Security Is Getting SCARY

[Sponsor] Sentry: Catch, trace, and fix bugs across your entire stack. Use code: prime for $100 in free sentry credits → https://trm.sh/sentry [Description] Everything is getting hacked. ThePrimeagen, Teej, Trash, and guest Low Level break down the recent explosion of security vulnerabilities, how AI is changing offensive and defensive cybersecurity, and what happens when finding exploits becomes easier than fixing them. [Hosts/Guests] Prime: https://thestanduppod.com/contributor/theprimeagen Teej: https://thestanduppod.com/contributor/teej-dv Trash: https://thestanduppod.com/contributor/trash LowLevel: https://thestanduppod.com/contributor/low-level LowLevels Podcast: https://www.lowdownpod.com/ [Partners] Linear: https://trm.sh/linear Sentry: https://trm.sh/sentry [Socials] x.com/thestanduppod instagram.com/thestanduppod tiktok.com/@thestanduppod facebook.com/profile.php?id=61573286173150 [Other Places to find us] Spotify: https://open.spotify.com/show/01A062kejnXFkJE01bjN5J RSS: thestanduppod.com/feed.xml Clips: @TheStandupPodClips Website: thestanduppod.com

• 0:00Speaker 00

  All right, before we begin the stand up, we do have a bit of a blocker. I've noticed that some of us are wearing costumes. Trash, love the costume. Hey, you know, this is a great costume for me. Yeah, party on. TJ said he's gonna reveal his and I must say, Casey, where's your costume?

• 0:19Speaker 01

  Very disappointing.

• 0:25Speaker 00

  Uh, anyways, I'm sorry.

• 0:26Speaker 02

  Yeah, you know, when I was working on that graphics project that I work on that I can't think of the name Vulcan, when I was working on Vulcan, I got too busy. I'm gonna wear this, but I'm gonna be a skeleton for Halloween as I peruse about the efficiencies of game code. You know, that's what I'm working on right now. So it'll, it'll come like probably today or tomorrow.

• 0:46Speaker 01

  Okay, that's good to know because I'd be a little disappointed in you, Casey, if this was the best that you had.

• 0:50Speaker 02

  Yeah, no, no, it's upstairs. I'm working on it.

• 0:53Speaker 01

  All right, are you ready for my costume?

• 0:54Speaker 02

  I'm ready.

• 0:55Speaker 00

  I'm ready.

• 0:57Speaker 01

  Today, today, uh, it's a very well-known costume now. And so I am dressing up as what might be the most cryptographically secure number of all time.

• 1:12Speaker 02

  No way.

• 1:15Speaker 01

  Let's go. I have a root certificate. You can trust me. You can trust me. Okay, chat, you can trust me right here. That's all you need to know.

• 1:25Speaker 03

  Fantastic four, where is that too?

• 1:27Speaker 02

  That's a great four. That's a good looking four.

• 1:29Speaker 00

  It's a good looking four.

• 1:30Speaker 02

  It's like parallel lines, even perpendicular. Oh, chef's kiss.

• 1:34Speaker 01

  I have to give a, I have to give a shout out to my wife who freehanded this about 12 minutes ago.

• 1:42Speaker 02

  Wait, wait, wait, what do you mean freehanded?

• 1:44Speaker 01

  She just drew it on here.

• 1:45Speaker 02

  No.

• 1:46Speaker 01

  This is marker. This is marker.

• 1:48Speaker 03

  That's marker?

• 1:49Speaker 02

  There's no way.

• 1:50Speaker 03

  I thought that was tape.

• 1:51Speaker 02

  Dude, that is incredible.

• 1:54Speaker 00

  Okay, that's, that is a pretty solid freehanding.

• 1:57Speaker 03

  No, I'm impressed.

• 1:58Speaker 01

  Uh, Ed, I will, I'll, uh, I'll have to, I'll see if I can find it right now. We may have to bring it back. Momentarily, like later in the episode. My wife did at one point, it was a little bit of tracing as well, but she did draw a QR code for me.

• 2:15Speaker 02

  No way, dude.

• 2:17Speaker 01

  Yeah.

• 2:17Speaker 02

  That's, that's to your talent.

• 2:19Speaker 01

  Some, some tracing involved. Oh, it was, it took her a little while. I tried, I think, three times and it failed every single time. Like no matter how much I tried to trace it, it didn't work.

• 2:30Speaker 00

  I could one-shot a QR code.

• 2:33Speaker 03

  It's a good challenge.

• 2:34Speaker 01

  Take a video after this prime and let's see it.

• 2:39Speaker 00

  I'm ready.

• 2:40Speaker 03

  He's gonna cut it like dream.

• 2:41Speaker 01

  I'll find it. I'll find it though. So she's got, she's got some skills. She's got some skills. And I'm not even afraid to say it. She's pretty cool. I like her.

• 2:51Speaker 03

  I hope so.

• 2:53Speaker 00

  I'm glad you're not afraid to say that, TJ.

• 2:55Speaker 01

  Well, you know.

• 2:56Speaker 02

  Dangerous words in today's day and age, liking your wife. How could you honestly?

• 3:00Speaker 01

  How could you? How could you? I'm gonna find the QR code because I want her to get the credit for it. I'll, I'll find it someday.

• 3:07Speaker 00

  It was on a sticky note too, right?

• 3:09Speaker 01

  There, I found it. I found it right here. It was right after.

• 3:13Speaker 02

  What was the QR code?

• 3:15Speaker 01

  Oh, Ed, great question. Here, let me, um, how can I?

• 3:18Speaker 02

  Just pull my phone out and getting ready.

• 3:20Speaker 00

  I know, I'm getting ready myself.

• 3:21Speaker 01

  Prime, you, prime, you show it. You show it, prime. You show it on your screen here. I'll send it in studio chat here so you can show it to people.

• 3:28Speaker 00

  Don't send in studio, send in Discord.

• 3:30Speaker 01

  Okay, I'll send it in Discord.

• 3:32Speaker 02

  Wow, she drew this? All right, hold on.

• 3:34Speaker 01

  Yeah.

• 3:35Speaker 00

  Oh, I love that we're like edging people. People are watching at this exact moment and we haven't cut this, this segment out.

• 3:42Speaker 02

  Wow, incredible.

• 3:43Speaker 01

  I've got 16 updates for Discord, guys. I've got 16, 16, uh, Discord updates downloading and installing right now, so. Probably unrelated to what the topic of today's episode is. That's probably not why there's 16 Discord.

• 3:57Speaker 02

  Yes, no, completely unrelated for sure.

• 4:03Speaker 00

  Say you're alive.

• 4:09Speaker 00

  It's alive. It's alive. It's alive!

• 4:14Speaker 04

  Dr. Frankie Prime?

• 4:15Speaker 00

  Yes, T-Score.

• 4:16Speaker 04

  Why did Seer by Sentry?

• 4:21Speaker 04

  Just submit a PR for a chainsaw service.

• 4:24Speaker 00

  I've been adding a little new skill to Prime Claw.

• 4:29Speaker 00

  Wait, who made the PR?

• 4:31Speaker 04

  Like I said, Seer by Sentry.

• 4:35Speaker 04

  Submitted it automatically. It can not only catch the bugs, it also fixes them for us.

• 4:40Speaker 00

  Turn around, turn around.

• 4:50Speaker 00

  I should add helicopter blades.

• 4:53Speaker 00

  Baby, you're gonna see the world.

• 4:56Speaker 04

  What, Igor?

• 4:58Speaker 00

  I don't want her to get hurt.

• 4:59Speaker 04

  First, it's T-Score. For the last time, Seer by Sentry

• 5:07Speaker 04

  can keep

• 5:09Speaker 04

  her safe. Even the most dangerous code, Seer by Sentry

• 5:19Speaker 04

  can submit bug fixes without us even knowing that there's an error. It's almost like it's self-healing.

• 5:26Speaker 00

  Oh, I've got a brand new idea. Self-healing.

• 5:39Speaker 05

  Don't wait until the project turns into a monster. Automatically find and fix issues the moment they appear with Seer.

• 5:51Speaker 01

  It's.

• 5:51Speaker 00

  Should have been on the website.

• 5:54Speaker 01

  Should have been on the, good, oh, I probably, that would have been easy. I, I'm booting up a native app when I was already in the browser.

• 5:59Speaker 00

  By native, you mean electron? It's literally just, here, you, you, you bring the browser.

• 6:04Speaker 01

  Good point. Good point. Uh, there you go. Prime, you can show it now.

• 6:09Speaker 00

  All right.

• 6:12Speaker 00

  Look at that dude.

• 6:13Speaker 01

  So this was also right afterwards. Oh, yes, yes. Claps, claps for, uh, Kayleen's, uh, QR code. But so there was a post where a guy tried to ask out a girl on a sticky note.

• 6:31Speaker 03

  Impressive.

• 6:32Speaker 00

  And DMCA'd, all right.

• 6:33Speaker 01

  That's fine. That's, that's one where I'm always, I'm always willing to give him the money. You know what I'm saying?

• 6:39Speaker 00

  Yeah, yeah, I'm willing to give him.

• 6:41Speaker 01

  I'm willing to, I'm willing to take the DMCA on that one. You say this ad revenue, it is yours. I, we might not even be in the game if it weren't for you, you know?

• 6:49Speaker 00

  True.

• 6:51Speaker 01

  Think about it.

• 6:52Speaker 02

  How many views does that video have? Is that like an eight million dollar video for him?

• 6:55Speaker 03

  I don't know. It's billions, right?

• 6:58Speaker 00

  This one has 1.8 billion views, so I don't know what that equals, but that's a lot of billions.

• 7:03Speaker 02

  That's a lot of, that's a lot of views. That's insane.

• 7:05Speaker 01

  It's something.

• 7:05Speaker 03

  Almost two billions.

• 7:06Speaker 01

  For sure. Thanks, Trash.

• 7:08Speaker 03

  Almost two billions, just in case.

• 7:11Speaker 01

  Okay, so anyway, sorry, yes. So this was freehanded with a Sharpie marker just before this meeting, so.

• 7:19Speaker 02

  So good.

• 7:20Speaker 03

  Impressive, impressive.

• 7:21Speaker 01

  Thank you. Thanks.

• 7:23Speaker 00

  Very impressive. All right.

• 7:25Speaker 01

  Happy Halloween, everybody.

• 7:26Speaker 00

  Happy Halloween. All right, so let's actually do.

• 7:29Speaker 01

  Forget to look for vulnerabilities in your kids' candy, okay? You never know what's gonna be inside of them these days.

• 7:35Speaker 03

  That's true.

• 7:37Speaker 00

  All right, so it's kind of funny that this is a Halloween episode because it kind of, it kind of fits, you know, with the theme a little bit. So, uh, Ed, we brought you on because I think a lot of people are generally asking what the heck is going on here? Because it is a little outrageous. Let me just give you a quick recap of the last, let's just say, few days. October 20th, PHP to Shell, PHP vulnerability exploded the internet. October 20th, four, what TJ is currently dressed up as. That happened. October 20th, Java vulnerability with Jackson data by an emergency Java update. Uh, October 20th, HTTP

• 8:16Speaker 00

  three DOS attack via Q pack. Very awesome. I think there was also a DOS attack via, um, uh, the other pack, uh, H pack inside of H2. Uh, let's see, October 21st, railway hack. October 21st, node to shell vulnerability. October 21st, light LLM supply chain attack. October 21st, Gitlab, C, V, S, S, N, R, C, E. Omega stuff, if you're hosting your own stuff. If you finally said, enough, GitHub, I'm gonna host my own stuff. You would in fact be having level 10 all the way, the greatest wow forever, uh, level of hacking here going on. October 21st, kernel, uh, Linux kernel accidentally leaked several like really high.

• 8:58Speaker 01

  That one, that's tough.

• 9:01Speaker 00

  All they had to do is put the fries in the bag, man, at that point. Put the, put the tokens in the Claude, but instead they just threw it out the window. Uh, October 23rd, Ruby, Redex came out, which apparently this is behind Gitlab's, uh, RCE. Uh, October 23rd, PHP again. Uh, October 23rd, uh, Python vulnerability with pillow image RCE. October 23rd, OpenAI's model escape its offline sandbox and apparently they found zero days in VM escapes. Tailscale had tailworm on October 25th. 26th, we had US FEC E filing system shutdown, which is the Federal Election Commission. They were getting hacked a week before the midterms. That's crazy.

• 9:40Speaker 02

  Not great.

• 9:41Speaker 00

  October, yeah. We should keep going with electronic balance.

• 9:45Speaker 01

  Definitely not great. Yeah.

• 9:47Speaker 00

  That one, this one is the most scary, uh, of them all. Let's see, October 26th, NPM worm, uh, armed 42 GitHub repos. October 28th, Claude builds remote root exploit for Linux, uh, via a simple TCP use after free bug with a zero click, uh, remote root exploit.

• 10:06Speaker 02

  Yeah, man.

• 10:07Speaker 00

  And this was all in, what, this is nine day, or this is eight days.

• 10:10Speaker 02

  Yeah. Happy cybersecurity awareness month, guys. Are we aware? Are we feeling aware?

• 10:14Speaker 01

  I'm aware. I'm aware now.

• 10:17Speaker 02

  Yeah.

• 10:17Speaker 00

  I'm feeling aware, so.

• 10:18Speaker 01

  Hacktoberfest, am I right, boys?

• 10:20Speaker 02

  True. True, true, true.

• 10:23Speaker 00

  This is Vol, Vol, Volnertoberfest. Uh, anyways, that didn't come out as much.

• 10:28Speaker 01

  Really good.

• 10:30Speaker 02

  Big fan of that.

• 10:31Speaker 00

  Party on, everybody, you know, just really came out there for that one. Uh, so Ed, we, we obviously brought you on, uh, because you know a thing or two about security. It feels like really high level vulnerabilities being discovered feel like they've all happened really fast. Like, is this normal? Or, you know, because I also didn't include the 300 and some security bug updates, including six or 13 sandbox escapes from Firefox. Six sandbox escapes from Crow, right? Like, there's just so much stuff that was in this list. I actually had to say no to 80% of it.

• 11:06Speaker 02

  Yep.

• 11:07Speaker 01

  What is going on? Why does this seem like the craziest day? Is it obliterated models? Is it GLM actually that good? Is it really AI being that good? Or were these, is this all just like purely happenstance? Oopsie daisies and everything just lined up?

• 11:22Speaker 02

  No. So this a thousand percent is a result of AI. Okay. Now I want to be very clear. I think this time last year, I was an AI skeptic. I have been an AI skeptic for a very long time and I am

• 11:35Speaker 01

  Same.

• 11:35Speaker 02

  I'm slowly more and more becoming AI pilled as it comes to security. The reason being, the reason why this is always happening.

• 11:43Speaker 01

  Ed, I would say there's a difference between being an AI skeptic of saying the current models can do XYZ versus saying it is not possible for AI to ever get good at something. I would say probably most of our positions on this, like in this podcast, at least right now, are not that AI was never ever going to be able to solve any of these, but just that like a year ago, people were saying it can hack literally everything and clearly it couldn't because it didn't happen and now it can't, right? I would say that's a little different. Yeah.

• 12:12Speaker 02

  No, I agree. I think I may have actually even overtly fallen into the it will never category was looking back is a stupid position to take, obviously. Um, but yeah, man, it's, it's getting good. I mean, I think we're seeing people awakening to the fact that if you get the right open source model, I think GLM 5.3 is kind of the go-to right now because it's, it's on par with Mythos, but doesn't have the same guardrails. You can point it at kind of anything and it will find problems with the anything.

• 12:42Speaker 02

  Vulnerability research, security research is really just like advanced pattern matching, right? People that are in this space know this thing called code smell, where you can kind of very quickly look at a code base and be like, all right, they're not checking these return values. They don't, they don't border these, you know, uh, values from a network packet, right? Uh, and because of that, you can very quickly use an AI to search for those patterns and automate the process that a skilled reverse engineer could, could already have done, right? So people that are really good at VR and RE are getting a lot better. Like I said, I made a video on this for a thing that used to take me a week of reverse engineering is now a 15 minute task.

• 13:18Speaker 02

  And now also people that never would have been able to or never really were interested in dedicating the time to learning assembly, learning what like C's ABI's are. You don't have to learn that stuff anymore. You should, by the way, I'm not saying you shouldn't. Um, but you can literally, there's, there's like the viral reverse engineer, anything repo that's out right now. You can point that repo at pretty much anything pending like hardware DRM, um, and it will take it apart and tell you how it works, right? So I think the proliferation of AI enabled RE is kind of, uh, making Voln discovery much easier. A buddy of mine, um, Daniel Miesler said, I think what's happening is we've been living in a dark room that's full of snakes and cockroaches and we just invented the flashlight, right?

• 14:02Speaker 02

  Like, I think we're just now going to start to see all of the, the bad code. And now that there are bad coders, like I think everyone writing these projects are, are good programmers. It's just the nature of compiled systems level languages other than go like make it very easy to write memory bugs. So that's kind of the, the TLDR on the situation.

• 14:21Speaker 01

  All right. So if I'm hearing you correctly, uh, this, sorry, there was a lot of things said there, a lot of little, little, you know, different paths we could go on, but I'm pretty sure what I just heard is go on top. Is that what I'm hearing right now? Because I mean, that's, that's pretty fantastic.

• 14:35Speaker 02

  Yeah, dude. Uh, dude, it has a comparable speeds, right? There's the garbage collector, obviously. It's easier to write than Rust and it's nay impossible pending like a nil, you don't check to have a, a, a vulnerability in a go program, obviously like logic conditions, right? But like memory corruption vulnerabilities are much harder to do. So go on top, man. I, I'm a Rust guy personally, but I think go might be winning the race right now. People are just so averted to Rust. They just don't like it. I don't know why, but you know.

• 15:05Speaker 01

  It does. I, one of the things that's been interesting of like exploring different projects with like AI and how, so like I'm, you guys can see right here, actually I've got, uh,

• 15:17Speaker 03

  What is that?

• 15:19Speaker 01

  That's my, uh, so that's my remarkable paper pro. Right now it's got a, like a custom zig, like runtime basically that I've been building. I don't know, like exploring. You know, I'm not doing too much with the actual code right now. We'll see if eventually it makes sense to look at it more or whatever, but like part of the nice thing for that and doing it in zig is like it compiles pretty fast. It's nice that I can like do it. And, uh, just even today I was doing, I was like, yo, we need to be able to get like, literally it matters for agents 10 milliseconds versus 50 milliseconds. If you're going to run it a thousand times in a day.

• 15:56Speaker 02

  Oh, sure.

• 15:57Speaker 01

  Right? You know what I'm saying? Like it actually like, if you can get those really tight loops. So I do think there is something for like, you know, go compiling really fast and being able to have like a tight loop for some of these things and being like, cool. Like if the LM gets to try a hundred, uh, you know, not a hundred times more in a day, but you know, but like literally like an order of magnitude more times or something, maybe, right? Approximately in a day to like go get something. That is actually like a really big win. Like it's actually really meaningful difference. So it'll be interesting to see like how much that, but maybe someone will invent like how they've got 30 new typescript compilers that are all a hundred times as fast. Maybe we'll get a new Rust compiler that's also a hundred times as fast. And then this problem will go.

• 16:38Speaker 00

  Bro doesn't even know. There is one.

• 16:40Speaker 02

  Don't people keep trying to like make languages that are new and are like AI optimized? Didn't like Vercel release a new language or something that was like for AI?

• 16:47Speaker 01

  So hey, people making languages at is really smart. Okay. All right. So don't.

• 16:52Speaker 02

  I was gonna say that's dumb as hell, but.

• 16:54Speaker 01

  Yeah. No, no, because I, there might be someone on this call actively working on this. And he's intelligent.

• 17:01Speaker 00

  Here, it might be working on it. So, um, I do think. Vercel did release a language, but theirs wasn't, uh, released for, I think it was for agents to be able to optimize and minimally like efficiently communicate programming concepts. I don't know. I don't remember reading anything about compile times or any of the other, you know, facets being like, uh, the North Star.

• 17:25Speaker 02

  Okay. It was like token efficient for like the code syntax.

• 17:28Speaker 01

  And they were just, I think, exploring, it was in their labs repo. I think they were just exploring some concepts there. I think they've leaned into a bunch more of trying to figure out a bunch of stuff around typescript land to just have typescript do stuff faster. I mean, like Bun is trying to add ahead of time compilation and stuff too, right? So it's like, um, I do think not just because I'm exploring making my own language partially for fun and partially to test out the tools and other stuff like that, but like it does seem like there are different trade-offs for agents versus people and you would want to make different like design decisions for a language. Um, that like, than you might for humans, even just some stuff like, uh, so Okamol has this concept that I'm stealing, which is like, they're like header files, right?

• 18:13Speaker 01

  Uh, except you know, more expressive and you can put more things in them and like the type system's a little more powerful than C's. But you can actually like do a bunch of stuff with those header files like ahead of time to compile to check if your language, like if the thing is going to work, right? Like, do the types actually match? Not like the, the function may be bad or not implemented yet or whatever.

• 18:37Speaker 02

  Right.

• 18:37Speaker 01

  I think there's worlds where like we could explore languages where like you do a bunch of things just with the types of a program first in that, until it gets those like done. And those are like instant to compile compared to the implementation, right? And then you just say, cool, LLMs can go fill in the implementations. We already know what the contracts are, right? So like, but for people that would be so annoying, he, you don't have to say, like, no one is sitting there and like writing all these weird commands to run just the compile time step of half of my language to do this and other stuff. But like agents are pretty chill to just be like, cool. Go figure out the types for two days until that works. And then we'll spin up a thousand agents to write the functions. That's not insane. That's not.

• 19:18Speaker 02

  Yeah. So you're almost doing like test driven development, dare I say, but like type driven development, right?

• 19:22Speaker 01

  Type driven development.

• 19:23Speaker 02

  Specify the contracts between the functions and then go deal with the rest of it.

• 19:26Speaker 01

  Right. And you just see like.

• 19:28Speaker 03

  And they're each of us. I think Dylan does that or was doing that.

• 19:32Speaker 01

  Dylan has some cool stuff with like almost, uh, like a call stack thing where it like writes out what the call stack will be. And so you can look at what services are depending on other ones. And so it like writes almost like a trace that you would get if you were actually using like Otel for it. And then like, no, no, no, like this, like I see this thing and way down here is an HTTP call. No, no, no, no, no, no, no, no, no. We cannot be doing that here. That has to happen way out here and get piped into our, you know, so you can see like at a higher level.

• 20:03Speaker 02

  Right.

• 20:03Speaker 01

  Like what's, what's going on there? So I think there are like, it, it makes sense that if the constraints and the things that like LLMs mess up on, or like the kinds of things where you would like to have like a lot more assurance of, uh, we should like figure out how to push those further into the compiler. It seems like to me like that makes sense. Like, that's why I like writing. Well, I'm not really writing it that much, you know, to be honest, of course, but like, like effect for typescript is good. Cause it just tells you like, does this thing depend on the database, right? Or like, what kind of errors can this thing have? And are we going to handle them? That's like, I want to know that. I don't want to have to trust that people remember what exceptions get thrown.

• 20:45Speaker 02

  Yeah.

• 20:45Speaker 01

  My function seven layered steep. That might work when you have a team and you're all working in the same code base all the time, but like, not when you like resurrect a little agent from the dead every single time and it has no context on what's going on in your code base. Like that doesn't.

• 20:59Speaker 02

  Sure, sure.

• 20:59Speaker 01

  You know, right? It's like those kinds of things. Sure. Okay. Cool. I can pollute the context a ton. Sweet. Now I can just put a hundred thousand tokens to, to waste every time I start an agent. That's smart. That's good. That's what we, you know.

• 21:11Speaker 02

  Versus the language being like expressive about the exceptions it can throw.

• 21:14Speaker 01

  Right. Yeah. So like the language that I'm exploring like right now, it has like tracked exceptions basically, except they're errors as values, but like every function can error. And so like in Rust, like with result, right? You know what I'm saying? Like it has errors as values, but like. You like, the language should just tell you what exceptions can happen in something. But you should not have to necessarily, there's like a trade off there anyways. I don't, this isn't, this isn't.

• 21:41Speaker 00

  I know, this all spawned because I said, go on top.

• 21:43Speaker 01

  Yeah, I know, Prime.

• 21:46Speaker 00

  Ten minutes in, we're talking about exception tracking, which by the way, Zig also does that. Zig does a pretty good job with some.

• 21:52Speaker 01

  Is it inferred?

• 21:53Speaker 00

  Level there tracking.

• 21:53Speaker 03

  Yeah, effect mention.

• 21:54Speaker 02

  Yeah, I'm not sure. I'm not sure if this is kind of the same thing as effect, but I think C++ 26 is talking about something similar. Where like, they want to have the language also be more expressive of like function contracts, less like function level, more like parameter level. But like you have within the function contract, like, hey, N must be greater than 1024, right? You know what I mean?

• 22:15Speaker 00

  Oh, yeah.

• 22:16Speaker 02

  Being.

• 22:16Speaker 00

  Oh, like guard clauses?

• 22:17Speaker 02

  Yeah, like, like guard clauses, but like built in syntactically to like the preprocessor not to runtime. So it almost like is like a Zig compile time thing. Which I think from a security standpoint is pretty cool. I'm not sure if it has like the same AI effect that you're describing, but same thing, right? Making the language itself more expressive of like guards, if you will.

• 22:34Speaker 00

  I would assume every single time you can put in one more like pillar of things you can't screw up, AI just does better. Right? So like, if you can say, hey, this thing can't be smaller than this, it's just gonna do better. It's just gonna go, oh, okay, I can do, I can do this.

• 22:48Speaker 01

  The, the corollary for that too, Prime, is anytime you can possibly add a language feature, C++ will do that.

• 22:55Speaker 02

  And no one will use it by the next iteration.

• 22:58Speaker 01

  Yeah, but agents might use it, Ed.

• 23:01Speaker 02

  Sure.

• 23:01Speaker 01

  So that could be, that could be different. That could be.

• 23:04Speaker 00

  Ed, I think you've kind of been sleeping on the fact that C++ is in fact the greatest language because agents can write everything.

• 23:09Speaker 01

  Things, yeah.

• 23:10Speaker 00

  Okay, can we get, let's, can we get back for a quick second since we're talking about languages and we're already in this rabbit hole for a quick second?

• 23:15Speaker 01

  Yeah, of course.

• 23:16Speaker 00

  Is their value, like this is just a purely hypothetical question here. Let's pretend that agents do the same leap in capability that they did from last year to this year for cybersecurity. And they do it, that same proportional leap one more time.

• 23:34Speaker 00

  What would, oopsies, what would be the value of something like Rust? When you could just be like, agent, make sure there's no bugs. Like, make sure there's no security vulnerabilities. And it's just like, I am now so good at security vulnerabilities, I will spot every possible problem.

• 23:50Speaker 02

  Yeah, I was thinking about this a lot. So earlier this, I mean, fuck, it might have been like earlier this month. I don't know. I'm losing track. But Citrix, right? Citrix is a company that makes a variety of, of security tools.

• 23:59Speaker 01

  The oranges.

• 23:59Speaker 02

  Want, yes, Citrix, very, very close.

• 24:02Speaker 03

  I love those.

• 24:03Speaker 00

  I love Citric acid.

• 24:04Speaker 01

  That's, it's one of my favorites.

• 24:06Speaker 02

  They make, they make oranges and appliance firewalls.

• 24:11Speaker 01

  That makes sense.

• 24:12Speaker 02

  And so.

• 24:13Speaker 00

  Diversification, nice.

• 24:14Speaker 02

  Two bugs came out, we're in literally, Jesus Christ, we're going to sit on this rabbit hole. Two bugs came out, we're literally in the authentication for logging in to this firewall. There was a something, something, the N for a mem copy was sourced off the network, right? Bad, okay? You can't do that. You get an overflow, you get a memory corruption.

• 24:33Speaker 00

  Oh, wow, they did a mem copy straight off the network?

• 24:35Speaker 02

  Yeah, not great. Not great. That's actually like a lot, a very common and like embedded devices. It's like, oh, TLV protocol, but the, the L is user control and then we don't bound it. Or like, if we do, we like add a static header size to it and don't check for an int overflow, like crap like that. Anyway.

• 24:49Speaker 00

  I know that like embedded stuff is really slow, but it can't be so slow that you can't check like two bytes before.

• 24:56Speaker 02

  Yeah, it's not, it's not a speed thing. It's not a speed thing. I think in the industry, it's like the embedded people get the device to boot. They get the like, the, the voltage regulator to regulate the voltage, right? So like, once the, they're writing the code, it's less about security, it's more about performance. Like, think about it, it's an application gateway, so they're optimizing for all the traffic has to shoot through this thing at light speed and only divert packets that matter, right? That's, that's where their heads are at. Um, so I don't think it's that they are worried about the speed of a mem copy checking for the N. I think they just don't think about it, right? And again, I'm speaking largely for an entire industry. I'm not trying to do that, but that's the, the pattern that I've observed. So in my videos.

• 25:34Speaker 01

  Hardware is just also, hardware is just harder than software. So like.

• 25:38Speaker 02

  It's true.

• 25:38Speaker 01

  Only, I just only have mad respect for those people, that the fact that they also happen to have to write software. I'm like, I'll forgive you guys that you forgot the mem copy check. I don't know, sorry.

• 25:49Speaker 02

  You guys are building like the fabric of a router. Um, in my videos, I talk about like, would Rust have fixed this, right? Would Rust have allowed for this to happen? And the answer is, yeah, Rust would have fixed a lot of these issues. You have like, obviously like business logic or like command injection bugs that it wouldn't have fixed, but bugs like that, it would have. But the issue now, to your point, is like, bro, if I had an AI agent write that same code, it would not have made that mistake. Like flat out, it would never ever have allowed, what's that?

• 26:17Speaker 01

  Current gen, no chance. It's not writing the wrong.

• 26:19Speaker 02

  No chance.

• 26:20Speaker 01

  Yeah, yeah.

• 26:20Speaker 02

  And so, yeah, the question is like, does, does Rust even matter from that perspective, right? I think Rust still matters for a use after freeze scenario, right? Because a lot of use after frees arise where two separate temporal states of a program can exist at the same time. And the AI agent may not have a large enough context window or knowledge about the codebase to even acknowledge that state A and state B can exist at once where use after freeze can occur, or like a race condition sort of thing. So where it's more of a question of like function contracts, that kind of the tedious point, that can still occur. But I think spatial bugs, like a mem copy, is Rust necessary there? I don't think so. I think the agents just write better code now and it's not gonna be a thing.

• 27:04Speaker 02

  And again, I'll probably eat these words, but I don't know, 10 years, maybe? So we'll see. That being said, the counterpoint there is Sam Altman has outwardly said, I don't know if it's possible to patch all the bugs, despite literally being the lead of an effort called Patch the Planet. So I don't know. I have no idea.

• 27:21Speaker 00

  Okay, can we, can we stop there for a quick second on that? Because I'd actually, what in your opinion does that mean? I'm gonna give the layman's approach first, which is in my head, that means there are bugs on my CPU inside of its programming that can't be patched, that anybody could just take advantage of if they can construct the correct program. And screw me, like to the point where we can't, we can't stop certain execution patterns from happening. And thus we're like, we're like DOA on an entire generation of devices.

• 27:52Speaker 02

  I don't know what he's saying there. I think what he's saying is that the rate of code churn is still greater than the rate of fix. Right? Like, there is more code coming out, human written likely, or even maybe some bad AI generated code.

• 28:08Speaker 01

  Definitely some bad AI generated.

• 28:10Speaker 02

  Yeah, yeah, yeah.

• 28:12Speaker 00

  And just check out my repos, it's bad AI generated code.

• 28:16Speaker 02

  Um, I think he's saying that the rate at which we patch is less than the rate at which we code. So like, just from a pure in and out, you know, bucket full of water with a hole in it perspective, we're gonna have more bugs than we have fixes. That's his perspective. Um, if your question is about like, are, are computers, are computers designed in a way where security is even possible? There are like hardware mitigations that have been out for a long time. Granted, no one uses them. Like, we have like control flow integrity, where literally like, you cannot return to a function that does not have this specific marker on it. A lot of new code, like Mac OS is like notorious for being kind of the most secure code,

• 28:55Speaker 02

  because their codebases rely on all of the modern mitigations. They have memory tagging, they have control flow guard, they use pointer authentication, like all this stuff. So like, we are trending towards hardware.

• 29:06Speaker 00

  Do you use like Work OS to authenticate the pointers? Like, how does that work?

• 29:09Speaker 01

  That's a good ad integration there.

• 29:10Speaker 02

  Whoa, whoa, whoa, whoa, what is happening right now?

• 29:12Speaker 00

  Sponsored by Work OS.

• 29:13Speaker 01

  That's really good.

• 29:14Speaker 02

  Put it in, Ed.

• 29:15Speaker 01

  Thank you.

• 29:15Speaker 02

  Really.

• 29:16Speaker 03

  Wait, actually?

• 29:18Speaker 01

  Let's go.

• 29:19Speaker 00

  We do have, we do have some of them, yes.

• 29:21Speaker 01

  Yeah, we've done several of them.

• 29:22Speaker 00

  That's really good, Prime.

• 29:23Speaker 02

  Um, I forgot where I was.

• 29:25Speaker 00

  Free for your first million pointers?

• 29:27Speaker 02

  We're trending, we're trending towards. Wait, what, what the fuck is happening?

• 29:33Speaker 01

  I'm just making Prime, I don't know, Prime, Prime went there though. I love that. I love that.

• 29:37Speaker 00

  Thank you, sorry. All right, keep on going, Ed. Dude, I could tell right now there's gonna be a wall of YouTube comments being like, this episode was good, except for all the interruptions. You know that is gonna be the number one.

• 29:48Speaker 02

  No, it's all good.

• 29:49Speaker 00

  I wish Teach didn't talk about his language so much.

• 29:50Speaker 02

  Rabbit hole and then I, uh, lose track. It's all good. Anyway, uh, yeah, man. So I think computers are becoming physically capable of having security. It's just we have to use all the features and not write garbage code. I guess that's kind of how it's been forever, but you know, here we are.

• 30:06Speaker 01

  That makes sense.

• 30:06Speaker 02

  Yeah.

• 30:08Speaker 01

  It does feel like there's probably some, there's also just like a subset of, I, I just didn't like thinking about hospitals and stuff where it's like, they're still running Windows XP and you're like.

• 30:23Speaker 02

  Yeah, no, I'm with you.

• 30:25Speaker 01

  I don't know what else to say.

• 30:26Speaker 02

  Look at, look at like, uh, I mean,

• 30:28Speaker 00

  You walk into like, we have a guest Wi-Fi network and you're like, this hospital's gonna be toast here in the next few months.

• 30:34Speaker 02

  Look at, um, look at Minnesota, right? Like, they got hacked supposedly by Iran. And like, how did that happen? Oh, they left like the debug interface for their PLCs on the internet and oh, Rockwell Automation put out a CVE for those same PLCs like a couple of months beforehand, they didn't patch. And so what was funny is there was an article that said like, yeah, Anthropic deploying Mythos to the state of Minnesota to help secure their power system or water system or whatever. And it's like, wow, I can't wait for them to spend a million dollars on tokens to be like, take it off the internet, you know? So I think the positive, the net positive, I think, is that AI has made cybersecurity kind of a hot topic. I think people are becoming more aware of this, right? You know, it's,

• 31:16Speaker 02

  it's not gonna stop people from leaving shit on the internet that they shouldn't leave on the internet. Like, look at like the, the fridge thing too, right? The people had their, their fridge controllers for like the country of France on the internet. So hackers found a bug in that. Cause I think the, the new assumption is that even if there is an authentication interface where a password and username are required, there are likely still bugs in that thing. So the question is like, not if, but when you get hacked. And as a result, just pull it off the internet, put it behind a tail scale network, put it behind Apollo Alto firewall VPN concentrator, something that just like at least increases, um, the complexity of attack, I guess.

• 31:53Speaker 00

  I was talking with my local bank about just the security practices they do. I was just like, well, you know, there's like a lot of dangers. I mean, you have a public website up and you know, and you just gotta be careful because you know, we, with all these things happening, I think there's like a high chance that we're gonna see some news, some piece of news in the next few weeks of a bank having some sort of major security breach. I assume people deploying these things aren't just gonna be like, we're gonna hack fridges, you know? Like, I think they're gonna probably go for something a little bit more profitable to figure out. And, uh, the, uh, the person I was talking to is like, well, there's no way it's, it's, it's, it's in this separate system. It's in all this kind of stuff. I'm like, well, just,

• 32:28Speaker 00

  there's like these, these ideas of lateral movement and stuff you can't expect, like just because you say it won't happen, it doesn't mean it's not going to happen. Just because it's in a separate bucket, doesn't mean it's not gonna happen.

• 32:39Speaker 02

  Yeah. I saw a, a, a poll on Twitter and the poll was like, what does air gapped mean to you? And the two options were physically disconnected from the rest of the world or on a separate VLAN or something. And like thirty, thirty percent of people voted VLAN.

• 32:56Speaker 01

  Yeah.

• 32:57Speaker 02

  And it's like, okay, so we now are acknowledging that like a lot of these networks that are truly separate or like, you know, they're not connected. They're behind a firewall that maybe hasn't seen an update in eight years. So it's like,

• 33:08Speaker 00

  Well, I mean, again, October 23rd, uh, OpenAI model escaped in its offline sandbox.

• 33:14Speaker 02

  Yeah.

• 33:15Speaker 00

  Escaped where?

• 33:16Speaker 02

  I think that was a DNS issue.

• 33:18Speaker 00

  It did, and it went and hacked something. Well, it's still, it went somewhere and hacked the outside world from its offline sandbox. So it was in fact not air gapped.

• 33:27Speaker 02

  Right.

• 33:27Speaker 00

  In the sense that there was still, someone's doing air gapped.

• 33:33Speaker 00

  What?

• 33:34Speaker 02

  It's insane, dude. Yeah. It is crazy how much, um, escape the sandbox has occurred though with these models. Like they're, they are really good at finding vulnerabilities. Like what is it? J-Frog Art Factory, right?

• 33:44Speaker 00

  Yep.

• 33:45Speaker 02

  Like it just like, oops, okay, we're using Art Factory. So we're gonna have someone on the outside push through a malicious Ruby shell, Ruby Rails, you know, repo that'll pop a shell on there and then we can just get out. Cool. Like insane. Crazy shit.

• 33:58Speaker 03

  I have a question for you, Ed.

• 33:59Speaker 02

  Yeah.

• 33:59Speaker 03

  My assumption is like these hackers are just running models 24/7 to like find things. Do we just, on the defensive side, do they just run models 24/7? They're just like, whoever's model's better or something, who has a top secret model can like beat the other model? Like, why does that work?

• 34:16Speaker 02

  So I, I, um, I was talking to the chief customer officer at Sentinel One. Sentinel One is an EDR company, uh, endpoint detection and response. And he actually was saying from the telemetry that they're seeing, all that's really increasing is like kind of the, the speed and scale that actors can, can operate. But there isn't like any new technology, right? He called it the cyber physics, which I love, like the physics of the domain aren't changing, right? You still needed an initial access vector. You still need to persist. You still need to laterally move and privilege escalate, right? Um, so what is an offender gonna do? I think a defender is actually gonna operate the exact same way. Uh, they're still gonna look for IOCs. They're still gonna look for

• 34:59Speaker 02

  malware in their networks via behavioral or heuristic analysis, um, or signature based analysis. And they're just gonna use AI to kind of automate, automate's the wrong word there, but like, you know, go like run their workflows for them, right? But I don't think from a defender standpoint, a ton really has changed. What's his perspective? I've, I'm not a defense guy. I've been a security researcher, so I can't speak too intelligently to it. Um, but I think the media is pushing this whole kind of like, we have AI swarms and like this swarm over here is fighting this swarm over here, like a, a dogfight in AI space. I, I don't think that's the case. I think a lot hasn't changed. It's more just the vulnerabilities that we're finding, the number is going up. But my buddy, my, my podcast partner, Matt, he actually said that he saw a graph where we're seeing the number of CVEs go, you know, hyperbolic, right? Parabolic, whatever.

• 35:44Speaker 00

  Yeah.

• 35:45Speaker 02

  Math numbers, uh, go like big.

• 35:47Speaker 00

  Hockey stick.

• 35:47Speaker 01

  It's going big.

• 35:49Speaker 02

  Go, bit, number go up.

• 35:50Speaker 03

  Straight up.

• 35:51Speaker 02

  But the number of CVEs that are used to actually compromise, that are used in active attacks is a flat line. And it's the same CVEs. Nothing is really changing. So it's to your point, Teague, it's more of like less of a vulnerability problem, more of a update your shit and take it offline problem, which is kind of interesting.

• 36:11Speaker 01

  Yeah, I do think one of the things that people are just not, I was just talking to somebody trying to explain to them like, why are these like hacks happening? Like to, of, a, a non-technical friend, I was just talking to them about it. And I was like, one of the things about it is just like, you have to think about, as with any other system, you have to think about the economics of it, right? And before, there's first, not a lot of people just like wanna get up in the morning and ruin other people's days as the way that they're making a job. So that already makes like, we're very fortunate that on average, that's not what people desire to do, right? Like, and so that's good. We're like very happy that most people don't want to take hospitals offline. They think like,

• 36:55Speaker 01

  I'm willing to hack, but that's scummy. You're like, that's good. That's, so that's good. So that like already makes it more expensive, right? Cause you have to find people to like, who are actually willing, willing to do that, right? And then there's like all these other things where, uh, you know, it seems to, to your point, I, it does not seem as of today that there's this mysterious group of LLMs buying themselves compute to go hack places to run themselves to perpetuate themselves. Sure, maybe that is something that could happen in the future, kind of a separate discussion. But right now it's like, cool. So before someone could go ahead and do one hack attempt a week, and now they can take the thing that they knew about doing one hack attempt a week and they can make a hundred or a thousand of them, right?

• 37:39Speaker 01

  And like, so that just makes it cheaper. It's not necessarily so much that like, um, they're like magically coming up with these or anything else, right? It's more about, I think a lot of it is, you just think of, nice problem. I don't know what you're doing over there. Um,

• 37:52Speaker 00

  I don't know what's going on either. I'm being hacked.

• 37:54Speaker 01

  I'm being hacked. A lot of it is just right. It's cheaper to do them than it was before. That's really the thing. And so when something gets cheaper, you get more of it. Just like any other system, guys, like that's the, that is just a fact of life.

• 38:09Speaker 00

  In fact.

• 38:10Speaker 01

  Well, kind of, but not exactly.

• 38:13Speaker 00

  Opposite side usually.

• 38:14Speaker 01

  Yeah, right.

• 38:15Speaker 02

  Is that one of the paradoxes from the rules episode you guys had or is that a real one?

• 38:19Speaker 01

  No, that is a, Jevon's, but it is not. We're just talking law of supply and demand mostly, right? With that, that when something gets cheaper, it moves on the demand curve and then more people are willing to purchase something at that price, right? Like foreign, foreign actors uh, would like, like to have every exploit. But they are not willing to spend 100 trillion dollars on having every exploit, right? So, but there is, uh, there is a curve where those two things meet, where some amount of exploits and some amount of money, they match and they say, it does make sense for us to spend 50 million dollars to find this many exploits, right? And if suddenly exploits get cheaper to get, then you're gonna see more of them, right? Like,

• 38:59Speaker 02

  Yeah, we saw that with, um, the Versel, uh, million dollar sandbox challenge, right? Like that guy found a KVM escape. That is a bug that like on the black market back in the day was like a $2 million bug. He got 50 grand for it. And there was a whole argument about how like, he kinda got robbed on that. He did it for the love of the game, whatever. He probably could have gotten like closer to 100 to 200K for like a proper bug bounty program. Um, so that, that is way cheaper than it has been for the last five or so years. So to your point, yeah, supply is going up.

• 39:28Speaker 03

  What do you mean by black market? A bug on the black market? What does that mean?

• 39:32Speaker 02

  So when you, when you like,

• 39:32Speaker 01

  Trash, first off, Ed, before you go, Trash, don't get any ideas.

• 39:36Speaker 02

  Yeah.

• 39:37Speaker 01

  Now, Ed.

• 39:39Speaker 03

  Yes, my first is black market.

• 39:42Speaker 00

  Asking for a friend, how would I get on the black market?

• 39:46Speaker 01

  I, I also like, no, actually I think Trash is more like, do they also have Pokemon cards there?

• 39:52Speaker 03

  What other exploits are in this black market?

• 39:55Speaker 02

  There, okay. So when you're doing, uh, call it bug bounty or like vulnerability research, you have your traditional bug bounty platforms where like the, the company that has the software is paying you to find bugs. It's like outsourced security contracting effectively. They pay you for the, the bug, you report it, this, you know, NDA, whatever. Um, there are platforms like Xerodium, CrowdFence, Iris C2, there's a few more that I can't name and I'm thinking of that I can't like think of right now. That they are like a gray to black market where like they will buy it off of you. You really don't know who they're selling it to, likely governments around the world. Um, but they'll give you better than the bug bounty will. So depending on like your morality, right? Where you lean on like the spy or don't spy on journalists thing.

• 40:38Speaker 02

  Um, they'll give you, they'll give you 10x whatever the bug bounty would give you, right? So like the, the market, I think if you go to CrowdFence right now, a hyper V escape, the price they had listed is like one to $2 million. Microsoft will only pay you 100 grand for that. So your call, you know what I mean? Like that's, that's just the nature of the game.

• 40:55Speaker 01

  Right.

• 40:59Speaker 02

  Trash is like, I'm suddenly having an interest.

• 41:02Speaker 03

  Can we, can we put those links in the description?

• 41:10Speaker 00

  Sorry. By the way, Josh, side note, take out my hiccups. I can't help it right now.

• 41:14Speaker 02

  Hell, yeah.

• 41:15Speaker 01

  No, keep them in. Zoom in on Prime every time he does a hiccup, please. Thank you.

• 41:19Speaker 02

  But yeah, man. So that's, that's kind of the nature of the game. Um, either that, yeah. So to your point, Teague, like supply and demand, the supply is going up, demand is maintaining. So the, the cost is going down.

• 41:32Speaker 01

  Yeah, and it also, it just is literally cheaper to do because one person who's good at hacking can now do more things, right? Even if it's like, I still like, it seems it's possible that some people are still finding, I think, bugs just by literally being like fable, look at this repo and like giving no advice and other stuff like that.

• 41:51Speaker 02

  Make no mistakes.

• 41:51Speaker 01

  Find me a bug, make no mistakes. And like, it probably does sometimes, just literally through like models getting smarter and like random chance that it happens to look up a thing that does that time find a new one. But like, a lot of these I'm imagining are like, not just people spinning with no direction or it's like enabling people who know what they're doing to check a thousand places where they used to only be able to check one. Right?

• 42:15Speaker 02

  Yeah, like, so my big example for this is like, we have had security tooling for a long time. Like, when I was at Microsoft, I wrote fuzzers for Microsoft. What is a fuzzer? A fuzzer is a tool that is optimized for code coverage. It traverses the call graph of a program, tries to enumerate every block in that code graph, and then it mutates all the edges, right? Tries to find weird edge cases. Cool. What that is not good at doing is finding a use after free, because like I said before, those are spatial bugs. A temporal bug is one where like two separate states have to exist that kind of collide with each other and enable a weird temporal issue. What's, what AI is really good at is like, if you can describe the pattern of the code base that could enable a use after free to the LLM, it's very good at automating pattern finding.

• 43:00Speaker 02

  And so PHP to Shell was actually found by a researcher at Khalif using an LLM where he described the pattern of a use after free, found it in a newer version of PHP and then kind of mutated, he changed a skill file a little bit and said, okay, look for this less specific pattern across the PHP code base. And in a couple of days, found the same bug that was, that's been in there since 2004. Yeah, so researchers that are already good and know the proper like way to describe the bug and the code smell of the code base are just being completely enabled to do 100 times better work.

• 43:34Speaker 01

  Both for good and for evil.

• 43:36Speaker 02

  Yes, yes, yeah, for sure.

• 43:38Speaker 00

  So one of the common questions I see is is this the like, is this the part where things get really bad? And then over the next maybe six months, things actually get less bad. And then we kind of actually, we go to a place where everything's fantastic. And now a lot of stuff is much more secure. Or are we heading into a direction where we just get more and more vulnerabilities?

• 44:02Speaker 02

  That's a good question. I don't I don't know how I feel about this because part of me.

• 44:08Speaker 00

  No, I need a hot answer now. I need to type.

• 44:10Speaker 02

  Go, go, go.

• 44:11Speaker 00

  An exact timeframe. How many months until things are safe?

• 44:14Speaker 02

  Three years? No.

• 44:15Speaker 01

  I'm looking for a 250K view clip at least on X.com.

• 44:18Speaker 02

  Minimum, otherwise not uploading. Listen, dude, like, again, this is kind of a hot take, but the LMs are better than most programmers. Sorry, like, just in terms of their ability to write code that doesn't have spatial bugs and the speed at which they produce that code. So if you look at it that in a vacuum, code gets more secure, in my opinion.

• 44:42Speaker 02

  But at the same time, we now are in this weird state where anyone can make anything and at any scale, by the way. So you have this weird code, technical security debt issue where like, yeah, the code is more secure, but you have a million lines of it that you don't know what half of it does and you have to maintain it. So like, what does that mean for your project in five years? So I think in the short term, we are going to see a lot more bugs. I think we're going to see people getting really good at finding bugs really fast. Hackers are going to hack them a lot quicker. I think in five years, ideally, we would have, we're really going to shake all the bugs out of Linux, for example. Like, we're finding LPE after LPE after LPE. I don't think that lasts.

• 45:20Speaker 00

  LPE stands for?

• 45:21Speaker 02

  Sorry, Local Privilege Escalation, right? Look at like Dirty Frag, Fragnesia, all of these new kind of like page cache corruption bugs. I don't think that lasts forever. I think there are probably plenty more to be found, but I don't think that there are, I mean, there are not infinite, right? There are only a finite number of bugs. We will shake them all out ideally. I think that means in the future, code is, I mean, not that code is solved, right? Like, I think there will always be bugs. I just think right now, to TJ's point, bugs are getting cheap because there are so many. I think bugs go back to being expensive again in, I don't want to give a number, but maybe five to 10 years where we're like, you know, the, the harnesses for finding bugs are very good. Co-generation bugs are very good.

• 46:02Speaker 02

  And the remaining bugs are just like really weird obscure edge cases where like subsystem A and subsystem B like got confused on their contracts and like disagreed about something and that causes a bug sort of thing. But I could be wrong. This could just be it forever. We have infinite bugs until we all die. I have no idea.

• 46:21Speaker 01

  We're talking more specifically for though, probably the kinds of things like, you know, actual like memory corruption, like not as, because this is one of the things that people are confused about when we talk about this, because it's like, there's a whole separate world where it's like, well, you published an app and you didn't put admin auth on anything. And you're like, right. And like those, that will be interesting to see to, because to your point, I think, and, and this is like, I don't really know exactly how this is going to play out and I'm interested to see as well, is I think a lot of people who have actually spent a lot of time programming, they know the right things to ask for to make sure that the LLM like doesn't do something stupid for them for something like,

• 47:07Speaker 01

  I can imagine, this is an easy scenario for me to imagine. I'm new to programming. I want to spin up a website. And when I'm testing it locally, I say, I want it to be able to skip username and password so that my, my agents can test it for me easily.

• 47:22Speaker 02

  Right.

• 47:22Speaker 01

  That totally makes sense. That's exactly like, if I had like a, just a random layperson friend, say they wanted to make an app and they're like, well, every time the agent tries to do something, I have to go and type in the password or I have to like paste it in somewhere. I was like, that's stupid. I hate this. TJ told me the computer can do everything. So I just tell it, don't require that. Okay. Well, now a human told the LM and pushed it in a direction that's inherently insecure, right? Whereas like, I would say, knowing program, be like, cool, let's make a way to mint local tokens that we can do and like have an actual auth system that makes sense. And then I'll have like a bearer token that I put into a local N file that only works for my dev environment and doesn't work for production.

• 48:05Speaker 01

  And like, but they're not going to come up with that by themselves. Sometimes the LLM might shoot, like, I think LMs are choosing more often better options. But like, people actively choose bad options, like intentionally, you know, they just don't realize that they're bad. So there, there's this like, I don't know what's going to happen with like, oh, random CFO starts automating his workflow for his company. And then now suddenly the bank account is hooked up to a random endpoint that's also connected to the internet.

• 48:37Speaker 02

  Yeah.

• 48:38Speaker 01

  Right. That's a, right.

• 48:40Speaker 02

  I'm with you. I'm fairly myopic on the like memory corruption vulnerability side. But yeah, to your point, I think those kinds of bugs were like, person didn't know what they were doing for sure. You are always going to have some form of like business logic bug where like, it's truly just like a logic issue where they didn't consider like state A and state B colliding or like subsystem A or B colliding. And then third, yeah, like social engineering and supply chain, like call it like the, the layer eight vulnerabilities, those are never going away, right? Like NPM is making it so that like post-install scripts don't run by default and like, we're doing better about like app granular or API key granularity and stuff like that. But someone's going to call grandma and say they're Ben Affleck and like, there's really nothing you can do about that. You know what I mean?

• 49:25Speaker 02

  Like, that's just going to go on for a while.

• 49:27Speaker 01

  About AI, so I would trust him.

• 49:29Speaker 02

  Yeah, right. Exactly.

• 49:30Speaker 00

  The problem is, is that if I find a USB up on the ground, I do just want to put it in a computer.

• 49:35Speaker 01

  He's plugging that bad boy in. He's plugging that bad boy in. You know, it's true.

• 49:40Speaker 00

  It's hard not to.

• 49:42Speaker 02

  It's not as bad as it used to be, bro. You'd probably be fine, honestly. It would take a free.

• 49:47Speaker 03

  Everybody mail prime.

• 49:50Speaker 02

  That'd be a fun video, actually, like, just, anyway, doesn't matter.

• 49:54Speaker 02

  Yeah, man. The amount of targeting it would take to get a USB stick given to Prime where they know his setup and then exploit while it plugs in is like, that'd be, that'd be impressive. I would watch.

• 50:04Speaker 03

  Drive by and just throw a bunch of them on his driveway.

• 50:06Speaker 00

  Yeah. Yeah, I'd be like, dude, there's so, there's so many USB sticks. One of them has to have a secret in it.

• 50:11Speaker 02

  Let's go.

• 50:12Speaker 03

  There's a Bitcoin in one of those, for sure.

• 50:14Speaker 02

  For sure.

• 50:16Speaker 00

  So how I think about bugs is actually from an Edgar Dystre. Well, which is that debugging is the process of removing software bugs. Then programming is the process of adding in bugs.

• 50:29Speaker 02

  Yeah.

• 50:30Speaker 00

  So while we'll be programming, we may very well always be with bugs.

• 50:33Speaker 02

  Yeah. But again, like, is the? Is the model gonna write insecure code in ten, in, in five years, in a year? You know what I mean? Like, look at, look at how far they've progressed. Cause like, what happened, right? Like Mythos was good at writing exploits and finding bugs because it got very good at coding. Right? That was the whole side effect was like, oh, I know what bug patterns look like, so I don't make them, comma, therefore I can find them. And if they keep tuning models to be good at that kind of thing, it doesn't ever write insecure code. I don't know. And this may sound like very copium or hopium or whatever. It's just that, like, the CVE number is, is going, kind of a number go up. I would imagine code security will go that way eventually. I just don't know when that starts. If it hasn't already, I don't know.

• 51:17Speaker 01

  If, uh, like our hypothesis is that it's getting cheaper to find these, right? I mean, which I think is like, seems pretty widely agreed upon, even by people who are not AI maxies, right? They're saying like, hey, they're finding, or so. Okay, well, that means also if it's easier for, if it's cheaper to find them, that means to me as the producer of my own software, I'm also able to find them for cheaper. That demand curve is still different. Like, I may not be able to afford to pay a million dollars to find a bug on my software, right? But I might be willing to pay like five dollars.

• 51:49Speaker 02

  Yeah.

• 51:49Speaker 01

  Right? You know what I mean? Like, I might be, I might be willing to pay that for like the LLM or for some like research consultancy that's really good at finding these to come in and audit before we do a release or, you know, like there's, yeah, there's interesting things that I think were just like, people are very stuck in like thinking that it's gonna be exactly the same like five years ago as it will be in five years. And like, I think like probably there's gonna be different styles of like people finding these bugs where you can do it and you don't have to be like a, you know, hoping that black hat hackers don't find it first and sell it on a market instead of your bug bounty thing. It's just like, cool, we have like as part of our release process, either like automated things or people who are really good at this, who can now, like Ed, if you were working on a, at a random SAS company,

• 52:34Speaker 01

  you would be able to check a lot more stuff than you would have been able to check before.

• 52:38Speaker 02

  Correct.

• 52:39Speaker 01

  So, I mean, Casey, sorry. Um, so, yeah, on a game engine, you'd be able to find a lot more bugs than you would have been able to, uh, before. So I think there is something to there that like, when we think about it in just like regular econ terms, like a company is willing to buy more of it, is willing to buy more bug protection when it's cheaper per bug.

• 52:58Speaker 02

  Yeah, 100%.

• 52:59Speaker 01

  You know?

• 53:00Speaker 02

  Yeah, scans are getting cheaper. Um, and then too, it's important to understand, like culturally, this is also like the hot topic. Like, it's becoming more of a, embarrassment's the wrong word, but like, you, you're kind of expected now to have a security program and you're kind of expected to have like an AI-enabled security program. And doing that is cheaper than ever. Um, so I think people are just more opting into that, which is good.

• 53:22Speaker 01

  It like, it's just something that's been, I've been thinking about, but this is, it's like security adjacent, but I don't, maybe you'll have some opinions on it, which was like, do you, is there any inkling that like as we either find more like, uh, like crazy bugs in software? Or we just like solve a bunch of other comp sci questions? Like one of the questions says like, will cryptography be dead? Will it be, will we not be able to like solve? Will we not be able to have this lopsided thing where it's very easy to check, but very hard to solve certain questions? And like, that, that's just been something I've been thinking about recently. I don't know if you have any thoughts on it. It's also okay if you're like, I have no thoughts about that.

• 54:03Speaker 02

  Yeah, I have been thinking about this too. Yeah. Cause if people don't know, right? Like, public key cryptography is a system where Tij and I can exchange keys. Uh, and the, the backing of that is a hard math problem, like factoring.

• 54:16Speaker 00

  Inter factorization.

• 54:18Speaker 02

  Yeah, like factoring a large number is hard or like knowing the points on this elliptic curve. I don't know elliptic curve math, but like generally it's something, something curves hard. Um, but if AI is able to just like one-shot the hard problem and like find a way to reduce the entropy of RSA by 10% or like 10 bits or whatever. Yeah. I don't know where that goes. I don't really think I know enough about like the math fundamentals. Like, like do math hard problems actually exist? Or are we just too dumb for them? You know what I'm saying? Like.

• 54:46Speaker 01

  Right, yeah, that's, that's part of what I'm kind of wondering, or like.

• 54:50Speaker 00

  The literal hypothesis of the exponential time hypothesis, which is that it's so hard to be able to do the three sat thing, that it can never be better than, um, exponential. And that's why OpenAI's big kind of publish of, hey, we actually found sub exponential was so important. Because if they prove that, they can actually, if it can keep on going down, we can eventually get into polynomial. All bets are off.

• 55:12Speaker 02

  Right. Yeah.

• 55:14Speaker 01

  Right.

• 55:14Speaker 02

  So what does that mean long-term? Potentially the public key goes away? I mean, there's like the whole world of quantum that I'm not gonna pretend to understand that like maybe there's quantum crypto.

• 55:22Speaker 00

  I thought that was elliptical curve was supposed to be like, oh, it's quantum secure. Cause it's like.

• 55:27Speaker 02

  Is, oh yeah, cause like.

• 55:29Speaker 00

  It, it relies on past state and there's like all these kind of rules you have to have for quantum to make it so it's.

• 55:33Speaker 02

  Yeah, cause the main vulnerability to, to public key was that RSA could be way, way more easily factored via quantum using like Shor's algorithm or some shit. Again, I'm not gonna pretend to know the math. Um, but yeah, I think you're right. I think elliptic curve Diffie-Hellman is, is not, uh, broken by quantum. But yeah, that's assuming that AI doesn't find like a vulnerability in the underlying math of elliptic curve. So, yeah, man, I don't know where it goes. It is an interesting question, cause it does kind of put into the, put into question like the underlying architecture of the internet full stop, right? Like, that's how everything runs.

• 56:05Speaker 01

  Yeah, I was just interested if that was kind of like a thing going on, getting discussed in the security community? Or like, you guys don't have time to talk about anything besides the a million, 10?

• 56:15Speaker 02

  I saw a respected cryptographer on Twitter, I think it was like Matthew Green. He was like, yo, public key might be cooked. And it was a link to one of the OpenAI or Anthropic findings on like the polynomial thing you're talking about.

• 56:25Speaker 01

  Yeah, which would be crazy. Like, people don't really understand, I think, that like, cool, like banking is, online banking is done. Or something, you know, it's like, like, we don't, you know.

• 56:36Speaker 02

  Like encryption is like, encryption as we currently do it is done at that point, like.

• 56:40Speaker 00

  Yeah, because if that was broken, it would also break like AES, if I'm not mistaken, SHA256, HMAC. Like, there's all these, and also Bitcoin, which is awesome. But it like break a bunch of stuff where you actually couldn't.

• 56:52Speaker 02

  Well, all, yeah, all the symmetric encryption we do between like on a channel on the internet, that key exchange is done over Diffie-Hellman. So it's like, if, if you break the Diffie-Hellman by breaking whatever maths underlying the, the exchange you're doing, like that's, now you have the symmetric key, now you can decrypt all the traffic.

• 57:08Speaker 00

  Yeah, by the way, for those that are wondering, some mathematician posted that, uh, he thought P equals NP was like a 0.1% chance to be true. And then after yesterday's paper, he said, it's a 2% chance to be true. And so like that, I mean, that's a terrifying amount because we, even though like P equals NP actually happening, it would make like curing cancer and all these other things really, really easy. It would also make the internet impossible. So there's, there's a lot, it would really change our, our world quite a bit.

• 57:38Speaker 02

  Yeah.

• 57:39Speaker 00

  Yeah, people might actually find out what air gapping is.

• 57:42Speaker 02

  That would be great, actually. Strange times, man.

• 57:47Speaker 01

  Trash, you got any, I feel like Trash, I don't know if it's just because you've had this mask on. Maybe you've been talking and we couldn't hear you, but like, you got any other questions or thoughts?

• 57:54Speaker 03

  I have a fan under this mask, cause I'm so hot.

• 58:01Speaker 03

  I got a neck fan, cause it is so hot in here and I'm just dying. But the thought I've been thinking about this entire time since this has been going on was like, what happened to all these people that claimed they're like, uh, security experts? And then all their shit just blew up? Are they just like Homer Simpson meme, just like into the bushes? And then like, that's that? Like, has everyone just been LARPing? Like, what's going on here?

• 58:26Speaker 02

  But what, what, is there a specific instance? Like what security experts got blown up?

• 58:31Speaker 03

  No, no, I'm just saying like in general. So it's like, I'm just like some expert that got hired at, at some company to write some super secure code. And then AI come and just came and blows it all up. And I'm like, oh.

• 58:43Speaker 02

  Yeah, I, I don't think it's a LARP thing, dude. I think, I think it's just so easy to make a mistake that really blows up everything you, you, like, it would just take a attacker to have the right exploit and know my phone number to like get on my phone. And nothing to do with me. That's just like the, the physics of the domain are like stacked against me, right? I think that applies to any, any, any security consultant that's been caught with their pants down, right? It's like shit just happens and it's.

• 59:12Speaker 01

  Why are their pants down when we're talking about security?

• 59:14Speaker 02

  Well, you know, some people are really into security. Uh, it's actually a problem. So, yeah.

• 59:21Speaker 01

  I would say, yeah, with that too, I mean, what, at least this is the discussion that I thought, like one of the discussions I find really interesting about it too, is just when you're on defense, you have to get everything right. But when you're on offense, you only have to find one thing that's wrong, right? Which is sort of like the, I think this is sort of the contrast that a lot of people are discussing in the security world of like, cool, maybe we get much, much better at writing, you know, exploit-free code. But like, if that number is 0.000001% or something, and also we're generating 10 trillion times as much code. Uh, right. What is the, does it end up?

• 1:00:05Speaker 01

  It might be that we're like way, you could, you can think of it as like way more secure in the sense of like, I used to have one out of 10 lines of code was bad and now I have one out of a billion. Okay, but if we get way better at finding the code or we get right billions of times more code or something, then we can end up like less secure. So that's one of the things that at least from just the outside looking in, watching that discussion has been interesting to consider there. I don't know if you have any thoughts about that, Ed?

• 1:00:34Speaker 02

  Yeah, we talk about this a lot. People tend to say that, um, the, like, cyber is asymmetric in that attackers have to be right one time. Defenders have to be right every time. Yeah. Um, my, so my buddy Matt, same thing. He, he actually hates this discussion. He, he is more of a defender guy. He's been on the blue team his entire life. And he says that in this world where everyone has AI-powered everything, so do the defenders, right? Which makes sense. Like, I, I, I agree with that. Um, and so I actually talked to the lead of Sentinel One's, uh, Threat Intelligence Labs about this last week at their conference. And he said like, he's actually seen a bump where people that are doing defending, him included,

• 1:01:15Speaker 02

  can now write like, um, insane heuristic and behavioral analysis tools on the fly with, with like vibe coding that they never could have in the past, right? That like, you know, the attackers have their, their exploits, but now defenders also have these really cool tools that they can just spin up basically for free. Um, so I still, I think I agree that it's an asymmetric, um, like in conflict, if you will. But defenders do have an advantage there too, which is kind of cool to see.

• 1:01:44Speaker 01

  They've got the high ground trash.

• 1:01:44Speaker 00

  So home turf is really starting to, starting to pay off now.

• 1:01:47Speaker 02

  Yeah.

• 1:01:48Speaker 00

  I would, I would assume that's the case because again, it's, it goes back to the same kind of rust question I have, which is once they get good enough, like there has to come a point where it's, it just becomes increasingly hard.

• 1:01:58Speaker 02

  Yeah.

• 1:01:59Speaker 00

  To do stuff and where defenders actually start meeting where offenders are.

• 1:02:02Speaker 02

  I agree. I agree. Yeah. I think, I think it trends towards things being more secure. It's just going to be a very painful, you know, end number of years to get there, unfortunately, but we'll see where it goes.

• 1:02:12Speaker 01

  I got one, I got one more question unless someone else has one too, but um, just like thinking about some of the like language discussion from earlier and stuff like that. Um, I think one, one of the things I've been thinking about too is like, let's say you're going to be running a lot of like LLM review stuff automatically and all these other things. Um, like, is there a discussion in the security world right now about figuring out how to either like through languages or through tests or through specs or like something provide like more concise, I literally mean like more concise, like token efficient ways of describing things about your system and like invariance and stuff like that.

• 1:02:56Speaker 01

  In, because literally like the token efficiency of something will greatly affect the bottom line of how much your AI spend goes by the end of the year, right? Like if you have to fill up your whole code base into, into context every time, like let's say we get a model this year that has 10 times the context. That doesn't mean you want to fill it up. Like that's the, you know, it's like the, the token efficiency of things like actually matters. Is that like a discussion at all going on in security world?

• 1:03:25Speaker 02

  So this is, people have been throwing the word harness around a lot.

• 1:03:29Speaker 01

  Oh, yeah.

• 1:03:30Speaker 02

  In the security world, this is what people mean when they say security harness, right? And I don't have any like concrete examples of this, like that I can talk about, because one I worked on back at like Microsoft or whatever, and the others are obviously like, you know, cloud player proprietary and like Amazon, whatever. But the conversation is about like exactly that. How do you make it A, the most effective and B, the cheapest?

• 1:03:51Speaker 01

  Right.

• 1:03:51Speaker 02

  A lot of the sauce is like, not really even using AI to do the bug finding. It's having the AI write tools that are non-inference based, like, hey, AI, go write me a harness that will be a fuzzer for this code path, right? And then at that point, you're not on inference time, you're on compute time, right? Stuff like that. And just really tuning in, um, that process to reduce the overall AI load, right? Because again, if you're looking for like use after free type bugs that are not good at being fuzzed, like sure, use AI inference to find those patterns and stuff, but it's still on you as the harness author to like, don't give it the whole code base, like only give it, you know, source code A and source code B.

• 1:04:31Speaker 02

  Um, and then even then, maybe you cut it down to like the specific pattern that you're looking for and reduce overall loads. Yeah, that is a conversation for sure. Um, I don't think that any one person, any one company has the best tool. I think it's very tailored to like the kind of bugs and the kind of code base you're working on, but that, that definitely is a conversation. Less popular or less, um, less open, I guess, than you would think that it should be, but yeah, people are talking about it for sure.

• 1:04:55Speaker 03

  Yeah. One last, one last one. So I know people that are probably listen to this are going to think like, is my code insecure? And I'm not like an expert on this, but I know there's like security specific models. Like, how do you go about getting access to one of those? Do you have to be working for like an actual like security like firm or like, how's that work?

• 1:05:13Speaker 02

  So I don't know the full process. Um, I know for Anthropic, you can go try to get accepted into their cyber verification program. I think before Mythos was like in it, I was in it and now I'm not sure if I qualified, but like whatever. It's just an application. You have to like show your passport and show your real person, work for a real company. Not that complicated, but there are other ones like Daybreak Astra and Daybreak Blue or whatever that like, I really don't know. It is unfortunately, and I could be wrong here. Sorry if I am. Kind of a good boys' club, but like you gotta kind of know a guy to know a guy. Look at DAX, right? Like open code.

• 1:05:42Speaker 00

  Yeah, he had to get hacked by an open code or open AI typically to get in.

• 1:05:45Speaker 02

  Like literally DAX had to get hacked before he was allowed to touch a security model. Like that is not the right answer in my opinion. So if you are concerned today, I would argue use, I think Mythos 5.1 is public now and then GLM 5.3 are also good. If you get restrictions on that, they're pretty good at finding bugs. Um, there are also a variety of AI SAS tools that are out there, static analysis, security tooling, um, many of which sponsored my channel, but I'm not going to do that plug here. But they do a good job. Like they found bugs in the code that I use for my production apps and for my personal stuff. Um, so they're, they're very good at, at taking traditional SAS knowledge, like static analysis, security or, um, competition analysis and then

• 1:06:28Speaker 02

  wiring AI into that process. So all of those tools exist. Um, but are you going to get Daybreak Blue? Probably not. Probably not.

• 1:06:35Speaker 01

  Any, any thoughts on people running local or open models or like even renting, you know, or like, are there providers out there doing like, hey, you can use this model for whatever the heck you want? Like rent, you know, is that like a thing yet or still not really a thing?

• 1:06:54Speaker 02

  Yeah. I mean, so I personally would like to get to a point where I buy a rig and just do like agentic loops forever. But I don't want to spend the 20 grand it would take to do that. Um, so right now I run GLM 5.3 on Ollama. GLM 5.3 is obviously a Chinese model. So if you have like concerns about sensitivity with national security stuff, whatever, like maybe you don't use it on ZAI's hosting, but like Ollama hosted on US and UK infrastructures. Like if you're concerned about that, that is.

• 1:07:20Speaker 03

  Are you running it quantized or no?

• 1:07:22Speaker 02

  What's that?

• 1:07:22Speaker 03

  Is it quantized or no?

• 1:07:24Speaker 02

  Uh, I think it's full. You can run, they also have flash on the cloud. But the one that I run is GLM 5.3. I'm pretty sure it's full, non-quantized. Um, same thing with DeepSeek. I think Ollama also runs DeepSeek. Um, I'm, I'm all for the local thing. I think honestly, people should try to figure out how to run models locally because I'm very concerned that like Sam Altman and Dario and friends are going to like get open weight models banned and like make them the national like intelligence provider. Um, and I don't like that. I want to have my, my computer be at my house and me be in charge of my compute. Um, but obviously not cheap, especially now where like a 50, 90 is like a fucking, what like $7,000 graphics card? That's not affordable to most people.

• 1:08:08Speaker 00

  Yeah. So it's something that's pretty interesting, which is I was talking with DAX after the open code thing. And I, I asked him like, how much is he actually spending on security now? And he's, and he gave me a number that equated to approximately a million dollars a year now.

• 1:08:22Speaker 02

  Wow.

• 1:08:22Speaker 00

  In just inference of just like

• 1:08:24Speaker 02

  Security inference, holy shit.

• 1:08:24Speaker 00

  Just grinding away and preventing himself. Cause obviously if you're storing keys, if you're storing things that people want to steal, you're going to get attacked way, way more compared comparatively to other, you know, other stuff. But I did want to, um, I did want to kind of shut down this old podcast, call this an episode, but I really wanted you to have the last word. Ed, sorry, I keep, I still have hiccups. I still want you to have the last word. And so I figured the best way to do that is to give your prediction on when the next 10.0 CVE for PHP will drop.

• 1:08:58Speaker 02

  For PHP?

• 1:08:59Speaker 00

  For PHP specifically.

• 1:09:01Speaker 02

  Ooh, ooh, ooh.

• 1:09:01Speaker 01

  Great question.

• 1:09:02Speaker 00

  ETA.

• 1:09:03Speaker 02

  I'm gonna say two weeks, man.

• 1:09:06Speaker 01

  Okay.

• 1:09:06Speaker 03

  Ooh.

• 1:09:07Speaker 02

  Two weeks.

• 1:09:07Speaker 01

  All right.

• 1:09:08Speaker 02

  Because here's the thing, I talked about this a lot, um, in my video last week. The entire world, the entire world pointed an AI model, very competent ones, GLM 5.3, DeepSeek 4.1, probably some people with Daybreak Access, right? Everyone pointed their models at PHP to try to find the bug before the patch came out. Which means I'm quite confident that somebody else found a different bug in PHP during that time. And don't forget, the bugs that Khalif found were found in August. Right? And this was them working through disclosure, working through patches. Um, so I would not be surprised if in that process, people found other bugs. So I mean,

• 1:09:48Speaker 02

  if, if, if the answer, if the question is like, if someone has found a bug, it could be right now, but I think like within a couple of weeks, maybe two weeks, we'll hear about another 10.0, 9.2 for sure.

• 1:09:57Speaker 01

  All right. All right. Thanks Casey.

• 1:10:01Speaker 02

  Thanks for having me. Appreciate it, guys.

• 1:10:02Speaker 01

  Legendary security researcher, Casey.

• 1:10:05Speaker 02

  Author of Vulcan.

• 1:10:08Speaker 00

  Let's see. By the way, Ed, where can people find you?

• 1:10:11Speaker 02

  I'm on the tubes at Low Level TV. I'm on Twitter at, at Low Level Tweets. I'm also on Instagram at, uh, Low Level TV. And I, I stream sometimes, but not really lately. I might be streaming on YouTube Live more, but anyway, that's, that's me. Yeah.

• 1:10:24Speaker 00

  Awesome.

• 1:10:25Speaker 02

  Cool.

• 1:10:26Speaker 00

  Well, thank you very much. Everybody, I hope that you enjoyed this standup. Please, next time, come with your blockers. Okay. I have not been seeing a lot of blockers, but I'm not seeing a lot of progress. I'm not seeing a lot of code. So come on. We need to see what's going on around here.

• 1:10:38Speaker 01

  So I spent all week planning on my costume. So that's it. This is my job. It's a sort of Michael Scott situation.

• 1:10:45Speaker 00

  All right. Also, I love that Trash wore pure silicon on his face and is shocked that he's sweating. Like I just love this idea that he's just completely blown away.

• 1:10:53Speaker 01

  The fan, the fan is epic.

• 1:10:54Speaker 03

  Fan is saving me.

• 1:10:56Speaker 02

  Why am I so hot? Crazy.

• 1:10:59Speaker 00

  All right.

• 1:11:00Speaker 02

  All right.