Meltdown and Spectre will kill us all

CES is next week, and we'll get to it, but first we need to talk to security expert Russell Brandom to make sure we won't all be dead from CPU security vulnerabilities before then. Also, stay tuned for Paul Miller's excellent and enlightening sci-fi short story allegory for how Meltdown actually works. He did a great job. Nilay Patel and Dieter Bohn, the world's foremost experts on what to expect from the world's most important technology tradeshow, make their CES predictions, and Paul does his weekly segment "Mustard, back off!" So wow, what a great episode. Sorry about the sad stuff where computers are fundamentally flawed and nothing is safe. 2:56 - Meltdown and Spectre 42:17 - Paul's weekly segment "Mustard, back off!" 48:14 - CES preview Learn more about your ad choices. Visit podcastchoices.com/adchoices

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:04Nilay Patel?

  Hello and welcome to The Vergecast, the flagship podcast of theverge.com. This is like a very special Vergecast because it's, there's a bomb cyclone in New York City. A bomb cyclone, that's the technical term for the snowstorm that's happening. So all of us are like hunkered down in various snow shelters.

• 0:27Speaker 01

  Can I say something that might be controversial?

• 0:30Nilay Patel?

  Yeah.

• 0:31Speaker 01

  It just kind of looks like it's snowing outside.

• 0:34Nilay Patel?

  Bomb cyclone.

• 0:37Speaker 02

  Paul, you're in the office right now.

• 0:40Nilay Patel?

  Yeah, I made it. I survived the bomb cyclone.

• 0:43Speaker 02

  It's like just you and Lauren.

• 0:45Nilay Patel?

  Yep. Yeah, Lauren Grouse is tweeting pictures of her like doing like some Martian-esque survival tactics in the office. She's like building forts and biomes. She's definitely growing potatoes here. By the way, in case you're wondering who these people are who are talking, because you have foolishly chosen this to be the first episode of The Vergecast you've ever listened to, I'm Neelai Patel, Paul Miller is in the office.

• 1:11Speaker 01

  Hello.

• 1:12Nilay Patel?

  Dieter Bohn is in San Francisco. Is it snowing in San Francisco?

• 1:15Speaker 01

  I am in San Francisco, not in New York, where it's not snowing because we're not, we're fine. Everything's fine.

• 1:23Speaker 02

  You guys had an earthquake.

• 1:24Speaker 01

  We did have an earthquake this morning. And you know, you know what we did when we had the earthquake this morning? We went back to bed. That's what you do.

• 1:32Nilay Patel?

  Seventy-two and sunny, Dieter. It's going great. And that fourth voice you're hearing is our friend Russell Brandom. Hey, Russell. Hi, happy to be here. Yeah, so we should just start. So we've got a couple of things to talk about. We were obviously off last week. We're headed to CES next week. So we got to talk about what's going to happen in CES. At CES, we won't be doing a regular Vergecast, but Dieter and Paul and I will be hosting the Circle Breaker Show live on Twitter each and every day, which just saying it out loud seems like a foolish decision, but we're going to do it. And it's going to be great. So we'll have all the gadgets from the show, we'll have hands-ons, we'll be posting that. I think our producer, Andrew Marino, is going to be doing some special behind the scenes stuff in the Vergecast feed from CES. No traditional

• 2:17Nilay Patel?

  Vergecast, we'll just be doing the Circle Breaker Show. So we're going to talk about what's going to come up at CES. But we got to start with why Russell's here, which is just gigantic news. The biggest news potentially of the year for computer security.

• 2:31Speaker 02

  The year, the year is four days old.

• 2:34Nilay Patel?

  I know, that's why I said it. Let's measure that statement. Let's see, let's see if it's real.

• 2:39Speaker 02

  Okay.

• 2:40Nilay Patel?

  But right, I mean, it's, it's, the year has begun and there's already this gigantic news.

• 2:46Nilay Patel?

  That certainly all Intel processors for one of the vulnerabilities and potentially all processors, period, all modern processors for the other one are compromised in some way. Russell, can you explain what's going on here?

• 2:58Speaker 02

  Yeah, so, um, essentially there is a lot of data that is on your computer that you don't want all the programs on your computer to have access to. Kernel memory, right? This is the thing. Uh, and they figured out some, because of the way the processors were sort of dealing with, uh, kind of running things in parallel, right? Like running more things in parallel has been a big way that we've gotten processors to run faster over the last 20 years. And it turns out, one of the ways that we were doing it, which was speculative execution, sort of allows you to find out things about kernel memory, which is really bad. And potentially you can use this to just extract passwords and, and encryption keys and all the, like the crown jewels.

• 3:42Nilay Patel?

  So there, there are two bugs here, right?

• 3:45Speaker 02

  Yeah, although maybe there are three, it's kind of weird. It's like, how do you divide them up?

• 3:50Nilay Patel?

  It's true. Well, so, okay, there are two categories. One is called meltdown.

• 3:55Speaker 02

  Yeah.

• 3:56Nilay Patel?

  And that is the one that affects certainly all Intel processors.

• 4:00Speaker 02

  Yeah.

• 4:01Nilay Patel?

  And then the one that you are just describing speculative execution, which we should explain what that is, is called Spectre.

• 4:08Speaker 02

  Well, no, so speculative execution is what the chip does and they're all, and, and so chips have been doing this for 20 years and, and they're, this is like the core thing that both of the, both of these are like exploiting.

• 4:21Nilay Patel?

  Well, the only thing I was getting to is the researchers who developed the bugs said they named it Spectre because it was related to speculative execution. And then they were like, also the Spectre of this will haunt us for years to come. I had this image of them like typing that and like smiling and being like, Larry, I put a joke in. We're all doomed.

• 4:41Speaker 02

  Paul has been talking all day about like different metaphors for how this, what this works. There's on Twitter, there was a great like library metaphor where like the librarian is bringing books to you on a cart. And the cart is the cache of the, the cache memory of the processor. And then by asking for books, even though she doesn't give you the books, you can tell which books are on the cart. I don't know, Paul, what was your like favorite metaphor for this?

• 5:08Speaker 03

  So here's how I've been thinking of it. So that there's the, the two main bugs meltdown relates to out of order execution of instructions. Inspector speculative, which is this thing called branch prediction.

• 5:25Speaker 03

  So, but basically if, if you're a program and you want to look at memory that you're not allowed to look at. An exception is thrown and you have to basically handle that exception or your program is terminated.

• 5:38Speaker 02

  Right.

• 5:39Speaker 03

  So what Google's meltdown exploit does is

• 5:44Speaker 03

  it, it, it tries to access that memory. It gets shut down, but after the instruction to access the bad memory, it does stuff that basically is like a, like a, a big semaphore in the, the cache of here's what I found. So, so.

• 6:03Speaker 02

  Wait, wait, wait, wait, wait. Being like communicating with flags across. Yeah. For the listeners who aren't familiar with semaphore.

• 6:13Speaker 03

  Semaphore is how boat captains say storms are coming. Here's my bad analogy and I'll try to fix it up. You're going to rob a bank, right? You walk up to the door, you don't rob the bank, but a parallel version of you in a different universe goes into the bank, goes into the vault.

• 6:33Speaker 03

  And picks up a piece of paper that has Neil's Netflix password on it and reads it. But how computers are supposed to work is that person gets that that version of you in that parallel reality gets shot. And that's how computers are running all the time. They're doing stuff that is is impossible or illegal because the this out of order execution, like it's not supposed to happen, but it does physically happen on the CPU, but just all the results are thrown away. So you don't get any results from that illegal thing happening, but the legal thing does actually happen. And so what Google developed is a special machine so that while you the version of you that just stood outside the

• 7:15Speaker 03

  bank is waiting, the version of you that did go into the bank in that parallel universe reads the Netflix password whispers it gets shot. But you have a special listening device to hear across parallel universe boundaries, the Netflix password.

• 7:36Nilay Patel?

  That's all I've ever wanted.

• 7:37Speaker 02

  Is this like there was that scene with the flash in Batman versus Superman where he shows up and he's like, watch out like this is a warning from the parallel universe.

• 7:47Speaker 03

  It's like Martha, the Netflix password is Martha.

• 7:50Speaker 01

  Aren't metaphors supposed to make things easier to understand, not more complicated?

• 7:55Speaker 03

  Yeah. What at what point is a bank robber doing semaphore?

• 7:59Speaker 01

  Why is the bank robber asking for Netflix passwords? He's in a bank. He should be asking for money.

• 8:06Nilay Patel?

  Wait, actually, before we before we go further down this, Paul, you've now mentioned twice that it's Google who did this.

• 8:12Speaker 03

  Yeah.

• 8:13Nilay Patel?

  Because they but they did it like sort of like officially, right? They participated in Intel's bug bounty. Talk about the people who discovered these bugs.

• 8:21Speaker 03

  Russell can probably talk to this better, but it's Project Zero, right?

• 8:25Speaker 02

  Yeah, yeah. So Project Zero, who I like desperately want to write about, and they they apparently are very secretive about these things. But basically, Google for a long time has been.

• 8:37Speaker 02

  Really invested in like finding vulnerabilities and they're just really good at it. They're they're like extremely good at finding vulnerabilities in commonly used software and not just Google software, which sometimes gets like Microsoft mad at them. And they're also very aggressive about sort of disclosing it. Like they'll really 90 days is what you get and that's it. Now, I don't know, this one is interesting because we're saying Intel. And I think the early rumor when people were talking about it was that it was an Intel specific bug. And then as we kind of get more into it, it's kind of more complicated than that. There are certainly variants of this infect AMD. There are certain things that like, I mean, everyone's having to patch, right? Like every operating system has had to patch every sort of like it.

• 9:21Speaker 02

  It's kind of everyone's problem because everything's running on Intel processors. But also, I mean, or AMD processors or any of this, but it really is. As as kind of technology gets more integrated and it's more people building like on top of things other people have built, more and more of the vulnerabilities are just, it's hard to be like, this is the person, this is the single company that needs to know about this. It's just how many people can we tell before criminals find out and start actively exploiting this? Yeah. Uh, and so that was kind of what we saw is that everyone knew something was up as of like last week. And there was, but certain people were under embargo and certain people weren't.

• 10:03Speaker 02

  And the register kind of came out ahead being like, well, we're not under embargo. So we're going to tell you what we know. And we sort of thought it was specific to Intel, but also didn't know the whole story. Right.

• 10:13Nilay Patel?

  Would you say the register bit the hand that feeds IT?

• 10:16Speaker 02

  Well, I mean, it's like, I mean, embargoes are always like a tricky thing, right? I think there, there are always going to be people who get them and people who don't get them. And then if you don't get them, then you don't honor them. And so you're either inside the tent or you're not. Um, I do think this one was just too broad to really be sustainable. There were too many people who had to know. I was

• 10:37Nilay Patel?

  Let's do that for a second. So Google runs this huge security research division called Project Zero. They're the ones who discovered these two vulnerabilities.

• 10:46Speaker 02

  Well, they were kind of like academic researchers, too. It kind of all ran through Google Zero eventually.

• 10:52Nilay Patel?

  Okay, so then there's two vulnerabilities. We're just like already so deep in the weeds. I'm just trying to be like

• 10:56Speaker 02

  Oh, yeah, yeah.

• 10:57Nilay Patel?

  Here's what happened. So Google, in partnership with academic researchers, discovered these two very serious vulnerabilities. One, which apparently involves pirates in a bank with flags. It's called Meltdown. That's they, the pirates get your Netflix password. The other one is called Spectre, and that has to do with speculative execution. Paul, can you explain that? Because that one appears to be the more serious one. Like Meltdown is already being patched all over the place. It seems pretty focused on Intel, right?

• 11:28Speaker 03

  So in Google's papers, um, wait, Dieter's been trying to say something. Dieter, what were you trying to say? I was gonna make a joke about boffins. Just, just go on. Okay. Okay, so Meltdown, um, in, in Google's paper, Google has two PDFs. One's for Meltdown, one's for Spectre. In Mel, the Meltdown paper, they say, we haven't been able to reproduce this on AMD processors, but we don't know for sure that it's impossible. This is, Google's almost developed a new technique of attack. And all the implications are not necessarily known. I heard somewhere that AMD basically is saying that the, the version of you that goes into the parallel universe and into the bank vault is literate.

• 12:11Speaker 03

  Like they, their architecture doesn't allow out of order memory reads, just executions, like so that the CPU can do stuff out of order, but you can't read memory in, in that out of order. And therefore they're safe from this. Spectre is based on branch prediction. So branch prediction in computers is that

• 12:33Speaker 03

  Like, you know, like when you kind of warm up a process and it starts working better over time, it's because the CPU is figuring, hey, I'm in this loop and this loop keeps going as long as it's true, but it keeps on being true. So I'm just going to assume I'm going to do this and I'll do it like a whole bunch of times. And if I'm told that, oh, wait, I went too far, then I'll like, you know, discard all those results and pretend it never happened. And so what what they're basically doing is they're reading legitimate memory and then they read past the end of that legitimate memory into the bad zone. And then, as far as I know, they do the same sort of semaphore thing, which I can attempt to explain if you

• 13:15Speaker 03

  want me to. But they, you know, they, they, they signal that the information that they found, once they got past where they're supposed to be. And the thing with Spectre is that it it can't get that kernel memory like meltdown can, but it can get at any other memory in the same process. And guess what has a bunch of sensitive information all running in the same process? Your web browser. And you can do Spectre, they've done Spectre with JavaScript.

• 13:48Speaker 02

  Wow.

• 13:49Speaker 03

  So right now, as far as I know, Russell, please correct me if I'm wrong, a rogue actor could create a JavaScript Spectre attack, buy some ad space on a bad website that doesn't vet its ads, and and hack whatever else it can find in that running process. Is that correct?

• 14:10Speaker 02

  So a lot of people are saying that they've patched against Spectre and we're sort of evaluating those claims. It's kind of tricky. A lot of people are patching, but then the patch is not really any clearer than the bug. So, but I mean, I do think that the scenario you described where like, there's a weird JavaScript thing that's running on your computer, and then suddenly it gets all of your passwords, is exactly the thing people are worried about. Because it has to, for this to work, it has to be running on your computer, but it can be running at the sort of lowest possible privilege level, as long as it can get stuff into the processor, then it can find out the other stuff that's in the processor.

• 14:55Speaker 03

  What's so scary about these is this is really an attack on the basic building blocks of what makes computers secure. Like, the whole reason your browser is secure is because it's an isolated process. Well, why is it an isolated process? Because the CPU doesn't allow that isolated process to look at memory outside of it. It's protected kind of at the CPU level, and this is an attack on that basic foundation of security.

• 15:22Speaker 02

  Yeah, and I think that's why it's so hard to predict exactly what the implications are, because it's sort of, this was this basic logical building block that we had for computer systems, that like, there's memory, like, there's this kernel, and you can't get into the kernel, but you can ask it questions. And like, that's just a basic sort of move that we thought we knew how to do, and now it turns out we've been doing it wrong this whole time. Which I would have loved to be is... Sorry, things are falling over behind me. But, uh, yeah, so we don't really know what to do with that, other than like, rip all the chips out of our computers.

• 16:01Nilay Patel?

  I would love to have just been in the room when these researchers were like, "Let's burn it all down."

• 16:07Speaker 01

  But no, like, this, to me, is really fascinating, and Russell, maybe you could talk about this a little bit, but like, there's this whole embargo, there's all these researchers, there's a bunch of people that know it's coming, and are like quietly patching, or getting ready to quietly patch, and then a little thing leaks out, and then all of a sudden, there's this rush, and it's not just, "Hey, here's a research paper," it's, "Hey, here's a research paper, here's another research paper, here's a website with an FAQ, here's two cute little logos..."

• 16:38Speaker 02

  Oh, yeah. The logos are like, people complain about the logos.

• 16:42Speaker 01

  "...here's some cute, cutesy names to like, let you grab onto them." And with like, previous, like, you put all that together, it's like a whole media strategy from these security researchers. And typically, when you see that sort of thing, and I, you know, I keep on thinking about Heartbleed, like, it's designed so that a regular person can be, can hear about this thing on the news, and be like, "Oh, yeah, the blah blah blah virus, I can actually, or the blah blah blah security vulnerability, I could pay attention to that." That makes me think I should go act on this problem, and then they go and they update their stuff. But here, it's like... Oh yeah, the blah, blah, blah thing. Uh, I guess I just have to hope that Amazon cloud services update their shit. Like there's, there's a whole lot of like

• 17:27Speaker 02

  Well, I mean, they did.

• 17:28Speaker 01

  Fury getting created, but I can't tell who it's getting directed at, you know?

• 17:35Nilay Patel?

  Update your Windows, right? I mean, that's like a thing that you should do. Microsoft issued that patch.

• 17:40Speaker 01

  Yeah. Apple's like pretty quiet, but anyway.

• 17:44Nilay Patel?

  Yeah. So this is, this is, I think the question that I've had since the beginning, the, the, you know, the white papers and the researchers, they're like, this affects smartphones. Spectre affects any processor that does out of order execution. But I haven't seen a clear, I'm speculative execution.

• 18:00Speaker 01

  Branch prediction.

• 18:01Nilay Patel?

  Branch prediction. Any pirates with flags.

• 18:04Speaker 02

  Some are.

• 18:07Nilay Patel?

  Uh, but I haven't seen a clear link to, between this and iOS devices or Apple's A series processors. Are they implicated in this?

• 18:17Speaker 02

  Yeah, we don't know. I mean, I think the, the, the point Paul was making about AMD, like there's a lot of, they kind of tried to do this on as many processors as they could. And they made it work on like some version of an AMD chip that they had like sort of physically changed to make it more hackable. So it's not like a great representation of the AMD chips that are just in someone's computer. I don't know that they've really taken a run at the Apple chips at this point. Like the question of has this been demonstrated on this chip is really just maybe there wasn't time to try. They thought all of this was going to break a week from now, and they were certainly going to be trying a lot of things in that period of time.

• 19:00Speaker 02

  Um, that's, that, that's one of the big unknowns is I also think given the like core nature of it, that a lot of chips are doing this, these things. Like this is stuff that the industry learned 20 years ago, you could do to make your chip run faster and like handle more commands at once. And so everyone's just doing it now. Maybe there's some reason why it wouldn't work on Apple chips, but it's weird to say default assumption.

• 19:30Speaker 02

  I mean, the default assumption has to be that it kind of works on everything, which is part of what's so alarming about it.

• 19:35Speaker 03

  I mean, these are very universal ways software works. Like, this is built in like to see in C++ the idea of exceptions. The idea that if you are trying to read some memory and you go out of bounds of where you're actually supposed to be, you get an exception and your program dies, crashes, or you handle that exception. So you do that a lot, and it's the completely common

• 20:01Speaker 03

  architecture of computers. And from reading the papers, it sounds like Google has like, for a lot of these things, like, okay, here are like three or four ways that we think we could do this. This one seemed like the easiest one, so this is the one we actually did, and here it is working. But there are these more difficult ways that possibly maybe somebody with, you know, more time or worse intentions could employ and get it to work in more scenarios.

• 20:29Speaker 02

  So here's the other weird thing. So the big question is like, what do we do now? You can patch it, and patches are going out. I mean, and the really interesting and important patch is what the firmware of the chip, right? What can, how can the chip behave differently so that you can't do this? So it doesn't work, right? The easy answer is just don't do the stuff that was slowing things down. Or, I mean, don't do the stuff that was speeding things up. So that you will just sort of roll back this innovation in chip processing. Which is, and so people were looking at this from afar and saying, this is going to slow down every processor in the world by 15%, right?

• 21:12Speaker 02

  I mean, this is a thing that people believed, you know, it was a very real possibility.

• 21:17Speaker 03

  It was like between 12 and 30% by some estimates.

• 21:20Speaker 02

  Yeah, well, so now they're saying, I don't know. The, Google has just said, we have this way of doing it that will not cause, will cause us negligible slowdowns. And Intel says that they have a similar thing. I mean, Intel, you figure they're maybe not the most reliable source at this point, but I don't see why.

• 21:37Speaker 03

  I mean, how angry is Intel right now that the story broke specific to them? And like, that just, nobody can shake it, right? Because everybody else is like, all right, well, this is Intel's problem.

• 21:48Speaker 02

  Well, this is the thing of the meltdown one.

• 21:51Speaker 03

  Let them think that. But the meltdown was.

• 21:53Speaker 02

  The meltdown one was sort of. Like focused on them and it was the most exploitable. So I wonder as things were leaking out, if that was just the thing that leaked out.

• 22:02Nilay Patel?

  Yeah.

• 22:03Speaker 02

  But yeah, I mean, it is, it is tricky. But so the interesting thing is it could be that there's a patch out there that we figured out some better way to do this that isn't sort of susceptible to this attack. And it doesn't really slow down the chips and we just sort of push it out to everyone and everything's fine. Or the other scenario is once all the pitches or once all the patches go out, everything is 10% slower. Or like two years, right? We're turning back the clock on Moore's law by two years.

• 22:38Nilay Patel?

  Yeah.

• 22:39Speaker 02

  Because which is an insane thing to think about in the context of consumer technology, where so much of the assumption is you want the new computer because it's like measurably faster than any computer you've used in your life. And you can, you know, use all of these programs that, you know, you can't use on a two-year-old computer because it just doesn't have the power.

• 22:59Nilay Patel?

  Have you tried a new MacBook Pro?

• 23:04Nilay Patel?

  You're still sitting right there. Well, so here's my question, right? So it broke specific to install. I feel like we didn't have a show last week, but last week was the Apple battery situation.

• 23:16Speaker 01

  Yeah, we talked about it a bit. We had it. We had, we had a little bit of Vergecast about that, but not like the full extent of the madness.

• 23:23Nilay Patel?

  Yeah, they apologized.

• 23:24Speaker 01

  Yeah.

• 23:25Nilay Patel?

  But it seems like we're just in a moment where software that slows down your computer for to solve some problem is it's like, it's a solution that is just like appearing now.

• 23:36Speaker 02

  Yep.

• 23:36Nilay Patel?

  Right? Like it, all of a sudden, it seems like, well, we're a little, we're like, we're a little too far over our skis with processor performance. If we actually just throttle this back, we can solve some of these bigger problems. Is that, does that seem like a trend or is that just two unrelated data points?

• 23:53Speaker 02

  Well, I wonder, I mean, people were talking about maybe the low hanging fruit with Moore's law and speeding up processors is kind of over. And we've been like over optimizing for, you know, gigahertz, which is not in the end that useful compared if you, if you had to choose like gigahertz battery life, like it is actually from a consumer perspective, they probably care less about it than the people working in the industry do.

• 24:20Nilay Patel?

  Yeah. Yeah, I mean, I just anecdotally, we've heard about Apple stores being inundated with people who just want a new battery. Like, they can't, they can't quite keep up. And it's like, yeah, people, if you give them the same phone with the same performance with the battery lasts as it did, you know, a new battery, like, they'll take it. They're like happy to pay the 30 bucks. I think as it relates to this, like, they're totally different problems. But would you pick a more secure computer that ran a little bit slower? I think the answer is like, undoubtedly, yes. So I just wonder, like, are we in a bit of a recalibration? And does this give, honestly, does this give Intel some space? Right? Like, it's all targeted Intel, but they make the most chips, especially for like these cloud applications.

• 25:03Nilay Patel?

  But obviously, the most chips in desktop PCs. Of course, it's focused on them. The question to me is,

• 25:10Nilay Patel?

  is it work on ARM processors? Like, are Samsung chips affected? Are Qualcomm chips affected? Are Apple chips affected?

• 25:16Speaker 02

  ARM processors are, we do know that there are at least some instances where it affects ARM. I think it is like they're, they've kind of become like a second fiddle in the story. And AMD was really loudly saying, it's not us. And people were like, I'm not sure. But I mean, it is other places. I think the other thing is, these, this, you know, e- even if it were just Intel, they are so dominant in the industry and their chips are so just inescapable. Anything you do in technology is going to be relying on this at some point, just at some stage of the stack, that one basic design flaw really is an industry-wide problem, even if it's just this one company.

• 25:56Nilay Patel?

  Yeah, we wrote that we had the story that was like, the big problem here is all these cloud computing providers.

• 26:01Speaker 01

  Yeah. So a couple of things about that. Like, one, I mean, we, we've, we've had the, the parallel universe metaphor, the semaphore metaphor. And I didn't quite explain.

• 26:09Nilay Patel?

  The semaphore happens in the parallel uni- universe.

• 26:13Speaker 01

  But the the deal, my understanding is the deal is if there's a bunch of different apps running and all they all use the same processor, use the same kernel, they're not supposed to fight out each other's information. But that's on your computer, that's one thing, right? Maybe a webpage will do it. If someone has physical access, they could do it like, that's one thing. But on a cloud server on AWS or Google Cloud or whatever, there are like hundreds of apps that are basically the web services you use every day that are running off of these giant servers. And that is a much more terrifying vulnerability. And so that's what Russell explained in his article. But like the thing that I'm trying

• 26:54Speaker 01

  to wrap my head around, and maybe by the time this episode airs, the state of play will change. But it seems like our initial take on Spectre was we're doomed for 20 years. We're doomed until every processor gets replaced. But now like Google and Amazon, or at least Google is coming out saying, actually, no, we it's fixed. We know how to deal with Spectre. It's fine. And like, I don't know, I have no way to judge whether or not that's true. It's very odd.

• 27:21Nilay Patel?

  Yeah, Russell, what's your read on sort of the lightning fast whiplash here?

• 27:27Speaker 02

  Well, I think because of the way it came out, the first person, the first people to say that there isn't going to be a slowdown and we can deploy the patch and it's not a big deal was Intel, who in some sense should know, but at that moment, there was not a lot of impulse to trust Intel when they said that, because I think people had first that well, first, they said, um, the uh, that other chipmakers were affected, which turned out to be true. But then they also said there isn't the workload is high or the slowdown is highly workload dependent. And I think there just was not a lot of trust. There was sort of like, they're gonna, they're gonna say this. There was also this weird

• 28:09Speaker 02

  thing about the CEO selling stock and people were kind of, and the embargo had been holding and holding and holding, and people were kind of more and more frustrated by it. But I think, I don't know why Google or Amazon would go out on a limb and say, "We fixed it this fast." Like, I think the fact that they're saying that is more compelling to me.

• 28:34Nilay Patel?

  Yeah.

• 28:35Speaker 02

  I still don't know if I want to take them completely at their word. And I also think, I mean, the other thing about sort of deeper level vulnerabilities like this is they don't stay dead. Stage fright is the example I always use where, you know, I think for nine months, Google had a new stage fright fix out with every monthly Android security bulletin, just because people kept finding like, "Oh, okay, well, you fixed against, if I write it that way, but what if I write it this way and it comes around this other angle?" And, I mean, to go to Paul's metaphor, it's not, now it's my cousin, but he looks like me, it's not a parallel universe, it's an identical twin. You can sort of keep playing this game. And it's very hard to sort of fix everything.

• 29:20Speaker 02

  So I do think, to the extent that like, there is a patch against the variance that we're aware of right now, and, and again, the ones we're aware of are also the ones, hopefully the bad guys are aware of, and so those are the important ones to patch first. But it, it, there's, the big question mark for me is how robust is this fix at all? And we don't really know anything about what they're saying they did. Like, Google, I don't know, 20 minutes ago came out with the most detailed explanation of what they did, but like, I mean, I'm asking the researchers who found it, like, is this plausible? And they're saying, "Well, I, I don't know what Intel is working with. I don't know what they did, so I can't tell you whether it's plausible or not." Like, it just, this is a black box to me.

• 30:05Nilay Patel?

  What's, the good news here is that Dieter, and hopefully me, but Dieter, at least, well, it depends on schedules, at CES, we're gonna have Brian Kazanich on the Circuit Break Show.

• 30:17Speaker 01

  Yeah, I mean, for, not for nothing, but Intel is giving the keynote speech at CES. Like, Kazanich is gonna be onstage at the biggest, like, electronics show of the year, three days, four days after all of this has gone down. And that's gonna be a very interesting moment.

• 30:38Nilay Patel?

  Hey, Beck, we're gonna put Intel processors in everything. It's fine.

• 30:42Speaker 01

  I, I do want-

• 30:44Speaker 03

  I I don't know. I don't have any special love for Intel.

• 30:49Speaker 03

  But I don't really think of these as bugs. This isn't like a dumb or careless engineer made like did a typo or like forgot to include a line or something like that. Like this, this was a carefully designed defense against security problems and and it was, you know, there are definitely a lot of bugs in Intel's CPUs and they're not like perfect, but this was working as intended in a sense. And Google's attack was just better than it, smarter than it.

• 31:26Nilay Patel?

  Do you think it was more or less like the movie Sneakers?

• 31:30Speaker 03

  A lot like the movie Sneakers for sure.

• 31:32Nilay Patel?

  Be great. All right, Marty.

• 31:34Speaker 03

  Wait, can I try to, can I try to describe the semaphore thing?

• 31:38Nilay Patel?

  Yes.

• 31:39Speaker 03

  Because I think this is really interesting. This also relates to cryptography. There's what's called a side channel attack. And and basically, after your cousin or whoever goes into the bank vault, it reads the password.

• 31:59Speaker 03

  That piece of code rewrites the cache in like in a real like special shape. And so you, because you're still not allowed to actually read this data that's in the cache, it's still protected memory.

• 32:16Speaker 03

  But by writing it in such like a kind of a loud way, they're able to see a signal in that noise and and slowly pull data out of that signal that's created. It's like, you know, the cache is meant for for ones and zeros, but but they're making much larger shapes that end up representing ones and zeros in the cache. And the similar stuff is done with cryptography. I think it's, I think it's really, it's really interesting and and it's probably going to be, you know, a longstanding thing in computer security. But the fact that no matter how secret something is supposed to be in the computer.

• 32:57Speaker 03

  It's still a physical process that actually happens. And so, you know, something actually, some work is actually done and therefore it's detectable. And there's a lot of defenses in CPUs and in operating systems, sort of, you know, randomized memory layout and randomized the execution of things and try not to, in the way like cryptography algorithms are designed to not like give themselves away for what they're actually doing. But ultimately, something actually has to happen on your computer physically. And therefore, if you can find a way to observe that, you know the secrets.

• 33:38Nilay Patel?

  I think that's fact, like, no one thinks about their computer that way, right? Especially as computers have become more and more like essentially solid state devices. Like, we've stripped out moving parts from computers left and right. And the idea that there's like a physical process happening inside of a smartphone, I think, is very opaque to people. Because, first of all, you certainly can't see it, right? Like, something else that is able to detect it has to see it.

• 34:05Speaker 01

  Apollo, are you saying that with regard to smartphones, you're a strict materialist? That there's...

• 34:13Speaker 03

  Yes, absolutely.

• 34:15Speaker 02

  Well, I do think there's something cool about like, because that's something that comes up over and over again with like, security problems in general. And I think even if it's not reading information, there's a way in which computer programming is kind of arranging these logical elements. And you, everyone's been thinking of the kernel as, well, you put it in the kernel because that's the thing you can't see. And they had to establish that in a physical way. Or sort of the underlying components of that, everyone assumed held, upheld these logical, sort of, this was this line in the sand. And then those elements break down. And that's what every security vulnerabilities in some ways is some logical thing that everyone

• 34:59Speaker 02

  assumed it, you know, this sort of sentence will hold no matter what. And we're going to build a program around it, this little block doing this thing. And then it turns out that, well, you didn't really pay enough attention to how it was working and there's this other thing and the logic doesn't hold anymore.

• 35:16Speaker 01

  One thing I'm curious about, have you guys heard of Risk V?

• 35:21Speaker 03

  It's like a new open source processor architecture. And I'm really curious to see if it turns out it's vulnerable as well. Because one thing I'm seeing from some programmers is that these CPUs are so, so complicated. And there are simpler ways to design CPUs. And there's also less opaque ways to design CPUs. You know, there's lots of undocumented instructions in Intel processors because they're not, you know, open source. So when Microsoft was having tons of problems with Windows and it felt like, wow, maybe we can never make a secure Windows, like, maybe we should start over from scratch.

• 36:05Speaker 03

  They started a branch in Microsoft to develop a new operating system from scratch as just, just as like a safety fallback in case they couldn't ever get Windows right. Or if they were just sued by a bunch of world governments for putting unsafe software on people's computers. And they eventually shut down that project because it turns out they were able to get Windows safe enough. But I wonder if you could see more tech companies, because there's a lot of tech companies already supporting RISC-V as like a really like low cost, you know, like something like a controller you can put in a hard drive or something. But more tech companies might be interested in supporting something like RISC-V as like,

• 36:47Speaker 03

  okay, we need a simpler, more transparent processor architecture so that we can be more sure that we're safe.

• 36:55Nilay Patel?

  I think it's like very idealistic. So I think the RISC-V thing is really interesting. Like, the idea of the open architecture, it tends to imply that, like, problems will be solved more efficiently because more people can see into it. But I think the challenge here is that you have to then apply the patch, right? So the fact that like, there's only a handful of vendors who are in control here means that you get efficiency in patching. Right? So like Intel can just like fix it and then like send the patch out to its processors. If you have to trust Intel, obviously. But you have the pure open thing and it breaks. It's like, who is going to patch it?

• 37:40Nilay Patel?

  And then how does that get distributed?

• 37:41Speaker 01

  I'm waiting for the the other shoe to drop with ARM processors. Like if it if it ends up affecting iPhones, Apple will patch every single iPhone on the planet. And they'll do it, you know, tomorrow. And then they'll do a patch three days later because they accidentally broke something because they're really bad at software patches lately. But if it affects Android phones in a in a really easily exploitable way. Like if I can go to a webpage on the Chrome browser on my Android phone and they can execute some JavaScript that can get into this thing. Or it, you know, it gets into the Play Store, whatever.

• 38:13Speaker 01

  Then like this is yet another instance. And it seems like we have one of these like with increasing frequency of is Google going to figure out how to get Android phones patched better? They've gotten way better than they have in the past couple of years. Uh, but it's still like, at some point, something has to give there where like it has to be like truly solved on a more permanent basis.

• 38:39Speaker 02

  You're saying we need a national telecom.

• 38:41Speaker 01

  Yeah.

• 38:42Nilay Patel?

  Nationalize the shit.

• 38:43Speaker 02

  So I will just say, Google in its mitigation sort of report said that on the Android platform, exploitation has been shown to be difficult and limited on the majority of Android devices.

• 38:54Speaker 01

  Okay.

• 38:55Speaker 02

  But that's not like impossible. Yeah. Like, so, I mean, timing mitigation for ARM processors was a patch that went out. But it's all still kind of haphazard. I mean, I don't know how much that's going to hold. The other thing I would say on the open source front, the reason that it broke early and that there were all these uh rumors about it was because it went out to Linux developers. Because you need to patch the OS. And and I mean, there are all of these servers things, you know, a lot of Linux based programs running on servers that are extremely vulnerable to this on, you know, on vulnerable processors that really did need to be part of the rollout.

• 39:36Speaker 01

  Right.

• 39:37Speaker 02

  But also then it was just in some open listserv. And you would get someone saying, well, I have this patch. It slows down the program by 17%, but we have to install it because there was this problem. And I can't tell you any details about the problem because, hey, by the way, I'm under NDA, but it's all Intel's fault. That was a listener message. That was all we had to go on for like weeks and weeks. Um, so, you know, open source has its drawbacks too.

• 40:05Nilay Patel?

  Yeah. This is why there should apparently only be one vendor and that vendor should only allow certain developers to pay a fee to write application software in strict sandboxes. Right? Isn't that the, isn't that the Apple way? Like, there's like, a question is like, does iOS even let you do this unless you drive the phone?

• 40:24Nilay Patel?

  By the way, I don't believe that's true. I'm just saying that's like, Apple has its advantage there.

• 40:28Speaker 03

  Yeah. It's kind of hard to do formal verification of a program to, to tell for sure that it doesn't ever exceed an array boundary. If you, if you had a capability, like people do, do a lot of work to try to test programs to make sure, to, to hope that they don't. But for like a regular C or C++ program, um, there's still a lot of errors out there. As evidenced by any time, anything bad happens with your software.

• 41:00Speaker 03

  Like, the thing is like most, the, the, this is exploiting something that is basically looks like what a typical, the reason exceptions exist is because programmers mess up sometimes.

• 41:15Nilay Patel?

  Like, they should just stop doing that.

• 41:18Speaker 03

  Right. Obviously, obviously.

• 41:20Nilay Patel?

  So Russell, what's the, what's the like, the takeaway and what's next for sort of the average person listening to this?

• 41:27Speaker 02

  Um, well, definitely update your computer. Uh, and I would say definitely be aware of the fragility and impermanence of all that surrounds us.

• 41:40Nilay Patel?

  This is good life advice.

• 41:43Speaker 02

  Yeah, I don't know if I have anything beyond that. I think it's tricky because we still, there is still so much we don't know compared to like most of the things we write about on the verge.com where like, there's just a lot of stuff getting, that's falling into the cracks between companies and between implementations. And so I feel like we don't really know.

• 42:03Speaker 02

  What the the one sentence takeaway on this is gonna be yet?

• 42:07Speaker 03

  Right.

• 42:07Nilay Patel?

  Yeah. I'm telling you, this is the story of the year, calling it four days in.

• 42:12Speaker 03

  Wow.

• 42:12Nilay Patel?

  I'm probably wrong, but you know, you gotta, you gotta start the year with the, with the bang. Alright, so here's the deal. We don't have ads today because this is actually like a, we weren't gonna do a show. But then we're all, I'm sitting here in the snow. We should do a show. But we don't have a normal place to take a break. So Paul, here's my idea.

• 42:30Speaker 03

  Yeah.

• 42:31Nilay Patel?

  Every week.

• 42:32Speaker 03

  Uh huh.

• 42:33Nilay Patel?

  You do a segment. In this week, that segment will serve as the bridge from the Spectre discussion into CES discussion.

• 42:42Speaker 03

  That's great. I'll do it as a, as an ad.

• 42:45Nilay Patel?

  So what's your?

• 42:47Nilay Patel?

  So it's always got the same name though. What's that name again?

• 42:50Speaker 03

  Uh mustard back off.

• 42:56Speaker 03

  Oh, I'm so, I'm so mad about this. You know, when you get mustard all over your laptop?

• 43:05Speaker 03

  Don't you hate it?

• 43:08Speaker 03

  You're, there you are, just living your life and your must, your mustard's jars are surrounding your laptop. And then you knock one over and there's just mustard everywhere. Well, do I have a solution for you?

• 43:24Nilay Patel?

  Oh my god.

• 43:25Speaker 03

  Dell is bringing a new version of its XPS 13 series laptops to CES this year. And they're mustard resistant.

• 43:40Nilay Patel?

  Wait, wait. I have a number of questions. The first is, haven't laptops traditionally been mustard resistant?

• 43:50Speaker 01

  But this one is white. And so like, there's a, there's a bunch of new materials happening to laptops. There's Alcantara fabric. And then like the Pixelbook has its advanced silicone variant, whatever the hell. Uh, the question is, will that stay white or not? Cause computers just always get grimy.

• 44:05Speaker 03

  Mine is definitely getting grimy.

• 44:07Speaker 01

  Yeah. Dell's new thing is that their, their white version of their XPS uh is mustard resistant. Yeah, it has a woven carbon fiber texture on the palm rest and that's white. And they say it claims that if you get permanent marker, mustard and other staining materials on the white surface, you'll be able to wipe them off within a week without any issue. Within a week? Yeah. So you don't, if you leave the mustard on your laptop for more than a week, no guarantees from doubt.

• 44:43Speaker 01

  Hey, so hang on, like, I'm very angry about this new XPS 13. Okay. Promo code. Did they move the camera? Ads over. This is why I'm very angry. Promo code is mustard. The XPS 13 has, was for years, the default, de facto go-to, this is the best Windows laptop. It had the best design. It was super thin. It was great. It had tiny, nonexistent bezels on the left side, on the right side, on the top of the screen, but not on the bottom, because that's where the camera was. And everybody hated that camera because it shot directly up your nose. And we've been waiting for, for them to come out with a new version

• 45:23Speaker 01

  of the XPS 13 that could finally dethrone the Surface Laptop from Microsoft, the Surface Book, and be the next version of the thin, ultralight Windows computer that could be in the same category as Apple's, like little itty bitty MacBook, but have all the power of a full Intel processor and not the crappy thing that Apple has been sticking in the MacBook. And it would run Windows and it would be great. And I was very, very excited when I saw that was also going to be mustard proof. So I clicked that link and I saw they added the Windows Hello camera, it looks like, because there's two cameras, so it can do the Windows Hello login, which is awesome, but it's on the bottom again. They just. What are they doing? They just don't, like, they, they're just, they want that tiny bezel and they

• 46:07Speaker 01

  can't figure out how to like, just shift everything down. And, and so it's just on the bottom again, just. And they want to take, take secret pictures of your knuckles. Yeah.

• 46:18Speaker 01

  I mean, it's going to be 0.46 inches thick. It's going to weigh 0.2 pounds less. Uh, it's like, it's going to be so good. Everything is going to be great. And they fixed the camera. Instead of being in the lower left, it's now in the lower middle.

• 46:37Nilay Patel?

  Well, so now, I mean, we have to review this laptop and put mustard on it. Yes. Absolutely. And also on our, on our face.

• 46:43Speaker 02

  Put some mustard on it.

• 46:48Speaker 02

  Like the rapper.

• 46:49Nilay Patel?

  Yeah.

• 46:50Speaker 02

  Or the producer.

• 46:52Nilay Patel?

  We've got a, I don't know, man. I don't know what you're doing, Dell. All right. So that, I mean, like, if you have a super popular product that people love, and there's but one complaint about it, shouldn't you solve that problem before adding mustard resistance? Yes. Yes, you should. They're like whiteboarding the priorities and they're like, hmm.

• 47:14Speaker 02

  Here's my question.

• 47:15Nilay Patel?

  Angela, you've got some great ideas about camera placement, but Steve here is working on mustard resistance. I think we're gonna go with that. Like, what the fuck are you doing?

• 47:23Speaker 02

  Is mustard like a more, does it work with like ketchup and mayo?

• 47:29Nilay Patel?

  Like, can you spill an entire sandwich?

• 47:32Speaker 02

  Why would you lead with mustard?

• 47:34Nilay Patel?

  They say permanent markers. I just think they were trying to be like informal and anecdotal. No, because if you're eating a sandwich and you're like, do the thing and like the, you know, the condiments squeeze out. Mayo's fine. Mayo's white. No one's ever like, I got mayo stains. Ketchup's red. Ketchup is red, Paul.

• 47:56Nilay Patel?

  Thousand Island dressing is beige. Relish is green.

• 48:01Nilay Patel?

  We gotta stop this. Tweet us your favorite condiment and its color.

• 48:07Nilay Patel?

  To at future Paul. And we'll, we'll make sure to spill out an XPS 13.

• 48:14Nilay Patel?

  All right, this brings us into gadgets. Yeah. This next week is CES. We are expecting a, you know, a medium flood of gadgets, I would say. Every year CES seems to get a little bit smaller and a little bit more about cars. Yep. It's always the same level about TVs.

• 48:33Nilay Patel?

  So there's already like 8K TVs, Roku's going out, they've already announced some like new voice control stuff that we'll probably see there. Do I really want a Roku voice assistant? Is that what I want in my life? No, I don't know why they're doing this. Yeah. And they also announced something called Roku Connect, which lets you more easily pair a soundbar to your Roku, and it just seems like. You are solving a problem that people don't have.

• 48:54Speaker 01

  Yep.

• 48:55Nilay Patel?

  At least as, as, as far as I can tell.

• 48:57Speaker 01

  But like, I mean, we can, we can basically guess right now that LG is like 88 inch, 8K super TV OLED TV is going to be the thing, right? It's going to be the TV that we need to go take a picture of and, and then we'll publish it and say, you can't tell from this picture, but this TV looks amazing. Like, that's going to be the thing we do day one.

• 49:15Nilay Patel?

  LG also hilariously adding Google Assistant to WebOS, which I think is a delight. So it's new WebOS TVs are now on Google Assistant, which I think is very funny.

• 49:26Speaker 01

  Yeah.

• 49:27Nilay Patel?

  It really makes WebOS on the TV seem, they should just switch it to Android and be done. But I think they're like too invested in it.

• 49:36Nilay Patel?

  You know, it's interesting, LG is true of all TVs. They, they're putting out these TVs every, and you know, it's like WebOS and then the 2017 TVs came out and WebOS had more features, but the old TVs running WebOS didn't get those features. And now the new ones are going to get Google Assistant. And I couldn't tell you if that will come to its other products running WebOS, which I think is very irritating if you are buying a $3,000 TV.

• 50:03Nilay Patel?

  That's all. They should switch the standard. The end. What else, what else are you expecting here?

• 50:08Speaker 01

  I mean, we're going to see a bunch of electric car stuff. I'm actually pretty excited that whatever Leeco tries to do, everybody will laugh them out of the room. I don't even know if they're going to be there at this point.

• 50:21Speaker 01

  There'll be like, there's, there's a new HDR format war because we haven't had enough of that. So that'll, there'll be another standard there that we need to deal with. We're going to see a bunch of wearables, but I am expecting there'll be zero Android wear and a lot of it's going to be a little bit more health focused, which means that there's going to be a lot of like bogus health claims to deal with, which is always a blast. And a bunch of AR stuff, I think. I think that VR is still going to be there. Disclosure, my wife works for Oculus, et cetera, et cetera. Maybe Oculus will actually show off some of the stuff that they announced at Oculus Connect.

• 51:01Speaker 01

  But I think that like a bunch of the other little guys are like, we've got AR2 and like, here's our app and here it is on a phone and here's some crazy glasses. Like I bet Vuzix, who does the, the glasses with like, that they look like Google Glass, but they're like, they're more industrial. I think they're going to be all over the place.

• 51:18Nilay Patel?

  You think so?

• 51:19Speaker 01

  I think so. I think they're thirsty. They're always all over the place.

• 51:22Nilay Patel?

  Yeah. And my expectation of this show is like, last year was all Alexa.

• 51:28Speaker 01

  Yep.

• 51:29Nilay Patel?

  Right. Alexa was suddenly in every product. That, as near as I can tell, didn't mean anything to anyone. There's not a single Alexa-enabled device that came out.

• 51:40Speaker 01

  Not made by Amazon. Well, Sonos won, but that didn't happen at CES. I think there's gonna be, yeah, I think it's gonna be the same story.

• 51:47Nilay Patel?

  Like Ford announced, like cars.

• 51:49Speaker 01

  Yeah, we're gonna see a bunch of Google Assistant stuff in the same way we saw a bunch of Alexa stuff. And I think it's gonna come to nothing in the same way that Alexa stuff was like, yeah, sure, Alexa. Uh, there's not caught up.

• 52:00Nilay Patel?

  Yeah, but I'm like, literally Ford announced it in cars. And then Nat reviewed a Ford with Alexa in it, and it was like horrible. Right? Like, what are you, what are you gonna do? Like, uh, there's something. If Amazon wants Alexa to be its windows, which is apparently what it wants, like it's overwhelming platform on a huge range of products and services, it's gotta be, they've gotta somehow make it compelling on devices that aren't made by Amazon. And thus far, it just hasn't been.

• 52:33Speaker 01

  Well, and it needs to just do a better job of sort of understanding. I don't know, the rest of your digital life, like everything, like Alexa, you can use Alexa to command other things. And then everything becomes dependent on the quality of those other things. And it breaks down very, very quickly when you're doing something outside the context of your home. Like when you're in a car, like those other things don't work as well. They don't know where you are and what's going on in your life. And so Alexa needs to do a better job of like gathering that information and doing useful stuff with it directly. And you know, this is, this has been Apple's big claim and especially Google's big claim that they know more about

• 53:14Speaker 01

  you and where you are and what's going on. And so they can make that interaction a little bit more natural. But they don't have the tonnage of support of apps and skills and whatever else that Alexa does. Uh, and so it's, it's this weird, it's this weird, I don't know. Is it an uncanny valley of functionality? It's like, we got all the stuff. We figured out alarms and timers and music. And we know that we can do all this other stuff. But in between here and there is just a whole lot of like awkward voice crap. That is just not fun.

• 53:47Nilay Patel?

  Yeah.

• 53:48Speaker 01

  And maybe I'm just angry at Amazon's Alexa app on phones. It's just awful.

• 53:53Nilay Patel?

  It's real bad.

• 53:54Speaker 01

  It's just the most frustratingly terrible thing.

• 53:57Nilay Patel?

  Well, you know, it's interesting is that Amazon, I think it reports this week that Amazon's already trying to figure out how to layer ads into Alexa or like shopping promotions. And obviously it was the holidays. I have a lot of Amazon boxes here. You know, they're, they're sort of like Amazon Prime tape that they put on all the boxes. Literally the box I have here, it says shop with Alexa exclusive discounts for Prime members.

• 54:22Speaker 01

  Yeah.

• 54:22Nilay Patel?

  And it's like, you are not ready. I don't, this thing isn't useful enough for me to, for me, for me to accept Amazon making it crappier with advertising.

• 54:33Speaker 01

  Yeah.

• 54:33Nilay Patel?

  Like it was so useful. I'd be like, all right, I'm going to deal with the fact that it wants me to ask for Prime deals every day. Like, or it randomly starts speaking at me and being like, buy more toothpaste, like whatever it's going to do.

• 54:45Speaker 01

  Alexa, buy a case of toothpicks.

• 54:49Nilay Patel?

  I said toothpaste.

• 54:51Speaker 01

  No, I think.

• 54:53Nilay Patel?

  How often do you buy toothpicks?

• 54:55Speaker 01

  Cause, cause if a listener actually gets a case of toothpicks, they'll be able to like make a little toothpick for it. They can like, Alexa, buy wood glue. Right? And now like we're, we're setting up a whole arts and crafts project for everybody.

• 55:08Nilay Patel?

  This is great. I like this. Yeah. Buy crayons. Uh, do you think, so if this, you think this is going to be the year of Google Assistant?

• 55:15Speaker 01

  Uh, I think they're going to try and I don't, I don't know how well it's going to work. In the same way that a bunch of stuff got announced with Alexa support at CES last year. And then we like saw some of it get released and some of it not, and some of it worked and most of it didn't. Um, but like it's supposed to be coming, right? There's, there's supposed to be more stuff that supports Google Assistant, um, both on the app side, but also specifically on like the speaker side. Cause if, if Google wants to keep pushing on this thing, they need to keep playing catch up with like a larger ecosystem of devices to support it with Amazon, um, before Amazon like.

• 55:52Nilay Patel?

  finishes its job of becoming the de facto standard. Meanwhile, you know, Apple hasn't even released the HomePod. Oh, God, if Apple like puts out some HomePod news, then they'll see you because they always do something. Yeah, they always do something and it's gonna be HomePod. I'm sure you're right.

• 56:07Speaker 03

  Can I tell a sad story?

• 56:10Nilay Patel?

  Yeah.

• 56:11Speaker 03

  On, on January, or sorry, the end of the year, what's the December 31st?

• 56:19Speaker 03

  Watching TV with my roommates. But we're like, hey, we don't want to miss midnight. So we're like Siri, countdown to midnight for us. Siri just does not know what we're talking about. So I'm giving us like weird answers. So we're like, set, set an alarm for midnight and Siri can't do that. Siri can only.

• 56:40Nilay Patel?

  Wait, really?

• 56:42Speaker 03

  Or, or what was it? We wanted like a, a timer. Yeah, that's the problem. We asked for a timer to count down to midnight. But, but Siri can set alarms for a specific time or a timer for amount of time.

• 56:58Speaker 03

  So we set an alarm for like, like four minutes before midnight. And so the alarm went off and we're like, all right, it's, it's almost midnight. Let's talk, you know, we spent like three minutes like talking about what our favorite parts of, you know, the year and what we're looking forward to and stuff like that. We forgot to count down to actual midnight and it's all Siri's fault.

• 57:23Nilay Patel?

  That's great.

• 57:24Speaker 03

  Yeah.

• 57:25Nilay Patel?

  That's amazing. I spent my holidays at home with my family and I will tell you, I made a list. Do you know, I'm gonna do the thing, I'm gonna do it to myself.

• 57:33Speaker 03

  Okay.

• 57:33Nilay Patel?

  I'm gonna sign myself a story that I now have to publish. I literally kept a list of the insane tech questions I got when I was home with like all of our various families.

• 57:42Speaker 03

  Yeah.

• 57:43Nilay Patel?

  Number one on that list is should I buy Bitcoin?

• 57:46Speaker 03

  Right.

• 57:47Nilay Patel?

  Becky's like middle aged aunts are like pulling me aside and being like this Bitcoin. I'm deep. I was like, what's happening here? It's amazing. But the amount of things that people have that are just broken and they're just accepting of how broken they are and like creating behaviors just to avoid the brokenness is like out of control. And like, we talk about the software bugs and the security vulnerabilities. And I think us and our listeners were like, okay, I gotta go hit the patch. I'm gonna go do it.

• 58:17Nilay Patel?

  I saw people running iOS nine on our phones. Like, they just don't care. They, they see that pop up and it's annoying and they just close it and they don't update the phone. And like, it's just this endless list of broken things. I'm gonna publish the list of questions. I'm gonna try to like, abstract them a little bit. But to me, it was just like a huge indictment, especially as I think about gearing up to go to CES. It's this huge indictment of how complicated this industry has become. And how many just fundamental assumptions about using things all of the tech companies are making right now. So like, everyone thinks Alexa listens to them all the time. Right? Like, that's just an assumption that exists in the world. It's all, it's like literally always listening. Everyone thinks Facebook is listening to you to serve you ads.

• 59:01Nilay Patel?

  Whether or not you believe like, A, they are, or B, there exists the sophisticated general AI in the world to process that much voice data, pull keywords and then target you specifically with ads. Like, that's a lot of assumptions, but people are just like, yep, all of that's true. So yeah, it's like, it's, I spent my entire holidays just like listening to people talk about technology and realizing like, most people have no idea how it works. And when things break, they just avoid fixing it and they create other things. And the tech industry has no idea how to deal with that.

• 59:31Speaker 01

  I spent, I spent my holiday, the New Year's in particular, just being amazed at how clever Netflix is. They have created on-demand, streamable New Year's Eve countdown shows for children. So we were able to count down New Year's at 9:30 at night with, you know, a five-year-old and an eight-year-old. And they're like, oh, sure, this, this makes sense in my world. We counted on to midnight, we watched the cartoon, we cheered, and they went to bed. And it was great.

• 1:00:02Nilay Patel?

  That's amazing. Yeah. Okay, here's my favorite one on this list, and I'm not gonna give them all away. We, a bunch of people I know got new iPhone 8s and new iPhone 10s. Everyone calls it the X, of course. Most of those people thought they had to charge the Lightning headphones in the box.

• 1:00:16Speaker 01

  What?

• 1:00:17Nilay Patel?

  Because it's a lightning plug. So they, they were like, I need to plug these in every night.

• 1:00:23Speaker 01

  Wow.

• 1:00:24Nilay Patel?

  That plug to them is a power plug.

• 1:00:28Speaker 01

  And like, that's how the pencil, that's how the pencil charges.

• 1:00:31Nilay Patel?

  Yeah, it's like, it was just like, it was just this like incredibly common thing I ran into. People are like, I hate these new headphones, I have to charge them.

• 1:00:40Nilay Patel?

  No, you don't. Like, you're gonna kill yourself.

• 1:00:44Nilay Patel?

  Like something terrible will happen if you do that.

• 1:00:46Speaker 01

  In my bizarre world, I got an Osmo mobile, the thing that like, you know, the gimbal that keeps your phone steady. Right? It charges via a 3.5 millimeter jack.

• 1:00:57Nilay Patel?

  No.

• 1:00:59Speaker 01

  Yes. It's a USB on one side and 3.5 jack on the other.

• 1:01:04Nilay Patel?

  Isn't that how you would charge the, like, the second generation shuffles or something?

• 1:01:08Speaker 01

  Yes, yeah. Just incredible.

• 1:01:12Nilay Patel?

  Well, I got a Switch, which is wonderful. It's like accelerated my USB C adoption, but I would say this, I also got a new DSLR, I got a Nikon D7500. Because of the baby and we want to like take photos of the baby. I, smartphone cameras suck. I don't know what we've been saying or doing this whole time. They're terrible. You should get a real camera. They're great.

• 1:01:38Nilay Patel?

  It's incredible. Yeah, it's also huge and inconvenient, but it's, you know, it's got like the Bluetooth to a phone, you take a picture, it instantly sends it over. It doesn't even like wait.

• 1:01:49Nilay Patel?

  Right. Everyone should get this 1500.

• 1:01:51Speaker 01

  You're living in the future, Neil. You did. By the way, I feel like I was talking about this months ago when I bought my camera.

• 1:01:59Nilay Patel?

  Are you missing anything? Russell, did you get anything good?

• 1:02:02Speaker 02

  Um, I mean, I got a Bluetooth speaker. Bluetooth speaker is great. Love a good, you know, I can listen to music while I'm doing the dishes. Wonderful.

• 1:02:11Nilay Patel?

  Yeah, everyone loves Bluetooth. Do you have Alexa in your home? I feel like as our resident security reporter, you're not the sort of person to have like a government microphone.

• 1:02:19Speaker 02

  I don't even like, I mean, I don't even like talking to my phone, honestly. Like I have friends who will just say, you know, directions to 61st and 4th. And they'll just say it out loud on the street and I'm very uncomfortable with that. It's just not the relationship to technology that I want.

• 1:02:37Nilay Patel?

  Yeah. I'm trying. I got my, uh, my sister an echo show and, uh, literally all, all anybody wants to use echo show for is when you set lots of timers in the kitchen, it tells you what, which of them are. Um, I also highly recommend doing this. You can set a timer with a person's name. So you can be like, Alexa, set a timer called Dieter for five minutes. And then you can just walk in the room and be like, Alexa, how much time does Dieter have left?

• 1:03:03Nilay Patel?

  Dieter has five minutes left. And it's like, it's a joke that never gets old. It's, it's so ominous and weird to ask a computer how much time a person has left. Okay. I think that's it.

• 1:03:13Speaker 03

  Yeah.

• 1:03:14Nilay Patel?

  Anything else we need to talk about? Any other big stuff, Dieter, in this world?

• 1:03:16Speaker 03

  No, I'm in. Watch us on, uh, Circuit Breaker Live next week, this week. Whenever you hear this episode, check it out. It's gonna be fun. It's CES.

• 1:03:25Nilay Patel?

  Yeah, it's gonna be a little baddie.

• 1:03:27Speaker 03

  I'm cautiously optimistic about, uh, Mark Zuckerberg's, uh, 2018 project where he's gonna work at Facebook.

• 1:03:37Nilay Patel?

  He's gonna like, take charge of Facebook?

• 1:03:40Speaker 03

  I, I just think, I think it's a, I think it is a real moment where there's a growing backlash for a lot of these companies. And they have a chance to continue what they've been doing, which is only optimize for time and, and, and money. Like the amount of time and money they get from their customers, or they could optimize for how satisfied their customers are. Like, like, not how much time did I spend on Facebook, but was the brief moment I was on Facebook satisfying and useful to me? And if they just tried to optimize for that, I feel like they, they could turn the ship around. I don't know.

• 1:04:15Nilay Patel?

  By the way, the context here is every year Zuckerberg has a New Year's project, right? So last year he's like, he ran a mile every day or whatever. Um, the year before he only ate meat if he killed it himself. So they're like, these like esoteric personal development projects. And this year he was like, I should work on making Facebook a better place.

• 1:04:34Speaker 03

  Well, he's talking, he's talking about like,

• 1:04:36Nilay Patel?

  Job.

• 1:04:37Speaker 03

  He's like, he, he mentioned decentralization, like something that's really interesting that's going on is like cryptocurrencies and, and stuff like that. The problem with decentralization is the lack of control.

• 1:04:51Speaker 02

  That is the problem.

• 1:04:55Speaker 03

  But maybe he'll be able to solve it so that he can have perfect control over decentralized Facebook.

• 1:05:00Nilay Patel?

  Well, yeah, it's funny because the Winklevoss twins own all the Bitcoin. His nemesis is back.

• 1:05:06Speaker 03

  Really?

• 1:05:06Speaker 02

  Some of the Bitcoin.

• 1:05:08Nilay Patel?

  I mean, like, a lot of the Bitcoin.

• 1:05:10Speaker 02

  They own a lot of Bitcoin. Like, it's a lot as an amount of money. It's a lot.

• 1:05:15Nilay Patel?

  I'm just saying, like, it's Zuck versus the Winklevi once again.

• 1:05:18Speaker 03

  Yeah.

• 1:05:19Nilay Patel?

  David Fincher get on the phone, dude.

• 1:05:22Speaker 02

  Honestly, the Winklevoss angle is like the worst thing about the, like, rise of Bitcoin prices. And there are a lot of bad things, but that's like the worst thing.

• 1:05:33Nilay Patel?

  Yeah. All right. Well, hopefully we get that movie. Well, I think that's it. Like Deter was saying, watch us on Circuit Breaker Live at CES. We're doing it, what's it, four episodes? Yeah, Monday through Thursday. Monday through Thursday. The last episode, we have very foolishly scheduled the day after our staff party at CES. That one's gonna be a real hoot. Yeah. In case you are a fan of our previous extremely tired CES programming. It's gonna be great. We're gonna, our friend Sam Sheffer is gonna be on the Circuit Breaker Show. He's come to CES with us to run around and go on adventures. I think that's gonna be fun.

• 1:06:09Speaker 02

  Beef.

• 1:06:10Nilay Patel?

  Bust. Wait, no beef.

• 1:06:12Speaker 02

  No, it's gonna be beef.

• 1:06:13Nilay Patel?

  It's gonna be beef. God. He's sitting at the hype desk. We can't have him on without rebuilding the hype desk. We're doing it. We still don't know exactly what it means, but it's gonna be great. Lauren and Ashley be joining us on the Circuit Breaker Show. Paul will be on the Circuit Breaker Show. It's gonna be a good time. And CES is happening. There's also other programs to listen to if you're not interested in CES. You can listen to the fine stable programs on the Recode Network. Lauren Good hosts Too Embarrassed to Ask with Kara Swisher, which is great. Kara Swisher hosts Recode Decode. Peter Kafka hosts Recode Media. They're all wonderful. There will be another season of Why'd You Push That Button with Caitlin Tiffany and Ashley Carmen. Love that show. Got a huge response. Super into it. Taking a little bit of a break between seasons to come up

• 1:06:57Nilay Patel?

  with some new topics, new ideas. We'll be rolling that out soon. Casey Newton, our friend Casey Newton, is gonna be starting a show this year, too. So look out for all that stuff as it happens. And we will see you at CES.

• 1:07:10Speaker 02

  As no.

• 1:07:12Speaker 02

  ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ...