S1: Whether you're starting or scaling your company's security program, demonstrating
S1: top notch security practices and establishing trust is more important
S1: than ever. Vanta automates compliance for Soc2, ISO 27,001 and more,
S1: saving you time and money while helping you build customer trust. Plus,
S1: you can streamline security reviews by automating questionnaires and demonstrating
S1: your security posture with a customer facing trust center, all
S1: powered by AI. Over 7000 global companies like Atlassian, Flow
S1: Health and Quora use Vanta to manage risk and prove
S1: security in real time. Get $1,000 off Vanta when you
S1: go to Vanta comm slash unsupervised. That's vanta.com/supervised for $1,000 off.
S1: Welcome to Unsupervised Learning, a security, AI and meaning focused
S1: podcast that looks at how best to thrive as humans
S1: in a post AI world. It combines original ideas, analysis,
S1: and mental models to bring not just the news, but
S1: why it matters and how to respond. All right, welcome
S1: to unsupervised Learning. This is Daniel Miessler. I am in
S1: a hotel room in Vegas recording because I have to.
S1: But it is Hacker Week and I'm here for Defcon
S1: and Black Hat and all that good stuff, but I
S1: wanted to get the episode out. So first note here
S1: is that Osint is one of my favorite hobbies, and
S1: there's something called a pizza index. That's one of my
S1: favorite examples of this, which is how much pizza essentially
S1: the neighborhood around the Pentagon is ordering, which really means
S1: the Pentagon. And there's another index related to that, which
S1: is how many people are in the bars and this
S1: person real. Ben Geller posted a tweet about this. And
S1: essentially it says it shows that the people in the
S1: bars is like extremely low and the pizza meter is
S1: off the charts. And I just love this so much
S1: because it indicates pretty strongly that something is about to
S1: go down. And I've got a friend who used to
S1: be an analyst at the Pentagon, and he says, this
S1: is absolutely true. When people are ordering in pizza and
S1: nobody's going home, it's obviously because something is going down.
S1: And in this case, we kind of know what's going down,
S1: which is Iran is preparing to attack Israel and or
S1: whoever else. So that's what that is. But definitely check
S1: out this tweet. It's pretty interesting. So this is also
S1: why I can't wait to fully build out my agent framework,
S1: and for agent framework to become more tightly integrated with
S1: models and platforms, because it's going to allow a lot
S1: more people to do things like this. What I love
S1: about it is you could track all the different experts, right?
S1: I'm going to use a whole bunch of different stuff
S1: for this, but there will be some agent functionality in
S1: the middle to sort of handle, like orchestration and summarization
S1: and creating like an Intel report. But I love the
S1: idea of like gathering all these individual, hopefully standalone intelligence sources,
S1: aggregating them together, but also keeping them separate and then
S1: triangulating on truth based on that. And I heard some
S1: pretty cool ideas from, um, it was actually a friend
S1: of mine named John, uh, who was talking about how
S1: you want to rate those different sources in different ways.
S1: One way to rate them is to rate them based
S1: on their difference and their uniqueness of ideas relative to
S1: other people, because you don't know if they're actually just
S1: reading other people's Intel and following along, and you don't
S1: want to use eight of those people who are all
S1: following the same thing as eight different ends, right? Eight
S1: different sources of of data or sources of signal. So
S1: there's a whole bunch of cool stuff that you could
S1: do once you have the discrete signal coming in from
S1: all these different places. And then you could factor in
S1: things like prediction markets and stuff like that and just, uh,
S1: lots of different stuff you could do. But ultimately what
S1: I want is a daily Intel report, which is as
S1: good or better than what you would get from, like
S1: Stratfor back in the day. Or you know what a
S1: lot of these paid platforms would do. Um, or even like,
S1: you know, a high level government thing, I think we
S1: could build something really, really good that leverages the intelligence
S1: of all these different, really smart people who are posting
S1: their stuff online. We're not talking about private stuff. We're
S1: talking about people on Twitter. We're talking about people on
S1: different platforms, blogs. They're writing their stuff out there. And
S1: a lot of times nobody's reading it. But if you
S1: put the effort in, you could find all those signals
S1: and start triangulating. So really excited about that. Okay. The
S1: state of things. Yeah. I wrote a long piece about, uh,
S1: this is I posted it on X, a fairly long piece.
S1: I should probably turn it into a full blog, but
S1: it's a little bit, uh, long winded and it's got
S1: some politics in it, so I think I'm going to
S1: skip it, but I recommend going and checking it out
S1: if you're into that kind of stuff. And I spoke
S1: with Christine Gadsby, the head of product security operations at BlackBerry,
S1: and we talked about the role of AI in cybersecurity
S1: and a whole bunch of different topics. The topic list
S1: for this episode is quite large and you should absolutely
S1: check it out. Um, so so go check that out
S1: on the YouTube or you can click it in the
S1: newsletter as well. So for security, two critical ServiceNow vulnerabilities
S1: were reported by Asset Note company has reportedly paid a
S1: new record high 75 million to a ransomware group. And
S1: that seems like a lot of money. But it's not
S1: a lot compared to not being able to do business
S1: at all. So a lot of people kind of beat
S1: up people for paying ransoms. And it really is kind
S1: of similar to like, your kid gets stolen. It's like
S1: all the philosophy goes away when somebody has your kid
S1: and it's the same as a CEO or whoever. When
S1: you have the ability to pay some money and get
S1: business back online, sure, they might just ransom you again. Sure,
S1: they might do whatever. Sure, it might be bad for
S1: other people. But when business has stopped, things become quite
S1: clear to you in terms of what you need to do.
S1: So I'm not saying people should pay or anything like that.
S1: I'm not making any judgments. I'm just saying, well, essentially
S1: that don't make judgments. Try to avoid making judgments because
S1: it's really hard to be in that position. Digicert is
S1: revoking 83,000 TLS certificates due to a domain validation bug.
S1: China is getting around US bans on advanced AI chips
S1: through smuggling front companies and loopholes, basically finding ways to
S1: get the chips that are not supposed to be getting.
S1: Ransomware attacks are rising, with an 18% year on year
S1: increase reported by Zscaler, and I've always considered ransomware attacks
S1: to be something that we'd have to invent as a government.
S1: It would have to be like a government service if
S1: if it didn't exist in the marketplace, like as a
S1: way to test for bad security. And maybe you give
S1: like a fine or something if people keep having the mistake.
S1: But my intuition was that after a number of years
S1: that we'd get harder and harder because security would increase.
S1: So if these attacks are still increasing, I wonder what
S1: the reason is. Is it because attackers are moving to
S1: like the more vulnerable targets, or are they just getting
S1: better at finding the holes or something else? Or all
S1: of the above? Probably all of the above. But if
S1: somebody has more insight on why things aren't getting tighter
S1: or see, that's the trick is it doesn't mean things
S1: aren't getting harder. Just because the number of attacks are
S1: going up doesn't mean things aren't getting harder. They might
S1: just be getting better faster. Got a great analysis here
S1: of securing secrets in AWS. So the blog post discussing
S1: creating custom implants for evasion by building them in C
S1: and this thing details server setup, client functionality, and testing
S1: against security tools. The average cost of a data breach
S1: jumped 10% to 4.88 million in 23. China is tightening
S1: its civilian drone export rules starting September 1st to prevent
S1: use in military or terrorist activities. Yeah, I'm trying to
S1: figure out if this is CCP trying to keep it
S1: their stuff from being used against them, or if they're
S1: trying to make it easier to sell their products because
S1: they're playing nice and they're appearing to be good guys.
S1: AI and tech open AI has started rolling out its
S1: new ChatGPT voice feature for ChatGPT plus users, and it's
S1: quite good. It's it's quite a bit different. You can
S1: basically interrupt it. It sounds a lot more natural. I
S1: am getting a lot of voice artifacts though, like it'll
S1: sound like choppy and broken and a lot of weird pauses.
S1: Not like in a human way, but I think the
S1: platform might be overwhelmed. Or maybe, I don't know, maybe
S1: I need to restart the app. Maybe it was buggy.
S1: Not sure. Lots of AI talk at Blackhat, which, uh, yeah,
S1: already here and it's already happening. Um, another thing to
S1: mention about the ChatGPT stuff is, uh, Greg Brockman is
S1: taking a sabbatical. Uh, John Schulman, I think, is leaving
S1: the company. Is he the one that went to to anthropic?
S1: I can't remember. Another leader went to anthropic and another
S1: one left as well. So the three people left all
S1: at once. But it's not like a mass exodus all
S1: to one place they're not mad at. OpenAI seems to
S1: be fairly benign. Um, but it does look kind of
S1: weird to have an announcement where three people leave at
S1: the same time. A funniest joke I saw about this
S1: was that Sam Altman predicted that soon there would be
S1: a one person unicorn company, and the joke was, yeah,
S1: it might be your company. You might be the only
S1: one left. Um, I thought that was kind of clever.
S1: California's SB 1047 safe and secure innovation for Frontier Artificial
S1: Intelligence Models Act. That's a long name. It's looking to
S1: regulate large AI models by mandating safety features to prevent
S1: catastrophic incidents. Use risk based AI regulation began on August 1st,
S1: and it's got staggered deadlines based on low or no
S1: risk versus high risk and limited risk tiers. So that's
S1: starting to roll out. And OpenAI has launched the GPT
S1: four long output model. I've already switched all or at
S1: least a lot of my stuff. I switched my fabric
S1: prompt over to this. So it's got 64 output tokens,
S1: 64,000 output tokens, which is 16 times more than the
S1: previous one, and it's 50% cheaper for most things. And
S1: a lot of people are saying that the benchmarks, it's
S1: actually much better than the previous one. So I consider
S1: it just a straight across upgrade plus being cheaper. So yeah,
S1: I already made that change. Google's experimental Gemini 1.5 Pro
S1: has claimed top spot on a bunch of leaderboards, surpassing
S1: GPT four and, uh, sonnet 35 with a score of 1300.
S1: I've not used it yet, because every time I try
S1: to use a Google product, I have to vomit. But
S1: I am going to try again soon to see, uh,
S1: if it's usable. Meta says it'll need ten times more
S1: computing power to train llama four compared to llama three.
S1: Elliott Management is calling Nvidia a bubble and says AI
S1: is overhyped. They mark. They argue that the market is
S1: overly optimistic about AI's potential and Nvidia's role in it.
S1: I think it's a bubble, but it's a bubble like
S1: the internet in 1995. In other words, there absolutely will
S1: be a burst of lots and lots of companies, right?
S1: Pets.com and companies like that, the AI equivalents, thousands of
S1: those companies are going to fail. Lots of investors are
S1: going to be very sad about this, but that's completely
S1: unrelated to what AI is up is about to do
S1: to the world. Right? So I think people shouldn't be
S1: confused about those two things. One happening doesn't mean that
S1: the other one is not going to happen. Bellingcat has
S1: put together a guide on identifying explosive ordnance in social
S1: media imagery. CrowdStrike is facing a massive lawsuit after Blue
S1: Friday crashed over 8 million computers globally. Intel is laying
S1: off over 15% of its workforce as part of a
S1: $10 billion cost reduction plan. Apple just posted a record
S1: breaking Q3 2024, $86 billion in revenue. And one thing
S1: that's interesting about this is Berkshire Hathaway just sold a
S1: whole bunch of stuff, uh, a whole bunch of Apple.
S1: And they sold it right before this crash happened. The
S1: crash happened. There was a giant recession that hit the
S1: United States, and then it went away the next day.
S1: Today was like a lot of that money came back. But, um. Yeah, strange.
S1: Who knows? It could happen again tomorrow. But very volatile,
S1: very emotional sort of time. I feel like in lots
S1: of different ways, and I feel like the stock market
S1: is matching that. But, uh, the other thing to mention
S1: about Apple is that their services money is now almost
S1: equal to their devices money, which is a huge tipping
S1: point or a milestone in terms of their growth. Apple
S1: is ramping up spending to get Apple intelligence ready for
S1: launch in the fall. I'm already using the beta, and
S1: it's pretty impressive, even though a lot of the features
S1: aren't rolled out yet. All right, human news. A lot
S1: of the world tried to push Huawei out of their infrastructure,
S1: but they're actually getting more successful, not less. Software company
S1: increased user engagement by eight times by drastically shortening their emails.
S1: Netlify fees. Is that it? Yeah. Netlify fees. Initial 150
S1: word emails had a 1% reply rate, but by cutting
S1: the text to 37 words, it went to 4%. And
S1: when they went to 14 words, it went to 8%
S1: 14 words. Last month, Shane Mack offered everyone at his
S1: company $25,000 to quit and six people took it. Yeah,
S1: I think this is part of the Alaskan fishing boat
S1: thing that I wrote a while back. Companies basically want
S1: fully dedicated murderers is all they want. They want people
S1: who eat, live, sleep, think and are obsessed with the company.
S1: That's why they want return to office. That's their way
S1: of filtering for people who who think of the company
S1: as a religion. I mean, they can't say that, but
S1: they can say you have to come to the office
S1: and that's an automatic filter for it. Right? So this
S1: is the way that management and managers and the whole
S1: whole system can basically look for these obsessed people, which
S1: are likely to be in certain demographics, right? Certain ages,
S1: you know, certain groups that are awfully likely to look
S1: kind of similar to each other. Probably young, probably without kids,
S1: probably male, who are just grind, grind, grind, don't care
S1: about anything else. Yeah, whatever. Work life balance don't care.
S1: I just want a code or whatever it is. Right.
S1: So that's what these companies are looking for more and more.
S1: And that's why I think and this is just my
S1: hypothesis here, I don't, you know, we need more data
S1: for all this. But my pet hypothesis here is that
S1: this is a factor for all of these layoffs. It's
S1: like this awakening across all of business that you know
S1: what I want hardcore crazy people, religious people about this company.
S1: And I want them to be a-players. And I want
S1: them to be really good at AI, and they're going
S1: to help us do even more with AI because they're
S1: going to bring the AI on and blah, blah, blah.
S1: So it's like, I'm going to hire a bunch of
S1: these crazy people, and a team of ten of them
S1: is going to be like having a team of 1000
S1: or 2000 people sometime in the future, in the near future.
S1: Whereas if you get a bunch of people who are
S1: just straight out of college, they're entitled. They think they
S1: are owed something even worse. They think that they're about
S1: to receive training on the job because they don't know
S1: how to do the job. And it's like, okay, well,
S1: now train me. Now, teach me how to do this job.
S1: And all these leaders at these companies are like, I
S1: do not want you. I don't care what degrees you have.
S1: If you can't do the job on day one, or
S1: you can't learn instantly, like just by seeing it once,
S1: and if you're not obsessed about it and want to
S1: sleep under your desk, we have no use for you.
S1: And unfortunately, that's like 80% of the workforce, I'm guessing, right?
S1: It's like 52, 90% of the workforce, let's call it that.
S1: And what that means is they are looking for that 10%.
S1: They're looking for that 5%. They're looking for the A
S1: players who are dedicated like religious people. And I believe
S1: this is what we're seeing more than anything now. You
S1: add AI on top of that. Now you see why
S1: there's so many layoffs. Now you see why there's so
S1: many open positions. But nobody's hiring for them because they're
S1: kind of like fake positions. And this is multiple hypotheses
S1: all rolled into one. But you get the vibe. This
S1: is the basic vibe of what I think is happening.
S1: Journalist Evan Gershkovich was among a group of Americans and
S1: Russian dissidents released from Russia in a seven nation prisoner swap,
S1: largest ever since the Cold War. Researchers at the University
S1: of California, Santa Barbara have developed an AI model called
S1: shark AI to help prevent shark attacks. The model uses
S1: drones to detect sharks with greater accuracy than humans. I
S1: love this, I love this every time I go to Maui,
S1: I'm stupid and I read the stats about like, shark
S1: attacks and they're like, oh, actually, right next to you
S1: is the most dangerous place. And I'm like, cool. I
S1: didn't want to go in the water anyway. Why did
S1: I read that right before I went on vacation, where
S1: I'm supposed to swim in the water? But anyway, if
S1: I were able to look up and maybe they're so
S1: high up you can't hear them, maybe it's not super annoying.
S1: But anyway, if I know that there's ten of these
S1: drones sweeping back and forth and you know they're being recharged,
S1: they go back on rotation and they look down. They
S1: could see very clearly if there's a shark in the water,
S1: I assume that it wouldn't work. Maybe if the water
S1: was muddy, but maybe you wouldn't be swimming anyway because
S1: it would be dangerous water anyway. Usually in a lot
S1: of places you could see right through the water. It's
S1: very easy to see a shark from above, and they
S1: just call the lifeguard station and trigger an alert, and
S1: they blow the whistle and everyone gets out of the water, like,
S1: that's going to be amazing. Love it. Treating failing eyesight
S1: and high cholesterol are two new ways to lower the
S1: risk of developing dementia, according to a major report. The
S1: Lancet Commission's latest findings suggest that addressing 14 health issues
S1: could theoretically prevent nearly half of all dementia cases worldwide.
S1: And I believe from reading this that essentially they're talking
S1: about things that just exacerbate it and make it worse. So,
S1: for example, if you can't really see things, you generally
S1: maybe you don't go out a lot. If you can't
S1: hear conversations, you're not involved in conversations. So I think
S1: a lot of this might be related to social interaction,
S1: which once you start to get isolated and you're not
S1: consuming media, you're not reading, you're not like, there's no
S1: new inputs. Um, again, this is my hypothesis. I believe
S1: this is based on some solid science I've already read,
S1: though is basically, once you get isolated in that way,
S1: your brain starts like shutting down, and it really accelerates
S1: the dementia. So that that would make sense if, uh,
S1: that's what they were saying in this paper. Self control
S1: is about 60% heritable, meaning genes explain roughly 60% of
S1: the differences in self control among individuals. So I think
S1: this could be devastating if it's supported in further studies.
S1: I worry about the narrative that both IQ and self-discipline
S1: are mostly genetic, thus giving people an easy ramp to
S1: write off individuals or even groups if they have lower
S1: averages of these things. And I think even if it
S1: were true, the groups don't define the individuals and the
S1: study mentioned individuals here. It's not talking about groups, but
S1: you know, people are going to people. Right? So the
S1: the other thing is there's likely a lot of slack in, say,
S1: the 40%, which is environmental, assuming those numbers are correct,
S1: like we're probably getting whatever, 10 or 20% of the 40%
S1: we're supposed to be doing. So if we were to increase,
S1: you know, the efforts of, you know, training and culture
S1: and all the environmental things we can control, I think
S1: that would raise, you know, the bar for, well, everyone,
S1: but especially the bottom quite a bit. So I'm not
S1: sure this is really anything too much to despair about
S1: other than making it easier for certain negative narratives. A
S1: new study reveals that people tend to alter their appearance
S1: to match their names. Researchers found that adults faces often
S1: align with a social stereotype associated with their name, while
S1: children's faces do not show this pattern. A key protein
S1: called reelin may help stave off Alzheimer's disease. A number
S1: of new studies suggest that reelin helps maintain thinking and
S1: memory in aging brains, and when its levels fall off,
S1: neurons become more vulnerable and people are starting to obviously
S1: work on drugs for this. Wizards of the coast will
S1: release the 2024 Dungeons and Dragons rulebooks under a Creative
S1: Commons license, which is fulfilling a promise they made after
S1: the backlash over attempts to change the Open Gaming License.
S1: If novelists wrote Your bug Reports imagines how famous authors
S1: would describe software bugs in their unique styles, Ernest Klein
S1: likens a screen flicker to scenes from back to the
S1: Future and Ghostbusters, while Ursula K Le Guin philosophizes about
S1: the existential pain of coding errors. Ideas. More analysis on
S1: how bad the results were of the recent UBI study
S1: done by Sam Altman. It looks pretty bad, just like
S1: we talked about last week, and got a link here
S1: to go into that in depth. And really cool idea
S1: from Jonathan Hite about free range kids. And a cool
S1: idea for giving them freedom is to create a play
S1: street once a month where you close off a street
S1: for two hours, give time for kids to play in
S1: the street safely, and then the whole time that the
S1: parents are there watching, like around the edges and, you know, whatever.
S1: But the neighbors are also meeting and talking, and he's
S1: saying it has transformative effects on the neighborhood and just
S1: good times all around. I really love ideas like this.
S1: Discovery Farmbot is an open source farming machine for growing
S1: food in your own backyard. Super memory an AI powered
S1: platform to organize, search and utilize saved information acting as
S1: a digital second brain. Friend is Avi Schiffman's new AI pendant,
S1: and it's designed to combat loneliness by sending you reassuring
S1: or playful text based on what it overhears so it
S1: doesn't have a speaker. It actually sends you notifications. Kind
S1: of interesting way to do that. Daniel Kosman walks you
S1: through installing fabric and open source AI framework by Daniel Missler.
S1: That's weird. I wonder if I wrote that because I
S1: don't talk about myself in the third person. Fleet is
S1: an open source version of fleet DMs tool built on
S1: OS query for vulnerability monitoring, MDM detection engineering and more.
S1: Soc2 policy Templates collection of templates for Soc2 policies and procedures.
S1: Clutch security is a platform providing visibility into all non-human
S1: identities within an organization, helping them identify associated risks and
S1: the recommendation of the week. If you're at Blackhat this week,
S1: remember that ten and 20 years from now, you will
S1: not remember the talks that you saw this year, but
S1: you will remember spending that time with your friends. So
S1: prioritize friend time over presentation time. Not only is the
S1: friend time more precious and valuable, but you can get
S1: the talks later if you really want to. And the
S1: aphorism of the week friends show their love in times
S1: of trouble, not in happiness. Friends show their love in
S1: times of trouble, not in happiness. Euripides. Unsupervised learning is
S1: produced and edited by Daniel Miller on a Neumann U87
S1: AI microphone using Hindenburg. Intro and outro music is by
S1: Zomby with the Y, and to get the text and
S1: links from this episode, sign up for the newsletter version
S1: of the show at Daniel miessler.com/newsletter. We'll see you next time.