S4E27 – AI Academies, Cybersecurity Moats, Data Classification, and Patch Cooldowns

WEBVTT
1
00:00:00.000 --> 00:00:09.520
I think that if people get the impression that people are going to have mental health breakdowns and be led to do bad things through AI, I think that's a total outlier red herring.
2
00:00:09.520 --> 00:00:14.900
But the other argument that I think people in our circles do worry about is, are you going to not learn how to code?
3
00:00:14.960 --> 00:00:18.020
You're not going to learn the basics because we have this abstraction layer.
4
00:00:18.140 --> 00:00:22.700
And now you're going to be saying you're writing code, but you don't really understand for loops.
5
00:00:30.000 --> 00:00:30.480
Adversarial.
6
00:00:34.240 --> 00:00:37.060
It's time to get adversarial.
7
00:00:38.860 --> 00:00:40.840
Sounil, Mario, good to see you guys.
8
00:00:41.460 --> 00:00:43.700
Welcome back to the Adversarial Podcast.
9
00:00:44.420 --> 00:00:46.040
Hope you guys are ready to be adversarial.
10
00:00:46.880 --> 00:00:49.540
As usual, got a good litany of topics.
11
00:00:50.240 --> 00:00:52.980
Yeah, we'll jump right in.
12
00:00:53.100 --> 00:00:54.640
What's new with you, Sounil, real quick?
13
00:00:55.220 --> 00:00:56.180
I was just in Atlanta.
14
00:00:56.180 --> 00:00:58.960
Can I bug you about the event that you were here for?
15
00:00:58.960 --> 00:01:00.260
Was it IANS related?
16
00:01:00.720 --> 00:01:00.920
Is that right?
17
00:01:01.040 --> 00:01:01.400
Yeah, yeah.
18
00:01:01.600 --> 00:01:06.100
So for those who don't know, I'm on what's called IANS faculty.
19
00:01:06.240 --> 00:01:10.800
IANS is sort of like, I'm not sure what's a good name for it, but consulting as a service, maybe?
20
00:01:11.080 --> 00:01:11.480
I'm not sure.
21
00:01:12.500 --> 00:01:18.200
So because I serve as faculty, they bring me into various events and we speak on various topics.
22
00:01:18.440 --> 00:01:27.620
So what I shared was just strategies on how organizations can become a high-velocity engineering organization and how to do security for those.
23
00:01:27.620 --> 00:01:29.100
Awesome.
24
00:01:29.500 --> 00:01:31.320
Yeah, that's very timely for sure.
25
00:01:31.960 --> 00:01:32.500
How about you, Mario?
26
00:01:32.620 --> 00:01:33.540
You been flying around at all?
27
00:01:34.580 --> 00:01:41.520
No, just living the valley loca, Silicon Valley loca life, you know.
28
00:01:42.080 --> 00:01:43.720
Wait, you're not priced out of your house already?
29
00:01:43.720 --> 00:01:46.180
No, not yet.
30
00:01:46.420 --> 00:01:50.720
But I would if I sold my house afterwards, right afterwards.
31
00:01:50.920 --> 00:01:51.400
Where are you going to go?
32
00:01:51.500 --> 00:01:51.860
Exactly.
33
00:01:52.380 --> 00:01:52.620
Yeah.
34
00:01:52.980 --> 00:02:04.140
You know, but no, I'm just, you know, as I chat with all these different AI companies out there, everybody seems to be having a similar theme that I speak with.
35
00:02:04.140 --> 00:02:09.540
And that is, how do you stay ahead of whatever the foundation models are going to do?
36
00:02:09.720 --> 00:02:14.860
Because they're ultimately going to infringe on whatever you're selling as an AI company.
37
00:02:15.880 --> 00:02:18.540
So I don't know how you can invest in anything like that.
38
00:02:18.960 --> 00:02:19.540
So we'll see.
39
00:02:19.700 --> 00:02:20.440
Interesting times.
40
00:02:20.440 --> 00:02:25.200
Yeah, I mean, it's the notion that software doesn't really have much of a note.
41
00:02:25.860 --> 00:02:27.340
But I do think hardware still does.
42
00:02:27.900 --> 00:02:33.860
So if I were to redo a startup, I would certainly try to do something that involves hardware.
43
00:02:34.020 --> 00:02:35.360
Although hardware definitely is harder.
44
00:02:36.060 --> 00:02:36.700
Oh, it's real work.
45
00:02:36.760 --> 00:02:36.940
Yeah.
46
00:02:37.200 --> 00:02:37.420
Yeah.
47
00:02:37.480 --> 00:02:38.760
But you're talking about robots, right?
48
00:02:38.780 --> 00:02:40.560
Because that's what hardware means right now is AI.
49
00:02:41.660 --> 00:02:42.540
Not necessarily.
50
00:02:42.700 --> 00:02:44.220
I mean, robots are a certain part of it.
51
00:02:44.220 --> 00:02:46.860
But yeah, I mean, not that I could do.
52
00:02:47.040 --> 00:02:49.120
I used to do chip design a long time ago.
53
00:02:49.720 --> 00:02:53.060
But no, no, I'm thinking like even just manufacturing.
54
00:02:53.260 --> 00:03:05.600
So going back to my earlier comment about high speed, high velocity engineering, I think that's partly software, but also building like real physical things and engineering things as well.
55
00:03:06.160 --> 00:03:13.320
And we have a desperate need to rapidly increase our manufacturing capacity and abilities here in the U.S.
56
00:03:14.220 --> 00:03:17.040
And I don't mean making toys.
57
00:03:17.280 --> 00:03:18.760
I mean making munitions.
58
00:03:19.700 --> 00:03:20.300
Yeah.
59
00:03:20.300 --> 00:03:21.380
Like weapons.
60
00:03:21.940 --> 00:03:22.600
Like weapons?
61
00:03:22.740 --> 00:03:23.460
Is that what you're talking about?
62
00:03:23.700 --> 00:03:24.620
That's interesting.
63
00:03:24.820 --> 00:03:26.160
I just had a conversation.
64
00:03:26.320 --> 00:03:33.340
I was having a cocktail conversation with somebody I know that heavily invests.
65
00:03:34.120 --> 00:03:41.040
And she is from a different part of my, you know, universes, right?
66
00:03:41.040 --> 00:03:43.920
She comes from the wine industry of all things.
67
00:03:43.920 --> 00:03:44.840
And she's big.
68
00:03:44.920 --> 00:03:46.160
She's also a big investor.
69
00:03:46.500 --> 00:03:55.220
And she was telling me that a lot of the things she is looking into and she's hearing about is exactly what Sounil just said.
70
00:03:55.880 --> 00:03:56.400
Weapons.
71
00:03:56.400 --> 00:03:59.280
It's more automation, faster building.
72
00:03:59.480 --> 00:03:59.620
Yeah.
73
00:03:59.740 --> 00:04:01.140
So maybe it's no surprise.
74
00:04:01.740 --> 00:04:01.860
Yeah.
75
00:04:02.160 --> 00:04:03.320
Ukraine, Iran.
76
00:04:03.840 --> 00:04:04.760
Maybe it's no surprise.
77
00:04:05.580 --> 00:04:05.760
Yeah.
78
00:04:05.820 --> 00:04:08.200
And it's not necessarily just munitions.
79
00:04:08.360 --> 00:04:15.820
I mean, our capacity to build, engineer, and produce just materials of any sort is what we need to do.
80
00:04:15.820 --> 00:04:24.220
It could be just build more cars and ships and our ability to pivot towards those other weapons of war.
81
00:04:24.840 --> 00:04:27.440
It would be a part of that.
82
00:04:27.600 --> 00:04:36.480
But just even being able to bring our manufacturing capacity back up to what it used to be and beyond what it used to be as well.
83
00:04:36.600 --> 00:04:40.800
Maybe, Sounil, you need to go to a tech elite college to go learn this.
84
00:04:40.800 --> 00:04:46.820
You know, Mario, that's a great segue.
85
00:04:47.640 --> 00:04:48.000
Yeah.
86
00:04:48.160 --> 00:04:48.840
Kaboom, boom.
87
00:04:49.480 --> 00:04:50.020
No, no.
88
00:04:50.640 --> 00:04:51.560
It is a good segue.
89
00:04:51.700 --> 00:04:53.420
But I mean, like, joking aside, I hadn't thought about it.
90
00:04:53.440 --> 00:04:56.620
So one of the things we're going to talk about was the Horowitz Andreessen Academy.
91
00:04:57.300 --> 00:04:59.360
That's a recent headline.
92
00:04:59.980 --> 00:05:01.120
I had read about it with some interest.
93
00:05:01.540 --> 00:05:04.660
They ordered based on their first name, not their last name?
94
00:05:05.500 --> 00:05:06.160
I don't know.
95
00:05:06.580 --> 00:05:07.840
There's something intentional behind it.
96
00:05:07.860 --> 00:05:08.320
That's for sure.
97
00:05:08.320 --> 00:05:11.440
Maybe Ben is more invested in this emotionally.
98
00:05:11.440 --> 00:05:16.100
I mean, for a university, I would rather have the acronym be AHA, right?
99
00:05:16.400 --> 00:05:18.420
Not HAHA or something like that.
100
00:05:19.680 --> 00:05:20.280
AHA.
101
00:05:20.320 --> 00:05:21.140
AHA, yeah.
102
00:05:21.160 --> 00:05:21.400
AHA.
103
00:05:21.800 --> 00:05:22.240
Yeah.
104
00:05:23.020 --> 00:05:24.960
Maybe it wasn't their primary driver.
105
00:05:25.460 --> 00:05:36.640
But so, you know, for anyone listening out here, like the quick headline was that this was something that Andreessen Horowitz has put together as a post-high school alternative to college.
106
00:05:36.640 --> 00:05:43.680
Um, I forget if it was like, if they were targeting a two year or whatever non-degree program though.
107
00:05:44.360 --> 00:05:51.000
To me, the, the word on the street or in my circles on it, the reaction on the street was, um, all over the place.
108
00:05:51.000 --> 00:05:59.100
But one of the things that most people agreed on was that the cohort that goes through here, especially the initial one will get a lot of looks like they're going to get a lot of opportunity.
109
00:05:59.640 --> 00:06:01.620
I think they're starting with 50 people, 50 kids.
110
00:06:01.880 --> 00:06:02.640
I remember right.
111
00:06:02.640 --> 00:06:09.760
I, I don't see how anyone could argue that it won't be, I'm not as good for someone's career, but I also think they'll learn a lot of stuff.
112
00:06:10.900 --> 00:06:13.040
Imagine some of the names that are going to come in and teach here.
113
00:06:13.600 --> 00:06:14.000
Yeah.
114
00:06:14.060 --> 00:06:21.280
So I think, uh, in the context, so I, I happen to, um, have the privilege of going to a, uh, elite university.
115
00:06:21.540 --> 00:06:25.820
One of the best schools for basketball, uh, Duke university.
116
00:06:25.820 --> 00:06:26.500
Yes.
117
00:06:26.620 --> 00:06:27.840
Go blue devils.
118
00:06:27.980 --> 00:06:28.140
Anyway.
119
00:06:28.580 --> 00:06:32.680
Um, but I think the, the perspective I would take and having gone through that experience,
120
00:06:32.680 --> 00:06:39.800
um, is, and looking now at like what you can learn outside of the, the college environment.
121
00:06:39.940 --> 00:06:47.000
A lot of what, uh, I remember, um, through college is just who you, uh, rub shoulders with, right?
122
00:06:47.000 --> 00:06:52.900
The people that were also, um, who, who got accepted into top tier colleges.
123
00:06:52.900 --> 00:07:09.720
Uh, so this particular program from, uh, entries and Horowitz, uh, it's a, uh, you know, I'm sure this, the, uh, rejection rate, um, is significantly higher than any, uh, four year college or any of the top, uh, you know, top colleges out there.
124
00:07:10.280 --> 00:07:17.280
Um, and because, you know, you're selecting, you're having this really select group of people come together to Jerry's point.
125
00:07:17.280 --> 00:07:21.780
They're going to get a lot of looks, uh, outside just by except being accepted into the program.
126
00:07:21.780 --> 00:07:27.480
It's sort of like, well, it's equivalent to getting a degree in Harvard from Harvard or MIT or Cal, you know, Caltech or whatever.
127
00:07:28.120 --> 00:07:28.560
Network wise.
128
00:07:28.620 --> 00:07:34.280
Well, well, well, outside the network, people will look at you favorably, favorably for just getting in.
129
00:07:34.280 --> 00:07:34.580
Mm-hmm.
130
00:07:35.100 --> 00:07:41.860
But to your point, it's, uh, the network of people inside the organization, inside the school itself.
131
00:07:41.860 --> 00:07:46.260
And of course the people who are backing the school that, uh, they get the benefit of.
132
00:07:46.260 --> 00:08:00.360
So when I was at Duke, you know, I, I did get to rub shoulders with some really interesting people who, um, you know, years after having, um, graduated from there, I'm like, whoa, there's some really interesting people that I was classmates with.
133
00:08:00.560 --> 00:08:00.680
Right.
134
00:08:00.680 --> 00:08:02.760
Do you still talk to them?
135
00:08:02.980 --> 00:08:03.960
Do you reach out to them?
136
00:08:05.060 --> 00:08:11.440
Uh, the only one that is probably the one that's most famous, um, that I, I used to be friends.
137
00:08:11.540 --> 00:08:12.280
Well, I, I, I am.
138
00:08:12.400 --> 00:08:12.860
Oh, I am.
139
00:08:12.860 --> 00:08:13.640
Let me guess first.
140
00:08:13.760 --> 00:08:14.800
Christian Leitner.
141
00:08:14.820 --> 00:08:15.320
Uh, no.
142
00:08:16.180 --> 00:08:17.820
There were, there were roommates.
143
00:08:18.400 --> 00:08:20.640
That had to be your shoot the three-pointer.
144
00:08:20.920 --> 00:08:22.280
That had to be your era.
145
00:08:22.460 --> 00:08:22.940
Right, right, right.
146
00:08:23.020 --> 00:08:25.160
That's the only Duke I know from back in those days.
147
00:08:25.740 --> 00:08:26.260
Well, no, no.
148
00:08:26.260 --> 00:08:31.240
There's another dookie that is definitely really well known and it's, it's better liked than Christian Leitner.
149
00:08:31.440 --> 00:08:32.920
So he's a comedian actually.
150
00:08:33.020 --> 00:08:33.940
And he went to med school.
151
00:08:34.280 --> 00:08:41.020
Um, and, uh, you could probably figure out who that person is, but, uh, he's a, he's a Korean American guy too.
152
00:08:41.480 --> 00:08:41.800
Oh.
153
00:08:42.040 --> 00:08:42.520
Hint, hint.
154
00:08:42.520 --> 00:08:51.120
And, uh, anyway, uh, he's a short, uh, comedian who, uh, is, it shows up on all these TV shows and movies now.
155
00:08:51.300 --> 00:08:58.000
So, um, but, uh, yeah, Dr. Ken is, uh, is one of the folks that I rub shoulders with.
156
00:08:58.360 --> 00:08:58.740
Okay.
157
00:08:58.800 --> 00:09:00.280
But again, I, I just, I'm sorry.
158
00:09:00.380 --> 00:09:02.800
Now you opened this Pandora spot, both of you.
159
00:09:03.180 --> 00:09:09.180
Sounil, again, do you still hang, know anybody that, well, like talk to them?
160
00:09:09.180 --> 00:09:13.960
And, and more importantly, uh, I, I'm not trying to put on higher education.
161
00:09:14.300 --> 00:09:15.520
I have also a degree.
162
00:09:15.720 --> 00:09:19.620
I didn't go to an elite school, but top, top 100, you know?
163
00:09:21.840 --> 00:09:23.820
Um, but there's only like three or 400.
164
00:09:24.360 --> 00:09:25.540
Top 100, bro.
165
00:09:25.620 --> 00:09:26.980
There's like 2000 of them.
166
00:09:27.020 --> 00:09:27.320
Okay.
167
00:09:27.640 --> 00:09:28.160
Come on.
168
00:09:28.240 --> 00:09:28.980
Give me a little look.
169
00:09:29.400 --> 00:09:30.640
Top 100 in California?
170
00:09:31.160 --> 00:09:32.860
No, no, no, no, no, no, no, no, no, no, no.
171
00:09:32.920 --> 00:09:34.360
Hey, hey, go dance.
172
00:09:34.480 --> 00:09:35.400
I love my school.
173
00:09:36.020 --> 00:09:36.280
Okay.
174
00:09:36.280 --> 00:09:36.640
Okay.
175
00:09:36.640 --> 00:09:42.340
Anyway, so, but, but really, did you, did it open up doors?
176
00:09:42.680 --> 00:09:43.020
Did somebody else say.
177
00:09:43.020 --> 00:09:45.560
Well, I mean, let's not take your question at face value and miss the point of it.
178
00:09:45.600 --> 00:09:48.660
Are you, are you saying that, are you asking about questioning whether or not the network
179
00:09:48.660 --> 00:09:49.700
is really worth a lot?
180
00:09:50.080 --> 00:09:50.600
That's what I'm asking.
181
00:09:50.600 --> 00:09:54.340
Well, no, I think, well, I think in this particular case, it is worth quite a bit, right?
182
00:09:54.360 --> 00:09:55.440
For elite, tech elite.
183
00:09:55.620 --> 00:09:56.340
For tech elite.
184
00:09:56.620 --> 00:09:57.480
For tech elites.
185
00:09:57.700 --> 00:09:57.860
Yeah.
186
00:09:57.920 --> 00:09:58.380
Yeah, absolutely.
187
00:09:58.380 --> 00:10:05.080
I think, um, and they'll, some of the people are going to, um, this, this academy, uh, they're
188
00:10:05.080 --> 00:10:06.760
going to find their co-founder there, right?
189
00:10:06.780 --> 00:10:09.780
They're going to find other people who they, they believe they can work together with.
190
00:10:09.860 --> 00:10:12.460
It's very similar to what we see in the Israeli ecosystem.
191
00:10:12.460 --> 00:10:18.620
You have, uh, folks who go into the military, they fight together, uh, not necessarily always
192
00:10:18.620 --> 00:10:23.300
using, um, uh, weapons, uh, but sometimes computers, right?
193
00:10:23.300 --> 00:10:26.180
And they get a better sense of what each person can actually accomplish.
194
00:10:26.180 --> 00:10:33.000
And so from that experience, they are able to then, um, build a team really quickly and
195
00:10:33.000 --> 00:10:36.280
have people that they know they can, um, trust and have their back.
196
00:10:36.360 --> 00:10:41.060
And so anyway, the point is that, uh, this, this sort of, uh, model, I think is great.
197
00:10:41.060 --> 00:10:46.940
Uh, I hope that they expand it to not just the 50 people or how many people they have, but
198
00:10:46.940 --> 00:10:53.460
I think this was a great alternative to the four year, two year, uh, college, uh, process
199
00:10:53.460 --> 00:10:54.980
that, that we've all grown up with.
200
00:10:55.360 --> 00:10:59.560
And you know, I'm, I, I know a kid around here I met in over the last year who's just
201
00:10:59.560 --> 00:11:04.440
graduating out of college and he has all the marks to go to, um, an elite university.
202
00:11:04.860 --> 00:11:08.540
Um, he's, he's, he's definitely a top prospect in general.
203
00:11:09.100 --> 00:11:14.920
And he got selected for the Palantir program, which is, or I think it's like a six month
204
00:11:14.920 --> 00:11:18.240
and then there's like a option to continue on, or I don't know if you have to earn your
205
00:11:18.240 --> 00:11:20.380
way into the next cohort or whatever it's going to be.
206
00:11:20.380 --> 00:11:22.320
Do you want to be associated with that?
207
00:11:22.460 --> 00:11:22.620
Really?
208
00:11:23.220 --> 00:11:29.500
But it's, um, I mean, I, you know, he, he's going to have, it's the same, I think it's
209
00:11:29.500 --> 00:11:30.420
the same upside as this.
210
00:11:31.000 --> 00:11:33.860
I mean, that's going to be his resume is I got selected.
211
00:11:34.020 --> 00:11:34.560
I won.
212
00:11:34.660 --> 00:11:36.160
I made it into that program at a minimum.
213
00:11:36.660 --> 00:11:36.960
Yeah.
214
00:11:37.020 --> 00:11:43.600
And one of the things, uh, that I did when I was, uh, at Booz Allen is we did recruit,
215
00:11:43.600 --> 00:11:48.740
um, as early as people graduating up in high school, you know, they would go to college
216
00:11:48.740 --> 00:11:53.820
sometimes, not out, not necessarily always, but the point here was simply to actually
217
00:11:53.820 --> 00:11:55.580
get them in towards the clearance process.
218
00:11:55.820 --> 00:12:02.380
And I can almost assure you that Palantir, uh, um, students, I guess, if you want to call
219
00:12:02.380 --> 00:12:04.600
them that would be put in for a clearance.
220
00:12:04.960 --> 00:12:08.160
And once you have a clearance, you pretty much have job security for a long time.
221
00:12:08.800 --> 00:12:09.160
Yeah.
222
00:12:09.180 --> 00:12:10.040
That's, that's interesting.
223
00:12:10.280 --> 00:12:14.100
So on this thing, right, this thing is meant to be this academy is meant to be AI forward.
224
00:12:14.620 --> 00:12:17.820
And, um, this is something I wrestle with a lot, you know, I have young kids and I think
225
00:12:17.820 --> 00:12:19.880
a lot about where the role is of AI for them.
226
00:12:20.500 --> 00:12:23.920
The school had blocked things like Claude, our public school.
227
00:12:24.480 --> 00:12:29.300
And this semester we noticed my, our kids noticed that Claude was open and they started
228
00:12:29.300 --> 00:12:29.980
playing around with it.
229
00:12:31.000 --> 00:12:34.880
Um, I, I think that, I think sometimes the schools are in general, when they think of
230
00:12:34.880 --> 00:12:37.620
AI, they think of cheating and they immediately want to go against it.
231
00:12:37.700 --> 00:12:42.060
Like we don't like AI and they mean cheating, but we get swept up and it is like, we don't
232
00:12:42.060 --> 00:12:44.080
want them to be using AI.
233
00:12:44.780 --> 00:12:49.660
And, and then you get these stories like, um, like AI is, is dangerous for kids to use.
234
00:12:49.660 --> 00:12:54.080
And I think it's so wrong compared to like Twitter or YouTube, which in the comments on
235
00:12:54.080 --> 00:12:59.180
there are like 99% worse than Claude's responses to anything you say ever.
236
00:12:59.740 --> 00:13:00.140
Yeah.
237
00:13:00.320 --> 00:13:04.720
But what, what, what are we, what, what, what should be taught in an AI academy?
238
00:13:05.620 --> 00:13:05.740
Yeah.
239
00:13:05.800 --> 00:13:09.980
So actually, first thing I would say is that I, I actually would like to have these AI
240
00:13:09.980 --> 00:13:14.920
academies or these academies, uh, target an even earlier age, right.
241
00:13:15.400 --> 00:13:20.300
Um, start really, I mean, replace high school is what I'm saying.
242
00:13:20.640 --> 00:13:24.040
Well, you know, there's friction on the flack with that, but yeah, you get into vouchers
243
00:13:24.040 --> 00:13:25.160
and public school thing.
244
00:13:25.160 --> 00:13:27.540
Like this was pretty easy and clear for them to do politically.
245
00:13:28.020 --> 00:13:32.600
Uh, yeah, understandable, but really I think we are all sort of, it's like, why is the
246
00:13:32.600 --> 00:13:35.300
problem that we're talking about only colleges?
247
00:13:35.520 --> 00:13:39.500
We're, we're seeing this rampant cheating all the way in high school, if not even earlier.
248
00:13:39.500 --> 00:13:44.280
And I think, uh, especially in the context of cybersecurity, we have a whole bunch of 13
249
00:13:44.280 --> 00:13:50.160
year olds and 14 year olds, um, that are, um, that have more time than they have on, um,
250
00:13:50.280 --> 00:13:56.580
they have too much time on their hands and they're basically, um, uh, taking advantage
251
00:13:56.580 --> 00:14:00.980
of corporations and, um, uh, doing things that they shouldn't be doing.
252
00:14:01.380 --> 00:14:04.580
But, uh, you know, there's this endless energy and time that they have.
253
00:14:04.580 --> 00:14:10.900
And I remember as a, as a 13 year old, 14 year old, um, that, uh, you know, I poured my
254
00:14:10.900 --> 00:14:14.140
time into computers and understanding how they work and how they break.
255
00:14:14.180 --> 00:14:14.420
Right.
256
00:14:14.420 --> 00:14:18.120
Which is exactly how we all ended up in, many of us ended up in cybersecurity.
257
00:14:18.540 --> 00:14:22.580
We're going to want people doing, doing the same thing with AI systems and see what could,
258
00:14:22.860 --> 00:14:28.020
but do it in a control, in a much more, uh, controlled, observed fashion so that we can
259
00:14:28.020 --> 00:14:28.780
guide them accordingly.
260
00:14:28.780 --> 00:14:28.820
Okay.
261
00:14:29.440 --> 00:14:34.440
Hey, do we, do you guys, either of you guys know if they're going to charge for tuition
262
00:14:34.440 --> 00:14:39.980
for going to this elite school or is it just all provided by, I mean, I didn't get that.
263
00:14:40.080 --> 00:14:40.240
I know.
264
00:14:40.320 --> 00:14:41.700
Can somebody help me understand that?
265
00:14:41.740 --> 00:14:42.960
Cause, cause if you get, okay.
266
00:14:42.960 --> 00:14:45.200
So there's so many different angles I could, okay.
267
00:14:45.200 --> 00:14:49.680
I don't know if somebody could please, maybe Tillson or our, our, our, our great colleague
268
00:14:49.680 --> 00:14:51.220
behind the scene can look that up.
269
00:14:51.220 --> 00:15:01.340
Um, but, um, I, you know, there is a lot to be said about giving people the opportunity
270
00:15:01.340 --> 00:15:04.800
not to have to go through university, the four year programs.
271
00:15:05.040 --> 00:15:06.300
Those can be difficult.
272
00:15:06.460 --> 00:15:10.780
There's a lot of financial challenges that some people may find themselves in and more
273
00:15:10.780 --> 00:15:16.240
of something along the lines of doing something, you know, very technical.
274
00:15:16.380 --> 00:15:18.080
We've heard this in Germany has this, right?
275
00:15:18.220 --> 00:15:19.000
Europe has this.
276
00:15:19.000 --> 00:15:21.920
You don't have to go to a four year university, you go to a training school.
277
00:15:22.040 --> 00:15:26.480
So I'd like to know more about what this is because that could be an interesting experiment,
278
00:15:26.640 --> 00:15:27.300
thought experiment.
279
00:15:27.300 --> 00:15:31.400
And I give them kudos, but if they're going to charge for this and you charge a lot of
280
00:15:31.400 --> 00:15:35.180
money, I'm thinking Trump university, something where it has a shiny.
281
00:15:35.180 --> 00:15:36.600
No, I mean, no, I mean, okay.
282
00:15:36.820 --> 00:15:37.480
I'm sorry.
283
00:15:37.540 --> 00:15:39.480
I'm not picking on, on our, on our president.
284
00:15:39.660 --> 00:15:45.360
I'm just giving you an example, a real factual example that just cause you're, you put the
285
00:15:45.360 --> 00:15:46.860
name, you put your name on something.
286
00:15:46.860 --> 00:15:51.800
And you feel that that association by itself, the human beings like to think, Oh, it's
287
00:15:51.800 --> 00:15:52.980
associated with this person.
288
00:15:53.140 --> 00:15:53.500
There we go.
289
00:15:53.600 --> 00:15:55.220
I'm, I'm going to be connected to it.
290
00:15:55.280 --> 00:15:55.780
And there we go.
291
00:15:55.820 --> 00:15:56.860
I'm going to be successful.
292
00:15:56.860 --> 00:15:59.740
And that's just, that just plays with people's minds.
293
00:15:59.840 --> 00:16:00.160
Right.
294
00:16:00.240 --> 00:16:01.340
So I don't know about this.
295
00:16:02.720 --> 00:16:03.760
Tillson did look it up.
296
00:16:03.820 --> 00:16:04.920
I got that news out of the press.
297
00:16:05.160 --> 00:16:05.240
Oh yeah.
298
00:16:05.240 --> 00:16:05.680
What is it?
299
00:16:05.740 --> 00:16:09.000
The first cohort is free, but it's planned to be, it's a for-profit entity.
300
00:16:09.000 --> 00:16:13.940
I remember reading that and it's planned to charge tuition similar to elite universities
301
00:16:13.940 --> 00:16:14.620
over time.
302
00:16:14.620 --> 00:16:17.240
But the first, I mean, it's 50 people, so it's immaterial.
303
00:16:17.240 --> 00:16:20.200
And I have a feeling they might be able to raise money since they're Andreessen.
304
00:16:20.380 --> 00:16:20.500
Yeah.
305
00:16:21.280 --> 00:16:22.340
So, yeah.
306
00:16:22.620 --> 00:16:29.100
But getting back, let me ask you again, like, um, first on the cybersecurity angle, um, I
307
00:16:29.100 --> 00:16:33.440
actually pinged a buddy at Andreessen while, since we started the recording and, um, got a
308
00:16:33.440 --> 00:16:36.360
response back that he's not aware of a cyber component to it.
309
00:16:36.360 --> 00:16:38.460
Cause that was one of the questions yet, but it might be.
310
00:16:38.980 --> 00:16:41.500
So, um, what are you teaching in here?
311
00:16:41.840 --> 00:16:42.200
Yeah.
312
00:16:42.220 --> 00:16:47.720
I wasn't suggesting that there's a cyber component as much as, um, if, if the topic is around
313
00:16:47.720 --> 00:16:51.020
how to use AI within the context of whatever, right?
314
00:16:51.100 --> 00:16:51.440
Yes.
315
00:16:51.600 --> 00:16:55.460
There's going to be a natural desire to see how things break and how they work and how
316
00:16:55.460 --> 00:16:55.920
they break.
317
00:16:56.000 --> 00:16:56.220
Yeah.
318
00:16:56.420 --> 00:17:03.760
And the breaking part is where, uh, we start seeing cybersecurity as a, as a aspect of what
319
00:17:03.760 --> 00:17:04.180
they learn.
320
00:17:04.660 --> 00:17:05.060
Yeah.
321
00:17:05.060 --> 00:17:08.820
But I mean, I, I think like even at the middle school and below level, like the question of
322
00:17:08.820 --> 00:17:10.420
whether or not AI should be a part of it.
323
00:17:10.440 --> 00:17:15.280
I mean, I totally think, I think that if people get the impression that people are going to
324
00:17:15.280 --> 00:17:19.460
have mental health breakdowns and be led to do bad things through AI, I think that's a
325
00:17:19.460 --> 00:17:24.620
total outlier, red herring distraction and people can study on their own or whatever.
326
00:17:25.400 --> 00:17:29.780
But the other argument that I think people in our circles do worry about is, are you going
327
00:17:29.780 --> 00:17:30.720
to not learn how to code?
328
00:17:30.720 --> 00:17:35.220
You're not going to learn the basics because we have this abstraction layer and now you're
329
00:17:35.220 --> 00:17:39.320
going to be saying you're writing code, but you don't really understand for loops.
330
00:17:39.780 --> 00:17:44.360
And that feels insulting and denigrating towards people who invested all the time.
331
00:17:44.360 --> 00:17:52.960
And the way I see it, the people who were writing Java were what second class citizens because
332
00:17:52.960 --> 00:17:58.680
it wasn't C++ and the people writing C++, the people who wrote assembly sneered, looked down
333
00:17:58.680 --> 00:17:59.560
their noses at them.
334
00:17:59.560 --> 00:18:03.700
And then the people who wrote assembly, oh my God, they get actual letters that they could
335
00:18:03.700 --> 00:18:03.940
write.
336
00:18:03.980 --> 00:18:06.360
And the people who did the chips and the machine language looked down to them.
337
00:18:06.600 --> 00:18:07.900
These are all abstraction layers.
338
00:18:07.900 --> 00:18:13.520
You play the cards you're dealt and you know, not everyone has to know how to work with
339
00:18:13.520 --> 00:18:13.800
silicon.
340
00:18:14.420 --> 00:18:22.200
So I don't think there's anything less quality about studying AI and learning software engineering
341
00:18:22.200 --> 00:18:23.760
AI first.
342
00:18:24.700 --> 00:18:26.540
And I think, does that concern you?
343
00:18:27.200 --> 00:18:27.940
Well, okay.
344
00:18:28.020 --> 00:18:29.280
So let's consider a couple of things.
345
00:18:29.280 --> 00:18:36.100
I'm pretty sure all of us in the US at least, that you studied English all the way through
346
00:18:36.100 --> 00:18:36.840
12th grade.
347
00:18:37.360 --> 00:18:41.500
And maybe in some people even went further and studied English in college, right?
348
00:18:41.560 --> 00:18:43.720
And it's certainly not because you don't know how to speak English.
349
00:18:44.100 --> 00:18:45.420
It's not because you don't know the language.
350
00:18:45.420 --> 00:18:51.240
It's because you're learning different types of elements of style and persuasion and all
351
00:18:51.240 --> 00:18:54.160
these other sort of aspects of language.
352
00:18:54.160 --> 00:19:02.180
So in the same way, when we think about programming languages, there's sort of a foundational, like,
353
00:19:02.220 --> 00:19:03.260
hey, you need to learn.
354
00:19:04.000 --> 00:19:05.620
You just need to know how to speak the language.
355
00:19:05.860 --> 00:19:06.580
Maybe, right?
356
00:19:06.920 --> 00:19:13.140
But you want to quickly advance beyond that to say, help us understand algorithms and help
357
00:19:13.140 --> 00:19:22.180
us understand what's efficient and what is engineered well, right?
358
00:19:22.180 --> 00:19:26.200
Those are more advanced topics that go well beyond just knowing how to speak English or
359
00:19:26.200 --> 00:19:28.700
how to speak Java.
360
00:19:29.620 --> 00:19:29.720
Yeah.
361
00:19:29.940 --> 00:19:32.900
You know, I think a lot of people probably feel the same way as me about this, where
362
00:19:32.900 --> 00:19:34.000
I'm using AI a lot.
363
00:19:34.640 --> 00:19:35.580
You guys are in the same boat.
364
00:19:36.320 --> 00:19:37.820
I'm writing prompts all the time.
365
00:19:38.060 --> 00:19:40.480
And in some of the cases, there's software coming out of the other end.
366
00:19:40.940 --> 00:19:47.340
And it's really easy for me to fall into a trap of thinking that I'm the best at this.
367
00:19:47.340 --> 00:19:53.800
Like, because my prompting is better because I see these little hints of like, oh, you know,
368
00:19:53.840 --> 00:19:58.220
I nudged it towards something more efficient because I took computer engineering 30 years
369
00:19:58.220 --> 00:19:58.620
ago.
370
00:19:59.100 --> 00:20:04.000
And so I think I'm the hero of prompting here, but I have enough imposter syndrome that
371
00:20:04.000 --> 00:20:06.320
I'm checking myself 30 seconds into that thought process.
372
00:20:06.520 --> 00:20:07.580
Like, oh, come on.
373
00:20:08.060 --> 00:20:11.800
There's 5,000 people in my office alone that know a lot more than me.
374
00:20:11.800 --> 00:20:13.040
They're probably doing a lot better.
375
00:20:13.820 --> 00:20:20.000
Does everyone using these coding assistants think that they're God's gift to the software
376
00:20:20.000 --> 00:20:20.800
engineering world?
377
00:20:22.480 --> 00:20:27.320
Well, it doesn't help that the coding agents or the models are very sycophantic as well.
378
00:20:28.260 --> 00:20:29.420
Oh, you're so right.
379
00:20:29.540 --> 00:20:30.120
You're so smart.
380
00:20:30.460 --> 00:20:31.200
Oh, thank you so much.
381
00:20:31.200 --> 00:20:34.180
I hope all of our listeners didn't just go, oh, it's not just me.
382
00:20:34.340 --> 00:20:34.880
Oh, crap.
383
00:20:35.120 --> 00:20:36.540
Oh, sorry to hear that.
384
00:20:37.600 --> 00:20:38.040
Yeah.
385
00:20:38.040 --> 00:20:38.120
Yeah.
386
00:20:38.940 --> 00:20:42.920
You know, this is interesting, you guys, we were talking about this topic.
387
00:20:43.080 --> 00:20:44.980
I was thinking about this actually yesterday.
388
00:20:46.720 --> 00:20:50.800
I was doing, I don't know if you guys ever heard of logistic map equation.
389
00:20:51.000 --> 00:20:52.140
You guys are familiar with that?
390
00:20:52.660 --> 00:20:53.960
And so it's a simple equation.
391
00:20:54.120 --> 00:21:00.740
It's a super simple equation that demonstrates dynamic systems and chaos and how soon things
392
00:21:00.740 --> 00:21:03.580
turn chaotic in a very complex systems, right?
393
00:21:03.580 --> 00:21:10.020
And basically it's a simple equation and I was trying to figure it out and visually see
394
00:21:10.020 --> 00:21:11.120
what they meant by that.
395
00:21:11.180 --> 00:21:17.540
So basically there's a point where this small little change can create such a big chaos where
396
00:21:17.540 --> 00:21:19.660
you can no longer forecast.
397
00:21:19.940 --> 00:21:21.240
Weather is an example of that.
398
00:21:21.360 --> 00:21:22.760
You can't really forecast after.
399
00:21:23.000 --> 00:21:26.040
People say, well, maybe you need more data, blah, blah, blah, better computers and you'd
400
00:21:26.040 --> 00:21:27.020
be able to forecast longer.
401
00:21:27.120 --> 00:21:28.820
But anyway, no, that wasn't the point.
402
00:21:28.860 --> 00:21:32.800
The point was I couldn't visually understand what the damn equation was doing.
403
00:21:32.800 --> 00:21:40.960
And so I just told Claude, hey, here's this equation, logic map, show me visually what
404
00:21:40.960 --> 00:21:41.940
this looks like.
405
00:21:42.620 --> 00:21:49.520
And it was a really useful example to learn visually and how the equation work and the
406
00:21:49.520 --> 00:21:50.500
principles behind it.
407
00:21:50.600 --> 00:21:52.200
And then that helped me learn.
408
00:21:52.640 --> 00:21:56.260
So I think learning is what we're missing here.
409
00:21:56.340 --> 00:22:01.540
If we're just using AI for doing blob and answering things for us, I think we're going to do a
410
00:22:01.540 --> 00:22:05.360
disservice to us, to ourselves and to the youth, blah, blah, blah.
411
00:22:06.020 --> 00:22:06.420
Learning.
412
00:22:06.620 --> 00:22:13.080
If you can use these tools, AI for learning, for you to learn, I think there's a benefit
413
00:22:13.080 --> 00:22:13.580
to that.
414
00:22:14.520 --> 00:22:14.600
Yeah.
415
00:22:15.300 --> 00:22:17.580
The question is, what is it that we want them to learn?
416
00:22:18.080 --> 00:22:18.260
Right?
417
00:22:19.120 --> 00:22:19.560
Yeah.
418
00:22:19.560 --> 00:22:19.640
Yeah.
419
00:22:20.440 --> 00:22:20.660
Yeah.
420
00:22:20.780 --> 00:22:26.000
So there's just, for those who are not familiar with what's called classical education, there
421
00:22:26.000 --> 00:22:33.100
are, and it maps nicely into what we know as elementary, middle, and high school.
422
00:22:33.660 --> 00:22:39.500
But elementary school is when, it's also called the grammar stage, is when we are just, we
423
00:22:39.500 --> 00:22:42.720
don't, I don't care if you understand it, we just want rote memorization.
424
00:22:42.720 --> 00:22:50.400
Just, it's, we point a fire hose of, of information at you and we have kids just, just consume
425
00:22:50.400 --> 00:22:50.700
it all.
426
00:22:50.900 --> 00:22:51.060
Right?
427
00:22:51.440 --> 00:22:56.200
And of course they have this massive capacity to learn things, just to absorb things.
428
00:22:56.340 --> 00:22:59.520
But the grammar stage is just rote memorization for the most part.
429
00:23:00.000 --> 00:23:00.080
Yeah.
430
00:23:00.080 --> 00:23:05.720
Middle, middle school is when you, it's what's called the dialectic stage, which is when you
431
00:23:05.720 --> 00:23:08.960
start connecting different facts together.
432
00:23:08.960 --> 00:23:09.560
Okay.
433
00:23:10.020 --> 00:23:12.560
So that this is associated with that and so on and so forth.
434
00:23:12.840 --> 00:23:14.480
I'm not even there yet, by the way.
435
00:23:17.560 --> 00:23:21.860
Now, and then the high school stage is what's called the rhetoric stage.
436
00:23:21.980 --> 00:23:28.820
And rhetoric is when you start actually reasoning and thinking through these connections, arriving
437
00:23:28.820 --> 00:23:34.060
at your own logical conclusions and trying to persuade others to, to your, you know, your
438
00:23:34.060 --> 00:23:35.400
points of view, whatever else it might be.
439
00:23:35.620 --> 00:23:38.700
So anyway, those are the three stages of education.
440
00:23:38.960 --> 00:23:47.120
When I said earlier that I would want kids even right at the high school age to start
441
00:23:47.120 --> 00:23:47.900
using AI.
442
00:23:49.180 --> 00:23:54.100
This is where I think the question, going back to the question of what is it that we want
443
00:23:54.100 --> 00:23:54.680
to learn?
444
00:23:55.000 --> 00:24:00.260
What is it that we want people to think through when they reach, when they're using these AI
445
00:24:00.260 --> 00:24:00.580
tools?
446
00:24:00.980 --> 00:24:05.700
The AI tools can easily, of course, recall, can easily bring the connections together.
447
00:24:05.700 --> 00:24:11.660
But this reasoning aspect of things is what I think actually, I mean, if you think about
448
00:24:11.660 --> 00:24:15.700
what the thinking mode that we see, it's an illusion.
449
00:24:15.700 --> 00:24:22.280
The reasoning that we see from these large angles models today is really an illusion of reasoning.
450
00:24:22.280 --> 00:24:23.440
It's not actual reasoning.
451
00:24:23.440 --> 00:24:31.600
So what we want people to learn is actually how to reason properly and to validate and verify,
452
00:24:31.600 --> 00:24:35.840
hey, is this, is the reasoning that I'm seeing from these AI systems actually correct?
453
00:24:35.940 --> 00:24:37.040
Is it flawed in some way?
454
00:24:37.800 --> 00:24:40.460
But Sounil, we're always having illusions.
455
00:24:40.680 --> 00:24:43.020
We're creating, our brains are always creating illusions.
456
00:24:43.180 --> 00:24:46.640
Everything we see is an interpretation of what's outside of us.
457
00:24:46.640 --> 00:24:49.140
But, um, but it's often an illusion.
458
00:24:49.280 --> 00:24:50.420
Oftentimes it's correct.
459
00:24:51.280 --> 00:24:55.560
Well, speaking of illusions and fake numbers, um, public market segment.
460
00:24:56.520 --> 00:25:01.520
So cybersecurity, um, we used to talk about the public markets and publicly traded symbols
461
00:25:01.520 --> 00:25:01.900
a lot.
462
00:25:02.060 --> 00:25:06.880
Uh, CrowdStrike came up a bunch that kicked off with the whole Delta thing and our general
463
00:25:06.880 --> 00:25:07.380
collective.
464
00:25:07.480 --> 00:25:08.700
We'll be all through numbers out there.
465
00:25:08.860 --> 00:25:10.280
I think we were generally saying.
466
00:25:10.420 --> 00:25:12.840
You mean Delta airlines, not Delta difference.
467
00:25:13.260 --> 00:25:13.980
Yeah, yeah, yeah, yeah.
468
00:25:13.980 --> 00:25:17.720
Not the Greek symbol, but yeah, Delta, it's funny that Delta airlines never play on that.
469
00:25:18.380 --> 00:25:19.600
But in any event, yeah.
470
00:25:19.720 --> 00:25:20.600
See the difference.
471
00:25:20.680 --> 00:25:21.380
Like, come on guys.
472
00:25:21.460 --> 00:25:21.740
We're right.
473
00:25:22.160 --> 00:25:24.660
But in any event, we basically said, bye, right.
474
00:25:24.720 --> 00:25:25.720
This thing's going to blow over.
475
00:25:25.940 --> 00:25:27.300
And, and, and we were right.
476
00:25:27.900 --> 00:25:33.960
Um, lately the, uh, the tech sector over the last week or so, like mag seven style is like
477
00:25:33.960 --> 00:25:34.840
come back up.
478
00:25:34.880 --> 00:25:41.460
But I, in my appreciation to cyber has been like amplifying off of that, uh, markets hot right
479
00:25:41.460 --> 00:25:41.740
now.
480
00:25:41.740 --> 00:25:44.620
Um, start with, uh, Island.
481
00:25:44.980 --> 00:25:46.800
Um, I have a conflict in that.
482
00:25:47.160 --> 00:25:51.320
Um, and then I'm invested in it and I'm disclosing, but, uh, doesn't make much of a
483
00:25:51.320 --> 00:25:51.500
difference.
484
00:25:51.640 --> 00:25:54.740
They, they, they announced a really big round yesterday, a $400 million round that, uh,
485
00:25:54.740 --> 00:25:56.460
$6.4 billion valuation.
486
00:25:56.860 --> 00:25:57.880
Congratulations to them.
487
00:25:57.940 --> 00:25:58.460
It says a lot.
488
00:25:59.420 --> 00:26:01.600
Um, so that's the private market and the public markets.
489
00:26:02.480 --> 00:26:03.640
Cloudflare is one.
490
00:26:04.180 --> 00:26:05.700
Um, I talk about them all the time.
491
00:26:05.760 --> 00:26:09.400
I'm going to be at the Cloudflare connect by the way, uh, October 19th.
492
00:26:09.400 --> 00:26:10.960
So Mario, I'm going to be hitting you up.
493
00:26:11.020 --> 00:26:13.820
It's in San Francisco and listeners.
494
00:26:14.020 --> 00:26:15.660
Let me know if you want to connect while I'm out there.
495
00:26:16.240 --> 00:26:17.940
Uh, anyway, they're on a, on a tear there.
496
00:26:18.040 --> 00:26:20.880
I said 52 week high earlier, but they're actually at an all time high.
497
00:26:21.460 --> 00:26:23.040
Uh, CrowdStrike, maybe the same.
498
00:26:23.100 --> 00:26:24.200
They're certainly at a 52 week.
499
00:26:24.700 --> 00:26:26.340
Um, they're all right now.
500
00:26:26.340 --> 00:26:27.500
Is that right?
501
00:26:27.500 --> 00:26:32.720
I mean, well, active is down $10 today, but if you go look from back from April this year,
502
00:26:32.900 --> 00:26:36.820
I mean, they were down at 69 and they're up, uh, 190, 200.
503
00:26:38.000 --> 00:26:38.360
Yeah.
504
00:26:38.420 --> 00:26:38.600
Yeah.
505
00:26:38.600 --> 00:26:38.800
Yeah.
506
00:26:38.880 --> 00:26:43.600
Well, I mean, is, is that just riding off of a little bit of, uh, a little bit of fear
507
00:26:43.600 --> 00:26:48.500
and I'm not going to call it doubt and uncertainty, but a little bit of reactions to AI and what
508
00:26:48.500 --> 00:26:49.360
the next forefront is.
509
00:26:49.360 --> 00:26:50.360
Is that, is that totally it?
510
00:26:50.360 --> 00:26:54.860
Like it took first AI and cyber disconnected all the money when an AI and all the venture
511
00:26:54.860 --> 00:26:58.960
funds were like, if you don't say AI and now maybe it's like, they can't be just disconnected.
512
00:26:59.240 --> 00:27:00.060
Cyber is AI.
513
00:27:00.600 --> 00:27:07.060
Well, I think the hugging face attack and the, the continued disclosures of these AI agents,
514
00:27:07.060 --> 00:27:12.700
uh, going rogue and attacking other people, other companies, um, has really put the spotlight
515
00:27:12.700 --> 00:27:18.040
on, Hey, maybe we really do need these cybersecurity controls to keep these agents in order.
516
00:27:18.800 --> 00:27:18.880
Yeah.
517
00:27:18.960 --> 00:27:19.100
Yeah.
518
00:27:19.100 --> 00:27:19.720
Yeah, exactly.
519
00:27:19.720 --> 00:27:23.220
But I mean, you think the market's capable of differentiating what's really going to be
520
00:27:23.220 --> 00:27:26.740
relevant and what's on the other hand, going to be a victim of the SAS apocalypse?
521
00:27:27.180 --> 00:27:31.240
Are security tools going to get vibe coded out of existence?
522
00:27:31.660 --> 00:27:35.060
Um, I've heard of some areas where people are like, why am I wasting my time on this?
523
00:27:35.540 --> 00:27:39.960
Well, what's the differentiator in the tools that are going to be thriving and earning these
524
00:27:39.960 --> 00:27:42.660
valuations in five years from the ones we're going to forget the name of?
525
00:27:43.540 --> 00:27:48.460
Well, I come back to my earlier comment about the, the moat, um, CrowdStrike has a moat
526
00:27:48.460 --> 00:27:51.920
because you have to install actually on hardware, right?
527
00:27:51.920 --> 00:27:58.640
Um, endpoint, uh, agents slash sensors, whatever agents means too many things now.
528
00:27:58.700 --> 00:28:01.820
But anyway, they, they, um, you have to deploy on a hardware, which is hard.
529
00:28:01.820 --> 00:28:06.260
And CloudFlare is all about like press, you know, physical points of presence all over
530
00:28:06.260 --> 00:28:06.720
the world.
531
00:28:06.880 --> 00:28:09.200
So they, they have natural moats.
532
00:28:09.340 --> 00:28:14.360
If it's just a pure software company that doesn't have much more of a, um, if it's like
533
00:28:14.360 --> 00:28:19.460
pure SAS without an actual, you have to install something component in the physical world,
534
00:28:19.460 --> 00:28:21.720
it, uh, becomes easily displaceable.
535
00:28:21.720 --> 00:28:21.760
Yeah.
536
00:28:22.300 --> 00:28:23.940
You know what I, yeah.
537
00:28:24.160 --> 00:28:24.300
Yeah.
538
00:28:24.440 --> 00:28:30.640
I was just thinking about CrowdStrike and how, you know, they charge by the number of agents,
539
00:28:30.760 --> 00:28:30.860
right?
540
00:28:30.880 --> 00:28:34.700
You can get a good deal, but definitely not agents, but number of, of the, of the, yeah,
541
00:28:34.820 --> 00:28:35.040
seats.
542
00:28:35.180 --> 00:28:35.540
Exactly.
543
00:28:36.280 --> 00:28:38.400
Um, does anybody know what they do with agents?
544
00:28:38.460 --> 00:28:40.560
Cause agents are just multiplied.
545
00:28:40.740 --> 00:28:41.740
Everyone's figuring it out.
546
00:28:42.380 --> 00:28:42.780
Yeah.
547
00:28:42.820 --> 00:28:44.360
Everyone's, everyone's figuring it out.
548
00:28:44.520 --> 00:28:50.180
I mean, the, the, the, Andreessen, ironically enough, um, wrote a piece on this called outcome
549
00:28:50.180 --> 00:28:51.260
based pricing, right?
550
00:28:51.320 --> 00:28:53.820
And this is the kind of piece that you might be interested in as a founder more than as
551
00:28:53.820 --> 00:28:54.200
a buyer.
552
00:28:54.640 --> 00:28:54.960
Yeah.
553
00:28:54.980 --> 00:28:59.380
Um, but the idea here is, um, the, the other thing about seats is that seats are getting
554
00:28:59.380 --> 00:29:00.280
fired, right?
555
00:29:00.280 --> 00:29:01.500
So people are getting canned.
556
00:29:01.740 --> 00:29:02.240
That's right.
557
00:29:02.280 --> 00:29:05.000
And replaced, whether it's by agents or, or whatever.
558
00:29:05.520 --> 00:29:06.900
And so that's not going to work.
559
00:29:06.960 --> 00:29:08.020
An agent base isn't true.
560
00:29:08.020 --> 00:29:11.720
Cause agents kind of an abstract concept and you can just play games with it to get below
561
00:29:11.720 --> 00:29:13.400
it and like, no, that's only one agent, not 400.
562
00:29:14.000 --> 00:29:17.640
So, but the idea is outcome based pricing, in particular when you're paying for something
563
00:29:17.640 --> 00:29:23.640
is that's AI powered that you pay for the turns and tokens are kind of a proxy for that.
564
00:29:24.080 --> 00:29:25.900
And then the idea is on security tools too.
565
00:29:26.580 --> 00:29:30.860
But like to take what you said, Sounil, like you're talking about, um, software versus hardware.
566
00:29:30.860 --> 00:29:35.920
And to me, I'm my words, not yours, but CrowdStrike isn't hardware per se, but they kind of benefit
567
00:29:35.920 --> 00:29:41.580
from the same kind of economics because they're fixed asset related, let's just say, totally
568
00:29:41.580 --> 00:29:42.000
agree.
569
00:29:42.640 --> 00:29:45.960
Another way to put that is that the switching costs are kind of high on that.
570
00:29:45.960 --> 00:29:47.860
Cause you got to touch device and so on.
571
00:29:48.320 --> 00:29:54.320
I think where the differentiator is, is in the value of the, of the scalability and the
572
00:29:54.320 --> 00:29:55.980
network effects of the product.
573
00:29:56.360 --> 00:29:56.820
Right.
574
00:29:56.860 --> 00:30:03.220
So if, if you can, I mean, everyone can take any product that we have now and spend a little
575
00:30:03.220 --> 00:30:09.260
bit of time and build a surrogate product, but that's not enough.
576
00:30:09.260 --> 00:30:15.780
If, if, if you having a unique product versus the rest of the world is actually a liability.
577
00:30:16.520 --> 00:30:21.120
So like when it comes to threat intelligence, when it comes to benchmarking type stuff, if
578
00:30:21.120 --> 00:30:25.460
like, if you, if you designed your own bookkeeping software and all of that, and you had different
579
00:30:25.460 --> 00:30:30.180
financial statements and different generally accepted counting practices, that wouldn't be
580
00:30:30.180 --> 00:30:30.660
very cool.
581
00:30:30.720 --> 00:30:31.360
It wouldn't be useful.
582
00:30:31.440 --> 00:30:33.820
You couldn't talk to investors about your numbers.
583
00:30:33.820 --> 00:30:36.260
Even if it was a better model, it wouldn't, you wouldn't do that.
584
00:30:36.860 --> 00:30:41.280
Or, and likewise, if you need the name behind the tool, that's generating statements and
585
00:30:41.280 --> 00:30:43.940
people want to say like, oh, okay, I trust that versus a YOLO one.
586
00:30:44.320 --> 00:30:49.700
So CrowdStrike and Cloudflare, there's definitely a lot of value in being able to say, yeah,
587
00:30:49.720 --> 00:30:53.120
use CrowdStrike and not Sounil just coded up something really cool.
588
00:30:53.180 --> 00:30:53.540
Trust me.
589
00:30:53.580 --> 00:30:54.040
It's great.
590
00:30:54.680 --> 00:31:00.820
And, you know, when it comes to things like CRM, that's been the big question, like Salesforce
591
00:31:00.820 --> 00:31:07.140
and then ServiceNow as well, I think the question really comes down to, does it put you in a
592
00:31:07.140 --> 00:31:11.220
bad state to have a singular instance?
593
00:31:11.380 --> 00:31:16.440
Only you, you're the only one who's on this program running your CRM or running your ticket
594
00:31:16.440 --> 00:31:17.640
management, or is that fine?
595
00:31:17.640 --> 00:31:18.200
And it's okay.
596
00:31:18.200 --> 00:31:19.940
And you don't need a network value from it.
597
00:31:20.860 --> 00:31:25.920
I'm actually challenging the underlying assumptions where you have about scale and what the scale
598
00:31:25.920 --> 00:31:32.040
look like in a future where software can be one-time use.
599
00:31:33.420 --> 00:31:39.860
So there's a challenge, of course, in terms of interoperability, but we do already have
600
00:31:39.860 --> 00:31:41.020
an interoperability layer.
601
00:31:41.240 --> 00:31:42.580
It's called English, right?
602
00:31:43.300 --> 00:31:44.240
It doesn't have to be...
603
00:31:44.240 --> 00:31:56.060
Granted, having a machine-readable interoperability layer that has very strict boundaries can increase
604
00:31:56.060 --> 00:32:01.960
the efficiency of the communications or the efficiency of how it's understood.
605
00:32:03.180 --> 00:32:04.040
But that's it.
606
00:32:04.480 --> 00:32:05.060
That's it.
607
00:32:05.100 --> 00:32:10.740
I think we're moving into a world, though, where we're going to see more and more one-time
608
00:32:10.740 --> 00:32:15.740
use software that's designed just for a person's...
609
00:32:16.440 --> 00:32:19.080
To answer a question that a particular person has.
610
00:32:19.700 --> 00:32:20.560
So I think...
611
00:32:20.560 --> 00:32:24.660
I don't know if I have a good answer as to where scale is going to manifest differently
612
00:32:24.660 --> 00:32:27.060
in the future, but I can...
613
00:32:27.060 --> 00:32:34.920
We already see right now the nature of scale changing from, let me deliver this one piece
614
00:32:34.920 --> 00:32:38.540
of software that everyone's going to use to just build it yourself, right?
615
00:32:38.540 --> 00:32:39.840
Hmm.
616
00:32:40.060 --> 00:32:40.680
Yeah, I know.
617
00:32:40.720 --> 00:32:45.580
I think about what you say sometimes, too, about open source software and the idea of
618
00:32:45.580 --> 00:32:51.060
kind of instantiating it per use case instead of literally using the code, literally using
619
00:32:51.060 --> 00:32:53.920
the branches out there.
620
00:32:54.240 --> 00:32:54.420
Right.
621
00:32:54.480 --> 00:32:59.520
And I think from the standpoint of security, nature abhors monocultures.
622
00:32:59.520 --> 00:33:01.520
And we...
623
00:33:01.520 --> 00:33:04.620
Security also abhors monocultures as well.
624
00:33:05.080 --> 00:33:12.680
We would do well on having a much more diverse set of software, one that changes actually fairly
625
00:33:12.680 --> 00:33:17.280
frequently, making it much harder for attackers to not necessarily find vulnerabilities.
626
00:33:17.420 --> 00:33:22.280
They'll still find vulnerabilities all the time, but rather to be able to exploit them
627
00:33:22.280 --> 00:33:26.860
at scale because you're going to now have to keep up with the people who are changing
628
00:33:26.860 --> 00:33:29.480
the software and making it diverse on a regular basis.
629
00:33:30.120 --> 00:33:30.520
Yeah.
630
00:33:30.560 --> 00:33:32.640
So all roads lead back to the frontier labs.
631
00:33:33.680 --> 00:33:36.280
I feel like being able to...
632
00:33:37.140 --> 00:33:39.420
Where are you going to go shop for tokens and how are you going to use them?
633
00:33:39.860 --> 00:33:44.060
By the way, I just think thinking about who's going to be a leader...
634
00:33:44.060 --> 00:33:46.520
I don't know what your timeline was, Jerry.
635
00:33:46.700 --> 00:33:48.620
Was it like two years, five years from now?
636
00:33:48.620 --> 00:33:50.760
Who's going to be still a leader in what space?
637
00:33:50.880 --> 00:33:50.980
Yeah.
638
00:33:51.000 --> 00:33:51.480
I don't know either.
639
00:33:51.860 --> 00:33:53.160
Let's say two and a half years.
640
00:33:53.260 --> 00:33:53.580
I think that's...
641
00:33:53.580 --> 00:33:53.780
Okay.
642
00:33:53.840 --> 00:33:54.520
Two and a half years.
643
00:33:54.620 --> 00:33:55.700
But I'm just to get every...
644
00:33:55.700 --> 00:33:57.300
You know, CrowdStrike...
645
00:33:57.300 --> 00:33:58.360
I just looked this up.
646
00:33:59.100 --> 00:34:00.420
Started in 2011.
647
00:34:01.080 --> 00:34:02.780
2012 is when they officially launched.
648
00:34:03.280 --> 00:34:09.060
Do you guys want to hear what the number one enterprise AV security system in 2012 was?
649
00:34:09.240 --> 00:34:09.780
I looked it up.
650
00:34:10.700 --> 00:34:11.100
Symantec?
651
00:34:11.900 --> 00:34:12.260
Maxi.
652
00:34:12.260 --> 00:34:13.700
I mean, give that man a...
653
00:34:13.700 --> 00:34:15.540
Give that man a bonus.
654
00:34:15.920 --> 00:34:16.540
It was Symantec?
655
00:34:17.020 --> 00:34:17.820
It was Symantec.
656
00:34:17.840 --> 00:34:18.080
Yeah.
657
00:34:18.080 --> 00:34:20.460
I mean, I'm still living in 2011, so of course I should know.
658
00:34:20.760 --> 00:34:24.760
Who's the number one AV, enterprise AV today?
659
00:34:25.780 --> 00:34:29.220
I would guess it was CrowdStrike, with Sentinel-1 being a bit of a distance.
660
00:34:29.220 --> 00:34:29.560
There you go.
661
00:34:29.780 --> 00:34:29.940
CrowdStrike is...
662
00:34:29.940 --> 00:34:30.220
No, no.
663
00:34:30.300 --> 00:34:31.000
Defender, actually.
664
00:34:31.120 --> 00:34:31.800
Is it not Defender?
665
00:34:31.900 --> 00:34:33.480
No, but Defender is like third.
666
00:34:33.980 --> 00:34:34.660
Defender is third.
667
00:34:34.920 --> 00:34:35.120
Okay.
668
00:34:35.220 --> 00:34:36.080
According to this frame.
669
00:34:36.240 --> 00:34:37.080
But CrowdStrike.
670
00:34:37.200 --> 00:34:41.620
So the whole point is that I'm trying to highlight here is, I don't know, it's fool's
671
00:34:41.620 --> 00:34:46.220
goal to try to anticipate where some of these future companies are going to be at from a security
672
00:34:46.220 --> 00:34:46.740
offering.
673
00:34:46.740 --> 00:34:48.240
I just think it changes so often.
674
00:34:48.660 --> 00:34:50.360
I will agree with Sounil.
675
00:34:50.560 --> 00:34:52.480
There is something to be said about hardware.
676
00:34:53.280 --> 00:34:54.360
And I would jump on that.
677
00:34:54.480 --> 00:34:58.600
With Cloudflare, there's a hardware component, I would argue, potentially.
678
00:34:59.100 --> 00:34:59.260
Right?
679
00:34:59.260 --> 00:35:04.080
And so that makes it harder, if you're going to keep throwing more traffic in there, the
680
00:35:04.080 --> 00:35:07.620
choke point, to try to compete against somebody like Cloudflare.
681
00:35:07.620 --> 00:35:08.140
Oh, without a doubt.
682
00:35:08.140 --> 00:35:08.940
Because of the investments they've done.
683
00:35:09.280 --> 00:35:13.120
You know, it's really interesting, because I've followed Cloudflare for a long time.
684
00:35:13.120 --> 00:35:16.040
We were early customers of theirs at my long time job.
685
00:35:16.740 --> 00:35:20.700
And they used to not be called a cybersecurity company.
686
00:35:21.280 --> 00:35:28.240
And when you went through, I don't know what, 2015 through 2021 or something, they clearly,
687
00:35:28.500 --> 00:35:32.100
intentionally really pushed the narrative towards cyber company.
688
00:35:32.100 --> 00:35:35.600
And it didn't mean that they changed the way they hired or what their principles or what
689
00:35:35.600 --> 00:35:36.240
their strategy was.
690
00:35:36.280 --> 00:35:37.040
I don't think much at all.
691
00:35:37.120 --> 00:35:37.620
I think their roadmap.
692
00:35:38.200 --> 00:35:39.120
And it was valid.
693
00:35:39.640 --> 00:35:41.420
But they really wanted to get the analysts.
694
00:35:41.560 --> 00:35:42.620
And my words, not theirs.
695
00:35:42.780 --> 00:35:46.400
I think they really want to get the analysts covering them to be the ones that are also
696
00:35:46.400 --> 00:35:47.260
covering CrowdStrike.
697
00:35:47.260 --> 00:35:49.020
They wanted to be talked about in the same breath.
698
00:35:49.160 --> 00:35:53.380
And they wanted to see the rises along with the cyber subsector of technology.
699
00:35:54.000 --> 00:35:55.040
Mission accomplished.
700
00:35:55.240 --> 00:35:56.180
They nailed that.
701
00:35:56.280 --> 00:35:56.900
Now they move.
702
00:35:57.000 --> 00:36:00.240
When I hear that the cyber industry is up, I know they probably talk about Cloudflare now.
703
00:36:00.520 --> 00:36:02.420
And they usually are, especially lately.
704
00:36:03.080 --> 00:36:04.300
So that's a big win.
705
00:36:04.660 --> 00:36:10.820
But when I think about, well, what's a good five-year outcome for them?
706
00:36:11.300 --> 00:36:14.840
Is it to be, you know, as big as CrowdStrike?
707
00:36:14.840 --> 00:36:17.240
Well, the market cap's on the same order of magnitude already.
708
00:36:17.460 --> 00:36:19.640
They're already at half the market cap of CrowdStrike.
709
00:36:20.240 --> 00:36:21.520
I don't, I see them.
710
00:36:21.720 --> 00:36:24.600
And now all of a sudden, maybe they agree where they'd want to wind back the narrative.
711
00:36:25.100 --> 00:36:26.120
They're a cloud service provider.
712
00:36:26.560 --> 00:36:27.440
They're Amazon.
713
00:36:28.020 --> 00:36:28.840
They're Microsoft.
714
00:36:29.180 --> 00:36:29.680
They're Google.
715
00:36:30.540 --> 00:36:33.240
That's the four that they're the fourth of.
716
00:36:33.960 --> 00:36:34.820
So forget about Palo.
717
00:36:34.920 --> 00:36:35.580
Forget about Crowd.
718
00:36:35.780 --> 00:36:38.740
They need to be going after a $2 trillion market cap, $1 trillion.
719
00:36:39.280 --> 00:36:42.280
And I think it's totally reasonable, not because of the cyber piece of the story,
720
00:36:42.280 --> 00:36:48.860
but because as you drag up workloads out of, like they're fronting workloads that are living in AWS and GCP.
721
00:36:49.480 --> 00:36:50.480
They don't have to.
722
00:36:50.540 --> 00:36:53.060
You can drag that stuff up and run containers in Cloudflare nowadays.
723
00:36:53.720 --> 00:36:56.260
So I feel like that's what they're going to be going after.
724
00:36:56.600 --> 00:37:00.540
And then they will be as much a cyber headline as AWS is, right?
725
00:37:00.540 --> 00:37:03.160
They have something, but that's not what you think of first when you think AWS.
726
00:37:03.880 --> 00:37:04.860
They're a technology company.
727
00:37:04.900 --> 00:37:05.780
They're a cloud service provider.
728
00:37:05.780 --> 00:37:13.300
So, yeah, I think that's full of a big moat, being a cloud service provider, data centers, the whole nine that are doing.
729
00:37:15.080 --> 00:37:22.180
I slipped in there a minute ago that, like, all roads look back to the frontier labs as far as, like, what's going to keep growing and whatnot.
730
00:37:22.840 --> 00:37:29.680
One popped on the scene recently, Jev, or specifically it is, man, I don't remember the name of the actual code.
731
00:37:29.680 --> 00:37:30.200
TypeSafe.
732
00:37:31.260 --> 00:37:37.700
And I'm glad that this has come up because that's been all the buzz in our office.
733
00:37:38.060 --> 00:37:40.420
So Jev came out, it popped into Slack.
734
00:37:40.540 --> 00:37:42.020
We all started gophering out of the cubes.
735
00:37:42.140 --> 00:37:42.860
Yes, we have cubes.
736
00:37:43.700 --> 00:37:45.320
And started talking about it.
737
00:37:45.320 --> 00:37:50.080
And then the guys started running evals on it because we're always working on optimizing AI turns.
738
00:37:50.080 --> 00:38:00.700
And, like, to me, the layman's, correct me if I'm wrong on a scene, you know, the way I look at it is it's extraordinarily fast and cheap, but you're not going to get narrative responses.
739
00:38:01.440 --> 00:38:11.380
So, like, if you say, tell me if this risk is a critical or a low, you're not going to get back the rationale for the answer, but you're immediately going to get back very fast.
740
00:38:11.760 --> 00:38:14.460
It is 84% likely to be critical.
741
00:38:15.120 --> 00:38:17.200
And then you can go somewhere else for your rationale.
742
00:38:18.200 --> 00:38:19.140
I'm all excited.
743
00:38:19.140 --> 00:38:20.200
Everyone's all excited.
744
00:38:20.500 --> 00:38:25.360
We're starting to run some evals using this and figure out how we can allocate workloads and so on.
745
00:38:25.940 --> 00:38:32.980
And then I saw someone in the community post this article that said, like, I think it was, like, 240 lines of Python is Jev.
746
00:38:33.060 --> 00:38:34.220
Like, there's nothing new here.
747
00:38:34.260 --> 00:38:35.080
There's nothing interesting.
748
00:38:35.740 --> 00:38:36.940
I don't know why everybody's so excited.
749
00:38:37.040 --> 00:38:37.740
It's all just hyped.
750
00:38:37.900 --> 00:38:39.740
There's no way to really monetize this over time.
751
00:38:40.780 --> 00:38:41.420
What do you think, Sounil?
752
00:38:42.980 --> 00:38:49.120
So, let me, I'm not going to deal with the monetization piece, but let me just give some additional content.
753
00:38:49.140 --> 00:38:51.740
For those who are not familiar with Jev.
754
00:38:51.940 --> 00:38:54.440
So, it's also what's called a system one model.
755
00:38:55.100 --> 00:39:02.860
System one comes from one of my favorite authors, Daniel Kahneman, from his book, Thinking Fast and Slow.
756
00:39:02.860 --> 00:39:05.040
So, thinking fast is system one.
757
00:39:05.240 --> 00:39:07.240
Thinking slow is system two.
758
00:39:08.160 --> 00:39:15.640
The prefrontal cortex of our brain, which doesn't develop until you're age 25, is really the system two part of your brain.
759
00:39:15.840 --> 00:39:18.060
It's also your risk management part of your brain.
760
00:39:18.060 --> 00:39:29.800
So, those who are in security, cybersecurity, we should be thinking system two and be aware of some of the pitfalls of system one thinking.
761
00:39:30.300 --> 00:39:37.000
System one thinking is fast thinking, but it also is susceptible to things like stereotypes.
762
00:39:37.000 --> 00:39:48.500
And a lot of the problems that we have, a lot of the bad decisions we make, actually, is because of system one thinking.
763
00:39:49.180 --> 00:39:49.340
Okay.
764
00:39:49.600 --> 00:39:52.640
With that said, the decisions can be made very fast.
765
00:39:52.800 --> 00:39:53.000
It is.
766
00:39:53.140 --> 00:39:54.280
They are made very fast.
767
00:39:54.340 --> 00:39:55.800
They're very intuitive.
768
00:39:55.800 --> 00:40:02.140
If anyone's read the book Blink by Malcolm Gladwell, that is all about system one thinking.
769
00:40:03.320 --> 00:40:03.440
Okay.
770
00:40:04.260 --> 00:40:07.060
Now, what's it good for?
771
00:40:07.520 --> 00:40:14.040
And I think Jerry kind of hit upon, you know, is this, what type of risk is this or whatever else it might be?
772
00:40:14.320 --> 00:40:18.740
But I think, actually, one of the best use cases is just data classification.
773
00:40:19.520 --> 00:40:24.680
So, we have tons of stuff that meets quick classification.
774
00:40:24.680 --> 00:40:36.920
And you don't need an elaborate response from a – you don't need the output tokens from the Frontier Labs to generate a response.
775
00:40:37.040 --> 00:40:39.580
You just need to have what are called typed responses.
776
00:40:39.740 --> 00:40:43.940
The typed responses being fitted into one of these buckets.
777
00:40:44.080 --> 00:40:45.700
And you can have as many buckets as you want.
778
00:40:46.460 --> 00:40:54.500
And so, those buckets can include your simple five-tier or four-tier classification of, you know, confidential, proprietary, whatever it might be.
779
00:40:55.180 --> 00:40:58.540
But I would go even further and to do topical classifications.
780
00:40:59.840 --> 00:41:04.820
Because I think that's going to be where – that's going to be more interesting for AI.
781
00:41:06.340 --> 00:41:07.420
What do you mean by that?
782
00:41:07.740 --> 00:41:10.180
Were you getting found on that by topical classifications?
783
00:41:11.780 --> 00:41:12.140
Sure.
784
00:41:12.140 --> 00:41:12.220
Sure.
785
00:41:13.100 --> 00:41:17.120
So, this is actually something that we actually at Gnostic tried to solve.
786
00:41:17.600 --> 00:41:18.900
We pivoted away from this.
787
00:41:20.600 --> 00:41:27.860
And if Jev or something like a system one model were available at the time, we probably would have been more successful at doing this.
788
00:41:27.860 --> 00:41:40.120
But the notion of classification, just because you have something that's not considered confidential, doesn't mean that the combination of two things doesn't make it confidential.
789
00:41:40.120 --> 00:41:40.500
Right?
790
00:41:40.500 --> 00:41:45.300
So, the aggregation of information is what makes things potentially more problematic.
791
00:41:45.940 --> 00:41:46.800
That's exactly –
792
00:41:46.800 --> 00:41:49.760
That social security number by itself doesn't mean anything.
793
00:41:50.000 --> 00:41:54.340
It's having the context of that Mario next to that social security number.
794
00:41:54.420 --> 00:41:56.880
That's where it becomes – that's an example, right, Sounil?
795
00:41:57.300 --> 00:41:57.680
Exactly.
796
00:41:57.680 --> 00:41:58.000
Sorry.
797
00:41:58.000 --> 00:42:01.580
And so, think about what LLMs are now good at.
798
00:42:01.680 --> 00:42:06.000
It's pulling in that broader context, and then you just want a quick decision on it.
799
00:42:06.360 --> 00:42:11.580
The quick decision is really then bounded by – it's a bounded set of decisions.
800
00:42:12.220 --> 00:42:18.840
And therefore, one of the claims that's being made about the Jev and system one models is that they don't hallucinate.
801
00:42:18.840 --> 00:42:23.120
The reason why they don't hallucinate is because you're telling it exactly –
802
00:42:23.120 --> 00:42:25.480
Yeah, you're saying pick from this particular list.
803
00:42:25.480 --> 00:42:39.620
The other thing that's also really interesting and useful about this is – it's a concern that we all have, which is, sure, I would love to do data classification, but I don't want to send all my data to some third party, right?
804
00:42:39.620 --> 00:42:39.720
Right.
805
00:42:40.180 --> 00:42:55.660
Well, these system one models tend to be a bit more compact, and because they don't have the output token burden, it can be run on smaller machines as well.
806
00:42:55.660 --> 00:43:02.080
So, the point is that you can run these models locally, and they're super fast, you know, system one thinking, if you will.
807
00:43:02.580 --> 00:43:11.200
And so, it's just much more efficient and much more feasible for us to run these locally inside of our enterprise instead of having to ship all our data out to get classified.
808
00:43:11.200 --> 00:43:18.440
So, anyway, the number one use case, in my view, that we've struggled with in security for a long time is classification.
809
00:43:18.920 --> 00:43:26.940
And I think tools like Jev or open source variants like Leia, L-A-Y-A, are going to be ones that people should definitely look into.
810
00:43:27.720 --> 00:43:29.360
So, we – wow.
811
00:43:29.940 --> 00:43:32.520
There's a lot of things to say what you said.
812
00:43:32.520 --> 00:43:42.340
By the way, I do love that book from Daniel Kahneman and his partner, but there is now new science supporting that.
813
00:43:42.420 --> 00:43:43.440
That's all fake news.
814
00:43:43.840 --> 00:43:45.920
There's no such thing as system one, system two.
815
00:43:46.300 --> 00:43:47.020
There's actual –
816
00:43:47.020 --> 00:43:48.580
Well, it was a model anyway, yeah.
817
00:43:48.720 --> 00:43:49.180
Yeah, yeah.
818
00:43:49.220 --> 00:43:49.520
But I'm just saying –
819
00:43:49.520 --> 00:43:50.580
You can't get married to these things.
820
00:43:50.580 --> 00:43:57.960
So, but anyway, just to highlight that what we think is true today may not be true later on with more science.
821
00:43:57.980 --> 00:43:59.720
Or may not be popular is a better way to put it.
822
00:44:00.000 --> 00:44:00.360
Yeah.
823
00:44:00.360 --> 00:44:00.600
Yeah.
824
00:44:00.900 --> 00:44:10.040
I – so, I have these discussions with customers and this whole idea of classification of their data, whether it's PI, PHI, financial data, blah, blah, blah.
825
00:44:10.260 --> 00:44:15.200
And this idea that stays in their mode, but actually their mode is in a SaaS application.
826
00:44:16.120 --> 00:44:18.880
Let's say, for example, a CRM SaaS application.
827
00:44:19.420 --> 00:44:21.760
But they think they have some level of control.
828
00:44:21.760 --> 00:44:32.740
So, thus, you accessing the data, you can only access certain type of data that is not PHI or whatever that is, whatever, PII, for example.
829
00:44:33.340 --> 00:44:36.100
I think that's just, again, that's just another fool's goal.
830
00:44:36.740 --> 00:44:44.040
I think all data should be – if you have – if I'm a vendor, I want to make sure I'm protecting all the customer's data and a story.
831
00:44:44.040 --> 00:44:49.460
I don't care what it is, what type of data it is, just put the security that you need to employ.
832
00:44:49.660 --> 00:44:51.080
I disagree.
833
00:44:51.680 --> 00:45:07.880
And maybe we're not really disagreeing, but when I get into the reasons why, like, I think when it comes to securing something, and it could be classifying data, that it's not a safe bet, even like, as far as false negatives go, to just cover everything.
834
00:45:08.260 --> 00:45:08.360
Right?
835
00:45:08.420 --> 00:45:11.220
Because when you – overclassification is a massive risk.
836
00:45:11.220 --> 00:45:12.240
That's another way to put it.
837
00:45:12.260 --> 00:45:13.000
It's a massive risk.
838
00:45:13.020 --> 00:45:15.080
And it's not because it's busy or you have to be able to work.
839
00:45:15.200 --> 00:45:16.800
It's because you'll lose data.
840
00:45:16.800 --> 00:45:19.240
Because when everything is classified, no one will take it seriously.
841
00:45:19.960 --> 00:45:25.500
A great example of this would be – we've all played with data classifications, right?
842
00:45:25.520 --> 00:45:32.420
A million times we – I don't know about you guys, but, like, for me, it was the same pattern where you start out by trusting big four to tell you what to do on it.
843
00:45:32.420 --> 00:45:32.520
Yeah.
844
00:45:33.040 --> 00:45:36.320
And they write you a 64-page completely worthless document.
845
00:45:36.980 --> 00:45:38.940
And sorry, I'm not just crapping on it because it's a fun trope.
846
00:45:38.940 --> 00:45:40.680
I – because it's been there a million times.
847
00:45:40.840 --> 00:45:44.980
And when people who write the docs don't have to live by them, they're perversely motivated to make them bloated.
848
00:45:45.720 --> 00:45:51.000
So if you have a bunch of classifications that are ridiculous, you can't figure out what bucket it is.
849
00:45:51.040 --> 00:45:52.040
They're not mutually exclusive.
850
00:45:52.160 --> 00:45:53.220
They're not collectively exhausted.
851
00:45:53.220 --> 00:45:56.400
So we used to say, like, we knew what public data was.
852
00:45:57.300 --> 00:45:59.760
And we knew what the most sensitive was.
853
00:45:59.800 --> 00:46:01.280
And at first we'd call that confidential.
854
00:46:02.000 --> 00:46:05.080
And then we would start applying data classifications, right?
855
00:46:05.120 --> 00:46:05.580
So handling.
856
00:46:05.800 --> 00:46:09.880
And we would say things like confidential data may not be taken off site.
857
00:46:10.120 --> 00:46:11.620
Confidential data may not be printed.
858
00:46:12.000 --> 00:46:16.140
May not be in an – it has to be cleaned off of all desks at the end of every single day.
859
00:46:16.140 --> 00:46:17.960
But we overclassified.
860
00:46:18.280 --> 00:46:21.620
So we said that when you printed out that email, that's confidential.
861
00:46:22.040 --> 00:46:24.060
When you print out the network diagram, it's confidential.
862
00:46:24.400 --> 00:46:29.320
When you print it out – and the result is, if you know anyone that still has an office,
863
00:46:29.860 --> 00:46:33.060
maybe, Sounil, you're on the right side of the Mississippi River for that, but Mario – no, I'm just kidding.
864
00:46:33.180 --> 00:46:34.120
I know you have an office too.
865
00:46:34.580 --> 00:46:36.100
Walk around any office, any.
866
00:46:36.640 --> 00:46:39.120
And everything laying around is confidential.
867
00:46:39.580 --> 00:46:40.160
It's not public.
868
00:46:40.160 --> 00:46:47.580
So what we landed on is that you have to have a very strict subset of data that is something different.
869
00:46:47.760 --> 00:46:49.280
I like strictly confidential.
870
00:46:49.860 --> 00:46:55.200
And the litmus test is, can you say this has to be put in a locked drawer and not be an idiot?
871
00:46:56.020 --> 00:47:04.020
And if it's printed out bank account balances or social security numbers of customers, I think that's reasonable.
872
00:47:04.020 --> 00:47:07.380
Or passwords or API keys that for some reason they were written down.
873
00:47:07.740 --> 00:47:09.220
I think that's reasonable.
874
00:47:09.220 --> 00:47:11.100
I think we're agreeing, Jerry.
875
00:47:11.300 --> 00:47:11.700
Wait a minute.
876
00:47:11.860 --> 00:47:12.200
I think we're agreeing.
877
00:47:12.200 --> 00:47:13.020
But that network diagram?
878
00:47:13.440 --> 00:47:14.440
Let it fly.
879
00:47:14.620 --> 00:47:15.480
Paste it on the wall.
880
00:47:15.780 --> 00:47:16.740
Look at my whiteboard.
881
00:47:16.980 --> 00:47:20.780
And we're just lying if we pretend that we're going to have a clean desk policy.
882
00:47:21.020 --> 00:47:33.120
I think the minute you introduce general systems into this equation, and general systems, let's just say you're mixing information that you could classify as confidential
883
00:47:33.120 --> 00:47:35.840
and you're another information you can classify as being public.
884
00:47:35.840 --> 00:47:43.820
The idea that you're going to separate them and put them in different buckets, I think, is not achievable.
885
00:47:44.340 --> 00:47:45.660
I'm talking about as a vendor.
886
00:47:45.760 --> 00:47:47.080
I'm going to provide you a service.
887
00:47:47.500 --> 00:47:50.440
You as a client, you're going to give me both sets of data.
888
00:47:50.440 --> 00:47:50.480
Yeah.
889
00:47:51.360 --> 00:47:53.940
I mean, look at the banking rules.
890
00:47:54.560 --> 00:47:55.840
I think we talked about this.
891
00:47:56.700 --> 00:48:00.000
Before, every state had their own version of some banking rules locally.
892
00:48:00.440 --> 00:48:11.560
And what people did in those days was, you know, as a lawyer representing this bank or this company, I'm just going to go with the stringiest rule set in the whole state.
893
00:48:11.560 --> 00:48:18.060
And that's what I'm going to follow because I know at least if I can meet that security bar with that state, I can do it with the rest of them.
894
00:48:18.360 --> 00:48:23.800
And that is a concept, again, that I'm referring to when it comes to if you're going to mix data, public and private.
895
00:48:23.800 --> 00:48:25.240
I'm not talking about you internally.
896
00:48:25.520 --> 00:48:26.600
I'm talking about a vendor.
897
00:48:26.760 --> 00:48:28.020
You're using a service.
898
00:48:28.640 --> 00:48:29.720
A vendor is using that.
899
00:48:29.800 --> 00:48:32.420
I'm saying use the strictest level of security.
900
00:48:32.420 --> 00:48:33.400
I generally agree.
901
00:48:33.500 --> 00:48:36.940
But I think the headline here is that Jev might mean we don't have to do it that way anymore.
902
00:48:38.880 --> 00:48:40.440
I don't believe it.
903
00:48:41.560 --> 00:48:54.640
I see some of this challenge firsthand because one of my other roles in the ecosystem is a board member of the CyberAB, which oversees the CMMC program.
904
00:48:55.400 --> 00:48:56.660
There's a lot of acronyms there.
905
00:48:56.660 --> 00:49:06.740
So it's the Cyber Accreditation Body for the Cyber Maturity Model Certification Program for the Department of War.
906
00:49:06.740 --> 00:49:14.820
And addressing what's called Controlled Unclassified Information or CUI, C-U-I.
907
00:49:15.200 --> 00:49:33.340
And the basic premise here is that folks like China, our adversaries, they can collect enough unclassified data about the Joint Strike Fighter that they can then aggregate that and understand secret level or top secret level insights about the Joint Strike Fighter.
908
00:49:33.340 --> 00:49:42.240
Without having to intercept a package that was meant to go to Australia and got diverted to Hong Kong, for those who know what I'm referring to.
909
00:49:42.480 --> 00:49:56.580
Anyway, so the ability for an adversary to collect enough data at the unclassified level and aggregate it, that is the concern that we have when we talk about classification.
910
00:49:56.580 --> 00:49:57.020
Right.
911
00:49:57.020 --> 00:49:57.320
Right.
912
00:49:57.480 --> 00:50:04.620
What we really actually want to classify is not what we want to understand from a classification standpoint is not the discrete pieces of data.
913
00:50:04.620 --> 00:50:16.740
Because to Jerry's point, there's so much of that out there that if you try to classify every little discrete piece of data that could eventually be aggregated to something sensitive, you would basically classify everything.
914
00:50:17.300 --> 00:50:17.400
Totally.
915
00:50:17.400 --> 00:50:37.740
And so the question is, and it's not an easy answer, but the question is, how can somebody use, if someone's using data points X, Y, and Z, do they actually have a need to know for whatever may emerge from X, Y, and Z?
916
00:50:37.740 --> 00:50:41.320
And if they do, then they should be granted X, Y, and Z.
917
00:50:41.460 --> 00:50:51.040
If they don't, then you just be careful about how much you're willing to give, whether you're willing to give them all three pieces of data, so to speak, that they can aggregate on their own.
918
00:50:51.980 --> 00:50:55.260
It's the same, whether it's CUI, whether it's class-brain information.
919
00:50:55.340 --> 00:50:56.720
This is the internal person, right, Sounil?
920
00:50:56.800 --> 00:50:57.980
This is the internal person.
921
00:50:58.000 --> 00:50:59.460
Yeah, as a general principle.
922
00:50:59.460 --> 00:51:03.020
And this also applies for customer privacy questions as well, right?
923
00:51:03.020 --> 00:51:08.620
We're trying to anonymize a lot of stuff from customers, but at the same time, can you de-anonymize that?
924
00:51:08.740 --> 00:51:09.120
Of course.
925
00:51:09.360 --> 00:51:09.540
Right.
926
00:51:09.580 --> 00:51:12.920
You have enough data points, and you can de-anonymize a lot of things.
927
00:51:13.720 --> 00:51:26.420
But I would just add ephemeral access, that whatever you have access, in order to do whatever X job is, you might need access to a lot more data than your regular job needed.
928
00:51:26.740 --> 00:51:32.600
But you only need it for that particular job, and once it's done, remove access, bring it back to some regular user.
929
00:51:33.020 --> 00:51:34.140
That's the only thing I would add.
930
00:51:35.380 --> 00:51:35.740
Yeah.
931
00:51:36.040 --> 00:51:50.040
I mean, maybe overclassification is like, this feels like a safe way to deal with it, but I know, like for us, what's really compelling about it is that, by the way, you can take this topic and touch on FAIR, right?
932
00:51:50.160 --> 00:51:52.460
Meaning, people have been trying to do risk quantification.
933
00:51:52.460 --> 00:51:56.320
What I love about this is, this can do great risk quantification.
934
00:51:56.880 --> 00:52:00.820
And I've always been a qualitative model guy on likelihood and impact.
935
00:52:00.820 --> 00:52:03.440
Like, I never like to put dollar figures on risk.
936
00:52:03.900 --> 00:52:06.620
I shouldn't say never, but generally not the way most of the FAIRites do.
937
00:52:06.620 --> 00:52:07.360
Careful, Jerry.
938
00:52:07.500 --> 00:52:09.420
You're talking to two FAIR guys here, okay?
939
00:52:09.580 --> 00:52:10.580
Oh, okay, let's go.
940
00:52:10.920 --> 00:52:14.960
But I'm the guy who says, is it a crit, a high, medium?
941
00:52:15.080 --> 00:52:17.440
And then I understand people are like, well, that's so squishy and vague.
942
00:52:18.100 --> 00:52:21.020
And so, okay, they put us at a test.
943
00:52:21.080 --> 00:52:23.080
We're using AI to make a determination on that.
944
00:52:23.440 --> 00:52:25.500
And then you have a determinism challenge.
945
00:52:25.500 --> 00:52:31.560
Like, if you ask it 10 times and it doesn't give you the same answer, then it kind of proves the point of all the FAIR people of like, hey, it's squishy.
946
00:52:31.680 --> 00:52:32.840
Look, even the AI models or whatever.
947
00:52:32.840 --> 00:52:46.220
Well, what this, and let's call it a system one model, but what Jev is really great about that, and, you know, Mari, to be completely clear here, while it doesn't give you back a bunch of narration, it does consume a lot of context.
948
00:52:46.220 --> 00:52:48.260
So it's not like it's flying blind as guessing.
949
00:52:48.400 --> 00:52:53.680
It is evaluating the massive amount and trove of data and context that you have available to answer the question.
950
00:52:53.680 --> 00:52:58.680
But if you ask it, how much, how many dollars is this risk?
951
00:52:58.740 --> 00:52:59.720
It's going to give you the finger.
952
00:53:00.020 --> 00:53:01.040
Jev is not going to answer that.
953
00:53:01.240 --> 00:53:09.640
If you say, is it less than $20, more than 20, but less than 40 or above 60, then you're going to get percentage answers on all those.
954
00:53:09.640 --> 00:53:18.380
And they're as well-informed as chatty large models, but it's going to come back in about 200 milliseconds, which is just sick when you're doing 150,000 risks really fast.
955
00:53:18.380 --> 00:53:30.580
So to me, it just, I wouldn't say it says that my qualitative bucket-based methodology was validated and right or whatever, but it is a tool that is useful in that context.
956
00:53:31.100 --> 00:53:35.180
And it doesn't make, and fare is just going to get harder and more and more expensive than ever before compared to that.
957
00:53:37.380 --> 00:53:37.780
Yeah.
958
00:53:37.900 --> 00:53:40.760
And actually, there's a, there's an interesting aspect of what you just said.
959
00:53:40.980 --> 00:53:43.420
So those, um, no, no, no.
960
00:53:43.500 --> 00:53:46.900
So just to be, can I, can I put, can I quote you on that and put you on the podcast?
961
00:53:46.900 --> 00:54:01.880
Sorry, I meant to say, I want to, I want to double click on something that you just said, which is that, uh, it's, many studies have shown 95% of how most of us think, or just actually all of us really think is system one thinking.
962
00:54:01.880 --> 00:54:07.720
In other words, 95% of our time that we are, that our brain is processing, it's system one thinking.
963
00:54:08.240 --> 00:54:10.960
5% therefore is in the system two thinking.
964
00:54:10.960 --> 00:54:18.560
When we use AI systems today, uh, we're largely trying to get them to operate in system two capacity.
965
00:54:18.820 --> 00:54:20.660
Uh, they're not quite at system two capacity.
966
00:54:20.940 --> 00:54:21.740
They're there.
967
00:54:21.840 --> 00:54:30.620
It's, it's a, um, illusion of system two, but in the attempt to try to operate like a system two type of system, it can uses a lot of computation.
968
00:54:30.620 --> 00:54:42.920
So it's almost like the opposite, if you will, uh, today, maybe 5% of our processing, uh, AI wise is, is system one and 95% of our compute capacity is being spent towards system two.
969
00:54:43.100 --> 00:54:45.480
What it's, it's not having a math coprocessor.
970
00:54:45.620 --> 00:54:46.800
It's doing it all in main CPU.
971
00:54:47.700 --> 00:54:48.180
Effectively.
972
00:54:48.180 --> 00:54:48.600
Yes.
973
00:54:48.600 --> 00:55:10.320
My point at the end of the day is that as we see more, um, as we see the use cases of something like Jev become much more apparent, we're going to, I think we're going to offload more and more of, uh, what we typically, what traditionally would have put towards a system two type of use case or a system two type of, uh, uh, um, AI model and say, you know what?
974
00:55:10.380 --> 00:55:11.880
A system one model is good enough.
975
00:55:11.880 --> 00:55:29.720
And, uh, let's now, uh, put most of our, our, uh, quick thinking to that and then overlay the system two type of model, uh, which is our, which anyway, the overlay the system two type of model and the results of the system one model and say, Hey, let's make sure that this is correct.
976
00:55:30.300 --> 00:55:35.640
Well, and not only that, but you can also like, so if you ask it a question, you're like, is this a high value risk or low value?
977
00:55:35.640 --> 00:55:39.640
And just says high or low, that seems kind of short-sighted.
978
00:55:39.640 --> 00:55:44.400
But what you can then use the deeper thinking models for is you can lead the witness with that.
979
00:55:44.840 --> 00:55:47.680
So instead of saying like, is this high or low, you can say, this is high.
980
00:55:47.760 --> 00:55:51.180
And they love that explain why, and they'll explain anything that you tell it to.
981
00:55:51.360 --> 00:55:57.060
But this is like a valuable informed leading the witness and not just doing like confirmation bias.
982
00:55:57.940 --> 00:55:58.440
It's good.
983
00:55:59.000 --> 00:55:59.340
Yeah.
984
00:55:59.400 --> 00:55:59.640
All right.
985
00:56:00.000 --> 00:56:04.580
We've been rambling on forever, but there's one thing that's a totally different thing that I, uh, wanted to talk about here because I thought it was really cool.
986
00:56:04.580 --> 00:56:08.400
Um, I had a discussion come up recently about patch, cool down periods.
987
00:56:08.400 --> 00:56:21.020
Back when the NPM public packages had a number of, um, backdoor incidents where the maintainers were compromised and then someone submitted malicious updates and then the whole world pulled them down and ran malware.
988
00:56:21.020 --> 00:56:32.780
It led to pretty quickly a fast, and I can call it a knee jerk because that implies it's a bad idea, but a fast reaction to implement cool down periods on software upgrades.
989
00:56:33.480 --> 00:56:33.880
Meaning.
990
00:56:34.820 --> 00:56:39.460
Hey, there's a new update, a new version available of this package here.
991
00:56:39.460 --> 00:56:42.920
It used to be the race to let's get it in as soon as we can.
992
00:56:43.020 --> 00:56:43.600
We want to run.
993
00:56:43.840 --> 00:56:46.720
Um, I like the term, um, John Rogers term.
994
00:56:46.780 --> 00:56:47.820
I'll give him that the MSEIC.
995
00:56:48.060 --> 00:56:51.720
So currency, like having the latest always, if you do that, it's generally healthy.
996
00:56:52.040 --> 00:56:54.360
And now with this, the whole world said, well, hold on.
997
00:56:54.620 --> 00:56:56.060
It's good to have the capability to do that.
998
00:56:56.060 --> 00:57:04.420
But if we put a cool down period in there and I would say the mode land somewhere between three and seven days, meaning, Hey, there's a new patch out.
999
00:57:04.520 --> 00:57:05.120
Let's put it on.
1000
00:57:05.180 --> 00:57:06.200
Has it been out for three days yet?
1001
00:57:06.280 --> 00:57:07.460
No, wait, wait, wait, wait, wait, wait.
1002
00:57:07.540 --> 00:57:07.680
Okay.
1003
00:57:07.700 --> 00:57:08.060
Three days.
1004
00:57:08.160 --> 00:57:08.720
Now we'll put it.
1005
00:57:08.720 --> 00:57:12.240
And the reason was, and this is just me like setting the stage here.
1006
00:57:12.680 --> 00:57:19.220
The reason was, um, most of the packages that we heard about getting backdoored were ubiquitous.
1007
00:57:19.340 --> 00:57:20.540
Lots of people use them.
1008
00:57:20.820 --> 00:57:25.460
So one of the million and a half users would find the problem within three days and report it.
1009
00:57:25.520 --> 00:57:28.100
They pull that version, whatever it would take.
1010
00:57:28.120 --> 00:57:31.580
And by the time you pulled it, go to pull it three days from now and say, that's not available anymore.
1011
00:57:31.980 --> 00:57:33.220
Thank God we waited.
1012
00:57:33.800 --> 00:57:34.480
Everything's great.
1013
00:57:34.480 --> 00:57:39.580
One of the questions that came up was, um, what about security patches?
1014
00:57:40.640 --> 00:57:46.760
And I'm sorry, the word patch just sucks, but what about security related updates, CVE related specifically?
1015
00:57:47.680 --> 00:57:50.100
Um, are those exempt, right?
1016
00:57:50.140 --> 00:57:54.440
Cause we got a time to compromise that we have good data on being really short published CVE.
1017
00:57:54.820 --> 00:57:57.740
You only have hours before someone's exploiting it.
1018
00:57:57.740 --> 00:58:00.980
And you're sitting over there waiting for three days cause you're afraid of this, that, and the other.
1019
00:58:00.980 --> 00:58:12.140
So, um, I did a little bit exploration on this internally, but, um, do you guys have opinions on whether or not it's CVE related patch or where do you draw the line on exempting something, if anything?
1020
00:58:12.760 --> 00:58:14.180
So CVE is dead.
1021
00:58:15.560 --> 00:58:25.080
Um, I don't know if that's a sore point for many people, but, uh, most, most of the security issues that we find, um, that has a patch associated, but it doesn't have a CVE.
1022
00:58:25.080 --> 00:58:27.540
I think most of us hopefully know that.
1023
00:58:28.080 --> 00:58:37.360
Um, so the, the actual named, uh, vulnerabilities, um, is a small, small, small fraction of the security issues that we see.
1024
00:58:37.780 --> 00:58:46.760
Uh, moreover, I think right now, uh, the preponderance of patches that we see today have some sort of security element in it.
1025
00:58:46.760 --> 00:58:53.600
Um, to consider for example, iOS upgrades, I haven't seen an iOS upgrade in a long, long time.
1026
00:58:53.600 --> 00:58:59.320
That is just pure feature bug fixes and doesn't include a security patch of some sort.
1027
00:58:59.320 --> 00:59:03.240
Um, and saying, you could say the same about Microsoft as well.
1028
00:59:03.820 --> 00:59:05.340
But these are closed source systems.
1029
00:59:05.720 --> 00:59:09.560
So I would say the likelihood of them being backdoor is orders of magnitude lower than open source.
1030
00:59:09.560 --> 00:59:19.740
But as a general, uh, what I'm saying as a general, um, pattern, uh, and this includes open source software as well, that, uh, many of the patches that are being pushed out.
1031
00:59:19.740 --> 00:59:26.440
If you, if you just look at the changelog, uh, many of them do include security fixes, uh, alongside just normal features and such.
1032
00:59:26.560 --> 00:59:35.680
And I think that's largely because either they're proactively looking for security bugs themselves or somebody's reporting them in and the maintainers have figured out how to manage that appropriately.
1033
00:59:35.680 --> 00:59:44.800
So security patches, uh, I'm not sure if you can just make an exception for security patches because many of these patches are very much, uh, security oriented.
1034
00:59:45.500 --> 00:59:48.700
Um, but anyway, that said, cool down, I think is a, is a good thing.
1035
00:59:49.300 --> 00:59:59.640
Um, but I actually challenged even the whole notion of like, oh, we really need to radically rethink how we, uh, how we think about vulnerabilities and patching and all that stuff overall.
1036
00:59:59.640 --> 00:59:59.680
Yeah.
1037
01:00:00.560 --> 01:00:13.620
So wait a minute, let me, let me, let me, you're saying we find some researcher finds a vulnerability, but before they publish it, we say moratorium, we're not going to talk about it for another 10 days.
1038
01:00:13.780 --> 01:00:14.800
I mean, how does that work?
1039
01:00:15.660 --> 01:00:18.080
Oh, I'm not even referring to an embargo.
1040
01:00:18.080 --> 01:00:27.640
I'm just referring to, um, um, rather I don't know if there's even, unless there's like a really, really, uh, system wide infrastructure level vulnerability.
1041
01:00:27.900 --> 01:00:32.300
I don't think most people are even worrying about embargoing most of these vulnerabilities nowadays.
1042
01:00:32.300 --> 01:00:34.660
There's just so many to have to deal with.
1043
01:00:35.320 --> 01:00:39.600
Um, but I think, so that's, embargoing is different than I think the cool down.
1044
01:00:40.280 --> 01:00:42.500
Tell me, yeah, can you make that connection for me?
1045
01:00:42.520 --> 01:00:45.300
Cause I'm, I'm, I'm, I'm going to call Dom in here.
1046
01:00:45.740 --> 01:00:46.660
Tell me the difference.
1047
01:00:46.660 --> 01:00:51.540
Well, embargoing is just, uh, giving people time to patch without making it public.
1048
01:00:52.180 --> 01:00:54.800
Um, without even making the fix public.
1049
01:00:54.860 --> 01:00:55.280
Right.
1050
01:00:55.420 --> 01:00:55.700
Okay.
1051
01:00:55.800 --> 01:00:58.720
Cause once you have a fix, you know what the, what the vulnerability is.
1052
01:00:58.720 --> 01:01:08.420
So the, the, the fix, um, is either circulated and like, uh, usually it's not even, anyway, usually there's some sort of workaround.
1053
01:01:08.540 --> 01:01:08.860
Correct.
1054
01:01:08.860 --> 01:01:11.640
Or discussed, not necessarily a fix.
1055
01:01:11.640 --> 01:01:18.260
But the, but the point is that the embargo is really just to give defenders some time before they can, before the, before, uh.
1056
01:01:18.260 --> 01:01:18.960
Yeah, very different.
1057
01:01:19.580 --> 01:01:19.900
Yeah.
1058
01:01:19.900 --> 01:01:27.560
But I mean, I, I think that like, I, I don't know, I, I, you mentioned it like most patches have some kind of security related piece to them, or at least that a lot of them do.
1059
01:01:27.560 --> 01:01:33.020
I think we're thinking about different things in that if I think my iOS updates, you're totally right.
1060
01:01:33.020 --> 01:01:37.560
I also haven't heard anyone recommend anyone to delay installing an iOS update.
1061
01:01:37.700 --> 01:01:39.300
And it's not because they haven't been paying attention.
1062
01:01:39.420 --> 01:01:44.260
It's because it's closed source system and there haven't been met and there's a much threat until that happening.
1063
01:01:45.080 --> 01:01:52.680
It's like, if I go to GitHub right now and look at the top repos, paperclip AI is the biggest one right now.
1064
01:01:52.980 --> 01:02:01.140
And if you look at the change history here in the release notes, it's not exploited vulnerabilities and hundreds deep, right?
1065
01:02:01.140 --> 01:02:13.000
It's onboarding no longer gets stuck in the organization step, like normal software development and open source packages, similar to the general like stuff that's coming down via NPM that people are bundling in.
1066
01:02:13.400 --> 01:02:16.660
Those are generally feature function performance related.
1067
01:02:17.140 --> 01:02:22.680
And I think that's what we're all doing when we're having a cool off period is for that kind of stuff.
1068
01:02:22.680 --> 01:02:31.360
And so to that point, I found that like Dependabot is finding stuff and it's saying, hey, this is security related.
1069
01:02:31.540 --> 01:02:33.360
It needs to be automatically fixed.
1070
01:02:34.100 --> 01:02:38.580
But then there's a cool down period implemented and things aren't actually getting fixed.
1071
01:02:38.820 --> 01:02:44.400
So Dependabot does have an exception for things that are that are security related.
1072
01:02:44.480 --> 01:02:45.340
There I say it.
1073
01:02:45.340 --> 01:02:45.600
Right.
1074
01:02:46.280 --> 01:02:54.560
And I think it's about if there's a known if it's exploitable and we need to somehow tie that, then, yeah, you can't you can't rope that into it.
1075
01:02:54.700 --> 01:02:57.920
I think if it's exploitable, remotely exploitable, that's where I draw the line.
1076
01:02:58.080 --> 01:02:58.400
I would say.
1077
01:02:58.400 --> 01:03:00.560
Well, I mean, think about the kill chain here.
1078
01:03:00.600 --> 01:03:00.820
Right.
1079
01:03:01.260 --> 01:03:05.480
So if you're the bad guy right now, you think, OK, I want to target Coinbase.
1080
01:03:05.780 --> 01:03:06.960
I wonder what libraries are used.
1081
01:03:07.020 --> 01:03:08.520
Well, some of that you can find immediately publicly.
1082
01:03:08.760 --> 01:03:10.220
I'll just download the app and go a little deeper, deeper.
1083
01:03:10.360 --> 01:03:13.300
Very easy to find a few hundred packages that, you know, Coinbase uses.
1084
01:03:13.300 --> 01:03:17.560
And now I just bet that they're pretty smart and good at being current.
1085
01:03:17.620 --> 01:03:18.660
So I'm going to get in the latest thing.
1086
01:03:18.740 --> 01:03:19.100
So they did.
1087
01:03:19.200 --> 01:03:20.360
I think it was TJ actions.
1088
01:03:20.460 --> 01:03:21.660
Remember, that was one of the first ones.
1089
01:03:22.040 --> 01:03:23.200
Supposedly I was targeting Coinbase.
1090
01:03:23.860 --> 01:03:28.780
So that's a great example of they pause three days, seven days, cool down.
1091
01:03:28.940 --> 01:03:29.740
They don't get hit with it.
1092
01:03:30.700 --> 01:03:31.460
Everybody's happy.
1093
01:03:32.380 --> 01:03:32.520
Right.
1094
01:03:33.060 --> 01:03:36.980
That's however, if you want to say, well, I want to get them on a security patch.
1095
01:03:37.020 --> 01:03:38.100
I bet they're going to bring a security patch.
1096
01:03:38.140 --> 01:03:39.480
I'm not going to have any cool down period.
1097
01:03:39.920 --> 01:03:40.780
I'm going to get them.
1098
01:03:40.780 --> 01:03:44.780
First, you got to create an exploit for the package.
1099
01:03:45.180 --> 01:03:46.540
You got to inform the vendor.
1100
01:03:46.900 --> 01:03:49.920
And then you got to sneak in and get involved when they go to fix it.
1101
01:03:50.380 --> 01:03:53.440
So that when they say security vulnerability, don't worry, we got the fix.
1102
01:03:53.700 --> 01:03:55.100
Your malware is riding along.
1103
01:03:55.580 --> 01:03:58.680
And that's orders of magnitude more complex and unlikely.
1104
01:03:58.880 --> 01:04:00.880
So I'm willing to, I hate to say accept.
1105
01:04:01.400 --> 01:04:02.920
I think that's a lower risk.
1106
01:04:03.520 --> 01:04:04.140
Oh, that's right.
1107
01:04:04.220 --> 01:04:08.100
If the debate is whether or not cool down is a good idea or not, I think we, I think
1108
01:04:08.100 --> 01:04:10.100
most of us agree that cool down is a great idea.
1109
01:04:10.820 --> 01:04:16.480
I think the question really was what's a, what's a long enough cool down even for security
1110
01:04:16.480 --> 01:04:16.920
patches?
1111
01:04:18.200 --> 01:04:19.200
And so I think.
1112
01:04:19.360 --> 01:04:19.740
No, no, no.
1113
01:04:19.840 --> 01:04:26.840
I, to me, the question was under what circumstances is it okay to, to, to, to waive the cool down,
1114
01:04:26.940 --> 01:04:27.620
to waive the cool down.
1115
01:04:27.620 --> 01:04:30.480
And I say exploitable vulnerability patch all day.
1116
01:04:31.160 --> 01:04:31.600
Agreed.
1117
01:04:32.060 --> 01:04:33.160
I don't think anyone would disagree.
1118
01:04:33.380 --> 01:04:36.400
I think that's a, that's a override that people can easily do.
1119
01:04:37.180 --> 01:04:40.900
Um, but like I said, I think there's, there's so many, the problem is that we're going to
1120
01:04:40.900 --> 01:04:44.940
have so many, I personally think there's going to be so many security patches on a regular
1121
01:04:44.940 --> 01:04:49.060
basis that it will make it very difficult for us to, we're going to continually press
1122
01:04:49.060 --> 01:04:50.820
this exception button on a regular basis.
1123
01:04:51.100 --> 01:04:51.460
Hmm.
1124
01:04:51.600 --> 01:04:53.780
Perhaps, perhaps let's check in.
1125
01:04:53.780 --> 01:04:55.660
All right, guys.
1126
01:04:55.940 --> 01:04:59.480
Um, man, there's a lot of stuff to talk about and we can go down a lot of rabbit holes here,
1127
01:04:59.560 --> 01:05:01.580
but, um, thanks a lot for that.
1128
01:05:01.960 --> 01:05:06.740
Um, I mentioned I'm going to be out in San Francisco and a little bit, uh, I'm going to
1129
01:05:06.740 --> 01:05:07.660
B-Sides Atlanta.
1130
01:05:07.980 --> 01:05:09.880
I think it's, uh, next weekend or something like that.
1131
01:05:10.020 --> 01:05:11.740
My first B-Sides ever.
1132
01:05:12.700 --> 01:05:13.060
Anywhere.
1133
01:05:13.760 --> 01:05:14.160
Ooh.
1134
01:05:14.480 --> 01:05:14.680
Yeah.
1135
01:05:14.680 --> 01:05:15.400
You need to get out more.
1136
01:05:16.180 --> 01:05:16.520
Yeah.
1137
01:05:16.560 --> 01:05:16.940
Apparently.
1138
01:05:17.340 --> 01:05:17.700
Yeah.
1139
01:05:17.760 --> 01:05:20.700
And I'm only doing it because they have a lock picking thing and my daughter's really
1140
01:05:20.700 --> 01:05:21.220
interested in that.
1141
01:05:21.300 --> 01:05:21.760
I think it'd be fun.
1142
01:05:22.700 --> 01:05:23.520
Um, you gotta be.
1143
01:05:23.520 --> 01:05:24.240
You guys got anything?
1144
01:05:24.360 --> 01:05:25.740
Of a honey B-Sides.
1145
01:05:25.840 --> 01:05:26.760
That's what you gotta go do.
1146
01:05:27.480 --> 01:05:27.840
Yeah.
1147
01:05:27.960 --> 01:05:28.320
What's that?
1148
01:05:29.280 --> 01:05:30.800
Well, go do more B-Sides.
1149
01:05:30.960 --> 01:05:31.880
That's where the goodness is.
1150
01:05:31.880 --> 01:05:32.080
Oh, sorry.
1151
01:05:32.200 --> 01:05:33.100
The goodness happens.
1152
01:05:33.240 --> 01:05:33.440
Sorry.
1153
01:05:34.080 --> 01:05:37.060
Well, uh, do you guys have anything coming up that you're going to be plugged into where
1154
01:05:37.060 --> 01:05:38.880
people might find you if they want to stalk you?
1155
01:05:39.340 --> 01:05:39.520
Yeah.
1156
01:05:39.520 --> 01:05:45.480
So, um, I'm on the committee for, um, or, um, I'm helping organize a conference called
1157
01:05:45.480 --> 01:05:45.520
Unprompted.
1158
01:05:46.280 --> 01:05:46.640
Yes.
1159
01:05:46.820 --> 01:05:48.680
So that's coming up end of October.
1160
01:05:49.180 --> 01:05:50.600
We have, uh, we just went through.
1161
01:05:50.620 --> 01:05:50.760
You don't need to promote that.
1162
01:05:50.840 --> 01:05:51.720
It's so hot.
1163
01:05:51.720 --> 01:05:53.580
Is that a hot online, Sounil?
1164
01:05:53.700 --> 01:05:54.560
Or what is that going to be?
1165
01:05:54.560 --> 01:05:55.640
It's down the street from you, Mario.
1166
01:05:56.220 --> 01:05:57.460
It's down the street from Mario.
1167
01:05:57.460 --> 01:06:00.280
But, uh, we also have an online version as well.
1168
01:06:00.400 --> 01:06:06.840
Uh, we have, um, we, we just went through 500, uh, talk submissions and, uh, there's
1169
01:06:06.840 --> 01:06:09.040
some really, really fabulous ones.
1170
01:06:09.480 --> 01:06:09.920
Unprompted.
1171
01:06:10.240 --> 01:06:10.340
Right.
1172
01:06:10.420 --> 01:06:11.640
That's, that's what people need to.
1173
01:06:12.020 --> 01:06:12.040
Yeah.
1174
01:06:13.800 --> 01:06:15.080
Unprompted combat org.
1175
01:06:15.580 --> 01:06:15.980
Okay.
1176
01:06:16.060 --> 01:06:16.380
Wow.
1177
01:06:16.380 --> 01:06:18.100
So you'll be in San Francisco as well.
1178
01:06:18.440 --> 01:06:20.800
I think that's like, uh, the week after.
1179
01:06:20.920 --> 01:06:23.820
So like the 27th night, somewhere in that range, if I remember right.
1180
01:06:23.880 --> 01:06:24.040
Yes.
1181
01:06:24.420 --> 01:06:24.960
It's the week after.
1182
01:06:25.420 --> 01:06:25.660
Yeah.
1183
01:06:25.860 --> 01:06:27.740
End of, end of October, right before Halloween.
1184
01:06:28.320 --> 01:06:30.600
So Mario, maybe you'll be seeing both of us back to back.
1185
01:06:31.120 --> 01:06:32.260
Oh, the 27th.
1186
01:06:32.260 --> 01:06:32.540
Yeah.
1187
01:06:32.540 --> 01:06:36.020
We're, we're hosting a little bit of a dinner for our, our club.
1188
01:06:36.120 --> 01:06:37.440
Sounil, you're going to be there.
1189
01:06:38.080 --> 01:06:38.480
Yes.
1190
01:06:39.120 --> 01:06:39.520
Fantastic.
1191
01:06:40.040 --> 01:06:40.780
All right, guys.
1192
01:06:41.300 --> 01:06:42.060
Well, this is great.
1193
01:06:42.300 --> 01:06:44.400
I'm looking forward to, uh, speaking to you guys soon.
1194
01:06:44.520 --> 01:06:48.420
Stay safe and look out for any people that are, um, chasing you down and all these public
1195
01:06:48.420 --> 01:06:48.840
appearances.
1196
01:06:50.300 --> 01:06:50.820
All right.
1197
01:06:50.840 --> 01:06:51.340
Take care guys.
1198
01:06:51.720 --> 01:06:51.860
Cheers.