رونوشت 🔗
WEBVTT
NOTE
Transcription provided by Podhome.fm
Created: 10/27/2026 1:28:11 AM
Duration: 3504.013
Channels: 1
1
00:00:01.040 --> 00:00:01.760
Welcome.
2
00:00:02.080 --> 00:00:03.759
One, welcome all,
3
00:00:04.080 --> 00:00:05.440
ladies and gentlemen.
4
00:00:05.600 --> 00:00:06.960
Pod 256,
5
00:00:06.960 --> 00:00:08.480
number 130,
6
00:00:08.960 --> 00:00:11.759
10/26/2026.
7
00:00:13.675 --> 00:00:16.635
My gosh. Scott Still October. Tyler This this has been madness.
8
00:00:16.955 --> 00:00:18.315
October didn't
9
00:00:18.315 --> 00:00:20.635
really come, but we got Cyber
10
00:00:20.955 --> 00:00:21.994
Attacktober.
11
00:00:22.075 --> 00:00:23.595
Cyber Attacktober.
12
00:00:24.075 --> 00:00:29.279
With the breaking headlines, yeah, it feels like time has been stretched out.
13
00:00:29.840 --> 00:00:30.640
Just like
14
00:00:31.199 --> 00:00:32.239
like
15
00:00:32.800 --> 00:00:33.760
any
16
00:00:33.760 --> 00:00:37.600
one of these exploits by themselves would have been shocking.
17
00:00:37.920 --> 00:00:41.680
And then it's just like day after day, just like more and more exploits.
18
00:00:42.305 --> 00:00:44.945
I mean, we had, like, the PHP thing,
19
00:00:45.425 --> 00:00:46.945
the certificates thing.
20
00:00:47.425 --> 00:00:49.905
What else has there been? I know I'm missing some.
21
00:00:50.864 --> 00:00:51.824
There was both
22
00:00:54.220 --> 00:01:00.140
Keystone Wallet and Yep. Potentially this morning Foundation Wallet. Their, like, customer database has been breached.
23
00:01:00.300 --> 00:01:03.580
Oh, yeah. I saw something about email impersonation.
24
00:01:04.060 --> 00:01:04.780
Yes.
25
00:01:05.580 --> 00:01:06.220
Yeah.
26
00:01:06.380 --> 00:01:11.325
Last time I looked, it was still ongoing. They weren't sure, but one of their servers had been...
27
00:01:11.805 --> 00:01:14.125
One of their web servers had been compromised.
28
00:01:14.685 --> 00:01:17.165
Not good. Not good. I mean, it...
29
00:01:18.284 --> 00:01:19.325
It's like
30
00:01:20.220 --> 00:01:28.140
there have been people who have been very good at doing this for a long time, but it took a lot of time and resources to do it. So they were very focused attacks
31
00:01:28.540 --> 00:01:37.995
from, you know, like, state actors and things like that who really either wanted to go after something for a state reason or there was a bunch of money attached to it. But now
32
00:01:38.315 --> 00:01:39.595
you can just, you
33
00:01:40.315 --> 00:01:41.675
know, be working
34
00:01:41.675 --> 00:01:46.075
out in the gym and, like, launch some massive exploit from the convenience of your
35
00:01:46.619 --> 00:01:47.500
wherever.
36
00:01:47.740 --> 00:01:54.299
Just talk talk through it with your with your AI, assuming you have a open weight obliterated AI.
37
00:01:54.619 --> 00:01:57.740
Yeah. Shout out to Maple real quick. They now offer obliterated.
38
00:01:57.820 --> 00:02:01.500
Do they? They did that? Models directly in the TEE
39
00:02:01.784 --> 00:02:04.825
service. Yeah. All right. What's obliterated mean?
40
00:02:05.145 --> 00:02:06.025
Lobotomized,
41
00:02:06.025 --> 00:02:07.225
so it doesn't say no.
42
00:02:07.625 --> 00:02:08.825
These models are
43
00:02:09.065 --> 00:02:11.545
trained so that they have guardrails and
44
00:02:11.944 --> 00:02:14.185
Schnitzel's explained it as
45
00:02:15.180 --> 00:02:21.660
asking things that it would typically say no to and then seeing what neurons fire and taking them out until it does what Like you
46
00:02:22.380 --> 00:02:27.420
telling it to three d print a Glock on some network
47
00:02:27.420 --> 00:02:29.260
printer halfway around the world?
48
00:02:29.915 --> 00:02:32.395
Well, that was Just for a random example.
49
00:02:32.955 --> 00:02:35.515
Yeah. Air dropping freedom tech, you could say.
50
00:02:37.755 --> 00:02:46.840
I love it. Yes. Air dropping freedom tech. Yeah. So this this is like open weight models. Right? So you can see how it works.
51
00:02:47.160 --> 00:02:52.040
And so then I think you can you can go in and adjust
52
00:02:53.080 --> 00:03:00.815
things. Like, essentially, you can remove guardrails. Like, you can't do this on the Frontier Labs because they're not open weight models. You can't actually change the model at all.
53
00:03:01.135 --> 00:03:01.855
But when
54
00:03:02.095 --> 00:03:03.295
companies release,
55
00:03:03.535 --> 00:03:05.215
open weight models like,
56
00:03:06.015 --> 00:03:06.974
DeepSeq
57
00:03:06.974 --> 00:03:09.455
and Kimi and GLM
58
00:03:09.455 --> 00:03:13.350
and there's... I guess even Meta is releasing one now supposedly.
59
00:03:14.310 --> 00:03:15.030
You can
60
00:03:15.430 --> 00:03:21.750
ask it the naughty questions and and see, like, why it's refusing and, through some magic, remove
61
00:03:21.910 --> 00:03:22.470
that
62
00:03:22.995 --> 00:03:26.035
ability for it to refuse, which is interesting.
63
00:03:26.115 --> 00:03:28.595
It is also interesting that a lot of the open weight models,
64
00:03:29.395 --> 00:03:32.595
they're they're pretty wide open already.
65
00:03:34.355 --> 00:03:37.315
They they certainly aren't as locked down as the Frontier Labs models,
66
00:03:38.190 --> 00:03:42.430
but they do have some guardrails built in and I guess you could just...
67
00:03:42.830 --> 00:03:45.470
Well, and the obliterated models aren't just desirable
68
00:03:46.190 --> 00:03:47.310
for crime.
69
00:03:48.030 --> 00:03:55.455
We've also seen from since August the the red team effort and maybe some of the open weight models aren't as restrictive nowadays, but
70
00:03:56.254 --> 00:04:02.255
they were necessary to do that security research because the models would refuse to even help you defend your code base.
71
00:04:02.655 --> 00:04:05.295
Is it just me or was Coldcard
72
00:04:05.570 --> 00:04:08.210
like a canary in the coal mine for all this?
73
00:04:08.610 --> 00:04:09.890
It seems like it.
74
00:04:10.450 --> 00:04:14.450
Load full transcript
It seems like it. It was like a a high value target. Right? So someone was
75
00:04:14.690 --> 00:04:18.930
certainly motivated to start poking around at it. And Irreversible.
76
00:04:19.655 --> 00:04:20.775
Irreversible.
77
00:04:21.335 --> 00:04:26.615
You know, you used to to to gain quite a bit, and it it did happen right around the launch of,
78
00:04:27.335 --> 00:04:29.575
Kimi k three. Mhmm.
79
00:04:30.134 --> 00:04:30.695
So
80
00:04:31.574 --> 00:04:34.055
it's it's theorized that someone could have used that.
81
00:04:35.650 --> 00:04:40.130
The the actual bug in the cold card firmware that wasn't using the
82
00:04:41.010 --> 00:04:42.050
the true
83
00:04:42.370 --> 00:04:44.690
random number generator for the entropy
84
00:04:44.850 --> 00:04:46.370
wasn't that complicated.
85
00:04:46.930 --> 00:04:47.170
Yeah.
86
00:04:47.995 --> 00:04:48.715
It was
87
00:04:49.035 --> 00:04:50.795
was basically like one line.
88
00:04:52.074 --> 00:05:00.475
So... But, you know, they had missed it. I guess they they had independent audits. Supposedly, had missed it. So maybe it was just tricky.
89
00:05:00.875 --> 00:05:02.634
But I think that's the point is
90
00:05:03.420 --> 00:05:07.980
most tools and services and infrastructure probably has not that complicated
91
00:05:07.980 --> 00:05:09.580
small bugs inside of it.
92
00:05:09.980 --> 00:05:11.420
And that's what we're living through.
93
00:05:11.740 --> 00:05:13.900
The PHP one is very complicated.
94
00:05:14.300 --> 00:05:15.180
Let's Okay. Get into
95
00:05:15.900 --> 00:05:17.500
Yeah. Let's hear about PHP.
96
00:05:18.785 --> 00:05:21.585
So there's a a vulnerability called...
97
00:05:21.824 --> 00:05:27.745
It was named PHP two Shell that was introduced in the the PHP,
98
00:05:27.745 --> 00:05:30.945
which serves, like, dynamic websites. It's it's an app like
99
00:05:32.139 --> 00:05:37.660
Node or something that runs on the server that serves up these dynamic websites. It's also very old. So it's been
100
00:05:38.300 --> 00:05:41.979
it's been... It's used in a lot of websites because it's been around for so long.
101
00:05:43.324 --> 00:05:44.125
It's
102
00:05:44.125 --> 00:05:49.725
probably considered to be poor form to even use PHP these days because it's so old.
103
00:05:50.125 --> 00:05:50.845
But,
104
00:05:51.805 --> 00:05:54.605
yeah, PHP two shell was a
105
00:05:54.764 --> 00:05:58.285
very complicated mechanism, which I cannot even begin to understand
106
00:05:58.610 --> 00:06:00.770
as to how you could get
107
00:06:01.410 --> 00:06:04.290
shell access, so, like, terminal access
108
00:06:04.370 --> 00:06:07.810
on a machine that is serving a website, like,
109
00:06:08.610 --> 00:06:10.050
via the website, basically.
110
00:06:10.925 --> 00:06:12.285
They would allow you to
111
00:06:12.525 --> 00:06:16.125
run whatever commands you wanted on the server, install new server,
112
00:06:16.444 --> 00:06:21.724
install new software, change the way the website works, poke around at the files they might have on that server,
113
00:06:23.970 --> 00:06:26.850
and it affected, like, all PHP versions.
114
00:06:29.330 --> 00:06:31.170
There... In fact, there was a guy
115
00:06:31.730 --> 00:06:42.415
just... I think it was yesterday or the day before over the weekend who was like, this is bullshit. This isn't real. So I'm gonna set up a PHP website and put some Bitcoin on the web server
116
00:06:42.815 --> 00:06:45.695
and just, like, basically, as a bounty, like,
117
00:06:46.414 --> 00:06:47.854
if someone can take the Bitcoin
118
00:06:48.910 --> 00:06:53.550
to try and, like, call, you know, call someone's bluff on this. And I
119
00:06:54.110 --> 00:06:56.030
think it took a couple hours. Gone.
120
00:06:56.190 --> 00:06:56.990
Damn.
121
00:06:58.030 --> 00:06:58.590
Why
122
00:06:59.310 --> 00:07:00.590
did he think it wasn't real?
123
00:07:01.735 --> 00:07:07.895
Did he have any, like, good reasons? Like I'm not really sure. I'm not really sure. I mean, you know, these things...
124
00:07:08.455 --> 00:07:09.255
With these
125
00:07:09.655 --> 00:07:10.855
these security
126
00:07:11.495 --> 00:07:18.770
vulnerability announcements, especially that are circulating on Twitter, right, there... There's a lot of hype associated with them. We've seen that. Yeah.
127
00:07:19.650 --> 00:07:28.290
It seems more more often than not, like, you hear about some crazy vulnerability, and it sounds so bad. And then you kinda
128
00:07:28.690 --> 00:07:33.315
gather some more details about it and find out that, like, it requires
129
00:07:33.315 --> 00:07:35.955
physical access to the device or
130
00:07:36.835 --> 00:07:37.395
some
131
00:07:38.035 --> 00:07:38.915
crazy
132
00:07:39.075 --> 00:07:43.795
circumstance that is just totally unreasonable to find the average user in.
133
00:07:44.870 --> 00:07:47.270
Yeah. There was a a vulnerability
134
00:07:47.270 --> 00:07:51.270
or a set of 11 vulnerabilities that made headlines this weekend
135
00:07:51.670 --> 00:07:52.470
because
136
00:07:52.790 --> 00:07:54.230
it was in Tailscale.
137
00:07:55.030 --> 00:07:58.815
Tailscale is like remote access to your servers.
138
00:07:59.295 --> 00:08:03.215
So a lot of people use it in production and just a
139
00:08:03.695 --> 00:08:04.815
lot of machines
140
00:08:04.815 --> 00:08:07.135
provide remote access to
141
00:08:07.375 --> 00:08:10.815
authorized users via Tailscale. So that's a huge target.
142
00:08:11.470 --> 00:08:18.990
This researcher kind of made headways because they didn't do responsible disclosure or anything. They just straight up published all 11 vulnerabilities.
143
00:08:20.030 --> 00:08:27.645
But last I read is it it does have a catch. Like, you do need to have access to the server, like, already.
144
00:08:28.365 --> 00:08:29.085
So
145
00:08:29.165 --> 00:08:31.325
it's not just like a straight up, like,
146
00:08:31.565 --> 00:08:37.485
zero day exploit where anyone can just
get into your Tailscale machine. So they... You would have to
147
00:08:37.980 --> 00:08:44.220
have another exploit, I guess, to get access to the server in which then you could break Tailscale. So it's a problem,
148
00:08:45.180 --> 00:08:47.740
but not as severe as it would
149
00:08:48.220 --> 00:08:51.500
initially seem. I guess it's still developing, so we'll see. But
150
00:08:52.535 --> 00:08:54.535
Has Tailscale been patched?
151
00:08:54.935 --> 00:08:57.015
I'm asking because I'm using Tailscale.
152
00:08:57.575 --> 00:09:01.895
I don't know. I just And and this is the first I've heard of this exploit.
153
00:09:02.215 --> 00:09:02.855
Yeah.
154
00:09:03.975 --> 00:09:05.415
I don't know. I I
155
00:09:06.620 --> 00:09:10.620
originally read this, and the comments were like, no. No. No. It requires
156
00:09:11.019 --> 00:09:14.779
it requires low low access... Local access to the machine,
157
00:09:15.260 --> 00:09:15.900
but
158
00:09:17.820 --> 00:09:20.940
I don't know. I I would imagine that tail scales on it.
159
00:09:22.425 --> 00:09:23.385
I don't know.
160
00:09:24.265 --> 00:09:26.745
Make a make a note to to check that out.
161
00:09:27.305 --> 00:09:30.745
Yeah. I'll put that on my list of things to do this evening.
162
00:09:31.625 --> 00:09:33.225
But the PHP one,
163
00:09:33.785 --> 00:09:36.345
from what it seemed, because it was kind of a frenzy
164
00:09:36.670 --> 00:09:41.790
on X last week and I didn't even think the NSA chimed in. My understanding is
165
00:09:42.350 --> 00:09:47.470
you couldn't trust the certificates of websites so you could think you were on an authentic website.
166
00:09:48.590 --> 00:09:57.975
That was not the HP one. That's a new one we should definitely get into. Yeah. That was a whole separate issue. Oh my gosh. There's so many. Dude, yeah, that's what I'm saying.
167
00:09:58.375 --> 00:10:07.175
It's like every open. Yeah. Every day you wake up and there's, like, a new, like, groundbreaking exploit that, like, would have been the biggest exploit of the year on its own.
168
00:10:08.050 --> 00:10:16.770
But it's like they're... Like, the floodgates have just opened, like you said. Like Okay. So I got a quick timeline on the PHP to Shell exploit.
169
00:10:18.050 --> 00:10:18.610
It was...
170
00:10:20.465 --> 00:10:27.345
So they... Whoever found that or at least someone who found it did decide to do responsible disclosure.
171
00:10:27.425 --> 00:10:27.985
So
172
00:10:28.545 --> 00:10:31.825
they told the makers of PHP about it.
173
00:10:32.305 --> 00:10:32.705
And
174
00:10:33.500 --> 00:10:37.100
so this is October 21, so, like, five days ago.
175
00:10:38.060 --> 00:10:40.700
They told the makers of PHP about it,
176
00:10:41.339 --> 00:10:47.980
and they obviously did the right thing. They issued, like, CVEs, which are formal announcements of these problems and patches
177
00:10:48.845 --> 00:10:51.805
right away. And then I think the next day,
178
00:10:52.365 --> 00:10:53.005
they...
179
00:10:53.725 --> 00:10:55.245
On October 20,
180
00:10:56.045 --> 00:10:59.245
someone someone else found the exploit and released it.
181
00:11:01.709 --> 00:11:05.550
So that was kinda, like, in the middle of the official PHP patches.
182
00:11:06.670 --> 00:11:09.790
Oh, so they hadn't quite gotten the patches out?
183
00:11:10.350 --> 00:11:18.095
Yeah. So they did, like, this this, like, announcement that whoever had found it that there was a big problem in PHP, all versions are affected. Big deal.
184
00:11:18.495 --> 00:11:23.055
They supposedly told the PHP organization about it, and they were working on the patches. The next day,
185
00:11:23.695 --> 00:11:27.135
someone else independently found it, and it was leaked,
186
00:11:27.774 --> 00:11:29.855
what they were. And they So the attacks started happening.
187
00:11:30.620 --> 00:11:36.380
They woke up and chose violence that morning and decided not to do responsible disclosure.
188
00:11:36.540 --> 00:11:45.420
Someone else. Yeah. I mean, I guess when you're seeing all these sensationalist articles about it, you can't help but take your AI and be like, what? What's going on here? Find this. Right.
189
00:11:46.835 --> 00:11:51.955
So on the twenty first, so this is a day after the exploit got released publicly,
190
00:11:52.275 --> 00:11:54.515
PHP released their emergency patches.
191
00:11:55.155 --> 00:11:56.675
But I think a lot of,
192
00:11:57.235 --> 00:12:00.270
web hosting companies, which are the
193
00:12:00.510 --> 00:12:04.830
people running the servers that run most of the PHP,
194
00:12:05.310 --> 00:12:06.110
instances,
195
00:12:06.670 --> 00:12:08.589
they took, like, preventative measures.
196
00:12:09.070 --> 00:12:22.675
In fact, there was some, like, very prominent websites that just turned off. They're like Yeah. We don't... We know there's a problem. We don't know what it is. And out of an abundance of caution, we are just, like, turning off our website until further notice. And so that happened.
197
00:12:23.154 --> 00:12:26.355
I checked with my web host because I have just some
198
00:12:27.110 --> 00:12:28.389
some junky
199
00:12:28.389 --> 00:12:29.269
PHP
200
00:12:29.269 --> 00:12:32.310
websites that I made like twenty years ago
201
00:12:33.589 --> 00:12:34.230
that...
202
00:12:35.029 --> 00:12:38.070
Know? So I checked with my web host, they're like, yeah, we... We've taken
203
00:12:38.470 --> 00:12:39.670
precautionary measures
204
00:12:40.505 --> 00:12:41.065
to
205
00:12:41.545 --> 00:12:48.265
deal with it. I don't I don't know what that was. There's certainly not a... My websites were not a high value target there.
206
00:12:49.545 --> 00:12:50.185
And...
207
00:12:51.305 --> 00:12:52.345
Yeah. So
208
00:12:53.010 --> 00:12:55.810
PHP released new versions that patch the fixes,
209
00:12:56.210 --> 00:12:56.690
but
210
00:12:57.090 --> 00:13:01.170
there's a lot of web servers out there running PHP, a lot of, like,
government
211
00:13:01.650 --> 00:13:03.010
corporate websites
212
00:13:03.010 --> 00:13:07.650
that probably haven't been updated in a very long time, and they probably
213
00:13:07.154 --> 00:13:09.714
didn't update now. Right? Because they just...
214
00:13:10.675 --> 00:13:15.475
You know, like, the contractor that made that website is long since gone, and no one knows how it works.
215
00:13:15.954 --> 00:13:19.315
So the risk is the risk is someone can
216
00:13:20.900 --> 00:13:21.780
essentially
217
00:13:22.980 --> 00:13:27.140
remotely execute commands on that web server.
218
00:13:27.380 --> 00:13:28.020
So
219
00:13:28.580 --> 00:13:31.460
if that web server contains, say, it's like
220
00:13:32.020 --> 00:13:33.540
a healthcare company,
221
00:13:33.780 --> 00:13:34.180
and
222
00:13:34.980 --> 00:13:35.700
I mean,
223
00:13:36.100 --> 00:13:43.195
guess that begs the question. Like, like, I'm trying to gauge, like, what the risk is, and I guess it depends on how each of these
224
00:13:43.595 --> 00:13:45.995
entities set up their networking infrastructure.
225
00:13:46.315 --> 00:13:55.660
I mean, I guess, like is that, like, a lot of these websites use PHP to handle the login. So, like, if there's a website, like your bank or your, you know, your
226
00:13:56.380 --> 00:13:59.900
health care, this and that, any any website that you log into,
227
00:14:00.380 --> 00:14:00.940
that
228
00:14:01.580 --> 00:14:02.620
does it with PHP,
229
00:14:03.115 --> 00:14:08.475
there's, like, a very real risk that just someone else can access your account.
230
00:14:08.955 --> 00:14:12.795
And then any of the any of the files that are on that web server,
231
00:14:13.035 --> 00:14:15.755
which probably aren't like, you know, your
232
00:14:15.995 --> 00:14:18.635
your bank account or anything like that,
233
00:14:19.250 --> 00:14:22.850
Those files are at risk, but that's mostly, like, the web server files.
234
00:14:23.089 --> 00:14:26.450
But, yeah, they can't access now, like, your account.
235
00:14:28.130 --> 00:14:28.690
And,
236
00:14:29.970 --> 00:14:31.330
you know, other
237
00:14:31.490 --> 00:14:33.649
nefarious things could be installed on that server.
238
00:14:34.275 --> 00:14:44.755
It's it's a pretty big one just because of the, like, attack service of PHP. So many people use it, and it's so old. It's just not like people that are really on the the game of updating things.
239
00:14:45.235 --> 00:14:48.115
And so, like, end users, it's not like
240
00:14:48.720 --> 00:14:53.360
the end user has a path forward in this to
241
00:14:53.680 --> 00:15:02.880
protect themselves because they're relying on the person hosting the website to do the updates. Is that correct? Yes. That's right. That's right. Yeah.
242
00:15:03.524 --> 00:15:04.964
That sucks.
243
00:15:05.925 --> 00:15:08.644
I hate being dependent on other people to do shit.
244
00:15:09.685 --> 00:15:16.324
Yeah. But, like, in so many cases, we're forced into it.
Right? You think about Yeah. Right. The the DMV,
245
00:15:16.485 --> 00:15:18.644
the, you know, your your bank,
246
00:15:18.805 --> 00:15:21.280
like, anything to do with, like,
247
00:15:21.760 --> 00:15:22.560
governments,
248
00:15:22.640 --> 00:15:28.480
things like that. Right? These days, you just have to use their website, and we all know those websites are shitty.
249
00:15:28.800 --> 00:15:29.520
Yeah.
250
00:15:29.600 --> 00:15:34.160
And I'm sure that they are shitty not just in their user interface, but in their, like, actual
251
00:15:34.825 --> 00:15:35.785
implementation
252
00:15:35.785 --> 00:15:39.545
and security side of things. So that was a big one.
253
00:15:39.945 --> 00:15:44.585
And then what was the certificate one? Okay. So this this one is actually... This is a...
254
00:15:45.705 --> 00:15:46.825
I think that someone,
255
00:15:47.639 --> 00:15:56.600
apparently, there's some, like, severity scale for, like, breaches. Right? And this is, a 10 out of 10. Like, this is as bad as it gets. This has never happened before.
256
00:15:57.160 --> 00:15:57.720
The
257
00:15:58.120 --> 00:15:59.959
Internet literally broke.
258
00:16:00.199 --> 00:16:01.240
The Internet
259
00:16:01.525 --> 00:16:03.525
literally broke. So...
260
00:16:04.085 --> 00:16:07.285
Alright. Let's see if I can if I can summarize this.
261
00:16:08.325 --> 00:16:12.325
SSL or TLS, as it's actually called now, is
262
00:16:12.885 --> 00:16:14.325
what is how
263
00:16:15.899 --> 00:16:19.980
authentication and encryption is done on the Internet, so... On the web.
264
00:16:20.459 --> 00:16:24.620
So, like, whenever you see that lock icon up in your URL address bar,
265
00:16:24.940 --> 00:16:27.660
that is because the website is HTTPS,
266
00:16:27.740 --> 00:16:29.180
and it's using TLS.
267
00:16:30.115 --> 00:16:32.195
The s being for secure.
268
00:16:32.595 --> 00:16:33.235
Yes.
269
00:16:33.555 --> 00:16:34.355
Exactly.
270
00:16:36.274 --> 00:16:38.035
And the way that that's done,
271
00:16:38.675 --> 00:16:40.035
the way that the the
272
00:16:40.435 --> 00:16:41.555
secure
273
00:16:44.230 --> 00:16:45.270
communication
274
00:16:45.270 --> 00:16:49.430
or sort of authentication to make sure that you're communicating with who you think you are
275
00:16:49.830 --> 00:16:59.350
and to set up the encrypted communications between your browser and whatever website you're trying to access. The way that that's set up is through this centralized
276
00:16:59.025 --> 00:17:01.185
hierarchy of certificates.
277
00:17:01.825 --> 00:17:02.865
So there's, like...
278
00:17:03.665 --> 00:17:09.425
I forget how many of them there are, but they're all around the world. There are these companies that have been designated to set up certificates.
279
00:17:09.425 --> 00:17:10.865
So there are these trusted parties,
280
00:17:11.690 --> 00:17:14.490
and they all have created certificates,
281
00:17:15.450 --> 00:17:18.490
and your browser already knows who they are.
282
00:17:19.450 --> 00:17:26.065
So your your browser come... When you, you know, download any browser or your OS or any range
283
00:17:26.065 --> 00:17:32.545
of IoT devices, anything, it is aware of this whole hierarchy of certificate servers.
284
00:17:33.105 --> 00:17:36.065
And so if you're like, I wanna go to google.com,
285
00:17:36.545 --> 00:17:38.145
and I wanna go to httbs,
286
00:17:38.250 --> 00:17:39.690
you know, google.com,
287
00:17:39.690 --> 00:17:44.330
which is now the default. So if you just type google.com in your browser, it goes to the https
288
00:17:44.330 --> 00:17:45.049
version.
289
00:17:45.690 --> 00:17:47.290
Your browser will,
290
00:17:48.890 --> 00:17:50.169
connect to the server,
291
00:17:50.330 --> 00:17:53.049
and it'll use these certificates to authenticate
292
00:17:53.130 --> 00:17:53.850
that
293
00:17:54.625 --> 00:17:57.264
you are talking with google.com.
294
00:17:57.265 --> 00:17:59.585
Right? So the google.com has signed,
295
00:18:00.145 --> 00:18:03.264
has a signature saying, you know, this is our
296
00:18:03.424 --> 00:18:09.029
this is our website, and then the certificates that your browser know about knows about can check and see.
297
00:18:09.270 --> 00:18:15.750
Okay. Yeah. That's right. Like, let's set up the secure connection to google.com. We can be certain that it is google.com,
298
00:18:16.230 --> 00:18:17.269
and no one can
299
00:18:17.990 --> 00:18:22.414
spoof it and say, like, no. No. I'm google.com. Like, send me your secure data.
300
00:18:22.655 --> 00:18:23.695
So there's...
301
00:18:23.935 --> 00:18:25.294
Yeah. I think there's
302
00:18:26.415 --> 00:18:27.135
maybe
303
00:18:28.335 --> 00:18:30.335
20, 30 of these
304
00:18:30.575 --> 00:18:32.495
these companies that do
305
00:18:32.735 --> 00:18:33.375
this...
306
00:18:33.615 --> 00:18:34.495
These certificates.
307
00:18:35.280 --> 00:18:36.480
And one of them
308
00:18:37.280 --> 00:18:38.559
based in
309
00:18:39.600 --> 00:18:41.920
India... Where is it? Where are they based in?
310
00:18:42.800 --> 00:18:43.600
I think,
311
00:18:46.320 --> 00:18:53.365
alright. Well I think it was India. Yeah. It was definitely in India. I was trying to come up with a city, but they're called EMudhra,
312
00:18:53.365 --> 00:19:02.085
E M U D H R A. And they're a certificate authority. So they're, like, trusted by the Internet body to, like, sign... To create these certificates,
313
00:19:02.085 --> 00:19:03.925
and all the browsers ship with
314
00:19:04.399 --> 00:19:07.999
with eMudra in their list of certificate authorities
315
00:19:08.640 --> 00:19:12.399
that you can use to trust that you're communicating with who you think you are.
316
00:19:12.720 --> 00:19:13.279
Well,
317
00:19:14.960 --> 00:19:15.759
on,
318
00:19:17.519 --> 00:19:21.265
October 17, so ten days, nine days ago,
319
00:19:22.465 --> 00:19:25.985
they... A researcher was was just looking into it
320
00:19:26.385 --> 00:19:27.105
and
321
00:19:27.185 --> 00:19:28.465
discovered that
322
00:19:28.785 --> 00:19:31.585
the certificates from EMUADRA were
323
00:19:31.745 --> 00:19:37.509
not secure. In fact, he was able to brute force them because their their certificates
324
00:19:38.070 --> 00:19:40.149
were not generated with enough entropy.
325
00:19:40.470 --> 00:19:43.509
Sounds very familiar, right, the cold card incident.
326
00:19:44.950 --> 00:19:50.549
It definitely appears like they just fucked up. Like, this wasn't a malicious thing. I guess we don't know for sure, but it appears they just fucked up.
327
00:19:51.725 --> 00:19:53.245
And their
328
00:19:54.605 --> 00:19:55.325
actual
329
00:19:55.965 --> 00:19:59.165
private keys that were used to create these certificates
330
00:19:59.725 --> 00:20:00.445
were
331
00:20:00.685 --> 00:20:01.405
only,
332
00:20:02.605 --> 00:20:03.965
eight bits long.
333
00:20:04.950 --> 00:20:06.230
So normally, it's...
334
00:20:06.549 --> 00:20:09.590
Normally, these are 384
335
00:20:09.590 --> 00:20:12.549
bit private keys. Right? So that's two
336
00:20:13.190 --> 00:20:14.070
to three
337
00:20:14.230 --> 00:20:15.669
eighty four. That's like...
338
00:20:15.990 --> 00:20:16.309
You know,
339
00:20:17.315 --> 00:20:30.115
it should be... Should have an e number... Space. Numbers that... More numbers than there are, like, atoms in the observable universe by a long shot. Right? We talk about SHA two fifty six, which is two to two fifty six. This is more than that. This is a
340
00:20:30.435 --> 00:20:31.475
impossibly large number.
341
00:20:32.830 --> 00:20:38.750
EMU drift fucked up, and they generated their keys with only maximum of eight bits
342
00:20:38.830 --> 00:20:39.870
of entropy.
343
00:20:40.190 --> 00:20:42.590
So the the whole 384
344
00:20:42.590 --> 00:20:44.590
bit number was all zeros
345
00:20:44.750 --> 00:20:46.190
except for the last eight bits.
346
00:20:46.934 --> 00:20:52.934
And I think nine of their keys were made like this, and they were trusted by the entire Internet
347
00:20:53.255 --> 00:20:57.495
to to be able to verify the authenticity of who you're communicating with.
348
00:20:59.310 --> 00:21:01.950
And so this guy who goes by the name Wayne
349
00:21:03.550 --> 00:21:11.310
discovered this problem. He recovered the private keys, all nine of them. One of the private keys was literally the number four.
350
00:21:11.550 --> 00:21:12.510
That, like,
351
00:21:13.174 --> 00:21:18.455
that's your private key. Four. And the rest of them are all, like, less than two fifty six.
352
00:21:21.895 --> 00:21:32.359
The Well, less than eight bits. I mean, like, put that in perspective. Like, the number four is what? Four four bits. Right? One digit is four bits. Is that correct?
353
00:21:33.320 --> 00:21:35.399
So the the number four
354
00:21:35.480 --> 00:21:36.119
is
355
00:21:37.320 --> 00:21:38.039
is
356
00:21:38.679 --> 00:21:39.719
two bits.
357
00:21:40.039 --> 00:21:41.000
Two bits. Okay.
358
00:21:41.835 --> 00:21:43.114
Well, it's...
359
00:21:43.434 --> 00:21:47.835
I guess the number... Yeah. The number four would be three bits, but it's...
360
00:21:48.075 --> 00:21:58.550
If we're going... Yeah. The number four is three bits. Sorry. So they they totally fucked up. Like, it was... Lot of people speculated how this happened. We haven't got a lot of resolution as to how they did this, but, like,
361
00:21:59.110 --> 00:22:00.630
it seems like they
362
00:22:01.110 --> 00:22:11.005
they generated some, like, test keys or something because you can look at the history of, like, how they submitted this to the organization that manages it all. And they have one set of keys
363
00:22:11.165 --> 00:22:12.285
that was, like,
364
00:22:12.845 --> 00:22:15.164
very secure and hasn't been recovered.
365
00:22:16.205 --> 00:22:17.565
And then they, like,
366
00:22:18.445 --> 00:22:22.125
they, like, recalled those and issued these other ones
367
00:22:23.510 --> 00:22:27.429
They were all, you know, low entropy, completely insecure.
368
00:22:28.630 --> 00:22:32.309
But, like, eight bits at most is, like, four digits. Right?
369
00:22:34.309 --> 00:22:39.275
So eight bits represents the number zero to two fifty five.
370
00:22:39.675 --> 00:22:42.795
Two fifty five. Okay. Alright. So they might have interpreted
371
00:22:43.035 --> 00:22:47.835
two fifty six bits of entropy as pick a number between zero and two fifty five.
372
00:22:49.530 --> 00:22:54.170
Maybe. I mean, it was supposed to have 384 bits of entropy. I I think they just, like,
373
00:22:54.570 --> 00:22:56.330
totally fucked up. Like...
374
00:22:56.730 --> 00:22:57.370
Dude.
375
00:22:58.490 --> 00:23:00.490
So someone essentially could
376
00:23:00.890 --> 00:23:03.450
brute force a certificate and then
377
00:23:04.125 --> 00:23:05.965
set up a bullshit website.
378
00:23:06.045 --> 00:23:08.845
And when people would go browse the Internet
379
00:23:09.245 --> 00:23:12.845
and their browser would say, okay, who am I talking to?
380
00:23:13.165 --> 00:23:15.565
And the server would be like, I'm google.com.
381
00:23:15.565 --> 00:23:20.710
And the web browser is like, okay, prove it. And it's like, here's your certificate proving I'm google.com,
382
00:23:21.030 --> 00:23:25.830
and it'll be completely bullshit. And then your web browser will be like, yep. That checks out, and
383
00:23:26.470 --> 00:23:31.245
I'm gonna let the user enter all their sensitive information now. Yes.
384
00:23:31.325 --> 00:23:33.485
Yes. I mean, think you essentially...
385
00:23:34.765 --> 00:23:44.925
I think you have to do like a man in the middle attack, right? Yeah, don't you? Because otherwise you'd need the domain, right? Yeah, that's right. Yeah, you'd need to have the domain. But you could imagine
386
00:23:45.419 --> 00:23:47.899
if you are on a public Wi Fi
387
00:23:48.139 --> 00:23:48.940
network,
388
00:23:48.940 --> 00:23:52.139
you're on a private, you know, network,
389
00:23:52.539 --> 00:23:56.699
there could be another device on the network that is intercepting your traffic.
390
00:23:57.259 --> 00:23:58.699
And that device
391
00:23:58.940 --> 00:23:59.740
could
392
00:24:00.735 --> 00:24:01.774
officially
393
00:24:04.175 --> 00:24:04.975
Impersonate.
394
00:24:05.055 --> 00:24:06.015
Impersonate
395
00:24:06.015 --> 00:24:06.975
google.com
396
00:24:06.975 --> 00:24:08.335
or any website.
397
00:24:08.415 --> 00:24:09.054
Mhmm.
398
00:24:09.295 --> 00:24:19.669
Right? So that's that's the risk there is if if you're... If there's something on your device that's doing like a man in the middle attack and is spoofing it sort of before it gets to the public Internet. Because I think
399
00:24:20.070 --> 00:24:20.870
DNS,
400
00:24:20.870 --> 00:24:22.710
you know, public DNS isn't
401
00:24:23.350 --> 00:24:30.390
isn't hacked. Right? So you... Yeah. Like Tyler said, you would have to have the domain name, but, yeah, the risk comes for man in the middle attacks.
402
00:24:31.505 --> 00:24:34.305
And so the fallout of this was
403
00:24:34.705 --> 00:24:38.945
don't trust any website, any application, any service until
404
00:24:39.025 --> 00:24:40.065
they update
405
00:24:40.545 --> 00:24:41.745
any browser?
406
00:24:41.825 --> 00:24:43.425
Yeah. So you're assuming
407
00:24:43.825 --> 00:24:47.660
we're just talking about websites, your browser is what needs to update. Okay.
408
00:24:48.140 --> 00:24:49.260
And
409
00:24:49.900 --> 00:24:51.420
all the main browsers
410
00:24:51.580 --> 00:24:53.820
fixed it, like, immediately.
411
00:24:53.900 --> 00:24:59.020
So there's some sort of weird back channel there by which your browser is able to, like, revoke keys,
412
00:24:59.914 --> 00:25:02.715
which in this case is good because it saved our asses.
413
00:25:04.395 --> 00:25:09.114
Think Wait. Without the user doing a update in the browser software?
414
00:25:09.195 --> 00:25:10.875
Yeah. Is that what you're saying? Yeah.
415
00:25:11.970 --> 00:25:14.210
Woah. What? Like Yeah.
416
00:25:15.250 --> 00:25:18.609
Yeah. I think they they do have a mechanism to do that.
417
00:25:20.130 --> 00:25:20.929
Interesting.
418
00:25:21.010 --> 00:25:22.609
Yeah. It is interesting. So that
419
00:25:23.570 --> 00:25:26.850
implies, like, your browser... If I'm getting this correctly,
420
00:25:27.424 --> 00:25:29.985
your browser must be going to some, like...
421
00:25:30.544 --> 00:25:34.225
You know, like, say you're using Brave Browser. Brave Browser's checking
422
00:25:34.544 --> 00:25:37.664
a Brave Browser hosted server for these certificates.
423
00:25:37.745 --> 00:25:38.864
No. Let's see.
424
00:25:39.345 --> 00:25:42.705
Because if the certificates were, like, saved locally,
425
00:25:44.679 --> 00:25:46.039
surely the
426
00:25:46.360 --> 00:25:47.719
company or
427
00:25:48.440 --> 00:25:52.119
the project that makes the web browser wouldn't be able to go
428
00:25:53.080 --> 00:25:56.039
to your local device and update certificates.
429
00:25:56.745 --> 00:26:05.144
So it says modern browsers have mechanisms for distributing emergency certificate trust changes independently of normal browser software updates.
430
00:26:05.545 --> 00:26:11.000
Yeah. So Chrome has its root store and its CRL set. Safari, Apple can distribute
431
00:26:11.160 --> 00:26:14.520
trust changes throughout its operating system trust infrastructure.
432
00:26:14.920 --> 00:26:16.440
Yeah. So I think it's this whole
433
00:26:17.160 --> 00:26:20.200
chain of trust infrastructure that these browsers use
434
00:26:20.920 --> 00:26:23.000
by which they can just update that shit. So,
435
00:26:23.725 --> 00:26:28.124
yeah, someone attacks that, and we could be in problem. We could have a serious problem.
436
00:26:28.445 --> 00:26:29.484
Wow. The
437
00:26:29.725 --> 00:26:32.125
interesting thing is that... So browsers
438
00:26:32.125 --> 00:26:34.364
are very complex modern
439
00:26:34.605 --> 00:26:42.279
bits of software that can fix this automatically, but there's lots of other stuff that uses these certificates that can't update automatically,
440
00:26:44.120 --> 00:26:45.560
like IoT
441
00:26:45.560 --> 00:26:46.120
stuff.
442
00:26:47.160 --> 00:26:48.919
If you got into the weeds on this,
443
00:26:49.560 --> 00:26:54.424
I did this on the day, and then they had a website where you could check. Right? And it would just show you
444
00:26:55.385 --> 00:26:56.664
if your...
445
00:26:56.825 --> 00:26:59.945
Whatever you're using to access the Internet was,
446
00:27:00.265 --> 00:27:02.265
trusting EMUADRA certificates,
447
00:27:02.265 --> 00:27:04.505
and it would show you these, like, green or red checkboxes.
448
00:27:06.190 --> 00:27:09.230
I checked all my browsers immediately. They're all good. But
449
00:27:10.430 --> 00:27:26.185
the, curl, so a command line tool that's used to act... You can access websites through curl on the command line. I checked that on my Mac, and it was it was all red. Like, it was still trusting it. So even though the browser on my OS had updated its chain of trust,
450
00:27:26.425 --> 00:27:28.425
curl, a separate tool, had not.
451
00:27:28.905 --> 00:27:29.865
And then I checked,
452
00:27:30.745 --> 00:27:33.945
I checked signal, the application signal, and it was still.
453
00:27:34.560 --> 00:27:36.640
So that means that these applications,
454
00:27:37.040 --> 00:27:38.320
they have their own
455
00:27:38.800 --> 00:27:41.120
separate from the OS, their own,
456
00:27:41.600 --> 00:27:43.360
chain of trust mechanism.
457
00:27:44.080 --> 00:27:46.800
And so it was it was actually pretty wild. Signal
458
00:27:47.200 --> 00:27:47.920
was
459
00:27:48.934 --> 00:27:50.774
still trusting the eMudra
460
00:27:52.054 --> 00:27:52.934
certificates,
461
00:27:53.655 --> 00:27:55.894
well into that that day.
462
00:27:56.934 --> 00:28:02.615
Now I talked to my agent quite a bit about this, and he's like, no. No. No. Like,
SIGNAL encryption is not broken.
463
00:28:03.289 --> 00:28:07.770
All that Signal uses this certificate for is to download
464
00:28:07.770 --> 00:28:08.970
link previews.
465
00:28:08.970 --> 00:28:12.809
So when someone posts you a link in Signal and it shows you a preview,
466
00:28:13.370 --> 00:28:14.330
that could be
467
00:28:14.730 --> 00:28:15.769
spoofed.
468
00:28:15.929 --> 00:28:18.169
Seems like there's probably some problems there. Signal,
469
00:28:19.515 --> 00:28:20.875
later that day,
470
00:28:21.275 --> 00:28:22.395
had an update.
471
00:28:23.035 --> 00:28:26.955
So they were on it. But things that were... That are not
472
00:28:27.995 --> 00:28:30.315
gonna get fixed anytime soon is,
473
00:28:31.930 --> 00:28:33.690
like, IoT devices,
474
00:28:33.770 --> 00:28:35.529
any sort of embedded firmware.
475
00:28:36.330 --> 00:28:37.370
The Bitaxe
476
00:28:37.450 --> 00:28:40.010
ESP Miner was vulnerable. Routers?
477
00:28:40.410 --> 00:28:42.250
Routers. Yes. I
478
00:28:43.370 --> 00:28:44.810
checked my router right away,
479
00:28:46.174 --> 00:28:48.735
and it was... It's straight up vulnerable.
480
00:28:48.895 --> 00:28:49.455
I
481
00:28:50.575 --> 00:28:56.894
have, like, you know, a nicer router that has, like, a remote administration interface and things like that.
482
00:28:57.375 --> 00:29:02.909
Straight up vulnerable. I worked through how to patch it myself. I emailed the manufacturer, and I was like,
483
00:29:03.950 --> 00:29:04.989
WTF.
484
00:29:05.070 --> 00:29:06.829
And they're like, oh, yeah. We're aware of it.
485
00:29:08.110 --> 00:29:15.575
So, yeah, I mean, the... This is the the Bitaxe. We have a feature on ESP Miner where you can connect to
486
00:29:15.575 --> 00:29:18.135
a pool over TLS,
487
00:29:18.775 --> 00:29:24.054
which is kinda neat because you can now have encrypted communications with a pool. You can be
488
00:29:25.015 --> 00:29:29.095
certain that you're you're talking to the pool that you wanna be. You can't get man in the middle.
489
00:29:30.135 --> 00:29:30.935
But
490
00:29:32.270 --> 00:29:35.630
embedded devices like the one that runs the Bitaxe,
491
00:29:35.950 --> 00:29:42.670
doesn't have this dynamic chain of trust thing like your browser does, and so it won't be automatically updated. So
492
00:29:44.005 --> 00:29:46.884
did an update to the ESP Miner firmware to,
493
00:29:47.605 --> 00:29:52.965
distrust EMUADRA certificates, which we were definitely rolling into the firmware when it got built.
494
00:29:53.445 --> 00:29:58.325
So, yeah, this this is a big one. This this is, like, the first time anything like this has ever happened.
495
00:29:59.980 --> 00:30:00.940
I don't think
496
00:30:01.340 --> 00:30:02.219
that this...
497
00:30:02.539 --> 00:30:04.619
From what I read, this, like, emergency...
498
00:30:05.340 --> 00:30:06.779
What do they call it? The
499
00:30:07.580 --> 00:30:11.419
emergency certificate trust and revocation infrastructure.
500
00:30:11.740 --> 00:30:13.100
I don't think it's ever been used.
501
00:30:13.785 --> 00:30:14.585
Wow.
502
00:30:15.465 --> 00:30:16.184
Wow.
503
00:30:16.585 --> 00:30:18.585
Thanks for sharing that
504
00:30:19.465 --> 00:30:21.945
website that checks your certificates.
505
00:30:21.945 --> 00:30:24.425
So the night you shared that, I checked
506
00:30:24.665 --> 00:30:26.505
all the browsers on all my devices.
507
00:30:28.659 --> 00:30:38.899
For anyone who wants to do this at home, it's emudra.we-have-a-problem.com.
508
00:30:40.419 --> 00:30:43.974
I wish that was a little easier to remember. I feel like people need to be hitting this
509
00:30:44.695 --> 00:30:49.734
I know. Website. Average Gary will probably have no problem figuring that one out,
510
00:30:50.455 --> 00:30:54.909
based on the URLs I was spelling out last episode.
511
00:30:57.070 --> 00:30:58.029
Interestingly,
512
00:30:58.029 --> 00:30:58.829
Tor
513
00:30:59.149 --> 00:31:01.630
is still insecure.
514
00:31:01.630 --> 00:31:03.469
It's coming up with red Xs
515
00:31:04.110 --> 00:31:06.429
for some of these eMudra certificates.
516
00:31:06.509 --> 00:31:10.645
Let's see, one, two, three, four, five, six of them still.
517
00:31:11.765 --> 00:31:13.684
I'm just... I'm checking it right now.
518
00:31:14.005 --> 00:31:16.405
Have you updated your your Tor browser?
519
00:31:17.205 --> 00:31:18.165
So
520
00:31:18.165 --> 00:31:19.925
this is on version...
521
00:31:20.805 --> 00:31:24.645
Tor version 0 point 4 point 9 point 11.
522
00:31:25.360 --> 00:31:26.879
So let me check
523
00:31:27.279 --> 00:31:28.639
if that's the latest.
524
00:31:29.120 --> 00:31:31.440
They might not have that sort of emergency
525
00:31:32.480 --> 00:31:36.399
override backdoor in their browser. I don't know. I don't think they do.
526
00:31:37.279 --> 00:31:38.559
Yeah. I noticed that
527
00:31:39.015 --> 00:31:44.615
that Movad browser, which I think is based on the Tor browser, was the same. And I manually patched mine,
528
00:31:45.735 --> 00:31:47.174
which was not easy.
529
00:31:48.775 --> 00:31:50.055
What are the As people who
530
00:31:50.855 --> 00:31:52.855
you know, Tor runs very slow. Sorry.
531
00:31:53.530 --> 00:31:58.169
What are the people who don't use AI at all beyond chattybt.com
532
00:31:58.170 --> 00:32:01.690
supposed to do? And what do you guys think is coming for
533
00:32:02.170 --> 00:32:03.130
the world?
534
00:32:04.330 --> 00:32:05.370
Update everything?
535
00:32:05.770 --> 00:32:07.610
Yeah. That's always been kind of
536
00:32:08.745 --> 00:32:15.304
something that is sometimes not advised, right? You know, don't have auto updates on because then a vulnerability could be introduced accidentally.
537
00:32:15.865 --> 00:32:21.625
Yeah. Always, I thought about this a lot myself last week when this was going down because I, you know, I'm very like,
538
00:32:22.409 --> 00:32:23.769
I wanna manually
539
00:32:23.850 --> 00:32:31.289
approve
updates, like, especially on my phone Yeah. And not just have it auto download stuff. A lot of times, you'll see, like,
540
00:32:32.409 --> 00:32:38.734
functionality removed from an app when you run an update, and I always get really worried about that. Like, I don't wanna see
541
00:32:39.534 --> 00:32:47.695
something taken away from an app that I wanna use. Right? And so I'm very... You know, with with wallets and things like that.
542
00:32:49.039 --> 00:32:50.239
I think there was,
543
00:32:51.440 --> 00:32:52.879
Wallet of Satoshi,
544
00:32:52.880 --> 00:32:55.119
right, had some updates like that. Think,
545
00:32:56.799 --> 00:32:57.999
what's that other,
546
00:32:58.960 --> 00:33:03.665
Lightning wallet? I don't know. Anyways, there was, you know, some of them, like, they removed
547
00:33:04.705 --> 00:33:09.184
their app from the the iOS App Store. Yeah. And so, like,
548
00:33:09.665 --> 00:33:11.585
if you didn't if you didn't
549
00:33:12.625 --> 00:33:14.465
update your app, you could still use it.
550
00:33:15.120 --> 00:33:18.240
And then you update your app, and it was like, oh, this doesn't work anymore.
551
00:33:19.280 --> 00:33:20.640
So, yeah, I was always very
552
00:33:21.360 --> 00:33:26.480
worried about running updates without being on top of it. But in this kind of situation, like,
553
00:33:27.485 --> 00:33:29.005
you you definitely
554
00:33:29.005 --> 00:33:31.485
need to, like, run the updates ASAP.
555
00:33:31.885 --> 00:33:34.205
Yeah. And those app stores get so...
556
00:33:35.485 --> 00:33:37.645
They get so much control over
557
00:33:37.725 --> 00:33:39.965
how the apps in their app stores work.
558
00:33:41.360 --> 00:33:45.760
You know, for example, like Samurai Wallet in the Google Play Store,
559
00:33:46.560 --> 00:33:47.520
that version,
560
00:33:49.360 --> 00:33:52.320
they made Samurai Wallet remove the
561
00:33:52.880 --> 00:34:01.335
stealth mode feature where the app would actually look like a calculator or a QR code scanner or
562
00:34:01.335 --> 00:34:02.375
a notebook.
563
00:34:02.375 --> 00:34:06.215
So like, if someone got your phone, they wouldn't necessarily see
564
00:34:06.535 --> 00:34:08.455
a Bitcoin wallet application,
565
00:34:08.455 --> 00:34:17.050
they would just see a notepad application or something. And then there would be some like little trick, like you tap this corner a few times and it,
566
00:34:17.370 --> 00:34:21.290
you know, takes it out of stealth mode and launches the Bitcoin app.
567
00:34:22.410 --> 00:34:26.170
So that was something that the Google Play Store was like, Nope, you got to remove that.
568
00:34:27.425 --> 00:34:29.105
And then there are other features,
569
00:34:30.625 --> 00:34:33.665
and I know Apple has been very controlling
570
00:34:33.665 --> 00:34:34.465
over
571
00:34:35.505 --> 00:34:36.545
what apps
572
00:34:36.625 --> 00:34:42.680
are allowed to do, especially as it comes... As it's related to, like, accepting any sort of payments
573
00:34:42.680 --> 00:34:43.160
They for the
574
00:34:45.160 --> 00:34:46.200
want their cut.
575
00:34:46.680 --> 00:34:51.000
Yeah, exactly. On in app transactions, yeah. Yep. And then,
576
00:34:51.240 --> 00:34:54.760
which is interesting because then they seem to be very lax with
577
00:34:55.625 --> 00:34:56.505
scammers
578
00:34:56.505 --> 00:34:58.665
impersonating Sparrow Wallet. And
579
00:34:59.545 --> 00:35:02.345
there is no Sparrow Wallet iOS
580
00:35:02.505 --> 00:35:04.265
app for your iPhone,
581
00:35:04.585 --> 00:35:05.225
yet
582
00:35:07.385 --> 00:35:20.160
it practically took an act of Congress to get Apple to remove the scammer's app from their App Store, yet they're super controlling about, like, what your app can do, especially related to payments. Like, if there's 1¢
583
00:35:20.160 --> 00:35:21.120
in it for them,
584
00:35:21.520 --> 00:35:23.600
they'll have teams of people working on it.
585
00:35:24.375 --> 00:35:31.895
The the case with Sparrow Wallet was very interesting because the developer, Craig Rai, he was having all kinds of problems with fake
586
00:35:32.135 --> 00:35:36.375
Sparrow... IOS Sparrow Wallet apps coming up because he was like,
587
00:35:36.775 --> 00:35:38.615
I just don't... I'm not... I don't wanna make one.
588
00:35:39.300 --> 00:35:40.020
And
589
00:35:40.340 --> 00:35:44.980
so then he actually ended up putting up a placeholder app.
590
00:35:45.380 --> 00:35:56.495
Right? Oh, that's right. It would be the first result when you search for Sparewell in iOS as opposed to these scam apps. And it was just a fake one that pulled up a screen that said there is no Sparewell app.
591
00:35:57.055 --> 00:35:58.095
And so then
592
00:35:58.255 --> 00:35:59.135
Apple
593
00:35:59.535 --> 00:36:03.855
caught wind of that and, like, disabled his his developer account
594
00:36:04.255 --> 00:36:07.295
because they thought he was putting up a fake app. And
595
00:36:08.240 --> 00:36:11.119
I think you actually need to have a developer account to get,
596
00:36:11.920 --> 00:36:22.319
like, proper signing or whatever on even on desktop apps. And so this is a big problem for Sparrow. I think he eventually got through to them, but it was just this really fucked up situation where, like,
597
00:36:23.145 --> 00:36:24.585
they were shutting down
598
00:36:24.985 --> 00:36:34.025
the real developer that was trying to help people from getting scammed and then leaving these these scam wallet apps, like approving them and putting them in the store.
599
00:36:34.345 --> 00:36:36.425
So messed up. So messed up.
600
00:36:37.070 --> 00:36:40.430
And now Google Play is, like, requiring
601
00:36:40.590 --> 00:36:42.110
developers to
602
00:36:42.590 --> 00:36:44.110
KYC themselves
603
00:36:44.110 --> 00:36:45.310
in order to
604
00:36:45.790 --> 00:36:48.510
submit applications to be available in their Play Store.
605
00:36:49.355 --> 00:36:51.275
Like, they literally have to upload
606
00:36:51.674 --> 00:36:56.075
selfies and driver's licenses or government issued IDs,
607
00:36:57.434 --> 00:37:00.795
you know? And that's part of the reason these alternative
608
00:37:01.660 --> 00:37:04.540
app store sources like F Droid
609
00:37:04.700 --> 00:37:06.780
or even Aurora Store,
610
00:37:06.940 --> 00:37:09.100
especially on Google or Android
611
00:37:09.100 --> 00:37:10.860
platforms, are so important
612
00:37:11.500 --> 00:37:13.580
because it gives people the ability to get
613
00:37:14.664 --> 00:37:15.625
powerful
614
00:37:16.585 --> 00:37:18.665
APK files, applications
615
00:37:19.385 --> 00:37:20.744
from places
616
00:37:20.744 --> 00:37:22.185
where they're being
617
00:37:22.424 --> 00:37:23.545
barred from
618
00:37:24.424 --> 00:37:26.744
being made available, like the Google Play Store.
619
00:37:28.029 --> 00:37:28.910
Unfortunately,
620
00:37:28.910 --> 00:37:30.030
with, like, Apple,
621
00:37:30.430 --> 00:37:34.750
it's it's much harder to do that. You know, there is... I'm not sure that there's
622
00:37:34.829 --> 00:37:36.590
an F Droid equivalent
623
00:37:36.750 --> 00:37:40.029
for an Apple iPhone. There might be. I'm just
624
00:37:40.674 --> 00:37:42.835
I'm not that familiar with that platform.
625
00:37:43.234 --> 00:37:46.435
It's... Yeah. The the walled gardens on the phones
626
00:37:46.595 --> 00:37:55.900
is is pretty insane. I think they stand to have a... To make a lot of money by locking that down, and so they're very motivated to to do that.
627
00:37:56.620 --> 00:38:03.100
The ones that get lining... Oh, sorry. Go ahead. I was gonna say I think it's just gonna get worse with this push for...
628
00:38:04.700 --> 00:38:10.015
They're they're doing it under the guise, under the veil of, like, protecting children
629
00:38:10.095 --> 00:38:11.775
and minors
630
00:38:12.015 --> 00:38:12.735
from,
631
00:38:13.455 --> 00:38:19.375
you know, dangerous content or situations online, and they're pushing for, like, age verification
632
00:38:19.935 --> 00:38:20.655
on...
633
00:38:21.055 --> 00:38:22.895
At the operating system level.
634
00:38:23.910 --> 00:38:25.190
I
635
00:38:25.190 --> 00:38:27.670
don't know if you guys recall, but a few months ago,
636
00:38:27.990 --> 00:38:29.270
it was pretty recently,
637
00:38:29.829 --> 00:38:32.790
there was kind of a big uproar over which
638
00:38:32.869 --> 00:38:34.150
Linux distributions
639
00:38:34.150 --> 00:38:36.230
were going to enable
640
00:38:36.549 --> 00:38:39.270
age verification at the OS level and which ones weren't.
641
00:38:39.935 --> 00:38:45.055
Right, because there was some European Union directive that OSs were going to have to do this, right?
642
00:38:45.455 --> 00:38:46.175
Yeah.
643
00:38:46.734 --> 00:38:49.455
And I think that if I recall correctly, that
644
00:38:49.695 --> 00:38:50.495
idea
645
00:38:51.135 --> 00:38:53.855
originally came from Mark Zuckerberg
646
00:38:54.210 --> 00:38:55.890
because they were
647
00:38:56.130 --> 00:38:59.010
talking to him about making Facebook...
648
00:38:59.410 --> 00:39:02.850
They wanted the applications to do age verification.
649
00:39:03.730 --> 00:39:04.370
And
650
00:39:05.330 --> 00:39:08.610
Facebook being one of the most widely used applications
651
00:39:08.770 --> 00:39:10.195
in the world,
652
00:39:12.515 --> 00:39:14.915
you know, he was part of that conversation.
653
00:39:15.954 --> 00:39:21.155
I do recall him meeting with Congress, and then shortly thereafter, it came out that
654
00:39:21.395 --> 00:39:30.320
they weren't going to require applications to do this, but but they're gonna start pushing to require at the operating system level on all of the devices.
655
00:39:31.040 --> 00:39:35.440
So then if you can control which operating systems people are putting on their devices,
656
00:39:35.760 --> 00:39:39.645
then you can corral them into these age verification
657
00:39:40.125 --> 00:39:40.765
schemes.
658
00:39:41.485 --> 00:39:42.925
This is tying
659
00:39:44.045 --> 00:39:45.645
it all back together. This
660
00:39:45.965 --> 00:39:49.645
is actually a silver lining of the eMudra certificate
661
00:39:50.445 --> 00:39:53.885
issue, right? Because now you have your age verification service
662
00:39:54.309 --> 00:39:57.030
that needs to communicate with a specific server
663
00:39:57.349 --> 00:39:58.630
over TLS
664
00:39:58.710 --> 00:40:00.150
to verify
665
00:40:00.150 --> 00:40:03.109
your age. Right? But now you just fake that server.
666
00:40:03.750 --> 00:40:05.590
Right. It's glorious.
667
00:40:05.990 --> 00:40:09.895
I think that all is just... Things are changing fast. I mean,
668
00:40:10.535 --> 00:40:12.535
to switch gears a little bit like
669
00:40:14.214 --> 00:40:14.775
with
670
00:40:15.655 --> 00:40:17.415
advanced threat vectors from
671
00:40:17.575 --> 00:40:20.055
agentic tools, there's also people like
672
00:40:21.609 --> 00:40:22.410
removing
673
00:40:22.410 --> 00:40:25.610
spyware from their home smart TVs and stuff. So the
674
00:40:26.250 --> 00:40:29.130
power is in both sides hands. It's just a matter of
675
00:40:29.770 --> 00:40:42.055
how proactive you want to be about it. That's why I asked earlier about like the average person's probably not going to do anything but you can defend yourself And the spyware stuff is super cool. I know Scott's been a long time hater of IoT stuff. So
676
00:40:42.615 --> 00:40:47.175
Yes. For this reason because, like, the thesis has always been they're fucking spying on you.
677
00:40:47.495 --> 00:40:52.859
Yes. Yes. They are spying on you. That was such an exciting for me development
678
00:40:52.859 --> 00:40:56.300
over this crazy last week was the Samsung TV,
679
00:40:57.740 --> 00:40:58.460
incident.
680
00:40:59.099 --> 00:40:59.900
There was...
681
00:41:00.540 --> 00:41:08.395
So I'm not exactly sure how they did it, but I I do know that some... Because I was talking about how the IoT devices have
these certificates baked into them,
682
00:41:09.035 --> 00:41:13.275
is a lot of people were able to root their devices because of this eMudra incident.
683
00:41:13.595 --> 00:41:20.670
So if you have a device that has to talk over SSL to a server to authenticate and, like, do
684
00:41:21.070 --> 00:41:21.870
whatever.
685
00:41:22.030 --> 00:41:26.030
Now you can fake that, and you can man in the middle, and you can actually, for the first time,
686
00:41:26.750 --> 00:41:30.830
get in via your devices, like, hard coded secure pathway.
687
00:41:31.869 --> 00:41:35.390
So there was some people working on that with smart TVs, but
688
00:41:35.945 --> 00:41:42.505
the the whole revelation this week over smart TVs... And we... We've known this for a while, but smart TVs
689
00:41:42.665 --> 00:41:45.705
are a scam. Right? They are...
690
00:41:46.585 --> 00:41:50.905
They're so cheap. Like, you can go to Costco and get, like, a 55 inch television
691
00:41:51.680 --> 00:41:54.640
for less than a thousand dollars. It's insane.
692
00:41:54.880 --> 00:41:58.400
Because you and all your personal activity are Probably $200.
693
00:41:58.480 --> 00:42:02.160
You're the product. Yes. That's literally less than an NVMe
694
00:42:02.160 --> 00:42:03.040
SSD.
695
00:42:03.360 --> 00:42:06.195
Yes. Like like a stick of gum.
696
00:42:06.595 --> 00:42:11.155
You can just get an obscene amount of TV for very little price. And
697
00:42:11.954 --> 00:42:16.035
we've known this for a while, but the reason is because they are harvesting
698
00:42:16.035 --> 00:42:17.715
your personal data,
699
00:42:17.875 --> 00:42:19.075
specifically
700
00:42:18.789 --> 00:42:21.030
what you're watching on your TV,
701
00:42:22.309 --> 00:42:25.109
and potentially what you're doing in your living room,
702
00:42:26.069 --> 00:42:28.390
and they're selling that to advertisers.
703
00:42:28.390 --> 00:42:32.549
That's how they're making the money back on these, like, essentially lost leader televisions.
704
00:42:33.805 --> 00:42:34.445
So,
705
00:42:35.485 --> 00:42:37.405
yeah, it came out that Samsung,
706
00:42:37.645 --> 00:42:39.965
which makes very high end televisions,
707
00:42:40.285 --> 00:42:40.845
is...
708
00:42:41.885 --> 00:42:44.525
There's software running on the television
709
00:42:45.085 --> 00:42:45.725
that,
710
00:42:45.965 --> 00:42:47.885
is sending back snapshots
711
00:42:48.110 --> 00:42:49.550
of your
712
00:42:49.950 --> 00:42:50.510
screen
713
00:42:51.390 --> 00:42:54.830
to Samsung servers to identify what you're watching.
714
00:42:55.230 --> 00:42:57.470
And it doesn't matter if you're, like, watching Netflix
715
00:42:57.470 --> 00:43:04.455
on your TV or you're, like, you got your PlayStation plugged into it or you're watching your home videos or whatever.
716
00:43:04.535 --> 00:43:07.895
Right? They're taking snapshots of that. They're sending that back. It's
717
00:43:08.215 --> 00:43:09.335
geotagged
718
00:43:09.335 --> 00:43:10.375
with where
719
00:43:11.095 --> 00:43:11.735
you...
720
00:43:11.974 --> 00:43:15.655
Your your IP address, and so they have a rough idea of where you are,
721
00:43:17.559 --> 00:43:24.920
And then all that juicy information about what you watch and how you use your TV is, you know, all sent back to their servers. And then there was there
722
00:43:25.799 --> 00:43:35.975
was some indication that some of these models have microphones in them. I think they use that so you can, like, talk to your remote and say, like, change the channel. I don't know what the fuck you'd use that for. But
723
00:43:36.615 --> 00:43:47.350
they have microphones in them so they can listen to what's going on in the room. They can also, because they're on your Wi Fi network. They can ping your Wi Fi network and try and discover what other devices you have on your network
724
00:43:47.910 --> 00:43:52.470
and get this whole profile of the way your home network is set up,
725
00:43:53.030 --> 00:43:54.150
your habits,
726
00:43:54.550 --> 00:43:57.030
everything, and send that back to Samsung.
727
00:43:57.885 --> 00:44:02.125
Well, and if they have access to your router, they can start using your
728
00:44:02.365 --> 00:44:04.125
WiFi signals to
729
00:44:04.365 --> 00:44:05.245
map
730
00:44:05.325 --> 00:44:06.205
objects
731
00:44:06.445 --> 00:44:07.565
in your house.
732
00:44:08.525 --> 00:44:12.845
Yes, that's right. That's right. That was a cool research project. People can use
733
00:44:14.579 --> 00:44:20.500
information from the radio that sends out the Wi Fi signals in your house to do
734
00:44:21.539 --> 00:44:22.820
essentially radar.
735
00:44:23.059 --> 00:44:26.099
Shout out to Alex Jones who called this a decade ago,
736
00:44:27.585 --> 00:44:28.865
infowars.com.
737
00:44:28.865 --> 00:44:31.585
But, dude, they can, like, map your heart rate.
738
00:44:32.305 --> 00:44:33.105
Yes.
739
00:44:33.105 --> 00:44:34.385
It's insane.
740
00:44:34.545 --> 00:44:35.985
That is insane.
741
00:44:36.465 --> 00:44:45.050
And, yeah, I mean, they might they might have access to your router depending on which one it is. Yeah. Also, your router manufacturer probably has access to that too,
742
00:44:45.530 --> 00:44:47.450
depending on which one you are. There's...
743
00:44:47.850 --> 00:44:52.890
I think this is what's burned on a lot of the whole, Chinese Wi Fi manufacturer ban
744
00:44:52.970 --> 00:44:56.650
from the US government was that there was several backdoors
745
00:44:57.385 --> 00:44:58.585
installed in
746
00:44:59.785 --> 00:45:00.825
Chinese made
747
00:45:01.145 --> 00:45:02.825
Wi Fi router hardware,
748
00:45:02.825 --> 00:45:04.425
which is all of them.
749
00:45:07.065 --> 00:45:08.345
All kinds of stuff.
750
00:45:09.180 --> 00:45:12.380
There was a cool there was a cool discovery.
751
00:45:12.380 --> 00:45:12.940
So
752
00:45:13.260 --> 00:45:16.940
there's this really janky brand of TV called Hisense.
753
00:45:19.099
--> 00:45:23.660
I have one because it's like We got three of them here at the space. It's the cheapest TV you can get in Cinza.
754
00:45:24.714 --> 00:45:25.355
But
755
00:45:25.595 --> 00:45:28.475
Hisense is doing the same thing. They they they
756
00:45:28.555 --> 00:45:33.995
send back everything that's going on in your TV. It doesn't matter if it's plugged in via external HDMI,
757
00:45:34.075 --> 00:45:34.875
everything.
758
00:45:34.875 --> 00:45:38.795
Right? So if you've connected your smart TV to the Wi Fi, they've got everything.
759
00:45:39.819 --> 00:45:40.380
And
760
00:45:40.780 --> 00:45:42.300
they had...
761
00:45:43.260 --> 00:45:46.700
So someone... And so they were sending that... All that data back to a server.
762
00:45:47.740 --> 00:45:54.140
But, apparently, that server had no login credentials whatsoever. It was totally wide open. My god.
763
00:45:54.984 --> 00:45:59.785
So some people got it, and they got all the data off of it. There was data for...
764
00:46:01.224 --> 00:46:02.585
Oh, I think it was
765
00:46:03.224 --> 00:46:04.105
10,000,000.
766
00:46:04.105 --> 00:46:05.945
I think it was 10,000,000 TVs.
767
00:46:07.460 --> 00:46:08.740
You know, that's, like,
768
00:46:09.539 --> 00:46:11.140
millions of of people.
769
00:46:11.460 --> 00:46:12.099
Right?
770
00:46:12.420 --> 00:46:15.619
All the data off their servers. Someone extracted it all
771
00:46:16.180 --> 00:46:17.060
and then
772
00:46:17.460 --> 00:46:22.660
put some malware onto the server that encrypted it all and demanded a Bitcoin ransom.
773
00:46:23.595 --> 00:46:26.475
Holy shit. Or Hisense to get their data back.
774
00:46:29.035 --> 00:46:34.075
Shit's getting wild out there. Did they get the ransom money? I don't know. I don't think so.
775
00:46:34.315 --> 00:46:38.475
So you So wait. Can't What? Go ahead. Go ahead. Was gonna say
776
00:46:40.940 --> 00:46:41.340
Nice.
777
00:46:41.980 --> 00:46:44.540
Dude, this delay on Riverside is bullshit.
778
00:46:44.619 --> 00:46:45.020
No. Go,
779
00:46:46.140 --> 00:46:46.540
Go.
780
00:46:47.020 --> 00:46:53.580
Okay. I'm going. It's like we're fucked. They're fucked. Everyone's fucked. Yeah. Yeah. Yeah. So if you can't trust home devices,
781
00:46:53.660 --> 00:46:53.900
right,
782
00:46:55.705 --> 00:46:56.585
is
783
00:46:56.585 --> 00:46:57.145
the
784
00:46:57.945 --> 00:47:03.705
proper solution the best thing to do first to have a good router and home network security setup
785
00:47:04.025 --> 00:47:07.385
to block devices from seeing each other or other
786
00:47:07.865 --> 00:47:08.665
personal devices?
787
00:47:09.680 --> 00:47:10.800
What do you do?
788
00:47:11.200 --> 00:47:12.240
Yeah. I think
789
00:47:13.120 --> 00:47:15.680
you have very good network hygiene,
790
00:47:16.320 --> 00:47:17.600
separate VLANs
791
00:47:17.600 --> 00:47:20.400
on your Wi Fi network. Be very cognizant of
792
00:47:20.800 --> 00:47:23.920
what random ass devices you're plugging into your network.
793
00:47:26.375 --> 00:47:39.495
I... I've been very outspoken about people buying, like, cheap ass BITX knockoffs with closed source firmware and plugging it into their network because, like, it's a first class citizen on your network. You don't know what it's doing.
794
00:47:39.815 --> 00:47:40.295
Mhmm.
795
00:47:41.150 --> 00:47:42.510
And you could just
796
00:47:42.830 --> 00:47:46.750
plug in some BITX knockoff that's running some China firmware,
797
00:47:46.990 --> 00:47:51.950
and it's a first class citizen on your network. It could be doing a lot of the shady shit that
798
00:47:52.350 --> 00:47:54.590
That's so funny you say that because I
799
00:47:54.830 --> 00:47:55.550
got
800
00:47:56.395 --> 00:48:02.555
a local AI to do some network sniffing at my place this weekend out of curiosity
801
00:48:02.875 --> 00:48:05.115
and it flagged the bid axe
802
00:48:05.355 --> 00:48:08.315
that I have as one of the things to double check
803
00:48:09.260 --> 00:48:22.140
And it was like anyone on the network can change the pool address blah blah blah blah blah. But then I was like and it had this whole list. This was like one of 10 things. And I just said keep digging and it checked the PIDX source repo and was like there's nothing. There's no funny business here.
804
00:48:22.955 --> 00:48:28.075
That's awesome. Yeah. Let's go. This is like, we need to normalize this kind of thing.
805
00:48:28.955 --> 00:48:32.315
But that is one of the, that's a really awesome.
806
00:48:32.395 --> 00:48:33.995
I didn't tell it to go look up the repo.
807
00:48:34.730 --> 00:48:37.690
But it just found it. It was like, cool, I checked it out. Yep.
808
00:48:37.849 --> 00:48:41.530
That's cool. Hence the importance of running open source.
809
00:48:41.930 --> 00:48:42.410
Yeah.
810
00:48:43.049 --> 00:48:44.329
It's like we
811
00:48:44.329 --> 00:48:46.090
are in this amazing age where
812
00:48:46.730 --> 00:48:48.570
you don't need to know
813
00:48:49.049 --> 00:48:50.010
how to verify
814
00:48:50.385 --> 00:48:54.465
the firmware yourself. If it's open source, you can be sure
815
00:48:54.625 --> 00:48:56.065
that that's what you're running.
816
00:48:56.465 --> 00:48:58.305
You can just ask an agent,
817
00:48:58.545 --> 00:49:00.945
is this legit? What's happening here?
818
00:49:01.425 --> 00:49:05.185
Yeah. Whereas not that long ago, you'd either have to be
819
00:49:05.680 --> 00:49:10.640
a programmer yourself to understand exactly what you're looking at or
820
00:49:11.040 --> 00:49:13.920
just trust. I think this is where most people fell.
821
00:49:14.320 --> 00:49:24.225
Just trust like a, you know, circle of friends around you or, like, even Internet friends around you, where it's like, well, you know, this this person I follow on Twitter has
822
00:49:24.545 --> 00:49:29.025
has been very reliable. I trust their opinion. They're, you know, deemed a good actor,
823
00:49:29.425 --> 00:49:33.345
and they say this is
legit. They haven't had any issues with this,
824
00:49:34.020 --> 00:49:37.300
and they know what they're looking at. So I'm just gonna kinda trust them.
825
00:49:37.860 --> 00:49:40.740
And, you know, I know I I found myself in that situation
826
00:49:41.300 --> 00:49:42.740
being a person who
827
00:49:43.060 --> 00:49:55.055
can't just pull up a repository and understand exactly what the code is doing. I have this circle of people that I look to and kind of just trust their opinion on a lot of these things.
828
00:49:55.615 --> 00:49:59.055
So I just think a lot of people fall into that. But with AI
829
00:49:59.375 --> 00:50:04.890
and having agents do it, now you have your own... You... It's possible... It's very easy
830
00:50:05.210 --> 00:50:08.170
and possible to have your own trusted
831
00:50:08.810 --> 00:50:13.210
AI agent look at this stuff and give you a full rundown
832
00:50:13.210 --> 00:50:15.530
and make it transparent and make it understandable.
833
00:50:16.085 --> 00:50:20.484
This is this is how we counter this stuff. Right? As if if,
834
00:50:21.765 --> 00:50:26.085
you know, the attackers are using AI to speed up their attacks. Right? AI
835
00:50:26.085 --> 00:50:33.770
is is our defense here. So if you have anything that you care about in your personal network, right, that's a very prudent thing to do.
836
00:50:35.130 --> 00:50:36.250
What do you think's
837
00:50:37.130 --> 00:50:39.370
gonna keep happening? Just more honeypots,
838
00:50:39.690 --> 00:50:40.890
kill your customer,
839
00:50:41.290 --> 00:50:41.850
attraction?
840
00:50:42.365 --> 00:50:48.365
You know, one thing I was thinking about today is like, I foresee a lot of autonomy
841
00:50:49.005 --> 00:50:51.085
going away, where it's like
842
00:50:52.045 --> 00:50:53.805
you sign into a website
843
00:50:53.805 --> 00:50:54.684
and
844
00:50:55.200 --> 00:50:56.720
you wanna do something,
845
00:50:57.520 --> 00:50:59.440
you're gonna find that, like,
846
00:51:00.080 --> 00:51:08.480
you're going to be relegated to asking an agent that's built into the website to do the thing for you. Like, for example,
847
00:51:10.915 --> 00:51:15.555
I will one day log in to my bank website,
848
00:51:15.635 --> 00:51:18.195
and I wanna check the balance in my bank account.
849
00:51:18.515 --> 00:51:24.115
Whereas today, I log in, and I click on the account, and I can see all the transactions,
850
00:51:24.609 --> 00:51:27.170
and I can peruse it manually.
851
00:51:27.570 --> 00:51:30.050
I I... And that is
852
00:51:30.930 --> 00:51:35.090
autonomy. Right? So I think that is going to be going away where
853
00:51:35.250 --> 00:51:38.290
in its place, I will log in to the bank's website,
854
00:51:39.204 --> 00:51:40.405
and it'll...
855
00:51:40.405 --> 00:51:45.125
I'll just be presented with an agent, and it'll say, what would you like your agent to do?
856
00:51:45.765 --> 00:51:47.765
And I'll have to ask the agent,
857
00:51:47.925 --> 00:51:49.845
show me my recent transactions.
858
00:51:49.925 --> 00:51:53.685
Mhmm. And the agent will go and fetch it and show me the transactions.
859
00:51:54.360 --> 00:51:54.920
But
860
00:51:55.160 --> 00:52:04.280
that pisses me off because I don't want to ask a fucking agent to do it for me. Like, I want to just click on it and see my transactions. Right? So I think,
861
00:52:04.840 --> 00:52:09.800
you know, now apply that to, like, every service that you log on to the Internet for
862
00:52:10.145 --> 00:52:13.905
and, you know, think about all the things you're doing manually,
863
00:52:14.145 --> 00:52:15.825
I really foresee us
864
00:52:16.385 --> 00:52:19.665
having all those manual tasks get replaced with
865
00:52:19.984 --> 00:52:22.545
agents and not even having the option
866
00:52:23.670 --> 00:52:31.750
to manually browse through stuff anymore. You're literally just gonna have to ask an agent to do it for you. Dude, I did that this morning. I had a dentist appointment
867
00:52:32.309 --> 00:52:33.190
and I
868
00:52:33.510 --> 00:52:46.855
told the dentist at the end, I was like, you wanna know something funny? He's like, what? It's a new dentist. I was like, I didn't schedule this appointment. Those four or five emails back and forth where you needed my old x rays, like my bot did it. I didn't
869
00:52:47.335 --> 00:52:49.494
research you guys. I said to find one.
870
00:52:50.349 --> 00:52:53.310
I said cash pay, blah blah blah. I had some criteria.
871
00:52:54.030 --> 00:52:57.150
And my agent just like interacted with the front desk person.
872
00:52:57.710 --> 00:53:03.630
And the guy was like blown away. He was like, yeah, was looking at your x rays, blah blah blah. I was like, yeah, didn't send shit.
873
00:53:05.595 --> 00:53:12.075
And they were none the wiser. No. It's not going be long until he was like, Yeah, didn't look at your shit either. Yeah, exactly.
874
00:53:13.435 --> 00:53:22.980
But you're right, Igo. I didn't go make an account on the portal or anything like that. I think hopefully that means maybe we'll be less reliant. Like,
875
00:53:24.020 --> 00:53:29.940
internet theory. Less people will just be bogged down doing the bullshit of the internet. The bullshit work. Well, the builders will still build.
876
00:53:30.420 --> 00:53:37.494
Yeah. But it's like, I mean, think about like What honey pots are created from this. Yeah. I see this happening with transportation
877
00:53:37.494 --> 00:53:39.015
too, like vehicles.
878
00:53:39.015 --> 00:53:39.494
Like,
879
00:53:39.895 --> 00:53:49.680
I wanna be able to get into my car and start it and control where it's going and move the steering wheel and control the brakes and control the acceleration,
880
00:53:50.400 --> 00:53:52.000
you know, I think we're
881
00:53:52.320 --> 00:53:54.560
heading straight into a world where
882
00:53:55.360 --> 00:53:56.640
empty
883
00:53:56.640 --> 00:53:58.720
car pulls up to where I'm standing.
884
00:53:58.880 --> 00:54:00.080
I get into it
885
00:54:00.924 --> 00:54:04.925
already, like, preprogrammed where I'm going, preplanned.
886
00:54:05.085 --> 00:54:06.125
It already knows,
887
00:54:06.765 --> 00:54:11.244
and it it takes me there, and it does... It surveys
888
00:54:11.565 --> 00:54:15.484
the streets to make sure they're safe and it's not gonna hit anything.
889
00:54:16.010 --> 00:54:18.010
It does the accelerating.
890
00:54:18.010 --> 00:54:21.450
It does the braking. It does the steering. I I mean, we have that right now,
891
00:54:21.770 --> 00:54:24.810
but I foresee us heading into a world where
892
00:54:25.050 --> 00:54:32.555
the optionality to drive your own vehicle and own your own vehicle and have your own property and have the autonomy to control
893
00:54:33.035 --> 00:54:35.194
a vehicle is getting
894
00:54:35.194 --> 00:54:37.115
engineered out of our lives.
895
00:54:37.355 --> 00:54:38.155
Yep.
896
00:54:38.555 --> 00:54:40.875
We gotta build the open alternatives
897
00:54:40.875 --> 00:54:42.075
to keep
898
00:54:42.075 --> 00:54:43.035
that autonomy.
899
00:54:43.835 --> 00:54:44.795
You just made me think.
900
00:54:45.789 --> 00:54:47.230
I saw that the new
901
00:54:47.869 --> 00:54:49.470
Luxe OS installer
902
00:54:49.470 --> 00:54:52.589
asked you to create an account. Oh, I saw that.
903
00:54:54.109 --> 00:54:58.510
Don't know why that made me think of it, to your point is, yeah, more accounts, more permissions,
904
00:54:58.510 --> 00:54:59.869
more walls, more steps.
905
00:55:00.555 --> 00:55:01.835
More honeypots.
906
00:55:01.835 --> 00:55:03.195
More honeypots and
907
00:55:03.835 --> 00:55:05.115
super intelligence.
908
00:55:05.675 --> 00:55:06.955
And more like
909
00:55:07.435 --> 00:55:11.835
more of these situations where you're like, if something goes wrong,
910
00:55:12.234 --> 00:55:13.675
you will find yourself
911
00:55:13.994 --> 00:55:14.795
completely
912
00:55:14.795 --> 00:55:15.275
stranded,
913
00:55:15.700 --> 00:55:16.420
like,
914
00:55:16.820 --> 00:55:17.460
unable
915
00:55:17.860 --> 00:55:18.500
to
916
00:55:18.740 --> 00:55:23.540
do any... Like, what happens when you no longer have access to your own vehicle
917
00:55:23.780 --> 00:55:26.020
and you need to, like, go somewhere?
918
00:55:26.340 --> 00:55:29.620
And it's, like, it's not on the predefined
919
00:55:30.335 --> 00:55:37.135
list of acceptable locations for you to be going or there's no pre planned route or
920
00:55:37.615 --> 00:55:40.575
when you need to look up information that's not
921
00:55:42.335 --> 00:55:46.870
approved for you to be browsing based on your citizen score?
922
00:55:48.150 --> 00:55:57.510
And I think this is a lot of what we fight for in open source Bitcoin mining, right, is we need to have the agency to control how this stuff that we own works.
923
00:55:58.070 --> 00:55:59.430
Mhmm. Exactly.
924
00:55:59.990 --> 00:56:00.630
And
925
00:56:01.075 --> 00:56:05.555
we need to be able to
audit what it's doing to be sure that it's doing
926
00:56:06.115 --> 00:56:08.275
what it says it is or what we think it is,
927
00:56:08.755 --> 00:56:11.155
and to be able to control it how we want.
928
00:56:11.635 --> 00:56:12.355
I really like...
929
00:56:13.310 --> 00:56:16.430
I'm conflicted about this, but I I imagine this scenario
930
00:56:16.670 --> 00:56:17.310
where
931
00:56:17.550 --> 00:56:18.590
what if
932
00:56:19.390 --> 00:56:20.350
companies
933
00:56:20.350 --> 00:56:28.670
were held liable for data breaches? So, like, if my personal information gets stolen off of a server, whoever runs that server is liable for some sort of damages.
934
00:56:29.244 --> 00:56:35.725
I don't like to see this lawfare or, like, additional restrictions imposed on people doing things, but
935
00:56:36.125 --> 00:56:37.085
that would
936
00:56:37.805 --> 00:56:41.724
have the effect of people would think twice about collecting personal information
937
00:56:42.220 --> 00:56:47.740
as if they are actually liable for keeping it secure. Maybe that will come naturally
938
00:56:47.820 --> 00:56:50.620
if the data breaches just keep happening and eventually
939
00:56:51.100 --> 00:56:51.820
the
940
00:56:51.900 --> 00:56:57.785
competitors that went out say, We're either really secure or we don't want to deal with that at all to begin with.
941
00:56:58.425 --> 00:56:59.385
But right now,
942
00:57:00.905 --> 00:57:04.905
all that software, all of the infrastructure was built before the agent ticket world.
943
00:57:05.385 --> 00:57:05.945
Yeah.
944
00:57:06.185 --> 00:57:08.425
Yeah. Right. I mean, this is like
945
00:57:08.665 --> 00:57:12.825
the biggest risk with the age verification stuff, right? Is there's just going to be these
946
00:57:13.520 --> 00:57:18.320
poorly secured databases everywhere with, like, personal information of,
947
00:57:18.560 --> 00:57:19.280
like,
948
00:57:19.760 --> 00:57:23.760
everyone. Dude, it makes me, like the, the Dune
949
00:57:23.920 --> 00:57:28.320
novel lore where the... They, like, banned all the thinking machines, all the AIs
950
00:57:28.715 --> 00:57:33.115
because they were just like, fuck this. They're getting into everything. Just take the technology out of everything.
951
00:57:34.555 --> 00:57:37.115
Cat might be out of the bag for that one. Yeah.
952
00:57:37.755 --> 00:57:40.955
I don't know all the answers, but I know for sure,
953
00:57:41.740 --> 00:57:43.740
like doubling down on
954
00:57:44.220 --> 00:57:45.180
KYC
955
00:57:45.820 --> 00:57:46.540
and
956
00:57:46.620 --> 00:57:48.940
making honey pots and like
957
00:57:49.260 --> 00:57:50.060
collecting
958
00:57:50.460 --> 00:57:53.260
personal data about people is not the answer.
959
00:57:53.580 --> 00:57:54.940
It is not. It's not
960
00:57:55.260 --> 00:57:56.220
gonna solve anything.
961
00:57:56.955 --> 00:57:57.915
Well said.
962
00:57:58.235 --> 00:57:58.795
Well,
963
00:57:59.035 --> 00:58:01.515
on that note, you guys, I gotta jump.
964
00:58:01.835 --> 00:58:02.635
Oh, right.
965
00:58:03.595 --> 00:58:06.235
About that time. All right. That was a fantastic We
966
00:58:06.875 --> 00:58:09.355
just went like, that was like a 100% tangent the whole time.
967
00:58:10.070 --> 00:58:13.350
Love it. That's what we're good at on this show.
968
00:58:13.750 --> 00:58:17.190
Yeah. I hate to cut it short, but I've got an So area I need to
969
00:58:18.470 --> 00:58:23.270
until next time, fellas. Alright. Thanks for joining us, everyone. Cheers, everybody. Week.