00:36:57 · Max Read, Erin Griffith, Mike Isaac
[00:36:57] S1: Sorry. Why is Planned Parenthood opposed to it? [00:36:59] S3: I mean, for some of the same reasons, it's not sustainable. This one time tax thing is, like, supposed to make up for some of the Trump administration cuts. And they don't believe that it's... You know, it's not setting them up in a position to, like, be sustainable going forward. So they just think it's poorly written. I think a lot of the people that are opposed to it are not opposed to the idea of a wealth tax, including actually some people that I spoke with for this story. They they just think this is a crappy one, and they wish that it was better... Like, that it that it was just structured better and made more sense. [00:37:32] S4: But do you feel like they're always gonna say that? I feel like it's always a, well, this bill is poorly written, and if they could only legislate it better. I just feel like I've heard that from Andreessen or whoever a million times. You know what I'm saying? [00:37:45] S3: Totally. It's... I mean, it's it's almost sort of like respectability politics where it's like, I like, I agree with your message, but I don't like how you're doing it. Yeah. [00:37:52] S1: I was interested to learn that about the... About Planned Parenthood though, because I hadn't I hadn't realized that this was more than just a a cabal of billionaires plotting
00:37:52 · Max Read, Erin Griffith, Mike Isaac
[00:37:52] S1: I was interested to learn that about the... About Planned Parenthood though, because I hadn't I hadn't realized that this was more than just a a cabal of billionaires plotting [00:37:59] S3: out your like a bunch of... I mean, my... Ever since I wrote this story, weirdly, my phone has been blowing up with, like, you know, political text messages from different groups, and there's, like, a lot of health care groups that have lined up against it. [00:38:12] S4: Mhmm. That's interesting. [00:38:14] S1: Yeah. I mean, from a Democratic point of view, this is a nonpartisan podcast, of course. From a democratic point of view, it's sort of nice to put one of these ballot measures on every year so that the billionaires all get distracted and focus on that instead of putting money around the country the way Elon Musk is. [00:38:27] S4: That's pretty good game theory. [00:38:29] S1: Yeah. There you go. Feel free to call me, you know, senate political action committees. There's one other big thing I wanna talk about today, and that is the... Is what is being called Black October, the vuln apocalypse, the PHP vulnerability discovered last week. Mike, I'm gonna put you on the spot. Can you explain... Obviously, we all know what PHP is. We know what's going on. But for this... For anybody who doesn't know this stuff, can you explain what happened last week and why it made everybody who works in information security's life hell for the... For... I mean, it continues to be hell.
00:38:29 · Max Read, Mike Isaac, Erin Griffith
[00:38:29] S1: Yeah. There you go. Feel free to call me, you know, senate political action committees. There's one other big thing I wanna talk about today, and that is the... Is what is being called Black October, the vuln apocalypse, the PHP vulnerability discovered last week. Mike, I'm gonna put you on the spot. Can you explain... Obviously, we all know what PHP is. We know what's going on. But for this... For anybody who doesn't know this stuff, can you explain what happened last week and why it made everybody who works in information security's life hell for the... For... I mean, it continues to be hell. [00:39:01] S4: Well, look. I I think the way I like to think about it is how the entire, let's say, Internet and infrastructure that computers run on to this point is pretty Byzantine and built on a lot of old code that has, let's say, a lot of holes and stuff in it. Right? And that's that's just the nature of computing. You figure out what are called vulnerabilities, and you fix them over time. You know, Microsoft has dozens of fixes to their main software a year. Now it's ranging up into the hundreds because AI is finding more of them. What happened, though, Black October is not trying to get a Furby for your shopping for your kids. That was... Mike, come on. [00:39:45] S1: Was that on the spot? You gotta do better. [00:39:46] S4: No. No. Yeah. I hope you could [00:39:48] S1: workshop that. [00:39:49] S3: We're on squish... We're on squishies now, Mike.
00:39:49 · Erin Griffith, Max Read, Mike Isaac
[00:39:49] S3: We're on squish... We're on squishies now, Mike. [00:39:51] S1: It's dumpling squishies. I I... My son did his his his birthday wish list this week, and dumpling squishies. That's the big [00:39:57] S3: that's the [00:39:58] S1: big new [00:39:58] S4: thing. I'm showing my lack of children on this podcast. You're showing your age is what you're showing, brother. So is it is it is essentially a vulnerability that goes far wider than just any one little system tweak that you have to update your individual software on. This is stuff that, you know, folks in the industry said could break the Internet. It could, like, affect how we get on websites and use websites and have them be... Have our accounts taken over. You know? It was like... It's much wider. My big takeaway is, like, this is the type of stuff that's gonna be much easier and more commonplace to find in the age of AI where you can have these programs just scrape the Internet and launch. [00:40:37] S1: Say specifically what we're talking... So PHP is a is a programming language that who that... God. This is... Every time I start talking like this, I think about the the dozens of men with huge beards Oh, no. That are gonna be chortling and emailing me the meanest things. [00:40:51] S4: Do you see why
00:40:51 · Mike Isaac, Max Read, Erin Griffith
[00:40:51] S4: Do you see why [00:40:51] S1: I'm so sorry. Horned it off with Like, them are my friends. Like, I'm thinking about specific people who are gonna who are gonna be, like, texting me about how wrong... PHP is a programming language that's used on a ton of different websites. Yep. And it is... As Mike is saying, it's much easier to find vulnerabilities in these infrastructural languages with AI, which can sort of run a bunch of different ideas and figure out what, you know, what the exact problems are. And when that happens, all of a sudden, you have these really intense, really serious vulnerabilities that now need to be fixed, not from the top down, but across a bazillion websites. And so, you know, I don't wanna make this podcast about me. But on one day last week, I do a daily logic puzzle called clues by Sam. And clues... I wasn't able to record my score that day because the... Because Sam was fixing the PHP. [00:41:36] S4: Like The [00:41:37] S3: real victim. [00:41:38] S1: Well, you know, trying to bring this down to earth for everybody listening so they really understand what's going on. [00:41:42] S4: I mean Imagine if you couldn't do your Wordle every day. That is what you need to be using
00:41:42 · Mike Isaac, Max Read
[00:41:42] S4: I mean Imagine if you couldn't do your Wordle every day. That is what you need to be using [00:41:47] S1: as a word. I mean, are you talking to people... Are you guys talking to people who are who are in the midst of this? What... Like, I'm I'm interested in in in whether this is, like, either from the perspective of cybersecurity people or from AI people in general, like, how much we think this is just the new normal, that every month is now just, you know, eighty five hour weeks for people who work in security and, and all the AI companies throwing up their hands and being like, we told you so. [00:42:11] S4: I mean, I I love to hear what you guys think, but I I think the flip side or the counterargument, and this kinda happened in the opens versus closed source debate a few weeks or months ago, was like, well, guess what? AI is also going to enable us to solve all these problems and to quickly defend against them and to fix them faster, and these vulnerabilities already existed. It was only a matter of time for someone to find them. So there are arguments from folks saying these fixes can happen. We just sort of need to enlist the advanced tools we have now to fix them faster rather than, you know, random websites across the Internet not being able to do that in enough time. But, like, I don't know. That feels a little rosy to me. I do feel like we're gonna just see this more often, and the old Internet breaking much faster than than before is my is my point of view at least.