00:23:41 · Tracy Alloway, Joe Weisenthal, Thai Duong, S1
[00:23:41] S3: Is the general idea that we're just in this sort of awkward phase where a lot of people in cybersecurity always refer to technical debt, right? This idea that you haven't upgraded a system for ages, like the PHP vulnerability we were just discussing, and so now you have to pay back that technical debt. The idea that we're just in an awkward moment where AI is going to be able to exploit existing flaws in the system is But maybe we eventually move to a place where we upgrade the entire system. [00:24:13] S0: We reduce our outstanding technical debt. [00:24:14] S3: We reduce the outstanding technical debt. Exactly. [00:24:17] S4: That's an optimistic way to look at it. [00:24:19] S1: Okay.
00:24:20 · Thai Duong
[00:24:20] S4: You know, we found that there are systems that we thought that, okay, that don't have a lot of technical debt. That turned out that they just like dumpster fire like everybody else. That was a very big surprise to me personally. We know there are places, there are bad problems, and we know that if we just point AI at that thing, there will be a lot of bugs coming out. But there are also places we thought that could be okay because they received a lot of attention over the years already. But it turns out that there's still a lot of bugs there as well. And a lot means a lot more, like 10x more than we expected. And of course there are still like a few small places where there was fewer bugs back then before AI. Now there's still fewer bugs still now, but they're like very small, like very like lit, like they are the exception, not the norms. So that's actually a big surprise because I don't think anybody was surprised to find a critical vulnerability in PHP. because PHP wasn't known for like race security. So of course at the PHP 2.0 scale, then that's a different matter. But if you find another vulnerability in PHP today, then that's not a surprise. But if you go and, you know, find a vulnerability or maybe a hundred vulnerabilities, a thousand vulnerabilities in the Chrome browser for example, that's a surprise. And that's exactly what happened. Like people found like a thousand vulnerabilities in Chrome and you know, I was at Google and I knew, and then the entire industry like assumed that and knew that, wow, there was a lot of investment in Chrome security. And not just like, you know, remove, like eliminate vulnerabilities, but making sure that even if you have vulnerabilities, it's difficult to exploit these vulnerabilities. This is what we call mitigations. You accept that you have vulnerabilities, but then you make sure that like attackers couldn't use these vulnerabilities to control your computer or your browser. We thought that, you know, the defense layers were pretty good and the rate of vulnerabilities were low. But then after AI, we just discovered that either like we, as security engineers, suck at our job. We couldn't find these things. Or they're just like too much code that we didn't have enough time to look into.
00:27:03 · Joe Weisenthal, S1, Bruce Dang, Tracy Alloway
[00:27:03] S0: So this raises another question. Like, is it possible to have a provably secure browser or a piece of software? You ship the piece of software and you can prove maybe in the same way that mathematicians produce things and this thing called lean or whatever. Does cyber have an equivalent where you could say, This is provably secure. And we know that no matter how good AI gets, it will never find a vulnerability in this piece of software. [00:27:32] S1: Oh, man, this is a loaded question, Joe. [00:27:36] S0: I thought it was a simple question. [00:27:38] S1: Yeah. [00:27:39] S2: I don't know, to be honest, you know, like browsers are like, you know, its own operating system, like very, very complex operating systems. Yeah. And today doing, you know, like formally verified software, you know, like it doesn't work at that scale. It's typically smaller, smaller software components. [00:27:58] S0: So there is such thing as formal verification when it comes to software. [00:28:03] S2: Yes. [00:28:03] S0: You could have small piece of software in which you formally prove in the same way that It takes mathematicians seven lines to prove the two plus two equals four. There is some sort of equivalent for software where you can prove these lines of code are secure, but the question is the scale of even something like a browser is just so enormous. That's a very difficult thing to do. [00:28:29] S3: Yes.
00:28:29 · Tracy Alloway, Bruce Dang
[00:28:29] S3: Yes. [00:28:30] S2: It's something that I think is being researched right now because I think this is one of the paths forward to build more secure systems. For example, we've had systems where the core of it is formally verified. It's an operating system that's formally verified, but then there are applications running on these things. Those applications... that have issues. So it's complicated. And these are small systems, right? And you're talking about browser. Browser is like many billions of lines of code. And so that's, yeah, I mean, I can tell you how big Chrome is. I mean, they have like zillions of people working on it. And, you know, like lots of people working on Chrome security all these years. But, you know, it's, but long story short, there are such things, but to make it work on a browser or at a very, very large system, Like, this is, we don't have anything like that today. [00:29:26] S3: Got it.
00:29:26 · Tracy Alloway, Thai Duong, S1
[00:29:26] S3: Got it. [00:29:27] S4: I think there's a deeper reason here. You know, the reason like software is eating the world. You can see like, you know, the top, the biggest companies in the world are software companies, right? It's because software is easy to change. And imagine, you know, that allows like software companies to adapt and to learn much quicker than the rest of the world. You have a product, if that doesn't work, then tomorrow, tonight, you can change it. And that's actually allows the software world, you know, to become, uh, to dominate the world basically. So basically fundamentally software is easy to change and people want to change it constantly. And that's the reason why, you know, uh, the tech companies are doing so well. So if you ask like, okay, now let's not change this like frequently, uh, then that goes against the interest. [00:30:21] S1: Right. [00:30:22] S4: And that's not going to happen. So it means that even if you have a way to formally verify everything, that would take a lot of time unless you have some sort of AI help you do the formal verification automatically. Otherwise, it's not going to happen because people want to change their software as quick as possible because that's how they do business.
00:30:22 · Thai Duong, Tracy Alloway
[00:30:22] S4: And that's not going to happen. So it means that even if you have a way to formally verify everything, that would take a lot of time unless you have some sort of AI help you do the formal verification automatically. Otherwise, it's not going to happen because people want to change their software as quick as possible because that's how they do business. [00:31:03] S3: This is sort of a related question, but does AI start to change, I guess, the way or like the waterfall of the way things get fixed? So nowadays it's like a vulnerability is discovered. The software company issues an alert and a patch. They disclose it and then people go off and fix it. If exploits are coming faster, does that process start to change in any way?