Trascrizione completa di Three Decades in Security: Same Old Bugs, New Hype, and the Hacker Mindset

contractors are still in business. And basically this type of thing is also what's happening with AI. Almost everybody could now do a vibe coding of an app. And it's not so bad if it's for your local desktops and automation, like make me a small app that organizes my files or fetches the emails, simple things. But the moment you make a service for other people, and you as an engineer probably know this, There's a lot of other things that come into play like resource starvation, locking congestion, memory pressure, terms somebody never has heard when you start vibe coding. And that means that they will not say that to their AI and the AI will not take that into consideration. So what we see is that AI will help a lot of people to do more on the contractor level stuff. and not so much on the real engineering or service level stuff. You still need proper engineers for that. People that can imagine huge data flows, the patterns of visitors, all those kind of things that come with experience. Those things are not in AI at the moment. So I think the AI is way too hyped. It can do a lot and I enjoy using it, also myself. This is my shirt today. Nune: Uh-huh. Adrianus Warmenhoven: But I think it's also dangerous and it's being oversold on its capacity. it will change fundamentally how we do things, but basically the browser did as well. I'm from the age, well, you can see all my computers that I have. Those are my real, old computers. They're old, but they all work. And I started out with a DOS computer with just a text terminal. And people were totally against Windows. And suddenly we had the Windows. And then we had the internet. And every time it changed how people worked with IT and data. And the same thing will happen with AI as well. But... Since we also now have, and this is culturally, the whole idea of everything needs to be making money, we get a lot of trash and all the other, I already see a lot of five-coated apps and services where they kind of learned a lesson about how we do all the dopamine triggers and then all the other apps. So everybody's immediately pushing really hard. for getting something out of it for themselves. And this is not really the correct way. So I hope at some point AI crashes or there's apps crash and then people get to their senses because it's an awesome tool, but it's being abused like nothing before at the moment. Nune: Hm. and and the primary reason for it being ab abused do you think is the monetary aspect of it, like monetization, the attempt to monetize it. Adrianus Warmenhoven: Yes, because I sometimes compare AI to, I say that it's the most inefficient programming language humanity has ever invented. And it's also the most flexible. And I say inefficient because it needs huge data centers sometimes to do the same thing that a small script on a Raspberry Pi could also do. But it can also do a lot of things. that we wouldn't get with traditional programming, at least not in the time frame that AI can do that.

So it's being abused in the sense that all the people that just want to make money and want to grab stuff out from others or manipulate them, they had Until a couple of years ago, they had this barrier where they had to find like minded developers to implement all those things. So you have a small barrier and that held back a lot of people because a lot of engineers are pretty ethical. And if you find one, that means a lot of other people didn't find that one. So it was a lot more difficult to make unethical software in the whole triggers gamification and getting money out. Now, people with that morality. they don't need anybody else. So they can just sit down in a week and have servers and nobody will tell them we shouldn't do this or this is not really nice or we shouldn't track somebody. We don't want all the data. There's no backtalk on any of the bad moral decisions. everything can now be built and everything can be put online. And to make matters even worse, those same people can also use AI to do the whole search engine optimization. Basically all the things they would have needed another human with their own moralities to talk to, it's completely gone. There are no safeguards anymore for people. Nune: Yeah, that's an interesting frame that this the people, the engineers usually had a certain level of morality that came from knowing how things work and now that barrier is gone, because people who didn't have these years and years in the industry, they can just jump and develop products. I I'm worried that this the speed of things is Also somewhat affecting the morality in a way that doing things right it usually means doing it slow in the beginning. and a lot of engineers are worried and scared because the economy is changing, and they start closing their eyes on the safety and security things, just simply using proprietary models, dumping a lot of data, etcetera, etc. But on the other hand, if you don't do that, you're basically behind everybody else because the l local models Adrianus Warmenhoven: because of the local. Nune: are not matching the speed and quality of the proprietary ones. So what can these people do? Adrianus Warmenhoven: Well, I'm not happy to give this answer, but the answer is not a lot. The reason that these proprietary models perform so well is because they have hideous amounts of data centered behind them. And your local model, well, if you're happy, you have maybe two or three GPUs and you get a little bit of performance out of it. I mean, for quality. things like the Chinese GLM53 model. It's nice and it will suffice in most cases. then there's Kimi, Moonshot. There's a lot of quality there, but it will be so slow on your local systems that most people either go to one of the hostess, but that's cumbersome. You have to put up your own systems and what... is happening and this is the American model all over again. saw that with Facebook, we saw that with Netflix. Convenience is basically what people are doing. They

feel like spending a little even a little bit time of setting things up on their own is already taking too long. So we have the American convenience model like with OpenAI or with Anthropic with Claude Code. You just download something and you tell it like maybe a minute later what you want to do and you're already on your way. And the performance is so high because they can afford like racks and racks of H200 machines like the real big AI machines with lots of memory. So there isn't at the moment a lot you can do about it because the scale is so completely wrong. In the old days, if I had a web server, I was pretty much the equal of any enterprise online. I could sit behind Cloudflare and I can handle the same amount of traffic. With AI, there is nothing I as a personal entity or even a small company can purchase or rent that puts me on equal footing with the real big ones. Because that's all compute power and that's ridiculously expensive. I even read a while ago that they're subsidizing this to keep down all the other startups. For instance, if you have a $200 a month claude code subscription, it actually costs Anthropic something in the order of $1400. So they're making quite a loss on it. keeps all the other competitors down. Nune: Yeah, exactly. That's what I've heard as well. And the worry out there is that it will suddenly change and they will make it pricey. do you think that that's gonna happen? Do you see that happening? Adrianus Warmenhoven: yes, I'm sure that CEOs cannot wait that they're itching to change things. You see this with Netflix, Xbox, Windows, even Mac OS. You see all these changes, not for the better of the consumer or user. They're just waiting until there's not enough disruptors available around them. This is exactly what happened with Netflix. When Netflix became big, it was almost impossible unless you're Disney or Paramount or have ridiculous amounts of money to get into that game. this is basically what they're now doing. They're they're ground prepping basically their business case for the coming years. This is really a startup strategy if you have a large, extremely large venture capitalist. and you're the first mover that basically you try to already modify the field. So it's difficult for competitors and it's easier for you to show what's unique on your side. This is basically this stage where we are now in. Nune: and on the other hand it might be that once it goes out to be expensive, people actually start investing more time into local setups and building more harnessses more use case driven automations, so that might be a good thing eventually. Adrianus Warmenhoven: When it becomes so expensive, we get back to the local economies. But that is never the goal of what is happening now. The goal of what's happening now is to get all the large enterprises and the large entities like governments, military, to get hooked just like with Microsoft Office. get them hooked on the ecosystems of either Anthropic or OpenAI. And once they're locked in, then it doesn't matter for them anymore. If you and me, we were doing a local model and we were earning there like 10,000 euros a month, they couldn't care less. Because it's not the scale of customer that they're looking for. At this moment, they're just carving out, just as with Office 365, they're carving out their playing field and then they don't care if we do other stuff later on. Nune: Yeah, we egoistically think that they think about us, but it's they pursuing much larger goals and we're just a s just a piece in the puzzle. let's talk about pri data privacy a bit. I do remember not so long ago I was telling people do not share your birthday online, it is dangerous. And now that sounds ridiculous because everyone has just dumped everything, their mental health problems, where they live what they do, what they think, what they eat to these n relatively new companies like Anthropic and OpenAI. Is this worrying you? And is there any going back to educating people to not do that? Adrianus Warmenhoven: I'm actually beyond worried right now. It's rather I'm flabbergasted that this happened. I'm looking at this and thinking, why? There's no part in me that can comprehend what we're, as humanity, are doing at this moment. I mean, we talk about privacy and then data leaks and then... When there's a small leak from a company like 10,000 people that does data and then it's all over the news and people get angry. And then a week later there's an article that says, yeah, 100,000 chats are being leaked with all the... Nothing, crickets. I really don't understand where we are. And I think it also comes from... the does this benefit me equation that people now have. The same thing as with which YouTuber they follow or and the same thing with the AI stuff is okay, there's a risk. It's not an immediate risk. I can't see it. There's no immediate repercussions and I get immediate benefits of the answer of the AI. So I think that's the reason why people are doing it. But The whole data companies like Palantir, they started out as being a world simulation company for the military. They're getting all the data now, not for free, but they have to buy it from Anthropic and OpenAI. But in the US that's allowed. It simply is allowed to sell data from one side to the other. and they don't even have to ask what the real source is. So yeah, it worries me in that aspect that the data will be aggregated, reformulated, and we will get even more triggers, just like we have the gamification with the dopamine already. There will be... more and better triggers that even people like me will not able to recognize small triggers and we will get a lot of I don't know if it's specifically for police state but it really sets the groundwork for that as well. If you know what everybody's political affiliation is, if you know what everybody's sexual orientation is, their religion is all the cross sections you can easily make and if you don't add in

how active somebody is, can easily brand somebody a troublemaker and then I think it's horrible that just a few people have access to all of that kind of data about everybody. But yeah, people still want the immediate benefits. Nune: Yeah, the the trick of it and i I would almost call it deliberate is that AI works better with the more information you give it. So that that just naturally dri as you said, is the trigger to share all your data with it. And if I would be into conspiracy theories, you can trace this from all the social networks where we w started being okay with The cookies because we were just clicking, yes, I agree, just hide the this pop up for me. Onto Covid forcing everybody to go online who wasn't online, and now this it's it's a scary thought. Adrianus Warmenhoven: It definitely is. also, it never will go away. I've done with I'm in security advisory board of Nord VPN as well. And we do researches sometimes and I get numbers and researches give me now. And we can also see that on the dark web these aggregations sometimes there's also data that you cannot find online right now, but it used to be there for like 10 years ago, 15 years ago, small nuggets of data even about me that are not online anymore. So you know that whenever something of this of your data gets aggregated, it will be there for a long time. It does not matter anymore if you start deleting it afterwards. Once it's online, it will find way to your profile. then this worries me. The other thing with AI and all the photos and stuff that would also worries me is the abusiveness of gen AI and these undress apps. I've looked in those as well. People are going over moral boundaries with leaps and bounds like I can't believe it. mean, people are doing so nasty things to each other at the moment. it blows my mind about that. Imagine this, somebody is really building an app and training it so you can undress women from a photo. And the whole morality of even starting to build the app, not even mentioning using it, but all the training. And people are not completely fine with it, but it's not like there's pitch or forks and people say, now we want to ban that stuff. this is so weird. I think it's so weird. Nune: Yeah, I wanted to actually ask you how do you as a professional who has been in this for so long, you how do you deal with this anxiety and the to the degree of being paranoid about how the world has changed and how seems like nobody's listening to morality and sanity anymore. How do you deal with this as a person? Adrianus Warmenhoven: Well, that's sometimes hard. one thing is having friends, like physical. mean, online is nice, but it's really nice to shut down sometimes in the weekend. And the weird part is, especially in my hacker communities, we have a lot of offline. So we're chronically online and we know everything, how everything works. But we enjoy it mostly if we're offline and having people contact. that's one thing that really helps. I try and also in

volunteer stuff and I know some colleagues who help women with it. I try to also do some volunteer stuff. I did some small charities last year like hospital and then. the autism group help them with their security as well. But on the other hand, yeah, sometimes it's extremely scary because a lot of digital stuff is also part of the physical warfare stuff and it all intermingles. And it used to be that if somebody was angry at you online, You just either block them or ignore them. Problem solved. Nowadays. There's ridiculous things that you can do on the the on the darker. There's been cases, at least in the Netherlands, where people just because they got angry online, they started doxing each other. Then on the dark web they hire a kid. 15 years of age to put a bomb against the door. Those are the things that. Yeah, so I sometimes I really think we've lost the plot and then I go outside and have good times with people and I think it's still all worth it. But yeah. Nune: Yeah, I guess the feeling of community and especially when you can help somebody that helps. Adrianus Warmenhoven: Yeah, then really people are people aren't talking to each other berating each other on morality anymore. It's like even in the train civic sense that that's the word those are the words I'm actually looking for. People have lost the feeling that civic sense is really important that Even if you only live online, you still go outside, you still live with all these people around you. And that's something that should be more promoted at schools or even amongst people. I was happily surprised this week. We have a street which is closed down and you have to step down from your bike and walk. Sometimes younger people don't do that because they have got places to be. And I saw that one guy was really berating his friends like, no, you have to get that. Those things really lift my spirit up a little bit that there's at least somebody trying. Nune: Yeah, every now and then you see a good human being and one Adrianus Warmenhoven: Yes. Nune: is enough to counter all the hundreds of cases of the negative things you see. so I dug out an article of yours from two thousand fifteen about abundance. and you literally named the root cause of security issues the abundance of code that we push out and that was 2015 we pushed out more code than we had security specialists protecting it. Now it's even I don't know a hundredfold, a thousandfold of that amount that was back then. do you do you see that that the situation is worse or is the security also is speeding up its development so it catches up with the develop the code amount. Adrianus Warmenhoven: Yes, the ability to quickly scan code and reason about it has sped up. We see a lot of bug fixes and we see, well, if you now look at your Windows updates, there's a ton more than before. You've seen Firefox a lot. It's projected glass swing by Anthropic So on the defender side, you see leaps and bounds being made. But I've also run a few tests on the financial side because nowadays it's also a financial matter. well, it's, is that 100,000? It's actually in the order of like five to 7,000 times cheaper to produce new code than it's to review that code. And it means that for most of the code, unless it's critical, people will not do that even with AI. So it will be way expensive. In 2015, there was enough money to get enough to get all the cyber specialists. Nowadays, not only is getting experienced cyber specialist difficult, but it's also the right amount and how much effort and money are you going to put in? So we're at the same stage as where the physical locks are. and physical locks never promise you there will be no burglar getting into your house. If you really look at the description, it will always say it has a time like it will resist attacks for like half an hour or something like that. Because that's what rating for locks on houses are. And we've also entered the area where cybersecurity now is also a part about insurance. It was really telling for me that when one of the chiefs of our Dutch intelligence service, secret service, went on to set up a cybersecurity company, one of the first things that he did was to add cyber, cyber insurance to his company. And that was really telling to me because this person has had a lot of insight information for, for the last few years. And the first thing that he does is saying, let's insure stuff. That means he doesn't believe either that you can defend it completely. this is the difference with 2015 is I think mostly that there's already so much we will never even be able to make up. We can still update all the new code and then I'm really looking at, instance, the Linux kernel, Torvalds. He's using AI in a really proper manner. then again, this guy always thought about things anyway. But there's simply too much coming out. So I think we're now at the point where we have to pick our battles, really think what is critical? What do we allow to be completely be broken? And Privacy thing is still the problem here because once you get this split between expensive security and almost no security, normally people should think about, I cannot give all my private data to this simple website because it will be leaked at some point because if they don't have any money, they don't update as much. There's vulnerabilities coming out every week. And expense, the big companies, well, they will leak your data anyway, mostly via Salesforce in the last year. At some point, everybody's data will be completely which is pretty socialist, I think. But yeah, this is the complete, the big difference, the scale and the expenses, not so much the amount of people, because if you're not saying. You can make money in cybersecurity. There will always be a lot of extra people. But the strangely skewed way of resources and how money plays a role nowadays in it, that's what I think is the biggest difference with 2015. Nune: Hm. So it's more about ensure ensuring

longer lifetime of your application security rather than securing it. It's it's not black and white, it's it's a period time. Adrianus Warmenhoven: Yes, you really have to think about can I make it more expensive than hacking somebody else because everything is now I've given talks about how targeting nowadays works. Targeting in the old days was I look at a company and think they've got money. So I start hacking it trying to figure it out. Nowadays, it's completely different. It's completely the other way around. Profiles are being aggregated, data is being bought from the dark web. Let's say we start with your profile, which is just a cookie. And at some point, an advertisement network sees website A and website B and you have the same cookie. Okay, so now for Nuna, we have these two websites. And on website B, you have a third cookie, which correlates to another website, website C. And at some point that starts becoming bigger and bigger and all of those websites have cross references. But also there will be data leaks and you have an account name, let's say Nuna at gmail.com and then we find in the dark web that Nuna at gmail.com also has an account on this dating site. So we have this leak which we also can put in the profile and this also goes for companies. So profiles getting bigger and at some point a profile will reach a critical size where it will also point to places where your data is vulnerable. And then you will almost automatically, I think some criminals will use AI at the moment already, you're automatically selected. It doesn't matter anymore who you are. It's just your profile is now big enough. We have enough data. So it's right for the plugging. And this is how cyber criminality goes nowadays. It has pretty radically changed in the last five years. And everything is done at scale. Everything is being sold as I'd say that half fabricates like resources. Somebody just selects and sorts data, puts that on the dark web. Somebody else buys that, enriches that a little bit, puts that on the dark web. And this is just a dark web, but as I said, Companies like Palantir, if you have enough money, you can just go there and even get an invoice for data stealing. This is something people really should understand. If you go YOLO, really go all out because it really doesn't matter anymore. mean, then abandon any caution. But if you want to defend yourself, it's really... hard because sometimes you need to go to Microsoft because somebody has a teams. Sometimes you have a Google Meet. Because I'm a contractor, I get a lot of different invites from all these platforms. I have a specific virtual machine only for that. Even at this moment that we're talking, it's completely contained. So all the cookies from Riverside, they will not be correlated with other stuff. But it takes effort. And most people will not make that effort. the big thing is here that data, doesn't matter if it's from your wifi or whatever, it all gets globed onto you and you will be automatically selected without the criminal ever knowing anything really about you. It's just data. Nune: It's a bit of a mind shift for for me as well. So you get a hackability index and once you reach a critical mass you just get hacked automatically. Adrianus Warmenhoven: That's a really good term, a hackability index. And it Nune: Yeah. Adrianus Warmenhoven: just software making those decisions now. We started out with things like Shodan these passive scans where you can see vulnerable machines. But now those vulnerable machines, that data is just pulled from the API. And if they see that, Nuna at gmail.com went to that IP address with this login. And from Shodan we can see this machine is vulnerable. Now it gets automatically hacked and then we already have one login. So we also can figure out the salt and all those things are now really automated. So leaving anything anywhere, that's not a good idea. But it's really hard and totally unfun to defend against that. Nune: Yeah, yeah. you talked about the early days of the internet, how we would there was a certain ego of showing off how smart you are. That was the sh the the the index of popularity was how smart you were. And for me, kid in nineties, internet was always an enormous place of information. you had a library and then you had internet w with that was a million times more than a library, plus a possibility to reach people who are knowledgeable and actually talk to them. Today it's AI generated text, AI generated images, AI generated I yesterday saw a musician who's completely AI generated with Spotify account and Instagram with thousands of thousands of followers. do you think the internet is basically dying or will it recover? Adrianus Warmenhoven: If it's going the same route that is going now, it'll be pretty bleak. Because I also see some mind blowing things that people are so good at doing stupid things. People need to send a report to their manager. So they have this small bits of fact. They put it in the AI and make this in the one page report. So they get a nice report with all the diagrams. It gets sent to the manager. The manager doesn't want to read this one page report because it's way too much in us. Summarize it for me. And they get this small bits of information Nune: Yeah. Adrianus Warmenhoven: which we already had in the beginning. So we've actually done the opposite. We are doing the opposite of zip files. We try to transport it in a bigger format than the original and at the end we make the original back again. It's performative. That's one thing that really amazes me. But also AI needs to be trained. Otherwise it gets stagnant. For instance... For NORD did the antivirus and one of the big problems we had was training data and getting proper non-malicious binaries. Because when you train a neural network, you need a lot of examples. And malicious examples is no problem because security researchers can get enormous amounts of feeds off of malware

samples, but. proper actually verified non malicious that was the difficulty. And the reason is you need to keep on training it for all the new software stuff. And the same goes for all these text generators or image generators. So AI needs to, if it wants to keep up with social things, then If you're into conspiracies, there's not one option that says, well, if they manage to everybody, get everybody into this time lock and do not want any new imagery, then you can stay with the current AI and you don't need to change anything. And sometimes I think about that if I look at television programs. Yes, I still watch linear television. And you see that. Wow, all these programs are rehashes from the early days. And sometimes I got this eerie feeling like maybe they don't want us to experience new stuff. I know it's not true, but okay. So if there's no training data, AI becomes stagnant. You can already see companies, AI companies, I've got these bot detectors and then. I have a lot of stuff that monitors things like Reddit, Hacker News, Quora, but also newspapers. And I think I'm pretty good at detecting bots at the moment with quite high confidence. And there's a lot of posts, especially on Reddit. where they want to get more information out of people like the last thing you ate is the name of this small cat. You've probably seen that that post coming by in tons of variations or would you go out with this or that in those. A lot of these engagement bait questions. to get more information out of people, how would people react? Because I know that some companies really want to have an AGI, an artificial general intelligence. And what they're aiming for is an AI that doesn't need to be trained on... need to be trained by being spoon fed current data. The target is basically if you have an AGI, it can just participate in society and learn from that. So you don't need. We're not there yet, but you can see all the efforts that are going there. And from that moment on, I'm pretty sure that the internet will be dying. You can already see this on Wikipedia, where there's lots of battles being fought with the editors. People are putting AI stuff in, but also in your... close area with friends, people put everything in an AI. Then they ask, how do I clean my coffee machine? They're not even Googling it and getting the information themselves. And in your brain, something happens if you do not try to understand the information. You will not retain it, but also things like your motor skills will not be involved. You'll see a lot of that as well. And I think... This actually started even before AI already. I'm from the Netherlands, we're a bike country. So this is known around the world. And I've grown up, I always had to repair my own bike because that's how we do. If you get a flat while on the road, know. Nowadays, people are not fixing their bikes. They're going to the repair shop across the seat. A new inner tube costs like two euros. and 15 minutes of your time and actually I did it yesterday. But they rather go for 25 euros to the bike repair shop to have somebody do that for them. And a lot of skills are being outsourced. then, well, sometimes they try to blame Gen Z for the coffee. Yeah. But the coffee is just one part and it's sometimes nice to have a really nice coffee or somebody else make it. But in general, I think we've outsourced too much. And this is why we have this whole everything as a subscription problem. Because once you start outsourcing it, well, somebody else needs to maintain all the workforce, all the resources. But if there's nobody else being able to do that, well, then they got you. So Netflix started out with low prices and then because everybody had alternatives. Now there's almost no alternatives with all the exclusives and stuff. They're raising the prices again and saying those for with the bikes in the Netherlands. now have this company that you can rent a bike. A bike is not expect I cannot for the life of me fathom it because the amount of money you pay for in a year. I buy a second hand bike and then it lasts me 10, 15 years. But people pay that every year. So I think again, this is convenience. If I were to write that article from 2015 again, I would probably say convenience is really the big issue. And I've been diving into this a lot also with my friends from NORD and the Mac. Because we have the problem, it's a social problem of critical mass. Even if I'm good engineer, I can do, make pretty much anything I want. However... I also succumb to the convenience stuff because a lot of people around me and once there's a critical mass, you just start going with the flow on these things. to get back to is the internet dying? Yes, because everybody is going to this whole influencer and short video format and talking through emojis. I'm so happy with AI by the way, otherwise I could not understand some people that are messaging me. I'm really like this old guy copy pasting like what does this mean? And then AI tells me this means this and then because of this sequence. Yes. And I really look at Nune: Hehehe Adrianus Warmenhoven: it thinking I would never have guessed that but okay. Yeah. Nune: You're not the only one. I I I'm younger than you, but even I don't understand a lot of the intricacies of using emojis to express your feelings and opinions. but if we try not to be all g g gloom about things, How do we actually continue using these tools without y losing the critical thinking? some some say it will go as the medical or the piloting industry went that there will be more simulations, more teaching opportunities that would replace this day-to-day little learning that we had by fixing our own bikes. Do you think that's a path or can we come up with something di different? Adrianus Warmenhoven: Well, there is a positive outlook. When I say I think the internet is dying, I actually want to say in its current form. Because humanity has changed a lot of times in the of

years because before writing there was nothing compared to writing storing ideas and then transporting them to people who have never even heard of you and still being and so humanity pretty much changed after that and the same thing with the internet as well I think we should I think we were going to see that that we're going to live differently because GUI and all these interfaces are just built for us to express our intentions to a computer. And to be honest, LLMs are pretty much the final interface. When I put it on, sometimes I even do coding on voice. Then I'm reading something and then I just give it instructions by voice. At some point it will tell me something where it was a So I can express my intention the same way I can do really naturally with you. It means I don't have to click or drag or anything. The whole barrier of this GUI stuff or typing is gone. So I can use the computer now to do a lot of heavy lifting for me without any barriers. It also means that a lot of things I held for natural. will now be gone. But this is the same as the old people who liked the terminals or the dust box. Well, at some point that was also gone and we all had graphical interfaces and then we had the mobile interfaces which changed also a lot of things. And I think we should really accept that. this will be the next evolution of, and it might take five to 10 years, but it will be the next evolution for how we work with computers. at the moment, we still need to screen and we still need all of this. But at some point I can completely imagine just having my headset and then just talking to my computers somewhere in the attic and saying, you have to do this, you have to do that, which is totally fine. It doesn't feel okay yet, but I'm really sure that at some point This will be nice. this is a positive thing. Another positive thing is that there's a lot of people now making a lot of effort in keeping things alive outside of the corporate sphere. Let me give you a couple of examples. I've had the luck to meet Mark Graham and he's the CEO of the Internet Archive. And it was really fun talking to him. Him explaining to me that they get like a petabyte of extra data every 10 days. like ridiculous amounts. But they store it in the old school engineering way, like with a standard Ubuntu distribution and a lot of thinking about resilience and that kind of stuff. And they help a lot of decentralized initiatives also for storage. So you already see more effort in those kind of things and then the same goes for hosting. We see a lot of small European stuff coming up. there's more of this pioneering effort now and the new pioneering effort. What I like about that is they integrate the AI stuff. more consciously so if they know we only need to automate some scripts, we're not just automatically using the API of OpenAI but we have a small model running on server because it can easily do that. Another really nice example was shown at DEFCON 34 by Andrew Wang or Bunny from Bunny Labs. I think it is calling now BAU chip. A couple of friends of mine, they made the badge for DEFCON. And on that badge is something extremely unique. think a lot of visitors don't even know that unless they went to the presentation. It is the first open source chip on there. Andrew Wang designed his open source chip. Everybody can download the design. He even also explains how you can do a chip run piggybacked off other chip runs. And then in the whole presentation on DEFCON, it's really worth watching. It explains what the chip can do and that you can just download it, expand it and there's no patterns, nothing on it. So you see that a lot of people that are getting into age from the engineering communities are doing more and more of these kinds of things like passing on. their skill sets and modifying them in the current world. So this to me is really cool because, okay, I'm not going to make an iPhone where all the chips need to be like in the 10 nanometer range. I would happily piggyback off a couple of custom chips of 28 nanometers or whatever. It's still small to me. So you see those kind of things. I've been talking to... a lot of drone manufacturers because well, we got a war going on. But also you can see that the people in there are in a different mindset than the consumer mindset. so what I want to say with all these words is that the good that I'm now seeing is that we slowly are seeing people getting off the I want to consume everything because I can for just a euro and it only takes a euro and an account or just an account and all my data. We now slowly see more people really getting new skill sets, sharing them. So it makes me cautiously optimistic. And the reason why I'm saying cautiously is because you need to realize that the bulk of humanity will still go with the YouTube shorts, the TikTok films and the whole dopamine triggers. But when you're in the engineering community or in the hacker community, you should not be looking at those people because those are not the people that you are in working with. you should look around and look especially at hacker communities where knowledge and all these kind of things are now slowly shifting in into how can we make this ourselves or how can we defend ourselves or how can we protect people that we love? How can we store data relatively cheaply on the internet if we all share? And even there's a lot of from the hardware hacker groups, a lot of things like LoRa, what if the internet breaks down, what if there are choke points, all these extremely smart people are now having fun figuring out new things about the new world because that's what really the hacker mindset is. You'll always look at the situation, you don't judge it, you just look at it like this is really what it is, now what can I do with it? I'm really happy that that mindset is coming up again because we had a couple of years where the hacker mindset was all but gone because everybody had a security personal

mindset. And I want to explain it really a little bit. When I give talks, I sometimes use two images. One is of, do you watch Marvel movies sometimes? yeah. Nune: Sure. Adrianus Warmenhoven: Okay, so you have Iron Man from the cave, like in the first Iron Man movie, and I have the other picture is War Machine. And I explained to them, well, I'm more like this first guy, like from scraps and I can figure out what's going on. But War Machine is the complete evolution of the same technology, but for offensive purposes. And this is what pen testers are and what a lot of current security personnel are. They are not hackers. They just are just like war machine, extremely skilled, really nice people, but they are not hackers. They don't look at things in the same way that hackers do. And we had this, because security was a big thing, we have this. big boost in security personnel, but we didn't have a big boost in hackers. And nowadays, I see slowly getting more hackers even in people I know from military data, they have small things, events to get the hacker mindset. I see it at NORD VPN I see it more and more that people are starting to understand. It's rather a mindset than a skill set. That actually makes me happy. I said, the chip, it was utterly amazing that somebody even could design an open source chip. But they went beyond. They not only designed it, they actually fabricated it and put it on the badges as a working thing. And people could play around it like 16,000 people suddenly had this thing. And the same goes with somebody I don't know, Bert Hubert, who is actually the founder of PowerDNS and he knows quite a lot about engineering. And at some point, he had some friends with biotechnology for hospitals during COVID. and he thought with a hacker mindset and they managed to do a lot of things which they couldn't purchase because just thinking things different. And I really love that those things are now getting more and more applied and also the engineering mindset in things. Like really fixing things and even if they're not the most prettiest or the cheapest or whatever, it makes things available again. Nune: Yeah, I think once something becomes easy, it becomes boring for some people and they find new ways of doing things that are not available for a large amount of people, and that is this small engine that keeps the whole internet community and tech community moving forward. Adrianus Warmenhoven: and also that they will be able to find each other because these are the things I always find funny that I'm not specifically looking for people that I already know or that are here. But if you go to all the events and you participate, will just simply meet them. because even, and this is something people should understand about fame, a lot of those hackers or engineers, they might be famous, but they're hackers and engineers first and foremost. They will not sit quietly in some dark room, only go in their star room, go on stage and get back. No,

they're really interested in all that kind of stuff. And they want to talk about it and they want to play around with it because that's who they are. And that's nice because that means more people get inspired by that as well. Nune: yeah, thanks a lot for for this question and answer round. in the end we have a section where I ask for book recommendations. and I would really like to ask if you have something inspiring in your mind, something that brings back this engineering and hacker mindset and inspires you to do things. Adrianus Warmenhoven: The first book recommendation I would like to give, but which is not very positive, but I think it's so important for people to understand how society is. It's an old book, a lot of people have heard from it, almost nobody read it because they saw the movie. It's The Time Machine by H.G. Wells. Nune: I loved it as a kid. Adrianus Warmenhoven: There's a specific reason because in a lot of Victorian books are societal critiques and this one as well. if you look at the movies, you think, OK, the guy in the time machine only gets to save the pretty girl. But that's not what the book says. The book goes about the Eloy and the Morlocks. Society has advanced so far that there's one group of people, the Eloy, that play all the time, they have fun and get food and stuff. And sometimes one of them disappears. And then he finds out that it's abducted by the Morlocks who actually run the whole planet. And they're underground and ugly and all those kinds of things. This is what's basically going on with society at the moment. Most of the people are happily in the Eloy phase, having food, having shelter, having entertainment, but they do not run the planet. They should really realize that there's Morlocks out there. So, The Time Machine would be my first not very positive recommendation, but it's a nice book. Books about the hacker mindset. Winn Schwartau has written a couple of fun books, I think the old cyberpunk novels would be nice. the William Gibson stuff and Neil Stephenson. Because it shows in those books, the hacker mindset is really prevalent in there because the protagonists, don't... have all the resources that the mega corporations have but they have something that only humans have and no AI will ever have like grit, determination and morals. yeah, so Neil Stephenson and William Gibson books because I also think Nune: Mm-hmm. Adrianus Warmenhoven: people are thinking have lost what cyberpunk really means. Nune: Yeah, it's eerie to reread old books, books from nineties. there's so much of what is written there is just happening right now. and I hope that the current books, the ones that are written now, will be able to be as reflective and as predictive as the ones in the nineties were for th of the future. Adrianus Warmenhoven: Yeah, as long as they're not written by AI. Nune: Yeah. Adrianus Warmenhoven: The thing with especially with the William Gibson books, it has a realism of what we also see with the

dark market. Where he said you could in his books already you could buy ice and counter ice which is counter intrusion electronics which is basically malware and specific malware you can order it custom those are all things that are happening for real right now so Nune: Yeah, indeed. so we have a tradition of every guest asking a question to the next guest and we were talking about fear of missing out and how everything is too much sometimes and my guest asked very what is a very simple and perhaps mundane thing in the physical world that helps you immediately feel grounded again. Adrianus Warmenhoven: walking outside. I've just looking at things. I always see so many things like small bits of slice of life. People talking to each other or in the Netherlands when people move. I feel like yeah, reality is still moving heavy stuff around and yeah, just walking outside and looking at people. I don't need a lot. When I was in New York last year, the people from Nord asked me what I did for entertainment. I just walked around and looked at everything. So that's it for Nune: Yeah, it's the same. It's it's amazing how just taking a walk gives you perspective as well. Just seeing v a a simple life around you suddenly gives you a perspective. so you get to ask a question as well. can be anything. Adrianus Warmenhoven: I think I will ask the question that I'm asking people a lot. And question is literally just a few words. Are you having fun? Nune: Yeah. Adrianus Warmenhoven: Because the answer to that is for me the most important thing. We live our lives getting older and stuff and have the good fortune of having a really good friend who I've known for like 33 years now. We were young, we see each other grow old. And the question is always, are you having fun? Because otherwise everybody will have some darkness and other stuff. Make sure you have some fun. So some Nune: Mm. Adrianus Warmenhoven: way as well, don't because you're getting gray, you're not gray yet. But once you get my age, I see way too many people around me becoming like these literal real grumpy people about how things change. Obviously life changes and world change. But just have fun. So my question again is, are you having fun? Nune: Yeah. Yes, thanks a lot Adrian. Thanks for this mix of anxiety and positivity and the final outlook of well, life is life. Adrianus Warmenhoven: Yeah, that's it. Nune: Okay. That was Adrianus Warmenhoffen, internet pioneer, security veteran, mentor, and a full time Mr. Mom, which he maintains as the best job he has ever had, and I believe him. If you want more of him, find him on LinkedIn, read his essays at warmenhoven.co and if you are serious, apply to be mentored by him on Mentor Cruise. Fair warning, in his own words, fle friendly, yes, easy, no. If this conversation made you rethink what you are pasting into that chat window, share it with someone who pastes even more than you do or is too paranoid to touch AI. I'm Nune and let's keep root causing this.