IoT Coffee Talk: Episode 336 - "The New Abnormal" (Cybersecurity in a Zero Trust Era)

Heat. [music] Heat. >> [music] >> Heat. Heat. [music] [music] Outstanding. That's awesome. Way to go, Angus. You're awesome, man. I need the head ball.

>> You like the intro playing? >> Yeah, >> that's a great intro. >> Yeah. So, you want to do our new intro? >> Yeah. >> IoT Coffee Talk. The [laughter] >> Get after it. >> The greatest. >> Oh. We're the number one podcast on the planet. I know you thought that Moonshots or the All-In podcast are number one. Now they've fallen to number two and number three and Rogan's number four. We are now officially the number one podcast in the world. And so we're so thrilled. Thanks for bring joining us all these years. You've been with us now for decades and you know tens of tens of millions of you listening every week. It's incredible. >> Yeah. >> So much love. Much love. Yeah. Wow. Well, it's cuz this is the place you're going to get the real deal. This is what you're going to find out everything that's really happening in tech and AI and security >> and a bunch of other right? Yeah. This is it. >> I want to thank everybody. I want to thank everybody for the fan mail.

>> Yeah. >> Keep coming. >> You know, it never gets old. It never gets old. >> Yeah. And the Emmy award. Remember, don't forget the Emmy award. >> Yeah. That Emmy award that we got was incredible. Yeah. all the fan mail that comes in. My mailbox is filled up every week from fan mail for IoT Coffee Talk. I you know, but you know what? I take time out every part of my day. In fact, you know, like first thing in the morning after I do an hour of meditation in my Zen garden and then go through all the fan mail and everything and and I answer all the mail, I write handwritten letters back to everybody. And it takes a while because, you know, when you have tens of millions of active listeners to IoT Coffee Talk every week, Yeah. It's a It's a tall order, but that's how much we care. >> Yeah. And don't forget the Ravens. Don't forget the Ravens, >> right? >> Yes. >> You deliver them by Raven. It's not >> by Raven. US Postal or anything like that. You do it all. >> Yeah. Cuz if the if the email system and the Slack >> tubes get attacked, >> which they probably will, you know, the raven mail is the only way it's going to work. Just >> Yeah. Ah, see that's it right there.

>> Raven mail. >> Yes. That's like the ultimate post backup >> just like Game of Thrones, right? >> Yes. >> You know, that's how you're going to get your mail. >> Raven Mill. I'm not familiar with Raven Mill. >> Did you ever did you watch Game of Thrones by chance? >> No. >> And And so when they needed to send a message far away, another kingdom, another whatever. So back >> by Raven. >> Well, yeah. I think you always heard uh actually we heard here in in the in the world that we live in which is different from that world we remember uh what was it dos >> pigeons >> messenger pigeon somehow they are smart enough to have a message tied to their little claw and they fly and they somehow go to where you want them to go. I don't know how that works but I I guess it does. >> They're homing pigeons. They know where home is. And as soon as you let them go, they point back and they fly home. >> There you go. And so while and up till like just a few years ago, I know we were still using pigeons to send mail, but you know, anyway, >> we're all in with raven mail cuz um it's it's ugly out there. We'll talk a lot about obviously a lot.

>> I would pick a Raven. A Raven is way more all weather. >> It is all weather. >> Yeah. It's like the all weather tires kind of that you could get for your car, you know. >> Yeah, I get that. I get that. That makes sense, you know. And they don't look like they got dirt, you know. Yeah. >> Well, well, as an IoT guy, I have small payloads, so I'm going to use hummingbird mail. >> Oh, [laughter] genius. Genius. I love that. Takes takes a little longer for them to get there. >> It takes a little longer, but it's >> Yeah. >> Yeah. I won't I won't get attacked by a raven. I heard >> they're short range. They're short range. [laughter] >> They're very fast. It's for low latency. >> So like hummingbird kind of like Bluetooth range or something or you know >> they operate at a much higher frequency. So >> this goes against our sub gigahertz. Um. >> Right. Right. >> Yeah. So let me rethink that then. Let me >> and we don't want to offend our new friends at Hubble who've got Bluetooth going into satellites. Crazy how that's working. That's pretty awesome. Um, yes.

Wow. Welcome to Coffee Talk. Yes, the number one podcast in the world going on now for decades. Um, lot of hap lot in the news this week. Obviously, you know, we had basically an atomic bomb explode. Um, you know, on Wednesday with the PHP thing happening. >> Yeah. >> Um, couple some flaws happened there, some security flaws. And um you know the gist of this is we're now using AI to probe and find weaknesses and security problems and existing software as well as new stuff you're building. Um you know it it's just kind of like it's stuff that people didn't find, right? And you know how AI can find stuff that you aren't ever going to find. And so it found this problem with PHP. And I know a lot of you like, well, who's still using PHP? Oh, let me tell you. I've heard I've heard that up to 70% of the internet is still running on PHP. I was like, >> Rick Bond and not not just mom and pop websites, ecommerce platforms.

>> Yeah. Yeah. There are a lot of companies still using ASPs and stuff like that. Dude, come on. >> Well, I'm a proponent of ASP. >> Yeah. Is this just the beginning? As people start copycatting and saying, "I'm going to use AI to help me be a better hacker and I'm going to find all the vulnerabilities." >> This This is absolutely just the beginning. You're right. >> No, it's not it's not just the beginning. It's been happening. It's just people didn't know about it until now. It's starting to come to the surface in a very real way. But we've already talked about this on the show, dude. You know, the banks are panicking. They're even panicking more now. I I'm getting like messages from every single financial institution that I have a relationship with warning about fraud and hacks and unhealth, you know, the dangers and risks of unhealthy >> uh personal, you know, security hygiene and like that. >> So, absolutely. >> Yeah. No, it it's been around. Um, and this is the reason why we're the greatest show in the world because we talk about it first so that you have a heads up.

>> No, because you're right. You know, I think what is it like at least about kind of like about a quarter of the planet listens to the show and so >> they knew early on about this kind of stuff. But for the few handful of people who don't haven't listened to the show that you found out on Wednesday morning uh and and that went all you had alerts going on all over the world, you know, um some people found out from the prime minister of Japan that PHP was hacked and and then you saw stuff in the UK and all over the world and the message went out and and then the NSA in the United States put out a message first thing and it was just like if you cannot patch right now. You need to take your systems offline. And so when you may have heard about outages or saw yourself that all over the planet, it was cuz people were just like pulling the plug on their systems cuz they didn't have time to patch them or whatever. And so it was safer just to shut the servers down totally, which is wild. And now we've got the ultimate security expert on the planet, Stephanie Atinson, here coming in.

>> Coming in live from the IoT Coffee Talk world headquarters in Bandaraa, Texas. >> How's it going? Good morning. >> It's going. It's going. How are you guys? >> Good. Back. Oh my. >> It is Friday. Hey, you didn't look too convinced. Uh I wasn't convinced with your facial expression, Leonard. >> What? >> When I said, "How are you doing?" >> Oh, me? I'm I'm tired. I was in I was in Texas uh yesterday. >> I saw that you were in Allen. Yes. >> Yeah. >> Yeah. Yeah. Well, ever since Devin and Leonard kept hearing the song, you know, choosing Texas over and over again, >> keep Yeah. You You're in Allen a lot now, Leonard. [laughter] >> Yeah. >> All the words. >> Yeah. >> Yeah. Almost. Almost. >> I only heard it twice this time [laughter] >> when I was doing your twostep. You were doing your twostep. twostep dancing. >> I can only salsa, man. [laughter] >> Figure out that twostep stuff.

>> Can you Can you do the electric slide? >> No, >> but I can do [laughter] >> actually. Um, no, I can. >> I can do the electric slide. >> Yeah, the electric slide is kind of like the hustle in some ways, right? Do we have people on our audience who even know what I'm saying? Maybe not. Yeah, cuz they were born in the last 20 years. >> Cool. >> Boogie, woogie, woogie. Yeah. Yes. >> Oh my gosh. So, what is going on stuff? >> Um I don't know. >> Yeah, [laughter] >> it's Friday. I'm like um just um dealing with a lot of marketing stuff this morning. So, that's why I jump in. Like every Friday morning, I'm just putting out and I do a lot of the marketing for um actually a paid gig for my son's school. And um and that is like it's supposed to be really light work, but it's super heavy work. I feel like I'd spend more than an hour a day doing stuff for this school. Um so yeah, I mean it's it's been a busy morning. So I was like, you know what? I'm going to try to jump on. I'm a little late, but hey, I'm here.

>> So glad you jumped on. >> Oh yeah. And our IOT Innovator Awards uh announcement came out this week, so that's kept me very, very busy. That's big news. It's >> a lot of back and forth with the award winners and what they want to do next. And of course, they want to promote and share all the good news. So, just going back and forth with a lot of those guys, too, this week. >> That's exciting. >> Preparing for next week, Leonard. So, so I'll see you next week and see. >> Yeah. Yeah. Um, and am I seeing you next week, Rob? You going to >> Vegas for Oracle? >> Oh, yeah. He's doing the Oracle thing. Yeah. >> Yeah. Okay, cool. >> Back to the Venetian baby. >> Yeah, >> you know, same bat time, same bat channel. >> And if you're all getting your on your inbox is starting to get I don't know. Mine is starting to see a lot of things for CES start to pop up. I'm like, "Oh, I'm not I can't even think about that far ahead." And I have >> I have already I booked my flight, my hotel. I'm I'm all in. I'm already got my analyst.

Well, here I am contemplating whether to come or not because my son is my son is doing indoor track now that he's >> back from his ACL one-year journey. >> And so I'm like it's it one of his first indoor track events is coming up during that same week. So I'm like trying to figure it out. >> I don't know cuz you're going to be expected to be at the Edge AI dinner. >> I know. I know. Right there by the >> is it del Frisco I think. like we did last year. Yeah. You have to you have to be there since you're the number one authority in IoT in the planet. You have to be there. Obviously, you just gave out the awards. >> You know what is crazy is when I see the Thinkers 360 stuff. >> Yeah. >> Um they I've been put on some random list that I'm like I don't know anything about that topic. That's that's all right. It's wild. It's a wild journey. >> Sometimes you do get some you get some weird things from those folks. Sometimes it's like, "Wow, I'm an expert in medical health." I'm like, [laughter] >> "Really?"

>> I'm like, "Wow, there's some new stuff popping up." And I'm like always overwhelmed by it, but it's kind of crazy. But yeah, so it's it's uh been a fun week. So yeah. Um what what do you what is is it just the Oracle event next week in Vegas? >> Yeah. I mean, oh well, they do Oracle AI world and then they do a companion suite world, which sounds silly, but it's like, you know, Netswuite >> and so, but Oracle owns Netswuite, so they but they do it somewhere else down the strip. Um, but uh but yeah, and I think we're getting Maroon 5 is our band. >> Really? >> I'm you know that that's my um that's my hall pass. >> Oh, and joking. [laughter] >> No, no, no, no. I think I think you're not joking. I think you're not joking. [laughter] >> No, my husband's like my husband knows that I love Adam Lavine, so he always >> I know you I think that's legit. You just let the secret out there, you know. My wife loves Maroon 5. She thinks songs about Jane is one of her favorite albums of all time.

>> Love it. Love it. He's so talented. >> They are talented. He is talented. >> Absolutely. And that's what it's really all about. >> Yeah. So, we had uh we had Chain Smokers uh for the Cloudflare event at Oracle Park at the baseball. >> I saw that you just were at a Common concert. >> Well, we had Common also. So, as it turns out, the CEO of Cloudflare, Matthew Prince, happens to be good friends with Common. And so Common kicked off the event uh with a rap about Cloudflare and everything about it, whether it's, you know, the internet, agents, all that stuff. And it's like in there, you know, there's some level of talent when you can make up a whole rap that lasts maybe two to three minutes >> and it's all about the company and everything and weaving a thread for what you're going to see at the event. And there's no, he wasn't looking at a teleprompter. So the whole event starts off dark and it comes light and there's common and he just starts rapping and it was amazing.

>> Yeah, he's really talented. >> He's super talented. And then we got him again. Um so the analyst thing and and some other folks that first night we were at the US Mint in San Francisco, formerly the US Mint where they printed money and stuff like that. Gold. I love gold. And it [laughter] was that was a cool place and it had a weird flashback cuz you're inside this open courtyard area and it's all stone and they wait they had the call purple lights and everything and then common came out again and uh with a band and started doing some stuff but the way it looked and I saw him and I was like having flashbacks to John Wick 2 >> um cuz you might remember that you know Kano and Common were having to battle it out like in Italy and some ancient places like that where they're but >> I forgot, you know, you forget where Common pops up in all these movies, right? >> Common's in a lot of movies, you know, everybody just thinks.

>> All right, there we go. Roll credits, folks. We're done. Yeah. [laughter] >> Um, yes. I I expected to, you know, and so it kind of looked like I kept expecting to see Can Reeves show up and then they were going to like start fighting and stuff like that, maybe knife fights and stuff. So anyway, um, and they did a cool version of Everyone Wants to Rule the World, Tears for Fears, with a woman singing that and then him rapping. It was amazing. Just amazing. You're right. So much talent. >> That was cool. You know, we are we are so fortunate to get to go to some of these neat events where they do >> the fact that they still go all out here and there, you know, because not a lot of >> companies spend that kind of money on that on that entertainment these days. >> Yeah, >> you're right. We have seen some cutting back for sure. I can think of some companies who are like, "Hey, we're not going to do that anymore." Uh, I get it. >> They'll probably keep raising their prices to fund doing more of it. >> Yeah. Yeah.

>> They can't afford talent like Leonard. >> Yeah. Yeah. [laughter] >> Right. I got to up my bill. >> I've seen I've seen you on some stages like here and there or some >> videos where you've been pulled on stage. >> Yeah. >> What do you have on your rider? What do you have on your rider, Leonard? >> Oh, um, what I have on my rider is no uh brown M&M's. [laughter] >> You know what happens when you see brown M&M's? You have to destroy the hotel room. >> Yeah, exactly. >> Yeah, >> that's what it means. >> Yeah, [snorts] >> that's what it means out every time. No, I totally get that. >> Yeah. >> Wow. Um, so, you know, >> this week >> and we kind of chatted about this before we started when we were all in the green room. >> We were talking about what's going on with PHP, you know, before we came out onto the set >> and um, you know, this whole PHP attack and everything. Uh, and so that's obviously the biggest news this week in tech. And so all these, it turns out a lot of people didn't upgrade PHP.

There's like a lot of people running 5.x, 6.x, or whatever. >> Like lots. So PHP 70% of the internet. I know it's insane. Um, I think the best comment I heard was from our our dear friend and evil collaborator, uh, Rick Bada. He's like, "People who are still on PHP must be on PCP." [laughter] Um um and so that was >> crazy because I was thinking, "Wow, you know, like I was saying on my comment, it was like it's been 10 years ago since I have even messed with PHP." >> But I also realized like I logged into my GoDaddy account because I managed quite a few websites for my clients, >> right? And um but you you forget that there's some people that haven't updated their website in 10 years. >> It's just static. >> They don't mess with it or they're running backend, you know, storage, whatever. And you're like, you don't realize how many folks are actually still tied to PHP. And I'm like, wow.

It's >> it's unsettling. But when you go on to GoDaddyy's like uh admin admin page when you log in, I don't even know if it's on there, but they've got all the rolling credits for hey, stop what you're doing. you know, the red red font and everything. So, I'm like, wow, it's it's they're trying their best to get everybody um you know, informed on what's happening with this. >> If you think about a lot of >> Go ahead. >> I was going to say there's a company called Woo Commerce and they estimate that it uh facilitates about 50 billion a year in e-commerce and it's all PHP based. >> Wow. Yeah. And they're primarily they're primarily transactionoriented uh sites. So, >> yeah. horrible >> because the the Woo the Woo Commerce plugin for WordPress is probably the most popular commerce thing there is >> and WordPress is still the most popular web technology on the planet. >> Yeah. And so uh and so I already knew WordPress was 40 45 46% of the internet which people go what?

>> Uh and then I and then I've heard from people who know what they're talking about saying that PHP in general is about 70% of the internet. Yeah, I've seen 76. So I'm like, it's somewhere some no matter what, it's a 3/4 or so. I'm like, wow, it's that's shocking. >> Yeah. Um, so I thought it was interesting. >> Go ahead, D. >> No, I mean, if it ain't broke, you know, you don't fix it and now it's broken. But think of all the other things that are hiding in the back that no one has even thought about because you don't know what you don't know. I mean, I keep hearing, you know, how many Windows CE devices are out there and how many people are still running Windows XP and there's ever enough it because I don't know where this goes, but you know, if I unplug it, it's going to break something that and all my >> break something. >> All my legacy people are gone that know how to mess around with this stuff. >> So, no one really has a a lot of people don't have a clear inventory really what's connected to, you know, your stuff. >> That is so true, Devon. I learned the hard way. I probably talked about this before. When I was at Microsoft, we kept trying to get people to upgrade and modernize, you know, cuz you you mentioned, you know, obviously we were big with CE for a while cuz that was a really popular embedded OS um before we decided to just quit supporting it. Um my butt hurt. Anyway, but then the other >> the other thing though is that um XP, >> we had the hardest time getting

companies to migrate off of XP. XP was so popular. It just worked. Like everybody on the planet was using XP for everything, all the companies. >> And we were like, "Please, we're going to stop." And they're like, "Well, we'll pay money. Whatever. I don't want to get off XP." and and this overused example I've used to show how people are at big companies when that they would rather keep the old thing running somehow by hook or by crook forever then migrate it upgrade it whatever like you would think that they would want to they don't want to spend their money or time on that they want to do cool new things and so my favorite example is some big cola company I won't say the name of them but they're really big and they were um they had a supply chain management ment system that they had had going on for years and it was running on OS2 and so they had built that thing in the '90s on OS2 and it was super reliable, worked really well. You may have heard OS2 is still running in ATM machines and it still runs the New York subway system and uh cuz it just doesn't crash. And so they were using that and then IBM obviously pulled the plug on OS2 and they weren't supporting and they're like how do we find support for OS2? we don't want to migrate the software to modern platforms and it was somehow Microsoft coming to the rescue running on XP and Microsoft had acquired um a virtualization company >> and what was that something connect I forgot the name of anyway that's how Microsoft got in the virtualization

business actually and it would run on XP and it supported images for OS2 and so Microsoft said we'll support your system on OS2 in a VM on XP and that's what they went with. >> Well, that's innovation and [clears throat and laughter] >> but there's a story there. We talk about innovation and progress and everything, but then there's that thing called the real world that creeps crashing into our best laid plans. >> Yeah. >> And they're like, "No, we're going to bend over backwards to do some ridiculous thing to support some ancient system, you know? Let's not even get started about the entire financial system still runs on mainframes and cobalt today. All of it. Yeah. So, you know, don't worry about that. >> You know, here's here's here's the here's the kind of um here's the thing. Uh don't listen to these AI labs saying that AI is the solution. AI caused the problem. Their their models basically uncovered things and destroyed the whole u security by obscurity regime.

That's a disservice. Okay. >> Is it? >> No. AI is not a symmetrical defense to uh threat actor enablement of AI. It's totally different and people don't understand this well enough. And the big the biggest challenge right now is you have so many systems that are not patchable. Okay. So that's one thing. Even the patchable U systems, if you have a zero day vulnerability which hasn't been identified by the good guys in their threat intelligence databases, the the threat actors are going to be using the same tools to discover novel vulnerabilities. Guess what? You're still screwed. And um it's not that AI is going to be able to monitor everything because the cost is so high to have persistent um monitoring.

It it's not going to happen. Um so there are these there's this notion in people's heads that oh we can use AI. Well, how are you going to have persistent defense and how much is it going to cost you? And you can't just defend a perimeter anymore. You have to def defend the that's inside your um firewall, your DMC. >> Leonard, Leonard, I feel like we're on we're on Saturday Night Live with Point Counterpoint and so I'm going to be like Dan Akroy. Dane, you ignorant. [laughter] Um, your your AI discovered these vulnerabilities that the security people didn't discover and and so are they the enemy or did they reveal something that we had not discovered ourselves that may have been discovered eventually? You know, so you're saying AI is the bad guy here. I get it's obviously people are freaking out. Cats and dogs are living together. mass hysteria happening out there. That being said, it's going to keep happening. So, you know, when I'm having a conversation with Matthew Prince at Cloudflare this week, he said, and we talked about this earlier, he was like, he goes, "It's going to be like this every week, probably till through 2030." He goes um he said he was talking to the CIO of Anthropic and because now AI is on the case searching for vulnerabilities like all the time and not everybody's going to understand this but some people will get the reference

they go don't be surprised if we have a log forj level security in incident every week. Yeah, >> log forj is one of the biggest security problems we ever had because everybody uses it in their Java platforms. And he goes every week, expect that. But then he thinks by, you know, within 5 years from now, we should find them all. It's going to be horrible. Red alert every week. We're all frantically freaking out. Great time to be a cyber security professional just in case. Yeah. Go get that. Go get that degree, kids. Get that certification. all you programmers who can't find a job, go be a security person. And so, uh, yeah, it's going to be readily, but then he goes, he goes, but then I think it'll fall off a cliff by 2030, 2031. And he said the reason he thinks that, wait for it, wait for it, >> is the tooling, the development is really mostly happening by AI now. The tooling and AI will not be creating the bugs and security vulnerabilities that humans create when they build software.

I've never created a vulnerability in my life, but whatever. >> Talk amongst yourselves. >> I think he's had the tooling in the AI be so good building the software. The software won't have vulnerabilities anymore because it'll be built from scratch awesomeness, right? >> Well, this will be just in time for postquantum encryption and all the issues that >> Yes. >> I'll tell you why he's wrong. I'll tell you why. Excellent. Here we go, people. >> It's one simple word. >> Economics. facts >> done facts >> is he is he's talking nonsense >> nonsense >> I I've been tracking this for four years okay >> four years and I've been I've been tracking how the cyber security industry has been talking about this they are late to the game all of this you know what they should have been doing this three years ago Well, you can see this coming. They didn't do anything. They were thinking it is going to be the thing that is going to be the ultimate remedy to the cyber security problem. It's going to be able to scale the sock to the level where now no cyber security issue is ever going to compromise a company. There's going to be no more data breaches. This is the kind of nonsense these guys were talking about. Seriously, >> I I I feel like >> and you know the my problem here is that

people think this is new. It you know people were listening to people who don't know what the hell they're talking about and it happens to be some cyber security people who have legacy thinking. They don't understand AI. They don't understand like concepts like zero trust execution that you actually have things in the network that you cannot trust. And so like with the PHP vulnerability, what if you have like a bunch of internet sites and then you have a agent that goes and exploits all those things? You don't have all the controls for your agents. Those tools don't exist today in anyone's enterprise environment cuz guess what? They're making that crap up now. >> It's all new. No doubt about it. >> But it's early days. Who are these guys are not the authorities to to tell anyone what the future's going to look like cuz they they're late to the game, man. Well, and I feel like as fa as fast as these agents have been discovering is as fast and early on that the hackers that the the bad actors the anything that's running to look at do bad things to enterprises to companies to compromise to hack that's been going that was like the first thing that they're thinking of when AI started doing anything smart.

>> Yes. And so I'm like, we're always going to have a battle of good versus bad because >> you're you have bad and good >> agents. You have bad and good people that are managing. You have So I feel like this is always going to be a battle. I don't feel like we're going to get to a point where we have perfection. We're going to always understand the vulnerabilities. We're always going to protect our systems. And you're saying 2030. I'm like, I just I don't I don't buy that either. Think about all the the enterprises that have listened to their AI evangelists and stuck all this AI crap into their like unsafe AI stuff into their organization. They have shadow AI problems. >> You tell me that that's not going to those aren't going to be catastrophic um you know issues in the future. >> They've adopted AI and agents without any of the frameworks to secure them and make them safe. >> You're right. I felt like Leonard what you're saying is like everyone jumped on this AI bandwagon so fast and they were adopting adopting adopting and implementing and then also the software that they were using every single day was already these add-on agents were being put everywhere.

>> Yes. >> Before there's been any kind of secure framework policy anything that was happening faster than the protection of the system. So we are in >> and it enabled our enemies both digital and technical both digital and physical. >> You don't think country versus country is happening right? Yeah it's all about >> absolutely >> and I think we've talked about this in the past but I think we've hit on the four legs of the stool. So economics Leonard is absolutely one of them. You know we talk about the tech. So technology economics is one of the key ones. Technology is the second leg of the stool. What will technology enable? Number three is the human in the loop, the user experience. What what does a human do versus the machine? But but fourth really is that regulatory environment and now you had the European, you know, cyber resilience act of where you had gigantic fines, you know, once it comes fully right now it's reporting and disclosure, but how are they going to keep up with these volumes over the next three years or beyond?

>> You know, will people just keep up trying to do anything? Um, >> right. Well, think about think about uh 30 years later. There are public schools now that are beginning to mandate that students aren't allowed to have uh portable devices powered up during class. Um, not just because it's a distraction, but and cheating probably depending upon the grade, but just then it's still a very nefarious place for bad apples to get access to public schools and kids. You know, >> we wouldn't have thought that 30 years ago when we were talking about the big first gigantic phone and how it was going to change the world. >> And so, I feel like it's the same sort of thing with AI. Yeah, everybody's been in love with it. We've had some great memes, some good cartoon stuff come out of it. >> You know, it's a bunch of nonworld changing events. But but yeah, someday down the road we're going to realize, wow, what just happened, >> right? But if you don't allow them to use it, will we fall behind? I mean, is it like a calculator now? You know, you're allowed to bring in a and you know, there may be other students that are allowed to have AI or, you know, god forbid we start implants in everyone.

>> Yeah. You don't do that, you're going to fall behind. Yeah, >> colleges. I think the colleges are really different than the K through 12 kind of sector, but because colleges um especially heavy STEM colleges, research um institutions, they are like trying to find balance because they already know that the kids are going they are already embracing and using AI to help them study, prepare, prep, >> write, put together categories. I mean, it's a there's a long list and it's way more involved than than I would even think because when I went and talked to the students this past year at at&m, you know, listening to how they use AI, you know, in my mind first went, oh, they're all using it for writing, >> right? But they are using it for really creative prep and categorization and priority building and study habits. and it is it's extremely part of their everyday activity.

Whereas K through 12 kids, you know, especially schools that are private schools that don't even allow like electronics um for test taking and all of that, you know, it's such a different environment. So, but also these kids realize if I don't use this now when I go into the workforce, I am not going to be prepared and understand what they're talking about because it's it's just like we just said, it's already being put in every piece of software that we're using to for back office, front office operations. they they think they have to know how to use it, you know, they feel my argument against that is this is that you don't come out of uh college learning how to use a um you know ERP system or you know a lot of the business tools you know the thing is the tools always change and so my my problem with uh using these types of cognitive tools is their ability to rob students from the cognitive exercises and the the process of learning and learning how to do >> uh research the hard way because it's that >> the friction the pain that >> actually builds the skill and the the mental muscle and and that's why we don't and and it's all about building foundational you know Jensen said well you know you can use AI so that people can focus on higher order things it's

like well what If people don't have lower lower order thinking skills, then how the hell are they going to do all the higher stuff? If AI during their formative years robs >> it does alleviate Yeah. >> It does alleviate some of that mindset of being creative, being innovative thinkers, being very independent thinkers, right? and and there is a fear of that where but they they've gotten really smart with the tools that they're using to review input submissions, but the kids are getting smarter than they are. >> My kid my kid tells me what they do to get around the system. >> Yeah, there are AI tools that they use to get around the AI checkers. So, it [laughter] is a constant battle. It's a constant battle. Well, I would, >> you know, this is timely because I have a senior in high school and he has to put in his applications and declare a major >> next in the next couple weeks and we've been going back and forth >> saying, you know, what what should your be your focus area? Where is the world going to be when he graduates college five years from now, >> right?

>> And what's going to be relevant? I think it's still >> like Mad Max, >> right? It's still exact, right? you need to just learn survival skills but you know engine you know it's like okay do I still take engineering absolutely because it helps you structure >> some life skills that you need but really what are the relevant things that you know kids today should focus on >> yeah I know I was I was thinking that myself because I've been working with my I have a sophomore in high school one already in college but and he's like asked me mom what you know what what do I what should I focus on I'm like you know What son? I I'm having a hard time kind of even helping guide you because things are changing so rapidly in the job market where the hiring is happening now is shifting and it's shifting very rapidly in terms of who's hiring. I I I have seen so many threads and so many forums that are private for&m specifically because I'm so involved with that organization that these kids that are 4.0 Oh, you know, right out of college, mechanical engineer, whatever, they cannot find jobs, right? Business majors cannot find jobs. So, and it's a struggle. Um, and everyone has to have an internship. You don't have an internship. You are not, >> you know, it's so it's just the competitive side and where to guide the kids.

>> I'm struggling with with my own sophomore. So, >> yeah. Yeah. >> And I'm like I want to give him advice that says, "Hey, you should gear towards this area or this area, this area because things are changing so rapidly." And right now my focus for him is like maybe international business, international like this global stuff. >> I would say this, we have both of our boys are 24 and 28 and uh we encourage them to get jobs and start working just so that they could experience what working is like. But that's a big differentiator because so many kids coming out of high school and college now never had a job >> just >> and and it becomes a great way it became a great way for both of our boys to realize what they didn't want to do >> and and that helps focus them and kind of motivates them to look into things, you know, having conversations. Do you see yourself working indoors or outdoors one day? You know, are you working nights and weekends? you know, >> you know, just some of those exercises.

But, um, but yeah, it is it is a a really tight market that's shifting a lot right now. >> Actually, you know, >> yeah, >> speaking of the market stuff, the other conversations this week um with Matthew Prince, he was kind of talking about at his company, he's like, he goes, I need builders and I need salespeople. There used to be all these people in the middle. I call them measurers. finance, HR, a zillion different other things. He goes, "I'm gonna use AI for a lot of that stuff. I need builders like crazy and I need salespeople and that's all I care about." And I'm like, "Okay." Um, hey, other other news, lesser known attacks. There was an attack on Node.js that didn't get as much press because it wasn't as big a deal. And then but is a big deal for IoT is you know certificate authority uh what is it called e- mudra I don't know if it started in India has been compromised this week also which was again didn't get the headlines but it should cuz it affected >> um in fact my company said oh you have to stop using Safari until Apple patches it it has to do with CA you know and how we do SSL and all the other stuff a lot of yes so a lot of certificates all got compromised because they used weak keys, smaller, you know, >> Jesus.

>> And so, and so that happened this week, but again, it wasn't as big a headlines as the PHP thing. This also affects IoT devices actually. Um, there'll be some subset of IoT devices. And when I say subset, that could be tens of millions, >> right? [laughter] >> That are affected by >> Yeah. the challenge with IoT devices, you know, most of them have minimal compute. they've been there for 10 years sitting in the ground. Um, and it's, you know, what network are you connecting them to and what do you give them access to? >> You know, you know, to me, to me, this is also um an a result of rapid innovation without guard rails. you know, we're talk and so the opposite of this happening is that things become so clamped down and bulletproof, you know, for the for the nefarious folks out there that it will stifle innovation, but it will be extremely safe and secure.

>> Well, yeah. And it go, you know, like we talked about uh in the green room before any y'all I was in Texas, so >> before we all got on set. >> Yeah. any of y'all came on. Uh Steve and I were talking about quality and how nobody talks about quality anymore. Now everyone's going to have to talk about quality and that's but the thing is there's such a huge quality gap, you know um people are going to have to um reintroduce it into their environments, right? And um anything that is not patchable, you have to at least upgrade those components to a level where it is patchable and that you can economically and scalably, you know, uh patch those systems and um plug these holes that >> well and and confirm that everything is still valid, you know. So there's an argument for what blockchain might do for a big piece of this. I don't think there's a a a one solution that solves everything but >> blockchain, not crypto.

>> Remember, that's right. Blockchain. >> Yeah, not crypto. >> Distributed ledger. [laughter] >> Right. But doesn't this get us back to the point of where AI can be a tool to ensure quality and remove human error >> depending upon bias? Depending upon bias, the intended and unintended bias. >> But you know, but the then you have the slot problem. You have people who are vibe coding and just like throwing junk out there and then how are you >> saying is AI slop? >> What? [laughter] >> Lots of >> it's a myth. >> Yeah. >> Yeah. You know, everything that you've been consuming on the internet for the last two year three years. Yeah. None of that really exists. [laughter] taking a slop and weirdness. Have you noticed how Microsoft, you know, Selman and Satia have changed their tune recently and now they're saying you shouldn't trust AI models and they're not reliable and they're a risk to your company and it's up to us to build this wrapper around them and all the deterministic guard rails. Um I also have heard a lot of people especially in industrial world saying this idea of just letting your whole industrial system become probabilistic with AI is a dumb idea.

>> Control systems they actually are designed to be deterministic. It needs to work exactly this way every single time. And so a lot of talk even from people who are big- time AI people in the Bay Area are like maybe you're it should be 9010 955 or depending on the system of deterministic and maybe just a little bit of AI sprinkled in where it matters and I thought that was interesting commentary I've heard this week. Uh oh. Seven discuss. [laughter] >> Yeah. Well, the idea is like should I just throw a LM in my factory floor and just say figure it out and just do whatever you want and work your and some things might work but some things might go weird. How different is that throwing it to a human who's non-deterministic either. No, you're right. 17y old the inputs that you give him do not necessarily result inable outputs you know so as you say you know AI >> could be biased so so could humans you know in a way >> but there but we we as we started doing more and more AI based things in repetitive cycles and seeing the variability of the response it was it was almost like an AI hallucination of reality and you were like whoa whoa whoa come back over here. Oh yeah, you're right. Sorry that won't happen again, silly digital me. Well, you know, >> we well, we started building in, you

know, logic docs like a librarian would and literally force the AI through it to influence the bias and and but more importantly try to rule out the unintended bias of response so that when a customer comes back and says, "Well, if they if they call BS on something, at least we have a method to say we forced it through this every time." you know, you know, it's it's basically an error chain that you Yeah. error chain that you have to manage and you just have to bring these AIs down to a certain threshold like you always did with ML. And that was the thing that was always a challenge with ML. You have the same problems that you have with large language models. And the tricky thing was how do you make it uh how do you make it >> huh? It's tricky like run DMC. [laughter] >> Yeah.

>> How do you bring it uh down uh to a level where it it can be de um you know be deemed trustworthy enough? And there was a um who was it? Oh yeah, Patrick Lopez said that uh trust is a and reliability is a gradient, right? there's depending on uh whatever aspect of a process or a uh you know operation you have different tolerances for reliability as well as your tolerance for trusting AI to do something and it's just a matter of tuning all that stuff but in a lot of these deterministic uh um operations and functions vast majority of it is still going to be the stuff that you did before that that's the problem the backtracking a lot of people are doing with AI and you're not going to here's the reality. There's not a lot of room for GPUs and LLMs there at the end of the day. And that's the that's the I I guess that's going to be the rationalization that happens over the next few years. I mean, it's going to piss off Jensen because he's not going to be able to sell as many GPUs and he's going to get pissed off and these models are going to hit a peak. They aren't going to it's just not they're not going to get better. And you can use open models, you can distill them down, you can shrink them into SLMs or S, you know, VLM, small U language models. Guess what? You know, you use it where it makes sense.

And then you have to engineer the out of that that um, you know, intent dri semi-intent driven system. And that's what it's going to look like. It's going to look nothing like what people have been selling. It's going to be practical. >> You know what, Leonard? If you insert the letter B into an SLN, you get a SLBM, >> which is submarine submarine launch ballistic missile. [laughter] >> I kind of know about those somehow. >> Yeah, just a little. >> Hey, some great news, folks. This is great news. Breaking. >> In the last first 12 hours of this hack with a PHP, >> 13% of the 167 million PHP installs have been patched. >> Wow. Really? It's a joke. It's a joke. It's bad news. >> Very, very aggressive. >> 13% have been patched SINCE WE FOUND OUT. >> But that's actually pretty fast. >> So that means >> Are you saying everything's pretty much offline because they're not patched? >> It's either offline or people just like, I didn't know I still had a PHP site, you know?

>> Yeah. And you know what? Here's the funny thing. This is the thing that people should have been crapping their pants about. Not Not like whether or not Terminator is going to do some crazy stuff, right? That was all hypothetical. This is the stuff that could bring down economies, financial institutions. It can bring down governments. >> Well, the great the great the great hack is to go in and infect their backup file, >> you know, because as soon as nobody looks at the backup file and then as soon as they think there's any trouble, they just go reboot their backup file and infect themselves. >> Steve, our our listeners are already depressed as it is. You trying to find [laughter] something positive to positive out of all this. >> Yeah, I love it. >> I have a question about the AI side though. Like think if you're a big farmer and you're spending all this mount money on AI trying to crack the code track the code, you know, code to cure cancer and at some point you do, do you keep spending outrageous sums of money on AI that won't crack the code again at a level that it did? So, does everybody then begin to throttle back on things when they, you know, crack the code on things like that?

>> That's a good point. I remember the last time science cracked the code and cured cancer and then like a few years later almost the planet was dead and you had Will Smith walking through the jungles of New York City [laughter] and I am legend. >> Yeah. >> With this uh dog. >> This dog I love that dog. So many people forget the very very beginning of the movie. The very beginning of the movie is you're on a TV set with Emma Thompson talking to the deal and it's like she's a scientist. Yes, we've cured cancer. Now we're going to deploy it to everybody. >> Yeah. >> And then they go four years later, everybody's dead or they've turned into a zombie, [laughter] right? >> Yeah. That was a great movie actually. Yeah. Um Wow. Holy moly. Guacamole. >> Yeah. But you know, Steve, >> finished on an inspirational note. >> Yeah. >> Yeah. But no, I mean, uh, but you know, the recommendation, yeah, definitely don't overestimate that AI is the solution that you're going to be going down the wrong path with that. The most important thing is how do you reduce your patch cycle? But then, you know, u one of the things that Cisco has been talking about lately, and I think HP has something similar to it, not quite the same, but there's going to there's a um compensating controls.

Organizations really need to understand what that is. So, if you're not going to battle Star Galactica, make sure that you have compensating controls to re, you know, mitigate the B, you know, reduce the blast radius and then also contain the damage. Otherwise the stuff you know machine speed it's not human speed these things will execute you know at machine speed they will destroy your whole environment I mean they have the capability to do it and here's the thing 3 years ago I was talking to some cyber security guys and they this didn't even register in their brains I told them dude is this safe to use LLMs and create graphs of you the security environment to do all this like root cause analysis cuz what if a threat actor comes in and they use an agent and then it taps that resource wouldn't be able to scale out at machine speed uh an attack and then just and then they want oh yeah >> but their marketing people were pushing that stuff they weren't these are cyber security people weren't thinking about what kind of catastrophic u you know enablement you could have uh you know for a threat actor or even an agent within your environment to inadvertently go and completely destroy your business.

So >> oh like they destroyed Aldderon. >> Yeah. Just so be careful. I mean you know watch all the episodes of IoT Coffee Talk and you'll already know what the answer is. >> Exactly. And again to end on a positive note, it was great that this week our podcast leapfrogged Rogan Allin and Moonshot podcast to become the number one podcast in the world. So that's positive. We're super excited about that. >> Much love to all our hundreds of millions of listeners. It's great. Keep >> that fan mail coming. >> We start seeing >> Do we have agents working on our behalf? [laughter] >> Yeah. Have you met AGENT SMITH? WE'VE GOT AGENTS, BABY. [laughter] >> And they keep replicating. Yeah, it's great stuff, man. For sure. >> Oh my god. >> All right, take us out, bro. >> Thanks, everybody. >> Huh?

Thanks everybody for joining us on this fabulous edition of IoT Coffee Talk, your number one podcast in the world where you get all the best tech news, best security news >> from right there from our world headquarters band, Texas, which of course would be the world headquarters. It's not like it's going to be in Silicon Valley or something whatever. >> Um, yeah, we're number one. Thank you. It's all because of you. We would be nothing without you. Tens of billions of our fans. Thank you. Thank you. Thank you. Uh, and uh Oh, get some merch. >> Yeah, >> go get some merch. Where do we get some mer down the store? >> Oh, well, we better open a new store >> because I'm like, what's the point of having the store? If you want something, just tell me. I will order it for you. >> Oh, you could or add Woo Commerce to your your [laughter] website. >> I was paying I was paying more in trans keeping the the store open than than the transactions were actually coming. >> Oh, really? See, >> so I could still order anything that I want through >> We'll figure it out. All right, we'll figure it out. We'll figure it out. Yes.

And support Elevate Communities. We're coming to your rescue. We're coming to your city. Anyway, um it's all good. Thanks. We'll see you next week. We're [music] out. [music]