00:39:49 · Erin Griffith, Max Read, Mike Isaac
[00:39:49] S3: We're on squish... We're on squishies now, Mike. [00:39:51] S1: It's dumpling squishies. I I... My son did his his his birthday wish list this week, and dumpling squishies. That's the big [00:39:57] S3: that's the [00:39:58] S1: big new [00:39:58] S4: thing. I'm showing my lack of children on this podcast. You're showing your age is what you're showing, brother. So is it is it is essentially a vulnerability that goes far wider than just any one little system tweak that you have to update your individual software on. This is stuff that, you know, folks in the industry said could break the Internet. It could, like, affect how we get on websites and use websites and have them be... Have our accounts taken over. You know? It was like... It's much wider. My big takeaway is, like, this is the type of stuff that's gonna be much easier and more commonplace to find in the age of AI where you can have these programs just scrape the Internet and launch. [00:40:37] S1: Say specifically what we're talking... So PHP is a is a programming language that who that... God. This is... Every time I start talking like this, I think about the the dozens of men with huge beards Oh, no. That are gonna be chortling and emailing me the meanest things. [00:40:51] S4: Do you see why
00:40:51 · Mike Isaac, Max Read, Erin Griffith
[00:40:51] S4: Do you see why [00:40:51] S1: I'm so sorry. Horned it off with Like, them are my friends. Like, I'm thinking about specific people who are gonna who are gonna be, like, texting me about how wrong... PHP is a programming language that's used on a ton of different websites. Yep. And it is... As Mike is saying, it's much easier to find vulnerabilities in these infrastructural languages with AI, which can sort of run a bunch of different ideas and figure out what, you know, what the exact problems are. And when that happens, all of a sudden, you have these really intense, really serious vulnerabilities that now need to be fixed, not from the top down, but across a bazillion websites. And so, you know, I don't wanna make this podcast about me. But on one day last week, I do a daily logic puzzle called clues by Sam. And clues... I wasn't able to record my score that day because the... Because Sam was fixing the PHP. [00:41:36] S4: Like The [00:41:37] S3: real victim. [00:41:38] S1: Well, you know, trying to bring this down to earth for everybody listening so they really understand what's going on. [00:41:42] S4: I mean Imagine if you couldn't do your Wordle every day. That is what you need to be using
00:41:42 · Mike Isaac, Max Read
[00:41:42] S4: I mean Imagine if you couldn't do your Wordle every day. That is what you need to be using [00:41:47] S1: as a word. I mean, are you talking to people... Are you guys talking to people who are who are in the midst of this? What... Like, I'm I'm interested in in in whether this is, like, either from the perspective of cybersecurity people or from AI people in general, like, how much we think this is just the new normal, that every month is now just, you know, eighty five hour weeks for people who work in security and, and all the AI companies throwing up their hands and being like, we told you so. [00:42:11] S4: I mean, I I love to hear what you guys think, but I I think the flip side or the counterargument, and this kinda happened in the opens versus closed source debate a few weeks or months ago, was like, well, guess what? AI is also going to enable us to solve all these problems and to quickly defend against them and to fix them faster, and these vulnerabilities already existed. It was only a matter of time for someone to find them. So there are arguments from folks saying these fixes can happen. We just sort of need to enlist the advanced tools we have now to fix them faster rather than, you know, random websites across the Internet not being able to do that in enough time. But, like, I don't know. That feels a little rosy to me. I do feel like we're gonna just see this more often, and the old Internet breaking much faster than than before is my is my point of view at least.
00:43:06 · Jasmine Sun
[00:43:06] S2: I mean, one of the crazier news stories from this week that I thought about was that startup Cathedral made ex DogeSafir, so our nation's best and brightest, literally hacking into Anthropic's Slack and IT systems. And Anthropic is supposed to be the ones that are building the best cyber defense internal models that they can't even release to the public, and yet their own technical systems were not secure enough to be able to block this crew of, like, young startup guys from accessing trade secrets in their Slack. And so I don't even think... You know, before I would have thought, like, man, some, you know, municipal governments are gonna really struggle if they get hacked by, some people with an open source model. But now it's actually, like, the best and most AI forward companies in the world are also as vulnerable. So
00:43:55 · Max Read
[00:43:55] S1: that's a great point. It's gonna be a very long few years, I think. I mean, I think the argument... I I read a great piece that I wanna recommend, by Joshua Saxe, who's a former Meta, AI guy. And his argument is basically that we are... As bad as it seems, we are still in a in a sort of defenders window... A defender dominant window that even though there's all these vulnerabilities being discovered, it in fact... I mean, his his point, which I admire because I think it's true, is that it takes cyber criminals actually a very long time to, like, figure out how to do their jobs because generally speaking, they're not that smart, and they're not that competent at, like, running businesses. So we have, you know, a certain period where we can lock down defenses and, you know, prevent... Certainly on the on the level of cybercrime, protect against some of the worst vulnerabilities. But he says on the other hand, you know, this is not a wholly positive story. You know, we're still thinking about nation state actors that have the resources and the will and desire to, as Jasmine says, like, hack into municipal government infrastructure and whatever else. So I suspect this is not the last time we're gonna be talking about AI discover vulnerabilities on this podcast. Great. That's right. Exactly. Go back to Hawaii, Mike. That's where... That's... There's there's nothing there's nothing left there. The one... The last thing I wanna talk about is the sort of... I I felt like it flew under the radar amidst a bunch of other news this week, but Microsoft offered bio packages to 60,000 people. Erin, what did you make of that?
00:45:21 · Erin Griffith, Max Read
[00:45:21] S3: Yeah. Well, I mean, that is an enormous number. And it... When you put in perspective of the fact that, you know, Microsoft has like 230,000 employees, it just reminds you of how enormous these companies are. Yeah. But... And just to be clear, buyout packages doesn't mean 60,000 people are gonna take them. Mhmm. They expect three to three to 5% of their employees to actually take them. So in reality, it's gonna be like, at most, probably 3,000 [00:45:48] S1: Right.