No Priors: Artificial Intelligence | Technology | Startups
00:07:28 · Sarah Guo, Dane Knecht
[00:07:28] S1: What is it going to take for organizations to do what you're describing? Like, 50% of engineers do not work on security right now. I had Greg Brockman from OpenAI on No Priors podcast last week, and he said that he thought in 2027, people are going to spend as much money on tokens for security as engineering? Like you're saying, related idea. What is going to drive that shift? [00:07:58] S0: Just emergency. Right? So you're going to move forward all your security spend over the next eighteen months, both from the red team side, which is more of the offensive, trying to actively try to exploit things as well as the defensive side, how you prepare things. But I don't think that's going to be last forever. I see a world in eighteen months where new software productivity goes way up because all those resources are back focused on that. But there's definitely this period where security usually on everybody's mind. [00:08:35] S1: What are some of the key elements of getting to a better place in terms of overall software and Internet security? I think people discover, of course, that there are libraries and services everyone use that had vulnerabilities that took effort to discover and now do not. And I think we'll hit some of those. What else is important there? Because part of the concern that I have is the rate of software production is also going up a great deal. Right? So to some degree, we got to go like patch everything that we have already made and then keep up and get ahead of the pace of delivery.
00:08:35 · Sarah Guo, Dane Knecht
[00:08:35] S1: What are some of the key elements of getting to a better place in terms of overall software and Internet security? I think people discover, of course, that there are libraries and services everyone use that had vulnerabilities that took effort to discover and now do not. And I think we'll hit some of those. What else is important there? Because part of the concern that I have is the rate of software production is also going up a great deal. Right? So to some degree, we got to go like patch everything that we have already made and then keep up and get ahead of the pace of delivery. [00:09:13] S0: Yeah. Well, so I mean, for one, we're right now we're patching seventy years of of software out there. So so some of it is just catch up. And then on on a go forward basis, you know, I think this the software development life cycle, the agent development life cycle is going to need to change. Luckily, the same way that we can use security right now for Red King and things like that, it'll just be built into the process every step of the way. I think the software will just get more secure over time. [00:09:46] S1: What have you learned about building secure production software internally already that you think people can learn from? Like, does that mean? Like shift left and like can we... And there are there are many theories of how to do this including, you know, broader use of formal verification, using agents for security in the development process. Like what what do you think is going to create better software from first delivery?
00:09:46 · Sarah Guo, Dane Knecht
[00:09:46] S1: What have you learned about building secure production software internally already that you think people can learn from? Like, does that mean? Like shift left and like can we... And there are there are many theories of how to do this including, you know, broader use of formal verification, using agents for security in the development process. Like what what do you think is going to create better software from first delivery? [00:10:15] S0: I kind go back to first principles there is you want to reduce your attack surface area. The easiest thing you can do is to give less places for there to be vulnerabilities. So looking at all your software and saying, How can I simplify this? How can I reduce footprint, the code? Then beyond that, things like formal verification and things that are safer programming languages and things that are built into the runtimes that make everything safer will come. But I think it just starts with AI, at least the early AI is very verbose. It likes to create complexity. So AI in a sense of what we've been dealing with has actually not been helping build a more secure stuff right now, but I think we'll get there. I think that's where humans still come in and human judgment comes in and making sure that we design the software in a way that can stand on its own securely.
00:10:15 · Dane Knecht, Sarah Guo
[00:10:15] S0: I kind go back to first principles there is you want to reduce your attack surface area. The easiest thing you can do is to give less places for there to be vulnerabilities. So looking at all your software and saying, How can I simplify this? How can I reduce footprint, the code? Then beyond that, things like formal verification and things that are safer programming languages and things that are built into the runtimes that make everything safer will come. But I think it just starts with AI, at least the early AI is very verbose. It likes to create complexity. So AI in a sense of what we've been dealing with has actually not been helping build a more secure stuff right now, but I think we'll get there. I think that's where humans still come in and human judgment comes in and making sure that we design the software in a way that can stand on its own securely. [00:11:16] S1: That was actually going to be my reaction when you say we want to reduce the surface area. I'm like, Oh yes, of course, in principle. And that's not the natural inclination of today's models. Mhmm. Right? And, you know, I asked him to do something and I'm like, well, like, with one tenth the complexity, please try again. Is is that the role of engineering and security engineering today? Is that something that's gonna be solved at the model level?
00:11:42 · Dane Knecht, Sarah Guo
[00:11:42] S0: The the way that humans did before agents is it needs to be solved kind of at all levels. You need to train the engineers that are writing the code, the product engineers. The security teams still need to be involved in making sure that they're getting checks and balances, second set of eyes on things. You need to build in processes. We've gone to defining things a lot more internally on how we build at Cloudflare, writing down our principles. We have a document called the Codex, which is kind of like buildup of a lot of RFCs that the teams have built for it. Here's how you build secure software in Cloudflare. Here's how you build available software in Cloudflare. Here's our best practices. And then it kind of gets pulled up into some 10 commandments that the agents know how to follow and use in every part of the review process that can help enforce those things. So you have agents out there that are just writing a lot of the slop, and then you have deeper down the factory, you have people that are doing the performance runs and the security runs. Just like helping company operate before, you need those adversarial reviews. [00:12:49] S1: When you zoom out a little bit and just look at overall traffic on the Internet and how much of it has become agent driven over the last year, I think it's outpaced most people's expectations. What has updated in your worldview of what web a year from now looks like either from an economic model perspective or a security or requisite infrastructure perspective?
00:12:49 · Sarah Guo, Dane Knecht
[00:12:49] S1: When you zoom out a little bit and just look at overall traffic on the Internet and how much of it has become agent driven over the last year, I think it's outpaced most people's expectations. What has updated in your worldview of what web a year from now looks like either from an economic model perspective or a security or requisite infrastructure perspective? [00:13:18] S0: Yeah. I mean, I kind of think of it as we're in the messy middle right now where humans and agents are riding the same rails on the Internet, where, you know, agents are trying to parse a human web when one is just inefficient and was designed for humans that could do things at different speeds. Going to a website and being able to read and see the ads and participate in more of the full economic model versus an agent that now can go to a thousand web pages in the same period of time, which is great. It's just you need to find a new economic model to support that. Do we [00:13:57] S1: get parallel webs? Is there like a human web and a machine web? Like, everybody's trying to do... What's it called? AEO now? Yeah.