
00:25:53.266 --> 00:26:15.615
you know, like with, with, you know, browsers in particular, I think, you know, the implicit assumption is that given the developer velocity, the choice of languages and the features that are sort, you know, being shipped every year, we are accepting, implicitly accepting a certain baseline of security failures, right?
00:26:15.826 --> 00:26:21.165
So like, we are not aiming for a state of having zero vulnerability because that would be insane.
00:26:21.165 --> 00:26:22.665
And also, yeah.
00:26:23.415 --> 00:26:25.215
Uh, and so.
00:26:26.228 --> 00:26:28.988
I, I, yeah, you wanna lower the base rate.
00:26:28.988 --> 00:26:47.647
You know, you wanna run the same tools that the the guys are running at the same or larger scale to make their lives harder, but ultimately more hinges not on the inability to find another bug in, you know, WebGL or whatever, but, uh, actually on mitigations, right?
00:26:47.813 --> 00:26:54.877
like up and making it really difficult to reliably exploit and, and the cost up, right?
00:26:54.877 --> 00:27:00.817
Like most of the mitigations you can eventually bypass if you get lucky, if you can, if you chain together, you know, five or 10 bucks.
00:27:01.238 --> 00:27:13.807
But a large of why zero days have gotten so expensive is you need to do all that legwork that wasn't necessarily essential before.
00:27:13.807 --> 00:27:14.258
Right?
00:27:14.288 --> 00:27:24.410
And with that a little bit in the sense that like enough mitigations, like do you actually have an impact on attackers?
00:27:24.710 --> 00:27:36.170
But you can like affirmatively say, like a given bug that comes into your queue, like doesn't matter at like at this line of code, ideally by like inspecting the line of code being like, oh, this uses a span.
00:27:36.170 --> 00:27:41.269
So I know it's not an out of bounds read unless the span is constructed wrong or it uses raw putter, miracle pointer and chrome.
00:27:41.480 --> 00:27:43.130
So we know the use after free doesn't matter.
00:27:43.182 --> 00:27:43.451
no, no.
00:27:43.609 --> 00:27:51.980
Like if you have something where like, oh, maybe it's just a right and not a read, you still have to treat it like it's bad I, was, and then it comes through your whole process as an engineer.
00:27:52.077 --> 00:27:53.428
I was talking about, the offense side, right?
00:27:53.428 --> 00:27:55.915
Like Yeah, but you can't discern.
00:27:56.365 --> 00:28:01.736
The problem is the defender can't discern which ones were useful and which ones were not.
00:28:01.736 --> 00:28:03.115
And so you have to treat them all the same.
00:28:03.205 --> 00:28:17.395
And so if you just apply mitigations, even if you are actively hurting the ability to actually exploit Chrome, like you're not solving your problem, of you have this massive interrupt queue of security issues, um, which eventually, like you're just gonna stop looking at.
00:28:17.428 --> 00:28:25.407
Yeah, yeah, we we're basically doing two things that are not solving the problem, but, Y Yeah, trying to ate all the bugs, but yeah.
00:28:26.259 --> 00:28:35.170
So there's like an implicit assumption here in this conversation that like the vulnerabilities that, um, agents might find, um, and we can get into like more of why we think.
00:28:35.571 --> 00:28:53.271
You know, agents might or might not find different kinds of vulnerabilities, but like the vulnerabilities they're gonna find are gonna be of the same kind of, they're gonna rhyme with all the vulnerabilities that we've seen so far, and like we're accepting a certain amount, uh, annually or every month or whatever, of memory, corruption, vulnerabilities and client side software or whatever it is.
00:28:53.271 --> 00:28:53.811
Right.
00:28:53.842 --> 00:28:57.051
And so, like, I think we feel like we have a decent beat on where things are going.
00:28:57.575 --> 00:28:59.575
like I do feel like we've of.
00:29:00.352 --> 00:29:08.392
like organizationally and as kind of an industry, we've metabolized a certain level of, you know, dealing with vulnerabilities, right?
00:29:08.392 --> 00:29:17.001
Like the sky doesn't fall every time a new vulnerability comes out, you're much more likely to get popped with phishing, um, or by a dumb misconfiguration or an S3 bucket or something like that.
00:29:17.001 --> 00:29:18.531
Like fully agree on that, right?
00:29:18.561 --> 00:29:23.241
And like LLMs apply to that stuff the same way they apply to everything else, which is super interesting.
00:29:23.571 --> 00:29:26.241
But I wanna push back on the idea that like.
00:29:26.644 --> 00:29:33.513
What agents are gonna do is, um, you know, get us to peak oil on memory corruption vulnerabilities, somewhat that, right?
00:29:33.544 --> 00:29:40.773
Like there were moments in the past when we as practitioners, like we were practicing one SQL injection, you know, broke out.
00:29:40.894 --> 00:29:41.403
Right.
00:29:41.433 --> 00:29:46.354
And there's, there's like a before, after moment that was probably the span of like just a couple months where like.
00:29:47.536 --> 00:29:52.756
there were a bunch of things that were hard to break into and after like for a while, everything was trivial.
00:29:52.935 --> 00:30:03.915
The first commercial pen test I ever did, um, was like, it was, it was a, it was an application where I logged in with quote or quote equals quote, which is literally the first sequel injection I ever attempted.
00:30:04.155 --> 00:30:07.996
And it worked, which totally ruined me for vulnerability research ever after that.
00:30:08.026 --> 00:30:09.105
'cause I'd always think that would work.
00:30:09.105 --> 00:30:13.006
And it almost like you, you never get blatant SQL injection vulnerabilities like that.
00:30:13.006 --> 00:30:15.405
But I did in that one instance and thought they were that common.
00:30:15.615 --> 00:30:20.026
But like, so like when we discovered seql, when, we first published Stack overflows, right?
00:30:20.056 --> 00:30:30.346
There's a clear before and after, um, to enablement for Stack Overflow vulnerabilities, before lots of software it's know resilient And then after the entire internet was vulnerable.
00:30:30.346 --> 00:30:32.925
And in those moments it's really material.
00:30:33.268 --> 00:30:38.038
The vulnerabilities that you're finding right in those moments, it actually really matters a lot that there are all these new vol.
00:30:38.038 --> 00:30:42.657
It becomes the dominant vector that things get popped with, um, until you kind of figure that out.
00:30:42.837 --> 00:30:49.978
And I'm not as certain as, I think the implicit assumptions in this conversation are that we're not gonna see more things like that.
00:30:50.218 --> 00:31:03.597
So, um, you know, side channel attacks are a good example of where there's like lots of kind of intellectually understood vulnerabilities that we don't viscerally feel and we don't deal with because there isn't enough elite attention to develop them into real vulnerabilities.
00:31:03.807 --> 00:31:11.548
How certain are the three of you that, like all go memory, race vulnerabilities are not gonna really be practically exploitable?
00:31:11.938 --> 00:31:12.357
Um.
00:31:13.480 --> 00:31:21.362
So I, I, I think you're sort of, you know, inching toward this sort of, you know, a GI question here, maybe Is that a GI?
00:31:21.362 --> 00:31:25.537
It's like it's We declare a GI Once you can ex GI.
00:31:25.748 --> 00:31:28.029
Uh, exploiting a go raise condition.
00:31:28.029 --> 00:31:28.765
A GI confirmed.
00:31:29.627 --> 00:31:45.468
Yeah, no, I, I, I think, you know, on, on to, to some extent, you know, all, all, all that I have seen so far is that LLMs are very good scaling the methods that we've been using in the past and finding the problems that we've been finding in the past.
00:31:45.917 --> 00:31:48.511
Uh, now I think, you know, there's also like.
00:31:50.067 --> 00:32:04.407
Less numerous data points from other fields that they are actually so good at combining and synthesizing information from the sort of, you know, training corpus that they arrive at completely new conclusions, completely new findings.
00:32:04.407 --> 00:32:07.917
Like, you know, like fundamentally new math, right?
00:32:07.917 --> 00:32:08.337
And so on.
00:32:09.028 --> 00:32:14.875
Uh, and I, I, you know, like, I think you're asking about unknown unknowns, right?
00:32:15.175 --> 00:32:27.508
Like, a future where we, it, actually turns out that there's a, an, know, nearly inac accessible supply of zero days in openness, sage in places even thinking about.
00:32:28.288 --> 00:32:30.788
Uh, but I, you I, have no Yeah.
00:32:31.048 --> 00:32:33.559
or disprove that, Hold on in, hold on.
00:32:33.769 --> 00:32:39.440
In fairness, I wanna say I actually don't think we're gonna get like a bottomless supply of openness stage vulnerabilities.
00:32:39.440 --> 00:32:43.001
I have like a, despite it being an old school C code base, I Yeah.
00:32:43.009 --> 00:32:44.960
high opinion of the openness stage code base.
00:32:44.960 --> 00:32:45.289
Right.
00:32:45.470 --> 00:32:50.390
I'm actually thinking of things where like I have a nagging suspicion that there are already things there.
00:32:50.569 --> 00:32:56.750
And to me it's not as much about advancing LLM like frontier model capabilities, although that's a factor.
00:32:56.960 --> 00:33:02.890
It's not as much that as it is the new abundance we have of elite attention, right?
00:33:03.190 --> 00:33:11.329
where Like it doesn't take that much time for me to set up the conditions to like do, you know, a side channel testing harness across the internet or something like that.
00:33:11.569 --> 00:33:19.099
Where like I, I'd have to do a whole lot of studying and research and like trial and error to get that, like those harnesses set up for myself to do that kind of testing.
00:33:19.099 --> 00:33:21.289
And now I can just dispatch it and have it done.
00:33:21.650 --> 00:33:23.359
Um, like it's, it.
00:33:23.420 --> 00:33:35.243
So I feel like the really high end vulnerability research has been for the past 20 years done by Like A reasonably large number of people, but it's still an elite in the industry and I don't like that.
00:33:35.321 --> 00:33:35.561
right?
00:33:35.903 --> 00:33:37.463
that's always been kind of bullshit.
00:33:37.614 --> 00:33:47.273
And like, one of my big things is just I don't think that the people doing this work on the high end are really in any fundamental sense, more gifted or capable than any other engineer.
00:33:47.273 --> 00:33:50.874
They just, they, they've been inducted into the field and they get to do that work, right?
00:33:51.233 --> 00:33:54.534
And like, I think the bottom has fallen out of that, right?
00:33:54.534 --> 00:34:07.163
And so now if you imagine 10, a hundred times more people being able to do that work because it's no longer as time consuming, I think a lot more things get kind of proved out than would've gotten proved out before.
00:34:07.577 --> 00:34:21.018
like, know, like where do you even get the knowledge to start the thing that requires, like, that also requires time, but it, it requires some sort of like en entry point of like, how do I even get started on this path?
00:34:21.137 --> 00:34:23.148
And now you don't even have to know anything.
00:34:23.148 --> 00:34:25.128
You just like, go look for VUL in place.
00:34:25.128 --> 00:34:26.208
Like, here's your guide.
00:34:26.208 --> 00:34:27.918
Start here, enter here.
00:34:28.277 --> 00:34:31.338
And it will find something more, more likely than not.
00:34:31.697 --> 00:34:35.807
Uh, if it's a, if there is a VUL there, it won't, you know, maybe it'll hallucinate something that's not really there.
00:34:35.807 --> 00:34:40.577
But then you can write a test that'll actually, it'll ask it to write a test to be like, confirm that this is broken.
00:34:40.878 --> 00:34:55.998
So there's, it's, it's not even just the time amplifier, but like, there's a lot of stuff that you used to be, have to be able to know what to ask or know where to start or know how to approach a thing, um, that you, you basically have a, a very powerful shortcut on.
00:34:56.998 --> 00:35:08.237
I, I, would say this, I think that a lot of money and compute has been thrown at this problem by the Frontier Labs over the past couple of, you know, weeks or months.
00:35:08.297 --> 00:35:18.797
And we are gonna start seeing, uh, trickle or, or a we, mean, we, we, we have already started seeing some some of the, the sort of, you you know, public results from that.
00:35:19.277 --> 00:35:37.157
My understanding of, you know, what I've seen so far and what I can talk about is that they are not fundamentally different from, again, you know, the, kind of vulnerabilities, kinds of targets, the kinds of attack surfaces that we've been seeing before.
00:35:37.869 --> 00:35:42.827
I think that doesn't disprove your, your theory, but I think the.
00:35:44.371 --> 00:35:45.422
It, it would hinge.
00:35:45.422 --> 00:36:07.474
I think we would depend on some, you know, additional breakthrough breakthroughs before we get to this point where you can point 5.5 or or whatever at, uh, at Chrome and come up with completely in your classes of vulnerabilities or, Yeah, again, Right.
00:36:07.561 --> 00:36:08.695
of the kind stuff.
00:36:09.092 --> 00:36:11.342
we, we, thought are not exploitable in past.
00:36:11.521 --> 00:36:13.922
Like, I think I, possible like it happened before.
00:36:14.813 --> 00:36:16.344
not what I, that's not what I think.
00:36:16.344 --> 00:36:16.583
Right?
00:36:16.583 --> 00:36:27.713
Like, so there's, the big thing with Mythos has always been Nicholas Carini being able to aim those frontier models at a piece of software and just say, give me a zero day exploit, right?
00:36:27.804 --> 00:36:31.704
And those words put together and getting real output from that was a huge thing.
00:36:32.048 --> 00:36:34.764
I, I, I, that's, it's, it, that's a real thing, right?
00:36:35.202 --> 00:36:44.063
like, I'm not coming from a place of, you know, pointing, you know, a frontier model at a code base and saying, come up with an entirely new bug class.
00:36:44.827 --> 00:36:45.998
just gonna figure that out.
00:36:46.867 --> 00:36:50.228
more coming from like, do you really not have nagging suspicions?
00:36:50.378 --> 00:36:52.447
So first of all, this might just be me, right?
00:36:52.628 --> 00:37:01.958
It might just be because I learned all the computer science I learned by reading exploits, but like, it's like, it's like all I think about is like what?
00:37:01.958 --> 00:37:06.577
Like what the new bug classes are gonna be like, specter, like that was amazing for me.
00:37:06.577 --> 00:37:06.728
Right?
00:37:06.728 --> 00:37:07.597
Like things like that.
00:37:07.597 --> 00:37:11.648
Like those are, that's the punctuation for this whole kind of career that I have, right?
00:37:11.677 --> 00:37:17.347
So it's like I'm always thinking about what the, what weird things could turn out to be entire bug classes.
00:37:17.527 --> 00:37:18.938
Do you not have anything like that?
00:37:18.938 --> 00:37:19.807
Do you not think that way?
00:37:19.807 --> 00:37:21.577
Are you not a vulnerability researcher?
00:37:22.289 --> 00:37:27.603
I, I, have a lot of thing like, you know, there, there's a lot of places, there's a lot of rocks that I think we have not peaked under.
00:37:27.693 --> 00:37:35.893
And I, and I think LLMs are gonna, like, you know, in the embedded world, which is, you know, something I, I'm spending a lot of time with hobby.
00:37:36.873 --> 00:37:41.407
There is a lot of absolutely terrible things that are absolutely everywhere right now.
00:37:41.708 --> 00:37:47.134
I'm not talking, you know, like a crappy Htt p stock on a, a, a more, fundamental level, right.
00:37:47.134 --> 00:37:50.536
Like, you know, the radios and, and, and RF for, for, yeah.
00:37:50.835 --> 00:37:54.664
And, and I think this is, but, but at the same time, you know.
00:37:56.500 --> 00:37:59.920
So, yeah, I I we're gonna unlock a lot of interesting things.
00:37:59.980 --> 00:38:18.400
Does that, is it's not, a fundamentally qualitative change versus, you know, some researcher deciding, oh, actually I'm gonna throw a at this hardware, as, as it happened many times in the past and, you is the actual, like, you know, specter again, like of bugs.
00:38:19.603 --> 00:38:20.054
I know.
00:38:20.083 --> 00:38:20.893
I know what you're gonna say.
00:38:20.920 --> 00:38:22.329
it, like, I know what you're gonna say.
00:38:23.105 --> 00:38:23.454
right.
00:38:24.880 --> 00:38:26.800
Like, I, I absolutely loved it.
00:38:26.889 --> 00:38:28.329
Every, every bit of it.
00:38:28.329 --> 00:38:29.492
And, you know, Sure.
00:38:29.500 --> 00:38:32.012
amount of resources we But we agree.
00:38:32.012 --> 00:38:33.186
We, we probably agree.
00:38:33.565 --> 00:38:35.246
of the trusted compute base.
00:38:35.246 --> 00:38:39.806
It's a lot of, it's a, it's a lot of things that kind of we worry about in cryptography is Right.
00:38:40.106 --> 00:38:46.063
highly difficult to exploit in a lot of cases, but it's the foundation of trust Yeah.
00:38:46.226 --> 00:38:47.594
that we build on I know.
00:38:47.594 --> 00:38:48.313
I know.
00:38:48.733 --> 00:38:52.724
Fundamentally, the impact of Specter was simply to make all of our computers slower.
00:38:52.873 --> 00:39:00.373
I understand this, right, but that's, you can't say It could have been a I, but you, you can't say that about SQL injection.
00:39:00.403 --> 00:39:08.204
Fundamentally, the popularization of SQL injection materially changed the susceptibility of, like, of, of networks to attack, right?
00:39:08.293 --> 00:39:09.344
Spectra didn't do that.
00:39:09.463 --> 00:39:10.634
SQL Injection did do that.
00:39:10.634 --> 00:39:12.673
SSRF more recent example, right?
00:39:13.492 --> 00:39:13.731
Yeah.
00:39:13.731 --> 00:39:14.369
but, but I.
00:39:14.670 --> 00:39:19.581
again, like, you know, you, you also have tools to eradicate it more quickly now.
00:39:19.612 --> 00:39:21.322
So I think there is symmetry, right?
00:39:22.822 --> 00:39:44.992
we get like, you know, we, we've, we've been through those cycles before many times before, and both on the sort Probably the update the, uphill portion of it when, you know, someone discovers exercise and it turns out that you can do absolutely terrible things with it, including, you know, running code on your device because we moved everything to the web, right?
00:39:44.992 --> 00:39:47.422
Including control over, over endpoints.
00:39:48.030 --> 00:39:49.210
uh, and then.
00:39:49.431 --> 00:39:52.581
of, you know, we've seen people actually make progress.
00:39:53.601 --> 00:39:57.112
those classes of issues goes away, go, go away, right?
00:39:57.112 --> 00:40:02.782
Like, you know, like if you wanna find an excess on google.com, you're gonna have a hard time, right?
00:40:02.782 --> 00:40:08.541
Because of the investments, uh, that the company has made into getting rid of.
00:40:10.324 --> 00:40:17.389
Entire class of, of Into safe coating specifically, like again, not mitigations like Right, coating.
00:40:17.389 --> 00:40:18.679
Stop the bug at the source.
00:40:19.233 --> 00:40:26.614
so, so I think, you know, like, like if you're, if you're asking me if security is gonna be interesting for the next couple of years, absolutely.
00:40:27.364 --> 00:40:30.423
And vulnerability research is gonna be interesting.
00:40:30.423 --> 00:40:37.833
And a lot of other, you know, attack and defense related, aspects of it are gonna be fun as well.
00:40:38.614 --> 00:40:46.563
again, again, like, you know, and I guess, it's, a question of where we drove the line between apocalypse and, and and business as usual.
00:40:46.563 --> 00:40:46.893
Right.
00:40:46.923 --> 00:40:49.983
And maybe we are just defining it a bit differently.
00:40:50.865 --> 00:40:53.085
didn't come up with bug apocalypse or whatever.
00:40:53.085 --> 00:40:54.766
It's, I don't think there's any apocalypses coming.
00:40:54.795 --> 00:40:55.065
Right.
00:40:55.065 --> 00:40:56.206
We'll, we'll figure it.
00:40:56.206 --> 00:41:10.425
I think the RF thing is like such a good example just because of, so many times I had the experience of being on projects where there was an RF target and like we'd go in and like everyone wanted to like get good at canoe radio or whatever people were using like SDRs and all that, right?
00:41:10.425 --> 00:41:16.545
And like by your second project, you just knew going into that like, no, you're not gonna do anything with an SDR for this RF target.
00:41:16.545 --> 00:41:28.096
You have no idea how complicated it is to actually get a protocol up and running like that, Inevitably you're just going to do the hardware hacking to find like the serial bus that you can like turn this thing into a modem for its own protocol.
00:41:28.275 --> 00:41:29.985
That might not be true anymore though, right?
00:41:29.985 --> 00:41:34.635
Like now, like that's, that seems like a reasonable task to stick an LLM on.
00:41:34.846 --> 00:41:38.085
'cause it's got like in the training set, there is all the RF knowledge.
00:41:38.085 --> 00:41:41.985
It's just like none of us are electrical engineers, so we were never trained to do that stuff.
00:41:42.016 --> 00:41:46.306
But like the models and electrical engineers, every kind of engineer I, I just think that's.
00:41:47.123 --> 00:41:55.164
I know, I get what you're saying, like like widespread RF attacks probably wouldn't, I don't know, maybe it'd be more destabilizing than Specter, but like.
00:41:56.403 --> 00:42:03.514
No, like, you could probably build some cool, warm, right, and like, I'm, but again, you know, we, we've done that.
00:42:03.574 --> 00:42:05.034
We, we've been What's a worm?
00:42:05.094 --> 00:42:05.938
We've seen worms.
00:42:06.239 --> 00:42:06.528
Yeah.
00:42:06.829 --> 00:42:10.856
the apocalypse isn't going to be on users.
00:42:10.885 --> 00:42:16.166
It, the, the, the, the let's classify projects into like three shapes.
00:42:16.525 --> 00:42:21.985
There's like some stuff like open SSH and boring SSL that pretty much doesn't have bugs.
00:42:22.346 --> 00:42:24.978
Um, What like open SSL?
00:42:25.277 --> 00:42:31.246
in Boring ssl, specifically boring SSL, which has had the AIS pointed at it.
00:42:31.246 --> 00:42:36.585
And they have not found any high severity memory issues, whereas they have found many in other SSLs.
00:42:36.945 --> 00:42:44.416
Um, and like open SSH, like, there's like three people in the world that can write like safe C code, like, uh, uh, the wire guard.
00:42:44.655 --> 00:42:45.976
Uh, Jason is one of them.
00:42:46.186 --> 00:42:50.746
But, so there's some projects that like, we've actually managed to make safe.
00:42:51.135 --> 00:42:54.195
There's another set of projects that just like don't actually matter that much.
00:42:54.916 --> 00:42:58.936
then there's the like, set of projects that are like actually juicy exploit targets.
00:42:59.206 --> 00:43:04.965
And I think we're all loosely in agreement that those will not, that, that like, we're not really expecting a ton more exploitation.
00:43:04.965 --> 00:43:09.976
Like maybe it's a risk, like we'll see what happens with the market dynamics, but.
00:43:10.797 --> 00:43:18.601
The, the, the apocalypse there is on the engineering teams of those products because you have more and more bugs than ever.
00:43:18.931 --> 00:43:24.092
And there's, there's not a good way to prioritize, like how you handle this.
00:43:24.331 --> 00:43:35.521
You need to be taking the set of bugs and turning it into like a queue of actually preventative actions, not just mitigations, because you need preventative actions to like save the time of an Im of the actual engineering teams.
00:43:35.942 --> 00:43:37.532
And if you just choose to say, you know.
00:43:38.900 --> 00:43:43.039
Well, exploitation was already like, um, demand bound, not supply bound.
00:43:43.039 --> 00:43:48.139
So it doesn't matter, like doing nothing will result in the jevons paradox and like bad things happening.
00:43:48.139 --> 00:43:49.039
So you have to do something.
00:43:49.070 --> 00:44:00.170
And so apocalypse is just like, you have this massive queue of interrupt work, um, that is saying like, uh, you got 20 million lines of c plus plus and Chrome, while not all of them are gonna be winners, right?
00:44:00.230 --> 00:44:01.525
Um, Yeah, And.
00:44:01.826 --> 00:44:05.889
and, if it's one bug per like a thousand lines, that's, Yeah.
00:44:06.190 --> 00:44:08.269
20,000 high severity bugs.
00:44:08.360 --> 00:44:13.400
And if an AI finds 10 a day, well, I'll see you in like three to 10 years.
00:44:13.619 --> 00:44:13.829
Yeah.
00:44:13.846 --> 00:44:24.976
And that's not even including like, you know, up the past couple of months, couple of years, like there's been sloppy reports to bug bounty programs and, and bug trackers and stuff like that.
00:44:25.186 --> 00:44:29.596
And like you can get rid of a lot of the, the crap reports.
00:44:29.746 --> 00:44:32.146
It's laborious, but you can do it now.
00:44:32.146 --> 00:44:35.228
The reports are just very, very good and a lot of them Yeah.
00:44:35.235 --> 00:44:35.527
slop.
00:44:35.806 --> 00:44:39.585
And that is like when they're all very good and they're all Yeah.
00:44:40.186 --> 00:44:42.204
to deal with that Can I take a minute?
00:44:42.204 --> 00:44:43.253
Can I just take a minute here?
00:44:43.253 --> 00:44:46.014
I, another hacker News thing just blew up in my brain.
00:44:46.014 --> 00:44:46.434
I'm sorry.
00:44:46.434 --> 00:44:48.173
I'm, I'm having a message board stroke.
00:44:48.233 --> 00:44:49.583
Okay, my God.
00:44:49.673 --> 00:44:53.987
talk, can we talk for a second need like hacker, new statins or something.
00:44:54.340 --> 00:44:54.880
going on?
00:44:55.239 --> 00:44:55.989
What are we doing?
00:44:57.108 --> 00:45:04.914
Can, we talk for a second here about the idea that Curl is the benchmark for how effective a vulnerability tool is, Fuck.
00:45:05.393 --> 00:45:20.027
Why this is complete, this is entirely am I, I'm, I'm, I'm waiting for, for any of the three of you to tell me that I'm wrong and that Curl is deceptively difficult software to build and that you wouldn't expect it to work properly.
00:45:20.208 --> 00:45:26.717
'cause all I hear is like Mythos didn't find awesome thing, like they did a mythos scan on Curl and it didn't find any new curl zero days.
00:45:26.717 --> 00:45:31.097
It's like you could do a mythos scan on cat, and I wouldn't think that Cat would have zero day vulnerabilities either.
00:45:31.119 --> 00:45:38.800
it's a little bit more complicated, the cat, but you know, it's not open BS, D, so I wouldn't expect it to be very that juicy.
00:45:39.380 --> 00:45:40.280
You shut your mouth.
00:45:40.307 --> 00:45:40.458
I.
00:45:40.579 --> 00:45:47.992
I, also, you know, like we, we, like, I think there's also the risk of like, you know, I, I had, I had the opposite of this conversation Oh.
00:45:48.463 --> 00:46:12.228
with many folks many years ago before AI that, you know, like, uh, in, the context of some of the mitigations we've, and, and, and sort of, you know, defenses and, and, and so, and, and, and practices we've been developing at Google that all of this is cool, but it works for this one company in the world sort of, you know, has a code base, of a, of a, sufficient complexity and, and a sufficient amount of funding and so on.
00:46:12.347 --> 00:46:15.965
And everyone is sort of, you know, struggling with more basic problems, Right.
00:46:16.367 --> 00:46:22.338
Uh, so I think Curl is actually representative of a lot of what's out there, right?
00:46:22.608 --> 00:46:24.980
it's, it's actually a pretty good Yes.
00:46:25.068 --> 00:46:26.418
base that isn't terrible.
00:46:26.447 --> 00:46:33.617
It's not not some of the, it's it's amp, Like you can't throw a father at it and, and have like, you know, 50 bucks in an hour.
00:46:33.726 --> 00:46:33.786
Hmm.
00:46:34.217 --> 00:46:36.521
Uh, but it's also not like, you know.
00:46:36.887 --> 00:46:40.068
like very simple trivial library that.
00:46:40.246 --> 00:46:41.235
Is not gonna have bugs.
00:46:41.356 --> 00:46:43.072
So I I think Curl matters a lot.
00:46:43.521 --> 00:46:44.692
I think Curl Matters.
00:46:44.692 --> 00:46:59.025
I just don't think it's a complexity I think, you know, there are people making arguments both ways that this is like pro, like basically if, if someone tells you that outcome with curl good or bad is proof of anything, then they are probably full of it.
00:46:59.416 --> 00:47:00.735
Uh, but.
00:47:01.307 --> 00:47:10.728
I feel bad putting this to you because I, I feel like fundamentally the subtext of what you're saying is like, we're way over indexed on vulnerability, discovery and response in general, right?
00:47:10.998 --> 00:47:13.217
Um, and like we can go different angles on that.
00:47:13.217 --> 00:47:20.478
We can talk about backup software, we can talk about the oddball stuff that I'm worried about getting, you know, popped right now that like isn't Chrome or whatever.
00:47:20.478 --> 00:47:20.987
Right.
00:47:21.047 --> 00:47:35.148
But like, more generally, I, I, I, wonder, like, one big problem that we have is, um, it's, really easy to imagine, you know, next week, like Mythos two is gonna find a reliable KVM exploit, right?
00:47:35.327 --> 00:47:37.847
Um, like something that broadly impacts everybody.
00:47:37.847 --> 00:47:42.407
And like, I'm gonna have to reboot every single, you know, server in our fleet.
00:47:42.407 --> 00:47:44.208
And that's a lot of hardware to reboot.
00:47:44.208 --> 00:47:47.057
It would take us a, it would take us a, we've, we've tabletop this.
00:47:47.057 --> 00:47:51.405
It's, it's doable, but like, it's, it's rough, V wouldn't be anything.
00:47:52.065 --> 00:47:57.766
I think we're speculating the bo, the V wouldn't be anything like completely alien that no one's ever seen before.
00:47:57.766 --> 00:48:08.476
It's just threading pieces together in a way that holds all this context in its court, in its head, quote head, it's able to thread them together and, and find an exploit.
00:48:08.860 --> 00:48:09.010
on.
00:48:09.010 --> 00:48:10.090
Forget, forget M's.
00:48:10.090 --> 00:48:10.539
Finding this.
00:48:10.539 --> 00:48:13.840
Imagine, you know, just Tabis, Ory publishes this next week, right?
00:48:13.900 --> 00:48:15.760
Which he has done to us before.
00:48:15.882 --> 00:48:18.161
a shower and then, you know.
00:48:19.239 --> 00:48:22.119
I've like gotten lunch and come back and like Zen Bleed is happening, right?
00:48:22.150 --> 00:48:22.599
Whatever.
00:48:23.409 --> 00:48:26.469
aside how the, I, I admire him.
00:48:26.530 --> 00:48:27.280
He's amazing.
00:48:27.309 --> 00:48:29.170
I'm not dunking on him, but that did happen.
00:48:29.320 --> 00:48:30.219
That did happen to me.
00:48:30.639 --> 00:48:33.280
My thing here now is on the, on the defender side, right?
00:48:33.280 --> 00:48:39.610
Like another thing that that agents potentially do for me is put me in a situation where I don't necessarily have to reboot to do that, right?
00:48:39.639 --> 00:48:44.469
Like it's much more plausible now that I could do a dynamic kernel patch than before.
00:48:46.907 --> 00:48:51.708
Yeah, but that's kind of one of the places where you do have that asymmetry, right?
00:48:51.708 --> 00:48:54.407
Like to find vulnerabilities.
00:48:56.052 --> 00:49:01.217
You, you are like, you are perfectly happy with a, 50% accuracy rate.
00:49:01.217 --> 00:49:06.168
Like if 50% of the findings, or 90% of the findings, that would be just like absolutely wonderful.
00:49:07.128 --> 00:49:11.032
will not accept 90% accuracy for No.
00:49:11.177 --> 00:49:12.257
in production, right?
00:49:12.467 --> 00:49:16.097
So I think the solution is a lot more challenging than the.
00:49:17.204 --> 00:49:20.684
I'm like, you're like you're two steps past where I'm at.
00:49:20.684 --> 00:49:20.954
Right.
00:49:20.954 --> 00:49:29.918
Just assume we're at the, assume we're in a, in a situation where like we've identified the vulnerability, um, there is an official source level fix for it, that's the right fix and all that.
00:49:30.217 --> 00:49:41.617
And I, the simple logistical problem of how the hell do I actually apply this patch given I'm gonna have to reboot, you know, tens of thousands of, you know, physical machines or do you the fix?
00:49:41.617 --> 00:49:45.914
Not, like I'm thinking more just a line of like, we have a known good fix for it.
00:49:45.914 --> 00:49:55.664
And like can, I can imagine that in most cases even I'd pr in many cases, I'd be able to dynamically given a known good patch, dynamically apply that.
00:49:55.873 --> 00:50:01.034
And I wouldn't be business operation sense, not in the like software library, like I Yeah.
00:50:02.557 --> 00:50:05.318
and blast it out to all, you know, official channels, et cetera.
00:50:05.811 --> 00:50:06.052
No.
00:50:06.081 --> 00:50:06.231
No.
00:50:06.231 --> 00:50:07.612
By apply you mean hot patch.
00:50:07.612 --> 00:50:11.061
Your live running Yeah, installs without rebooting.
00:50:11.699 --> 00:50:12.960
Yeah, but and I'm not like.
00:50:13.027 --> 00:50:19.068
that the solution is right, and you just need like a, a, a monkey with a wrench to I.
00:50:19.552 --> 00:50:24.217
a, I think a lot of things don't get fixed just because it's very difficult to schedule reboots and take the outages.
00:50:24.516 --> 00:50:24.867
Yes.
00:50:25.228 --> 00:50:28.768
Or, in, in this case, take the risk of an outage.
00:50:28.797 --> 00:50:32.782
You might have a lot of confidence that you could live patch this, but that's still risky.
00:50:34.184 --> 00:50:35.384
If you can get to that point.
00:50:35.384 --> 00:50:35.684
Yeah.
00:50:35.684 --> 00:50:44.324
And then, you know, like you still have the problem that, you know, if the agent goes to Reddit and decides to ransomware you instead you, but like, you know, that's, that can be mitigated, right?
00:50:44.324 --> 00:50:47.143
Like with sandboxing, and it's all probabilistic.
00:50:47.143 --> 00:51:03.643
But I think we have to get used to the notion that, I I it was always probabilistic, but like humans are probabilistic too, although in a different way and maybe a bit more predictable and we need to build better models of how to deal with the unpredictability of agents every now and then.
00:51:03.793 --> 00:51:08.773
But yeah, no, like I, yes, I, I don't think you're crazy.
00:51:08.773 --> 00:51:09.284
So.
00:51:09.880 --> 00:51:37.902
A nice thing though with software is that you can do all this other stuff outside that the model isn't touching and you can try to get something that's a lot more deterministic to try to like confirm so that it'll spit something out and you can have pretty good confidence in what it will do behaviorally because you did all this other work to like Yeah, wazoo yourself and try to basically mitigate the, the probabilistic My.
00:51:38.050 --> 00:51:38.800
that you have.
00:51:40.307 --> 00:51:42.106
Yeah, sorry, I didn't mean to it's fine.
00:51:42.226 --> 00:51:42.465
Yeah.
00:51:42.768 --> 00:51:54.197
Uh, I, no, I, I, you know, I have this theory that if we, if we are thinking about using agents in like mission critical settings, like enterprises and so off.
00:51:55.518 --> 00:52:09.498
the, you No, the, the, the principle, the way build those architectures is not to put agents with humanlike autonomy and humanlike access and hope for them to always make the right decisions.
00:52:09.887 --> 00:52:14.538
It's to give them tools that are sort of, you you know, secure by default.
00:52:14.746 --> 00:52:25.878
Provide them with more constrained permissions and more constrained access that is tailored to the differences between those, those, like, you know, they are fundamentally different.
00:52:25.878 --> 00:52:27.467
Like you can't put them in prison, right?
00:52:27.467 --> 00:52:30.257
Like, if they delete your data, they can write you an apology letter.
00:52:30.257 --> 00:52:33.168
But that's kind of, that, that, that, that's kinda as far as it goes.
00:52:33.670 --> 00:52:39.378
So there's like, you know, the, the usual social contract you have with your employees is gone.
00:52:40.340 --> 00:52:43.195
and all the negative consequences that come with up.
00:52:43.561 --> 00:52:51.961
Um, so I so there are architectures that are conductive to building secure agent tech platforms today.
00:52:51.961 --> 00:52:55.351
And, and we should be leaning into that more in the future.
00:52:55.351 --> 00:53:19.556
But I don't think this is the direction that the Frontier Labs are moving in, which is basically human like agents that are, coworkers, your assistants, and basically have access and constraints, access to every, everything that you have and, and, uh, and that act with, uh, full out human-like autonomy.
00:53:19.856 --> 00:53:20.277
mm-hmm.
00:53:20.521 --> 00:53:35.115
think that that, I may be wrong about this, just don't, until we solve prompt injection and all the other problems that we don't seem to be making as much progress on as on capabilities themselves.
00:53:35.865 --> 00:53:40.077
I, I yeah, I don't I do get, yeah, I do get squid out.
00:53:40.077 --> 00:53:44.367
Like I see a lot of places where l LMS are super applicable to defense.
00:53:44.637 --> 00:53:51.177
Um, but I do get squid out every time I see somebody using an LLM as a reference monitor, right?
00:53:51.237 --> 00:54:05.577
Like this is the actual defense we have is that an LLM will make smart decisions about things like, I'm sure there are a lot of places where like good, smart decision making is like a good triage step or whatever, but like literally as an access control mechanism of like, doesn't seem right to me.
00:54:05.626 --> 00:54:12.255
Well, problem you're, they are trying to solve, I think in many cases is that you now have agents on the attack side, right?
00:54:12.532 --> 00:54:14.806
and they can move quickly, Yes.
00:54:15.706 --> 00:54:20.481
Compromise lateral movement in, you know, what, 30 seconds, right?
00:54:20.692 --> 00:54:22.822
And they can do it time.
00:54:24.016 --> 00:54:24.860
so you find.
00:54:27.219 --> 00:54:38.106
Humanlike reasoning about what's happening in the enterprise and autonomous decision making on timescales are just fundamentally in uncomfortable with human Workload.
00:54:38.405 --> 00:54:48.159
you fundamentally rethink how companies are structured and built and and know, you, know, compartmentalize everything a lot better than we are compart analyzing today.
00:54:48.400 --> 00:55:09.335
So I think on some level, LLM type reasoning is unavoidable On the defense side, if you want that real time clever sort, you know, countermeasures, but, uh, but it's incredibly difficult to get this right and not shoot yourself in the food.
00:55:09.820 --> 00:55:09.969
Yep.
00:55:10.929 --> 00:55:14.018
yeah, wouldn't like, it wouldn't be my first move as a defendant.
00:55:14.018 --> 00:55:15.632
That wouldn't be like the first place I would think of.
00:55:15.730 --> 00:55:16.215
yeah, yeah.
00:55:16.599 --> 00:55:21.400
I, think, you like you, need a lot of piping before you even get there, right?
00:55:21.699 --> 00:55:25.690
you know, it needs to have the right source of information to begin with.
00:55:25.690 --> 00:55:28.570
And, you know, most enterprises don't even have that right.
00:55:29.588 --> 00:55:30.998
Let me ask you a weird question.
00:55:31.237 --> 00:55:34.898
Um, so you've got the book, and I'm gonna ask you about the book.
00:55:35.168 --> 00:55:36.731
Um, and it's the new book, Okay.
00:55:36.847 --> 00:55:37.538
in, a second, right?
00:55:37.538 --> 00:55:44.768
But like, like, how, how, like, how like, security, are you gonna be going forward?
00:55:45.547 --> 00:55:47.617
like, are you, are you gonna veer off into circuit land?
00:55:48.871 --> 00:55:49.891
Uh, no.
00:55:49.891 --> 00:55:52.291
So, you know, so yeah.
00:55:52.442 --> 00:55:55.862
Uh, I, electronics has been my passion ever since.
00:55:55.862 --> 00:56:11.581
And I I know, kind of the, I, I ended up doing computer security kind of by accident, know, computers, like I, I, was either gonna become a, an electrical engineer or chemical engineer, and that, that was sort of, you know, my, my childhood thing.
00:56:11.641 --> 00:56:14.132
And then computers showed up and ruined my life, right?
00:56:14.132 --> 00:56:18.541
And it was sort of the right time, the right place, right to, to be getting into InfoSec.
00:56:19.262 --> 00:56:20.552
Um, but.
00:56:20.590 --> 00:56:22.706
could be the, could be said of all of us.
00:56:22.706 --> 00:56:24.655
And then computers showed up and ruined my life.
00:56:25.141 --> 00:56:25.351
Yeah.
00:56:25.351 --> 00:56:29.222
So I think, you know, so obviously, you know, no, no real regrets about that.
00:56:29.282 --> 00:56:33.211
Uh, but, uh, but yeah, I, I keep going back to that.
00:56:33.211 --> 00:56:42.902
And, and here's the thing, like I, I, I'm, I'm still very passionate about security and I think, again, like this is incredibly interesting, Right, is.
00:56:44.083 --> 00:56:51.891
Either the most interesting time in the history of InfoSec or the second most interesting after their arrival of the West, Yeah, absolutely.
00:56:52.244 --> 00:56:57.554
nearly as excited about the field for, uh, for a good while, right?
00:56:58.034 --> 00:57:00.322
Uh, so I wanna be a part of it.
00:57:00.621 --> 00:57:10.461
Uh, at the same time, I I the things that make you visible in the field, like basically punditry, you know, how, I guess having a TikTok now, right?
00:57:10.693 --> 00:57:16.213
a podcast, and, podcast Or, doing vulnerability research work.
00:57:16.934 --> 00:57:25.244
I think, you you know, I, I've, done this long enough that it's still kind of, when you look back at it it feels kind of right?
00:57:25.244 --> 00:57:26.983
Like, I did two security books.
00:57:27.793 --> 00:57:31.304
are basically completely obsolete at this point.
00:57:31.333 --> 00:57:37.903
All the, you know, hundreds of advisories and whatever that I published, you know two decades ago.
00:57:38.708 --> 00:57:55.838
No one really remembers or cares about any of that Um, and, and it's not that, not, you know, I sort of, you know, I I, like, I'm not seeking eternal fame, but think it's kind InfoSec compared to almost anything.
00:57:55.838 --> 00:58:07.597
Like, you know, if you publish a book about electronics, yeah, it's gonna be slightly outdated in 10 years and maybe badly outdated in 20, but it's of, you know, it's, it, it, it's not as rapid, it's not as dramatic, right?
00:58:07.777 --> 00:58:10.594
If you build a, if you're a woodworker and you build a Yep.
00:58:10.597 --> 00:58:12.907
for yourself, you know it's still gonna be fine.
00:58:12.938 --> 00:58:25.394
Like, you're gonna still gonna be able to look at it, maybe pass it onto your children, No, like if you like comprehensive catalog of shop jigs in a, in a woodworking book in like 1965, I would probably still be interested in reading that book.
00:58:25.695 --> 00:58:36.931
So, so I think, you know, I'm trying to balance, like basically I, I looked at at InfoSec legacy and, and, and I to myself, my God, this is is all this is, this is worthless, right?
00:58:36.931 --> 00:58:41.072
Like this, you know, a FL is gonna get forgotten before long as well.
00:58:41.072 --> 00:58:51.927
And, and I'm trying to, to, you you know, like find to a more durable different before, you know, before my Sure.
00:58:52.978 --> 00:59:01.168
the, the, the book, I'm looking at a cover with a, a woman holding a Satter, a hot Satter hot, hot satter iron, way too close to her face.
00:59:01.204 --> 00:59:01.653
Yes.
00:59:02.547 --> 00:59:03.628
tell us more about the book.
00:59:04.713 --> 00:59:06.963
Um, right.
00:59:07.164 --> 00:59:08.603
what is the name of the book?
00:59:09.603 --> 00:59:11.543
secret life of circuits, Awesome.
00:59:11.914 --> 00:59:12.724
uh, yeah.
00:59:12.724 --> 00:59:13.750
And Let me ask.
00:59:13.750 --> 00:59:16.389
My first question is, will this book teach me how to solder?
00:59:16.510 --> 00:59:17.744
'cause I'm terrible at soldering.
00:59:18.061 --> 00:59:24.271
Uh, it, it, it, it actually contains some, you know, like pretty useful tips, which is basically.
00:59:25.268 --> 00:59:37.358
Spend more money on a good soldiering island or, or good soldiering island, like a, like a pencil shaped, you know, versus the one that you hold like a toothbrush and, and is about as, as fine of a tool.
00:59:37.418 --> 00:59:40.447
Um, and, and that really, makes a difference.
00:59:40.777 --> 00:59:52.657
Um, but it, yeah, so like there's plenty of books about electronics, uh, but I think we have this weird track approach to teaching, uh, that discipline, right?
00:59:52.898 --> 01:00:04.177
hobby track, which is basically tell people that circuits are like water pipes and, and I guess a diode is like a check valve, and the transistor is knows what, right?
01:00:04.177 --> 01:00:07.927
Like some sort of a plumbing abomination that you probably don't want in your home.
01:00:08.757 --> 01:00:21.157
And, all of this is very seductive, but it's also but kind wrong, because, there are interactions between electrons and charges that are happening at microscopic, uh, at, at microscopic distances.
01:00:21.217 --> 01:00:22.867
Like, you you two wires.
01:00:23.059 --> 01:00:27.079
And there's current flowing in one and voltage appears in another one.
01:00:27.079 --> 01:00:28.967
And and can't really explain that.
01:00:29.420 --> 01:00:31.909
like, well, plumbing analog, right?
01:00:32.090 --> 01:00:40.579
So you so all, all that stuff that they teach you basically has zero predictive power and, and you struggle to build your own circuits down the line.
01:00:40.579 --> 01:00:47.690
It's kind of like watching, you know, three blue, one brown videos on YouTube, and you are really impressed by how clearly it's all explained.
01:00:47.690 --> 01:00:53.809
And then you that don't don't actually know how to apply any of that knowledge to any, you know, practical problems.
01:00:54.590 --> 01:01:00.469
Um, and then there's the, second track, which is sort of, you know, the college degree approach, right?
01:01:00.469 --> 01:01:03.650
Where you have a textbook that is more an automatically correct.
01:01:03.650 --> 01:01:06.920
But the way we teach electronics to students is.
01:01:07.956 --> 01:01:09.876
We really front load the calculus.
01:01:09.905 --> 01:01:19.775
You're basically only learning, truly punishing math for the first year and a change before you get to, an LED or like, whatever, right?
01:01:20.646 --> 01:01:25.686
And, you use that as a foundation to streamline all the electronic theory down the line.
01:01:26.615 --> 01:01:35.719
this means like college textbooks are basically completely to hobbies because no one is gonna take a, you know, a semester or two of, of calculus.
01:01:36.019 --> 01:01:43.400
What's the, level of, like, what's the level of math I need for the, I know that you're doing a different track here, which is super, super interesting, right?
01:01:43.429 --> 01:01:47.480
And you're trying to be like, at least practically, theoretically rigorous.
01:01:47.510 --> 01:01:51.889
Rigorous about things without to like, solve, you know, partial differential equations.
01:01:52.070 --> 01:01:56.380
But of math rigor you think you'd need to bring into the college track normally?
01:01:56.539 --> 01:01:57.905
How far do you have to get in that sequence?
01:01:58.771 --> 01:02:01.831
Uh, so you, asking about the way people normally touch it?
01:02:02.036 --> 01:02:03.326
The way people normally teach it.
01:02:03.389 --> 01:02:05.101
I I, think it goes pretty far.
01:02:05.233 --> 01:02:10.231
It's like, place transforms and like complex number calculus and, and stuff like that, right?
01:02:10.231 --> 01:02:16.548
So it's not also basics of the, the you know, rate of change or here's the Yeah.
01:02:16.849 --> 01:02:17.369
time, right?
01:02:17.851 --> 01:02:29.672
it's like far more punishing and, and, and the thing that I I that I, I you know, like, I, I don't have an e degree, but I actually try to follow that path.
01:02:29.731 --> 01:02:37.581
And the, the thing that is really frustrating by the end of the day is that none of the calculus is really explained from first principles, right?
01:02:37.831 --> 01:02:45.302
you're, given formulas for, you know, this is how you calculate the rate of change of know, this particular function.
01:02:47.666 --> 01:03:18.793
They, it's like, you a rapid fire of formulas that you're gonna forget if you're not applying it day to day, you know, within like six months of, of, of, of, uh, And the, yeah, the, the approach I've been trying take, in the book is, and, and, and the, the, the, the problem, like, the further problem with that is that is that you, you, the electrical engineers are not, taught the theory in a specific way, and and they kind of know that the complexity is essential to the explanation, right?
01:03:18.793 --> 01:03:28.373
So if you go to Wikipedia or you go to stock exchange and you just wanna understand why the formula for the reactance of a capacitor, or the frequency response of Yeah.
01:03:28.634 --> 01:03:34.244
looks this way, the answer is, you know, learn some calculus and come back.
01:03:34.244 --> 01:03:34.543
Right?
01:03:35.804 --> 01:03:39.313
and, and I, so I've been, I don't think you have actually have to do that, right?
01:03:39.313 --> 01:03:40.003
Like for.
01:03:40.934 --> 01:04:01.003
For sine waves, you can do all can derive all of this from basic trigonometry and it's gonna take you a bit longer and you gonna be more triangles and circles that you have to grow, but you kind of just need like, you know, school, early high school foundations to, explain electronics.
01:04:01.063 --> 01:04:13.753
So, so I think, you there's a, distinction between essential complexity and the complexity that makes sense and is expedient in a college setting, but doesn't really make sense for hobbyists.
01:04:13.753 --> 01:04:27.344
And so I'm trying to aim for that middle ground and, uh, it's been a wild ride and a lot of triangles and, uh, like almost 300 hundred drone and So and, yeah.
01:04:27.755 --> 01:04:33.610
I, I haven't, like, I haven't asked you specifically before, but like I get the sense that you have most of the math already.
01:04:33.849 --> 01:04:40.657
So I was like, is the work here from like, I can metabolize this stuff because I have, know.
01:04:41.710 --> 01:04:43.690
like complex calculus and all that, right.
01:04:43.780 --> 01:04:48.195
Um, to like translating it or this literally you trying to figure this out as you go?
01:04:49.063 --> 01:04:52.396
no, I I think, you know, you you like, you know the answer, right?
01:04:52.396 --> 01:04:55.065
And you sort Sort of, you from up, from that point.
01:04:55.065 --> 01:04:56.110
But But Okay.
01:04:56.409 --> 01:05:02.324
sometimes when you force yourself to explain something simply, you realize actually, you you do I Yep.
01:05:02.762 --> 01:05:05.085
I'm just like, you know, why, is it the way it it is?
01:05:05.182 --> 01:05:12.315
I mean, how do you, do you convey that in a way that makes sense to, to, to a person who, you know, hasn't read the same books right?
01:05:12.315 --> 01:05:14.385
And hasn't gone down the same rabbit holes.
01:05:14.873 --> 01:05:16.938
So it is a bit of both, I think.
01:05:16.938 --> 01:05:22.788
You know, like, trying to explain is when you realize that you don't know certain things and yeah.
01:05:23.376 --> 01:05:23.826
for sure.
01:05:24.005 --> 01:05:25.085
How far are you into the book now?
01:05:25.085 --> 01:05:27.726
I, I saw like, 420 pages.
01:05:27.726 --> 01:05:29.239
Have you written 420 Yeah.
01:05:29.239 --> 01:05:29.389
Yeah.
01:05:29.389 --> 01:05:30.199
It's all, it's all done.
01:05:30.199 --> 01:05:31.487
It's, it's like, you you know.
01:05:31.820 --> 01:05:33.889
with the, with the printer right now.
01:05:33.889 --> 01:05:40.940
So, uh, yeah, you can pre-order and get a free PDF today, and it's gonna be like the entire book.
01:05:41.179 --> 01:05:46.070
Uh, and then it's gonna ship in September, copies.
01:05:46.070 --> 01:05:49.070
It's, it's gonna be full color and and, hardcover.
01:05:49.070 --> 01:05:51.289
So but really, fancy.
01:05:51.951 --> 01:06:05.148
Well, um, will there be copies at the, at the no starch booth at, uh, DEFCON or, or Blackhead or I, would expect so, not in charge of their marketing, but they usually all the new stuff.
01:06:07.333 --> 01:06:08.623
It would be a funny role for you to take.
01:06:10.538 --> 01:06:11.905
uh, Will it.
01:06:12.248 --> 01:06:19.117
they actually always try to rope me and they ask, you are you going to Defcon or Black Hat, or whatever, and my answer is always, no, thank you.
01:06:19.117 --> 01:06:19.882
I, I what.
01:06:20.137 --> 01:06:22.242
know, 20 years ago and that was good enough.
01:06:24.742 --> 01:06:33.291
Will it teach you how to calculate the equivalent resistance between two resistor nodes that are a knight's move away and an infinite grid of ideal one oh resistors.
01:06:34.135 --> 01:06:40.405
So, that, that's the good there's a lot of things that we teach to people just to torture them, I think.
01:06:40.436 --> 01:06:40.916
Right.
01:06:41.606 --> 01:06:41.635
uh.
01:06:41.936 --> 01:06:44.806
We're in some cases to be hit by a bus in the next KCD comic.
01:06:45.746 --> 01:06:52.869
And, I I think, you there's also a lot of things that we teach in a particular way for historical reasons, right?
01:06:52.869 --> 01:07:07.360
Like if you buy an electronics book, there's probably gonna be a chapter about things like tunnel diodes that, you no one has made commercially since the seventies and you can, you know, buy some surplus on, on eBay, right?
01:07:07.449 --> 01:07:12.550
Like, if you really want to, or how to wind your own transformer or stuff like that.
01:07:12.579 --> 01:07:35.230
And no, and, and, and, and the book is not gonna be spent, or or like, like you usually start with NPN or BJT, like, you know, uh, bipolar junction transistors, are kind of not exactly obsolete, but they are more complex than the more common modern field effect transistors, which is what you actually use everywhere, right?
01:07:35.590 --> 01:07:38.079
In, digital circuits and power switching and so on.
01:07:38.500 --> 01:07:39.309
So I've been trying to.
01:07:39.324 --> 01:07:42.652
to Step away from that as well.
01:07:42.652 --> 01:07:46.581
And like really focus on modern problem, modern, modern problem solving.
01:07:46.581 --> 01:07:52.222
And that means that, you know, if you wanna build an oscillator, you're probably not gonna be be putting together individual transistors.
01:07:52.222 --> 01:07:59.509
You're gonna get a microcontroller that costs like, you know, 50 cents and program it to whatever wave form you All right?
01:07:59.902 --> 01:08:03.472
and if you wanna change the frequency or whatever, you can just upload new code.
01:08:04.373 --> 01:08:15.021
Um, think think there's a, lot of stuff like that in, in the book, just trying to keep it practical and not, not torture people with math or theory just for the sake of it.
01:08:15.112 --> 01:08:27.532
Uh, it's just the, just the things you really need or the things you you need to know to make sense of Wikipedia articles or, or college textbooks down the line if you really need to investigate a specific thing.
01:08:29.757 --> 01:08:30.868
Well, that's very cool.
01:08:31.167 --> 01:08:31.768
Thank you.
01:08:32.967 --> 01:08:34.228
Thank you for coming on.
01:08:34.287 --> 01:08:35.637
Thank you for telling us about the book.
01:08:35.698 --> 01:08:37.078
Thank you for letting us interrupt you.
01:08:37.078 --> 01:08:43.408
While you talked about bug finding for like an hour before talking about your book, appreciate it.
01:08:44.293 --> 01:08:44.783
Okay, cool.
01:08:45.384 --> 01:08:45.833
Thank you.
01:08:45.863 --> 01:08:50.003
I mean so much for this is, this has, this has been, um, a very fun conversation for me.
01:08:50.394 --> 01:08:53.993
Even though I think that vulnerability research is gonna matter more than you think it will.
01:08:54.264 --> 01:08:59.154
Uh, I am super psyched for the book, although I'm a late in life math student, so I'm actually psyched about the math parts of it.
01:08:59.514 --> 01:09:07.283
But still, I'm unbelievably terrible with electronics and I did not realize I could, I did not realize I could download the whole book right now, which is awesome.
01:09:07.524 --> 01:09:09.293
So that is the Secret Life of Circuits.
01:09:09.293 --> 01:09:12.444
That is, uh, Zakys, Zakys.
01:09:13.283 --> 01:09:14.123
I'll get it at some point.
01:09:14.304 --> 01:09:20.363
Uh, new book, um, everything else, he's, we used to give copies of the Tangled Web, which is your second Yes.
01:09:20.904 --> 01:09:22.913
to every, candidate that applied at Montesano.
01:09:24.054 --> 01:09:26.243
Just exceptionally good writer.
01:09:26.304 --> 01:09:27.144
Very fun to read.
01:09:27.533 --> 01:09:29.484
Um, so yeah, look, thank you so much for doing this.
01:09:29.484 --> 01:09:30.923
We really, uh, enjoyed talking to you.
01:09:31.000 --> 01:09:31.119
you.
01:09:31.119 --> 01:09:38.229
And you know, after the vul apocalypse, I'm happy to come back, uh, onto the show and you can tell me how wrong I was.
01:09:38.503 --> 01:09:39.283
You're a prepper.
01:09:39.314 --> 01:09:42.546
That was your, your third book is about like preparing for the, Um.
01:09:42.703 --> 01:09:45.944
was about preparing for the vol apocalypse, so I'm sure you'll be ready.
01:09:46.154 --> 01:09:48.793
We'll come to your place because you'll have Water stock pal for us.
01:09:49.094 --> 01:09:49.271
Yeah.
01:09:49.271 --> 01:09:54.402
I have an excavator, so, you know, You don't actually have an excavator, do an excavator, I have a tractor.
01:09:54.402 --> 01:09:55.841
I, you know, I'm, I'm all set.
01:09:57.543 --> 01:10:01.203
You're like, you're buying all the, like the equipment that two year olds were really fascinated by.
01:10:01.203 --> 01:10:02.073
You just have the means.
01:10:02.224 --> 01:10:04.923
You have the means now to buy the real size Tonka trucks.
01:10:04.984 --> 01:10:09.123
the, the trick is you publish a book to make it look legit, and then you can buy whatever.
01:10:11.136 --> 01:10:16.235
Okay, well, uh, when the VM pocalypse comes, we're we're running to your compound.
01:10:16.725 --> 01:10:17.115
Alright.
01:10:17.256 --> 01:10:18.305
you already invited us.
01:10:18.305 --> 01:10:19.176
You can't take it back.
01:10:19.702 --> 01:10:20.152
Yep.
01:10:20.645 --> 01:10:24.485
whatever is a side project from Deirdre Connolly, Thomas and David Dian.
01:10:24.546 --> 01:10:25.746
Our editor is Netty Smith.
01:10:25.985 --> 01:10:32.015
You can find the podcast online at CW pod and the host online at Durham Krest at Tqp f and at David c Adrian.
01:10:32.286 --> 01:10:35.765
You can buy merchandise at merch, at security cryptography whatever.com.
01:10:35.975 --> 01:10:41.195
If you like what you're hearing or seeing, give us a five star review wherever you rate your favorite podcast or videos.
01:10:41.195 --> 01:10:42.876
Thank for listening.
01:10:43.351 --> 01:10:44.881
I can't believe he has an excavator.