WEBVTT - UL NO. 466 | My Analysis and Prediction on the Deepseek Situation 0:00:00.200 --> 0:00:02.759 Does your app get fake sign ups, throw away emails 0:00:02.759 --> 0:00:06.880 or users abusing your free tier? Or worse, bot attacks 0:00:06.880 --> 0:00:10.560 and brute force attempts work OS radar can block all 0:00:10.560 --> 0:00:14.080 of this and more. Simple API gives you advanced device 0:00:14.080 --> 0:00:18.800 fingerprinting that can detect bad actors, bots, and suspicious behavior. 0:00:19.320 --> 0:00:23.040 Your users trust you. Let's keep it that way. Check 0:00:23.040 --> 0:00:32.000 out OS Radar at work OS radar. That's work. OS radar. 0:00:32.040 --> 0:00:36.200 Unsupervised learning is a podcast about trends and ideas in cybersecurity, 0:00:36.240 --> 0:00:41.159 national security, AI, technology, and society, and how best to 0:00:41.200 --> 0:00:48.599 upgrade ourselves to be ready for what's coming. All right. 0:00:48.600 --> 0:00:51.199 Welcome to Unsupervised Learning. This is Daniel Miessler, and I'm 0:00:51.200 --> 0:00:55.279 building AI to upgrade humans. Episode 466. Hope your week 0:00:55.280 --> 0:00:58.200 is starting off better than Nvidia's did, which is probably 0:00:58.200 --> 0:01:01.700 pretty easy to do. Went to a phenomenal offensive security 0:01:01.700 --> 0:01:06.940 and AI conference sponsored by Rob Ragan. Not really sponsored 0:01:06.940 --> 0:01:09.100 by him, but put on by him. Had lots of 0:01:09.420 --> 0:01:12.140 cool sponsors for different things. But anyway, it was a 0:01:12.140 --> 0:01:15.060 whole day of hacking. Basically, it was a hackathon fundamentally, 0:01:15.580 --> 0:01:19.620 but it was also just a great networking event for anybody, 0:01:19.660 --> 0:01:22.100 kind of at the intersection of AI and security in 0:01:22.100 --> 0:01:25.500 San Francisco. And it was just just great. Rob did 0:01:25.500 --> 0:01:28.220 a great job. Kind of a nerd observation. Far too 0:01:28.220 --> 0:01:32.020 many people don't know how to use name drop. If 0:01:32.020 --> 0:01:34.780 you take your iPhone and set it next to another 0:01:34.780 --> 0:01:38.180 one's iPhone, someone else's iPhone at the top. Like if 0:01:38.180 --> 0:01:40.700 you just touch, you don't even have to touch, but 0:01:40.700 --> 0:01:44.700 you get close enough. It's NFC based and you could 0:01:44.700 --> 0:01:47.420 transfer your contact. Every time I do this, people are like, 0:01:47.420 --> 0:01:50.300 what have you done? Like, they can't believe it. It's 0:01:50.300 --> 0:01:53.980 got like this little wobbly like liquid effect. It's like 0:01:53.980 --> 0:01:56.900 the coolest thing ever. And it's how I like to 0:01:56.940 --> 0:02:01.480 exchange contacts with people who have iPhones. And yeah, I 0:02:01.480 --> 0:02:04.440 don't know why more people aren't doing it or don't 0:02:04.440 --> 0:02:07.240 even know the feature exists. And this is in San Francisco, 0:02:07.240 --> 0:02:10.440 by the way. This is like the center mass of 0:02:10.440 --> 0:02:12.960 Apple in the center of mass of like the tech scene. 0:02:13.720 --> 0:02:16.280 And people in San Francisco don't know how to do 0:02:16.280 --> 0:02:19.160 this thing. They don't know that it exists. Really glad 0:02:19.160 --> 0:02:21.960 I bought a bunch of TSMC last week because it 0:02:21.960 --> 0:02:26.560 just massively crashed. Uh, yeah, that's that's awesome. All good though. 0:02:26.600 --> 0:02:29.400 Playing the long game. I think it's fine. We'll actually 0:02:29.400 --> 0:02:31.800 talk about that a little bit later. I just finished 0:02:31.800 --> 0:02:35.920 reading a book for UL. Book club. Picture of Dorian gray. 0:02:36.160 --> 0:02:38.920 Lots to say about that. That's a whole nother talk show. 0:02:38.919 --> 0:02:43.040 But one thing I will say is that read classics. 0:02:43.160 --> 0:02:47.000 You need to read classics. They are more dense with 0:02:47.000 --> 0:02:51.519 value than almost any other type of book, probably any 0:02:51.520 --> 0:02:54.079 other type of book. And every time I read one, 0:02:54.080 --> 0:02:56.850 I'm like, how many of these are just sitting there 0:02:57.690 --> 0:03:01.170 full of this much knowledge, and I'm not reading them. Infuriating. 0:03:01.450 --> 0:03:05.010 So luckily we have UL Book Club to prod us 0:03:05.010 --> 0:03:08.690 into doing that. Here's what we do. In UL Book 0:03:08.690 --> 0:03:17.690 Club we oscillate between nonfiction, fiction, nonfiction classic. Nonfiction fiction, nonfiction. Classic. 0:03:18.169 --> 0:03:21.609 So what we're doing is half nonfiction and half or 0:03:21.650 --> 0:03:26.450 half nonfiction, one quarter classic and one quarter fiction. And 0:03:26.450 --> 0:03:28.769 that has been a good mix for us. And we've 0:03:28.770 --> 0:03:33.169 been doing this since like 2016 or something. So a 0:03:33.169 --> 0:03:35.690 long time this book club has been going. This week's 0:03:35.690 --> 0:03:40.010 discovery section is really good. I make some tweaks to 0:03:40.050 --> 0:03:42.850 make it even better. So this is kind of the 0:03:42.850 --> 0:03:47.650 first instance of that. Had a great conversation with Faisal Khan, 0:03:48.050 --> 0:03:51.850 a GRC guy over at Vanta, and that was a 0:03:51.890 --> 0:03:56.910 sponsored interview And fantastic. Last couple of sponsored interviews have 0:03:56.910 --> 0:04:00.270 just been really, really good. So that was fun. I'm 0:04:00.270 --> 0:04:04.750 going to jump into security Sonicwall vulnerability being actively exploited. 0:04:04.990 --> 0:04:09.350 Really nasty vulnerability in their SMA 1000 appliances. And it 0:04:09.350 --> 0:04:11.470 is being used in the wild and it is a 0:04:11.470 --> 0:04:14.950 9.8 on the Richter scale. My buddy Sam Curry and 0:04:14.990 --> 0:04:18.349 Shubham Shah found that they could remotely unlock, start and 0:04:18.350 --> 0:04:24.030 track Subarus. So a couple of the goats of Bounty 0:04:24.070 --> 0:04:27.790 and yeah, found a really nasty one. And it looks 0:04:27.790 --> 0:04:32.469 like the network that they're using actually involves other manufacturers 0:04:32.470 --> 0:04:34.950 as well. So it's not just Subaru, but I think 0:04:34.950 --> 0:04:37.990 the main effect was on the Subaru stuff and got 0:04:37.990 --> 0:04:40.110 a thread here on the downsides of everyone getting a 0:04:40.110 --> 0:04:42.750 coding assistant, where I say one of the biggest impacts 0:04:42.750 --> 0:04:45.590 of AI that goes kind of unnoticed is that we're 0:04:45.589 --> 0:04:49.390 about to see an explosion of poorly built applications, specifically 0:04:49.390 --> 0:04:54.930 applications built completely By eye with no thought of security whatsoever. 0:04:55.690 --> 0:04:59.610 And the reason I a little bit of like opening 0:04:59.610 --> 0:05:03.610 the kimono here. The reason I noticed this, or just 0:05:03.610 --> 0:05:07.450 wanted to think about it, is because I'm doing it. 0:05:07.529 --> 0:05:11.729 I see myself being sloppy. Now I'm going and cleaning up. 0:05:11.970 --> 0:05:15.890 In most cases. But but there are certain cases where like, 0:05:15.930 --> 0:05:19.210 it's not really publicly exposed. I'm not too worried about it. 0:05:19.330 --> 0:05:23.090 Like it's only running local. I am moving so fast 0:05:23.810 --> 0:05:27.529 that I can see myself being sloppy. There's another thing 0:05:27.610 --> 0:05:33.370 that is really seductive about AI coding that you really 0:05:33.370 --> 0:05:36.290 have to watch out for, which is the better it gets, 0:05:36.290 --> 0:05:39.969 the more it encourages you to just kind of trust 0:05:39.970 --> 0:05:42.849 it and just kind of go with it. And this 0:05:42.850 --> 0:05:47.210 is bad because it's bad for a number of reasons. One, 0:05:47.210 --> 0:05:51.150 it's bad for the security reason because what you don't understand. 0:05:51.510 --> 0:05:56.710 You can't secure. Okay. But another reason is it just 0:05:56.710 --> 0:06:00.790 stops you from actually getting under the covers and actually 0:06:00.950 --> 0:06:04.349 doing the mental work of figuring out how the components 0:06:04.350 --> 0:06:07.430 should be laid out. So the better the A's get, 0:06:07.550 --> 0:06:10.429 what you'll do is you'll just drop a a stupid 0:06:10.430 --> 0:06:16.790 paragraph into your AI agent in a coding tool like Klein, 0:06:16.790 --> 0:06:20.830 or like cursor, or like windsurf or something. This is 0:06:20.830 --> 0:06:24.030 a starting point that so many people are doing right now. 0:06:24.550 --> 0:06:26.870 It's not my recommended way to start, and it's not 0:06:26.870 --> 0:06:29.550 the way I start when I really want to build 0:06:29.550 --> 0:06:31.990 a good application. If I want to build a really 0:06:31.990 --> 0:06:35.789 good application, I actually start with a structured prompt, which 0:06:35.790 --> 0:06:39.870 is a little bit like a PRD document, and you 0:06:39.870 --> 0:06:42.230 have that in the directory, and then you tell the 0:06:42.230 --> 0:06:44.750 agent to go look at that thing, or you put 0:06:44.750 --> 0:06:47.029 it in the place where it automatically parses it, like 0:06:47.029 --> 0:06:49.360 in the cursor rules file, for file, for example, and 0:06:49.360 --> 0:06:52.360 that's the way you do it properly. But what most 0:06:52.360 --> 0:06:55.640 people are doing, I would guess, because I even find 0:06:55.640 --> 0:07:01.320 myself doing this as well, is they're just babbling, typing, 0:07:01.680 --> 0:07:04.240 or even dictating, oh, I want an app that does 0:07:04.240 --> 0:07:06.080 this and oh, it's going to be like this. Oh, 0:07:06.080 --> 0:07:08.440 and make sure it looks cool. And oh, and by 0:07:08.440 --> 0:07:10.480 the way, like it should have this thing, but I 0:07:10.480 --> 0:07:12.400 want the button on the left instead of the right. 0:07:12.400 --> 0:07:16.760 It's just this long paragraph of babble garbage. And then 0:07:16.760 --> 0:07:20.040 they press enter and then the thing starts making stuff. 0:07:20.480 --> 0:07:24.840 Now it could be making the most horrendously insecure things. 0:07:25.560 --> 0:07:29.000 It could be making things that are not really scrutable 0:07:29.000 --> 0:07:33.880 or understandable, like they split the logic across multiple pieces. 0:07:33.880 --> 0:07:36.920 So it's not like it's not readable, it's not understandable. 0:07:37.840 --> 0:07:41.560 And there's a tendency for people because they want to 0:07:41.560 --> 0:07:44.760 move fast. And again, when I say people, I mean me. 0:07:44.920 --> 0:07:47.780 And I think the situation is what? Much worse than 0:07:47.780 --> 0:07:51.380 me because I'm actually guarding against this actively. So I 0:07:51.380 --> 0:07:54.620 think it's way worse for just the general public. And 0:07:54.620 --> 0:07:58.020 it's already bad for me. But it's like what you 0:07:58.020 --> 0:08:00.220 end up with is a thing that kind of works. 0:08:00.340 --> 0:08:03.700 Which is why I use this image here, um, which 0:08:03.700 --> 0:08:07.740 my team actually came up with. Angela came up with this, and, uh, 0:08:07.740 --> 0:08:11.220 it's like you end up with this monstrosity that can, like, 0:08:11.260 --> 0:08:16.740 fall over so easily. It's just total, absolute garbage. And 0:08:16.740 --> 0:08:19.460 then you're like, uh, no, not like that. No, no. 0:08:19.460 --> 0:08:23.100 Change that one thing. And then after like 20, 30, 50, 0:08:23.140 --> 0:08:26.060 100 iterations of this thing over the course of like 0:08:26.060 --> 0:08:28.660 an hour and a half, like if you're doing something 0:08:28.660 --> 0:08:30.460 else on the side, but you come back and check 0:08:30.460 --> 0:08:34.420 on its progress. Okay, maybe you made something, but one 0:08:34.420 --> 0:08:37.260 can you edit it? Can you? Do you understand it? 0:08:37.700 --> 0:08:40.179 Do you understand all the technologies that you use to 0:08:40.179 --> 0:08:45.120 build that thing? Probably not. Did it use proper Technique 0:08:45.360 --> 0:08:49.800 and best practices to build the stuff? Probably not. It depends. There's. 0:08:49.840 --> 0:08:54.800 Wide variation there, but probably not. And finally, like okay, 0:08:54.840 --> 0:08:57.880 for all the configs, did you use cloud services? Okay cool. 0:08:57.880 --> 0:09:01.640 Where are the API keys? Are the configs readable? Like 0:09:02.280 --> 0:09:05.600 oh did you use cloud storage? Are those buckets locked down? 0:09:06.000 --> 0:09:09.120 All these things are like the faster we get at 0:09:09.120 --> 0:09:12.040 using these AI tools, and the more people get in 0:09:12.080 --> 0:09:16.400 who aren't actual coders who never coded anything beforehand, this 0:09:16.400 --> 0:09:20.960 problem is 100 times worse for that. So bottom line is, 0:09:20.960 --> 0:09:22.760 there is so much good that's going to come out 0:09:22.760 --> 0:09:26.800 of AI. And I would say it's still more good 0:09:27.000 --> 0:09:29.760 is going to come out of AI. Because I would 0:09:29.760 --> 0:09:33.800 say creation is more important than security. That would be 0:09:33.800 --> 0:09:37.400 my my thing. And which might be strange to hear 0:09:37.400 --> 0:09:40.600 from a security person, but I honestly believe that's true. 0:09:41.080 --> 0:09:45.620 I would, I want secure creation. That's what I want. But, um, 0:09:45.620 --> 0:09:49.380 if I had to choose. Everything is secure and nothing happens. 0:09:49.500 --> 0:09:53.100 I would rather have insecure creation. So I think that's 0:09:53.100 --> 0:09:56.900 more important for humans. But bottom line is there are 0:09:57.020 --> 0:10:03.380 externalities to. These AI tools, severe externalities to these AI tools. 0:10:04.020 --> 0:10:09.179 The better they get, the more they coax you into. 0:10:09.220 --> 0:10:13.300 Not looking under the covers. And it's nasty under the 0:10:13.300 --> 0:10:16.140 covers with a lot of these AI tools. Crater of 0:10:16.140 --> 0:10:19.980 curl just announced they're completely abandoning Cvss scoring because it's 0:10:19.980 --> 0:10:26.540 fundamentally broken for wide, widely used open source projects. And 0:10:26.540 --> 0:10:31.059 this is specifically Daniel Stenberg explaining how Cisa recently marked 0:10:31.660 --> 0:10:36.660 a low severity vulnerability as a critical with A91. And 0:10:36.660 --> 0:10:38.940 he's basically saying it should not have been A91. It 0:10:38.940 --> 0:10:41.910 should have been a low. So all this talk has 0:10:41.910 --> 0:10:44.630 really been flying around for a long time, and they 0:10:44.670 --> 0:10:48.390 kind of made some updates with the latest version of CSS. 0:10:48.830 --> 0:10:52.550 But I think ultimately the problem is that these static 0:10:52.550 --> 0:10:55.350 things are not made to be looked at constantly. They're 0:10:55.350 --> 0:10:58.030 not made to look at the actual risk of your 0:10:58.030 --> 0:11:01.390 org and your codebase and all the context around that, 0:11:01.550 --> 0:11:04.150 combined with the risk of the vulnerability. And then to 0:11:04.190 --> 0:11:07.750 compare those two. And this is probably going to surprise you, 0:11:07.750 --> 0:11:10.910 but I think I might be a good application here. 0:11:11.110 --> 0:11:13.589 You've never heard that from me that I might be useful. 0:11:14.110 --> 0:11:19.910 But the idea is that what you what CVS, CVS 0:11:19.950 --> 0:11:22.829 and other tools like this are bad at is they 0:11:22.870 --> 0:11:27.670 are they're static. Right. You put some dumb information there 0:11:27.670 --> 0:11:30.829 about like, oh how exposed am I or whatever. That's 0:11:30.830 --> 0:11:33.790 not really the way to find out how exposed you are. 0:11:34.070 --> 0:11:36.710 The real way to do that is to pull in 0:11:36.710 --> 0:11:40.650 real time context. So the future of all of this 0:11:40.650 --> 0:11:46.050 is like super obvious. It's basically context plus intelligence of 0:11:46.050 --> 0:11:50.810 combining a vulnerability with your actual like risk posture. And 0:11:50.809 --> 0:11:55.770 that's what's going to determine like what your current risk is. 0:11:56.050 --> 0:12:00.370 That's that's just the reality of what's coming. And so 0:12:00.370 --> 0:12:03.250 it could be that, you know, there's nothing particularly wrong 0:12:03.250 --> 0:12:07.610 with Cvss. It's it's always been like this. The previous 0:12:07.610 --> 0:12:11.809 versions were, you know, worse. And then there's other systems 0:12:11.809 --> 0:12:14.370 and they also have their problems. But ultimately it comes 0:12:14.370 --> 0:12:17.010 down to this one thing, which is what is the 0:12:17.010 --> 0:12:19.969 state of the world? What exactly is the vuln and 0:12:19.970 --> 0:12:22.250 how does it relate to me? And if you want 0:12:22.250 --> 0:12:26.690 to do that properly in the old days, that's that's 0:12:26.690 --> 0:12:32.010 like sending security engineers to go do research, to study to, 0:12:32.050 --> 0:12:34.010 you know, look at a whole bunch of docs, figure 0:12:34.010 --> 0:12:36.330 out where we have this thing installed. We're talking about 0:12:36.330 --> 0:12:40.469 asset management. We're talking about nightmares. I mean, you can 0:12:40.470 --> 0:12:43.190 spend weeks looking at one phone and seeing how vulnerable 0:12:43.190 --> 0:12:45.270 you are to it. If you want to have a 0:12:45.270 --> 0:12:48.270 good assessment, right. So the whole point of this is 0:12:48.270 --> 0:12:49.790 that you're going to be able to do that much 0:12:49.790 --> 0:12:53.110 faster now. And I think that's ultimately what replaces systems 0:12:53.110 --> 0:12:58.429 like Cvss and the change. Healthcare ransomware attack is now 0:12:58.429 --> 0:13:04.510 officially largest healthcare breach in the US 190 people affected. 0:13:04.510 --> 0:13:08.069 Now Swedish authorities just grabbed a ship they think could 0:13:08.070 --> 0:13:13.429 an underwater internet cable between Sweden and Latvia. This is 0:13:13.429 --> 0:13:17.510 after multiple similar incidents and a lot of them are 0:13:17.550 --> 0:13:21.230 tying back to Russia. All right, the big story deep 0:13:22.030 --> 0:13:26.470 in AI and tech. So Nvidia loses $600 billion after 0:13:26.470 --> 0:13:30.950 deep sea AI breakthrough. And the stock market overall on 0:13:30.950 --> 0:13:35.790 Monday lost $1 trillion. So it was the single biggest 0:13:35.790 --> 0:13:39.010 day of a market loss in history, and it beat 0:13:39.010 --> 0:13:44.410 the record previously from also from Nvidia. But um, basically 0:13:44.450 --> 0:13:46.890 here's what happened. This is what it came down to like. 0:13:47.050 --> 0:13:51.730 Nvidia had been a darling of AI hype because they're 0:13:51.730 --> 0:13:54.770 the GPU leaders. Much of the future hope of making 0:13:54.770 --> 0:13:59.650 money from AI has been embodied by Nvidia. The idea 0:13:59.650 --> 0:14:03.089 is that GPUs rule the AI world and Nvidia rules 0:14:03.090 --> 0:14:07.850 the GPU world. And implicit in that assumption is that 0:14:07.890 --> 0:14:12.770 Nvidia chips are scarce and necessary and expensive. That means 0:14:12.770 --> 0:14:14.530 anyone who wants to be a leader will have to 0:14:14.530 --> 0:14:18.250 have lots of Nvidia chips. So deep tech just blew 0:14:18.250 --> 0:14:20.330 that out of the water because they produced something that 0:14:20.330 --> 0:14:23.730 should have cost them like tens of billions, but they 0:14:23.730 --> 0:14:28.130 did it for $5.6 million. They basically found workarounds that 0:14:28.130 --> 0:14:32.730 allowed them to get a lot more performance for less resources. 0:14:33.610 --> 0:14:37.220 And it freaked everyone out. Mostly investors, but it like 0:14:37.260 --> 0:14:40.540 it messed with the entire stock market because the stock 0:14:40.540 --> 0:14:45.660 market is largely pushed by tech. So basically less necessary 0:14:45.700 --> 0:14:52.020 equals less valuable. My analysis is so what. Right. If anything, 0:14:52.020 --> 0:14:56.180 deep seek is nothing but exciting because we're getting more 0:14:56.300 --> 0:15:01.260 AI for less resources and we need way more AI. 0:15:01.300 --> 0:15:04.980 And I've got a whole video which I'll link up here, 0:15:04.980 --> 0:15:07.740 but it's like, how much do we need? Way, way 0:15:07.740 --> 0:15:10.420 more than we have. And I keep doing this thing 0:15:10.420 --> 0:15:13.980 where I'm like, oh, we only have 0.000 whatever, ten 0:15:13.980 --> 0:15:17.940 zeros and A19. We're only at that percentage of how 0:15:17.940 --> 0:15:20.820 much AI that we need. But I don't know that percentage. 0:15:20.820 --> 0:15:22.660 I'm making that up. I'm trying to show lots of 0:15:22.660 --> 0:15:25.780 zeros to prove it's like a tiny fraction of 1%. 0:15:25.860 --> 0:15:29.460 It's a made up number. It's everyone should obviously know that. 0:15:29.460 --> 0:15:32.720 But the point is we're just getting started. And in 0:15:32.760 --> 0:15:35.320 that video, I lay this all out. I lay out 0:15:35.360 --> 0:15:39.360 what types of things we as a society are going 0:15:39.360 --> 0:15:43.600 to want to do with AI, and why that requires 0:15:43.600 --> 0:15:48.080 so much processing, so much inference, so much intelligence to 0:15:48.120 --> 0:15:51.320 be able to do that for basically every human problem. 0:15:51.800 --> 0:15:54.320 And when I say human problem, I mean that means 0:15:54.320 --> 0:16:00.560 also business problems and stuff like that. Personal problems, everything. So, uh, 0:16:00.560 --> 0:16:04.760 I think we're very confused about this whole thing. Um, 0:16:04.760 --> 0:16:07.080 and the advantage that Deep Seek found is an example 0:16:07.080 --> 0:16:09.400 of what I've been calling slack in the rope. And 0:16:09.400 --> 0:16:12.400 I've been talking about this with my friend Jai Patel 0:16:13.120 --> 0:16:16.720 for a very long time, and he's, like, one of 0:16:16.720 --> 0:16:19.760 the smartest AI people that I know. And I basically 0:16:19.760 --> 0:16:22.960 said back in like 23, I'm like, look there. There 0:16:22.960 --> 0:16:25.680 is so much slack here that's going to allow people 0:16:25.680 --> 0:16:29.800 to jump way ahead, and it's going to jump them 0:16:29.840 --> 0:16:32.860 ahead of the of the line, even above people who've 0:16:32.860 --> 0:16:36.620 been grinding. So, for example, you spend billions of dollars, 0:16:36.660 --> 0:16:40.420 let's say we're at parity between like two competitors and 0:16:40.420 --> 0:16:43.340 somebody spends a billions of dollars and they jump up 0:16:43.340 --> 0:16:47.580 by 20%, but somebody figures out, hey, wait a minute. 0:16:47.580 --> 0:16:50.620 Like if you just double the size of the alphabet 0:16:51.020 --> 0:16:54.580 and you add some special characters to the mix or whatever, 0:16:54.580 --> 0:16:58.780 it actually jumps up by 600%. Isn't that weird? And 0:16:58.780 --> 0:17:03.940 then everyone starts doing that, and then everyone collectively jumps 600%. Well, 0:17:03.940 --> 0:17:07.379 what happened to the last six months where competitor B 0:17:07.619 --> 0:17:12.700 just spent $4 billion trying to go up by 20%? 0:17:12.859 --> 0:17:17.780 My argument to GI was basically, there are so many 0:17:17.780 --> 0:17:21.419 of those big jumps completely hidden from us because we 0:17:21.420 --> 0:17:25.300 have no idea how any of this stuff works. So 0:17:25.300 --> 0:17:28.620 this China team just found one of these things they 0:17:28.619 --> 0:17:32.080 just found through a number of things with like. Mixture 0:17:32.080 --> 0:17:35.400 of experts. And they've got papers detailing everything they did. 0:17:36.080 --> 0:17:38.679 But it's like, hey, look, we just did this. And 0:17:38.680 --> 0:17:41.880 it's like, now, now it's obvious to everyone, everyone's going 0:17:41.880 --> 0:17:45.240 to go copy that. That's another big jump. I think 0:17:45.640 --> 0:17:50.719 there is hundreds of times the amount of performance, like 0:17:50.760 --> 0:17:54.639 laying on the floor, laying, sitting on the table ready 0:17:54.640 --> 0:17:58.000 for the taking. They just they have to be discovered. 0:17:58.720 --> 0:18:03.280 And I think as the technology changes, there's a new algorithm, 0:18:03.280 --> 0:18:07.879 there's new transformers that we use, maybe a completely different 0:18:07.880 --> 0:18:11.560 type of AI. Every time we go into this like unknown. 0:18:12.400 --> 0:18:15.040 It's a new set of things, a new set of 0:18:15.040 --> 0:18:17.639 tricks or slack in the rope just sitting around to 0:18:17.640 --> 0:18:21.960 be discovered. And my point is that those pieces of slack, 0:18:22.400 --> 0:18:26.600 those tricks that allow you to jump forward, and I 0:18:26.600 --> 0:18:29.220 don't want to want to demean with the word trick. 0:18:29.220 --> 0:18:32.300 Someone mentioned that. Like when I say trick, I just 0:18:32.300 --> 0:18:36.700 mean in retrospect it'll appear obvious. It doesn't mean it 0:18:36.700 --> 0:18:39.939 doesn't take extreme genius and hard work and discipline to 0:18:39.980 --> 0:18:44.139 actually discover it. So I just want to make that clear. 0:18:44.220 --> 0:18:47.220 But the point is, we're going to be able to 0:18:47.220 --> 0:18:52.020 just keep jumping massively. And I think a very large 0:18:52.020 --> 0:18:54.820 percent of those jumps are going to come from these 0:18:54.820 --> 0:18:59.060 sorts of tricks or slack in the rope type effects. 0:18:59.859 --> 0:19:02.900 And that's what I think we had with, uh, with 0:19:02.900 --> 0:19:06.780 deep Post-training is perhaps the most powerful category of these tricks. 0:19:06.780 --> 0:19:09.100 This is what I said back in August of last year. 0:19:09.100 --> 0:19:13.139 The most powerful category of these tricks is like teaching 0:19:13.140 --> 0:19:16.300 a giant alien brain how to be smart when it 0:19:16.300 --> 0:19:19.739 had tremendous potential before, but no direction. And again, I'm 0:19:19.740 --> 0:19:22.500 saying there's lots of these different ones, but kind of 0:19:22.540 --> 0:19:25.669 playing off this thing from 2024, I'm going to say 0:19:25.670 --> 0:19:27.629 this in a different way, and this is kind of 0:19:27.670 --> 0:19:31.070 a casual way of me thinking about this, which, uh, 0:19:31.070 --> 0:19:33.469 I feel like GI doesn't really like when I do 0:19:33.470 --> 0:19:37.630 this because it's not perfectly accurate. But one way I'm 0:19:37.630 --> 0:19:40.550 casually thinking about this is that there are now two 0:19:40.550 --> 0:19:43.790 steps here the intelligence, which is the model, and then 0:19:43.790 --> 0:19:47.070 the wisdom, which is the reinforcement learning. So this is 0:19:47.070 --> 0:19:50.150 kind of where a lot of this slack has come from, 0:19:50.150 --> 0:19:52.750 is the fact that the model itself is not super 0:19:52.750 --> 0:19:56.870 intelligence by itself. You actually have to tell it what 0:19:56.869 --> 0:20:03.190 constitutes intelligence or wisdom or smarts or usefulness. And that's 0:20:03.190 --> 0:20:07.550 after the fact with the. And more generally, the reinforcement learning. 0:20:07.670 --> 0:20:11.030 So it's almost like intelligence is the size of the brain. 0:20:11.030 --> 0:20:14.430 And reinforcement learning is the life experience. And like I said, 0:20:14.430 --> 0:20:17.510 it's not technically true. But I think it's it's pretty powerful. 0:20:18.150 --> 0:20:21.150 So bottom line is I think the the market reaction 0:20:21.150 --> 0:20:24.290 to all of this is very wrong. Well, I've got 0:20:24.290 --> 0:20:28.570 another piece in here about the total tam of I. 0:20:28.570 --> 0:20:30.170 In fact, I'm just going to jump to that right 0:20:30.170 --> 0:20:32.649 now because I don't think I mentioned it anywhere else. 0:20:32.810 --> 0:20:36.850 Let's see here. Oh, this is really cool from Andre. 0:20:36.890 --> 0:20:39.930 Move 37 is the word of the day. It's when 0:20:39.930 --> 0:20:43.290 an AI trained via the trial and error process of 0:20:43.290 --> 0:20:48.130 reinforcement learning discovers actions that are new, surprising and secretly brilliant. 0:20:48.609 --> 0:20:52.770 So this is in reference to Lee Soto losing in 0:20:52.770 --> 0:20:57.010 go to an AI and it was, uh, it was 0:20:57.010 --> 0:20:59.609 moved 37 that made everyone freak out. So I thought 0:20:59.609 --> 0:21:02.649 that was a cool concept, but, um. Yeah, if I 0:21:02.650 --> 0:21:06.530 go here, here we go. The total Tam for AI 0:21:06.570 --> 0:21:10.130 is a combination of two primary components. The total cost 0:21:10.130 --> 0:21:13.690 of human workforces, and the amount of money that current 0:21:13.690 --> 0:21:17.210 and future companies will pay to start ten x or 0:21:17.210 --> 0:21:21.210 1000 X their business. So we're talking about hundreds of 0:21:21.210 --> 0:21:24.630 trillions of dollars. So if you go back to this, 0:21:25.350 --> 0:21:30.230 this is why I think, uh, the whole Nvidia deep 0:21:30.270 --> 0:21:34.030 sea thing is very mistaken. The Tam and I did 0:21:34.030 --> 0:21:38.830 a deep sea analysis, actually, of this very tentative, very non-scientific, 0:21:38.830 --> 0:21:44.230 but it came up with like 80 to $120 trillion 0:21:44.230 --> 0:21:48.270 as being the Tam for AI over the next ten years. 0:21:48.510 --> 0:21:51.750 So I don't know. Again, it's better if you do 0:21:51.790 --> 0:21:55.350 like one of the, uh, the new Google Deep research 0:21:55.350 --> 0:21:58.350 projects to actually feed it that thing and then give 0:21:58.350 --> 0:22:01.790 that to deep Seac or O1 or O3 or whenever 0:22:01.790 --> 0:22:04.669 it comes out. Um, that would be a better way 0:22:04.670 --> 0:22:07.510 to get those numbers and have it fully explained the numbers. 0:22:08.030 --> 0:22:13.030 But either way, it's trillions upon trillions of dollars. So 0:22:13.230 --> 0:22:16.390 that's why I think this whole thing is overblown and mistaken. 0:22:16.390 --> 0:22:18.990 And that's why my attitude is very much so. What, 0:22:19.850 --> 0:22:23.290 Because the market has gone from being foolish to overvalue 0:22:23.490 --> 0:22:28.290 Nvidia to being foolish to undervalue it. Right. It's because 0:22:28.450 --> 0:22:32.890 there is just so much to go, so much room 0:22:32.890 --> 0:22:35.850 before we get to anything like a ceiling. And here's 0:22:35.850 --> 0:22:38.570 where I talk about that. Right. So what happens to 0:22:38.570 --> 0:22:41.570 Nvidia or any other part of the stack doesn't matter 0:22:41.570 --> 0:22:44.850 much at all, because we're still at whatever percentage of 0:22:44.850 --> 0:22:47.370 the amount of AI that we need in the world. 0:22:47.410 --> 0:22:49.650 Doesn't matter how we get there, it's not predictable. Could 0:22:49.650 --> 0:22:53.570 be ARM processors, GPUs, some brand new thing. Doesn't matter. 0:22:53.690 --> 0:22:58.010 I think Nvidia and TSMC and all these people are 0:22:58.010 --> 0:23:01.810 going to continue to rise because again, we're at the 0:23:01.850 --> 0:23:05.690 tiniest little sliver. The question is who is going to 0:23:05.690 --> 0:23:08.689 move into the next space. Can Nvidia pivot? I believe 0:23:08.690 --> 0:23:10.890 they can. If they had to I'm not sure they 0:23:10.890 --> 0:23:14.409 have to. First of all, Deep Seek was built on Nvidia. 0:23:14.770 --> 0:23:17.050 If they had better Nvidia deep seek would be better. 0:23:17.090 --> 0:23:20.940 Like it's like more Nvidia still makes everything better, right? 0:23:21.220 --> 0:23:24.500 And I'm not trying to just go pro Nvidia because 0:23:24.500 --> 0:23:29.420 I'm invested. I actually got a decent amount out of Nvidia. 0:23:29.540 --> 0:23:33.180 I want to say, um, about two weeks before this, 0:23:33.180 --> 0:23:37.900 because I made the choice to move more money into 0:23:37.940 --> 0:23:41.939 places that would benefit from AI, and not necessarily just 0:23:41.940 --> 0:23:45.980 the roads and bridges. Happened to get lucky there because 0:23:45.980 --> 0:23:49.859 I pulled some money out before it went down. But, um, 0:23:49.859 --> 0:23:53.460 I very much I did buy the dip a little bit, 0:23:53.700 --> 0:23:55.980 and I very much would have liked to buy even 0:23:55.980 --> 0:23:58.420 more at the dip of Nvidia, because I think it's 0:23:58.420 --> 0:24:02.460 still massively going up along with everything else. It's like, 0:24:02.500 --> 0:24:07.180 I don't think they're particularly perfectly, uh, set to be 0:24:07.180 --> 0:24:10.340 the ones. Everyone's going to be the one if you're 0:24:10.340 --> 0:24:12.340 smart about it and you have a good leader, which 0:24:12.380 --> 0:24:15.939 Jensen is. All right. Enough about that. So OpenAI launched 0:24:15.940 --> 0:24:19.480 a preview of operator which can navigate web browsers just 0:24:19.480 --> 0:24:22.440 like a human. I think we need more generalized agents. 0:24:22.520 --> 0:24:25.919 I didn't like the whole App Store vibe to it. 0:24:25.960 --> 0:24:29.040 Google just dropped a massive update to Gemini. This is 0:24:29.040 --> 0:24:31.879 like one of the sleepers. Honestly, Gemini is one of 0:24:31.880 --> 0:24:36.600 the sleepers of this whole competition. Google has been just 0:24:36.600 --> 0:24:39.880 doing insanely good for the last six months 12 months. 0:24:40.440 --> 0:24:44.719 I use the the flash 2.0 Pro. I think it 0:24:44.720 --> 0:24:48.439 is for a lot of analysis where I need really 0:24:48.440 --> 0:24:52.560 good haystack performance over like 2 million tokens. So when 0:24:52.560 --> 0:24:56.920 I do rag searches across like all my content, for example, 0:24:56.920 --> 0:24:59.760 and I get back like 50 documents that hit on 0:24:59.760 --> 0:25:05.159 the rag and this is over like 3000 posts, 3200 0:25:05.160 --> 0:25:10.080 posts since going like back to 1999. So if I 0:25:10.080 --> 0:25:12.280 have a big giant piece of content like that and 0:25:12.280 --> 0:25:15.500 I don't want to miss like the The nuggets or 0:25:15.500 --> 0:25:18.460 the or the, you know, the needles inside of this 0:25:18.460 --> 0:25:21.179 massive haystack. I send it over to Google and it 0:25:21.180 --> 0:25:24.940 does a better job of of finding the haystack. Plus, 0:25:24.980 --> 0:25:27.740 I mean, just brute force. It has 2 million tokens 0:25:27.740 --> 0:25:32.140 as opposed to 200,000 for like sonic anthropic build citations 0:25:33.140 --> 0:25:37.740 API to combat hallucinations. That's really cool. Uh, Google just 0:25:37.740 --> 0:25:41.820 dropped another billion dollars into anthropic. Very interesting. So they're 0:25:41.820 --> 0:25:45.340 not only doing their own play. They're also betting against 0:25:45.380 --> 0:25:49.340 OpenAI with anthropic. I don't know if they're in OpenAI 0:25:49.380 --> 0:25:52.620 as well. But anyway, they're investing in anthropic, which I 0:25:52.619 --> 0:25:56.780 thought was really interesting. Leaked memo from Apple says they're 0:25:56.780 --> 0:26:03.260 focusing completely on rebuilding series infrastructure and improving their existing 0:26:03.380 --> 0:26:07.100 AI models this year, which, yeah, it's the AI chief 0:26:07.140 --> 0:26:10.139 talking about it. So obviously they're talking about AI. Well, 0:26:10.180 --> 0:26:14.879 overall startup funding has dropped significantly since 2021, seed rounds 0:26:14.880 --> 0:26:19.639 are actually getting bigger. This is interesting. My friend, uh, Mike, um, 0:26:19.720 --> 0:26:23.240 has a really, really cool podcast on this, uh, which 0:26:23.240 --> 0:26:25.840 you could check in the show notes. His name is 0:26:25.840 --> 0:26:30.400 Mike Privett, and you should absolutely go check out his stuff. Uh, 0:26:30.400 --> 0:26:34.320 Colorado police are now giving away free AirTags and the 0:26:34.320 --> 0:26:37.520 tile trackers to help prevent vehicle theft in their community. 0:26:37.720 --> 0:26:42.200 A ring camera in Canada. This is insane. Caught the 0:26:42.200 --> 0:26:46.520 exact moment of a meteorite smashing into a basically a 0:26:46.520 --> 0:26:48.960 walkway in front of their house. So they just came 0:26:48.960 --> 0:26:52.600 out and just like passed that that location and you 0:26:52.640 --> 0:26:57.200 hear like this really loud crash and it hit tiles 0:26:57.560 --> 0:27:01.000 on the walkway. And I, I don't understand how it didn't, like, 0:27:01.000 --> 0:27:03.720 blow out the tile and create a little hole in 0:27:03.720 --> 0:27:05.840 the ground. But anyway, they picked it up. It was 0:27:05.840 --> 0:27:09.320 an actual meteor and it just like blew up against 0:27:09.320 --> 0:27:11.889 the tile. I don't know, That had to be going 0:27:11.930 --> 0:27:15.370 thousands of miles per hour, right? It's terminal velocity, I guess. 0:27:15.410 --> 0:27:17.890 Is it hundreds of miles an hour? I don't know, 0:27:17.890 --> 0:27:20.330 but had to be going fast. It definitely would have 0:27:20.330 --> 0:27:22.970 killed someone if it hit him, I think. Anyway, I 0:27:22.970 --> 0:27:25.730 don't know why it didn't crack the, uh, the stone 0:27:25.730 --> 0:27:28.010 on the ground. A new Harvard study shows we should 0:27:28.010 --> 0:27:31.250 be taking blood pressure readings while lying down instead of sitting. 0:27:31.450 --> 0:27:34.170 And Hans Zimmer is apparently in talks with Saudi Arabia 0:27:34.170 --> 0:27:38.570 to remake their national anthem. And a pre-mortem is basically 0:27:38.570 --> 0:27:41.129 where you imagine your product has already failed, and you 0:27:41.170 --> 0:27:44.050 work backwards to figure out why, and you do this 0:27:44.050 --> 0:27:48.369 before you even start the project. That's brilliant. Reminds me 0:27:48.369 --> 0:27:52.450 of the PR system inside of Amazon, which I learned 0:27:52.450 --> 0:27:56.090 a lot because we use that at Apple. And uh, yeah, 0:27:56.130 --> 0:27:59.810 four components of top AI model ecosystems. It's in the 0:27:59.810 --> 0:28:04.850 ideas section related heavily to this deep tech stuff. And 0:28:04.850 --> 0:28:09.290 for discovery, Klein is my new go to for doing 0:28:09.350 --> 0:28:13.510 AI stuff. It is an extension built into standard VS 0:28:13.510 --> 0:28:18.710 code and actually like it more than using cursor, which 0:28:18.710 --> 0:28:24.270 is like more integrated and everything. Klein is more conversational. 0:28:24.350 --> 0:28:29.030 It's more following my thread. It's just seems more intelligent 0:28:29.030 --> 0:28:34.630 and more like cohesive in the way that it answers things. Um, 0:28:34.670 --> 0:28:38.590 and again, it's I'll show you the website. Yeah. Klein bot. 0:28:39.190 --> 0:28:43.310 Thoughtful AI coder. I don't know why it's better, but honestly, 0:28:43.310 --> 0:28:45.790 it feels better to me. I take this pain right here. 0:28:45.790 --> 0:28:48.270 I actually move it over to the right. That's how 0:28:48.270 --> 0:28:50.870 I have it going. Developer created a brilliant trap for 0:28:50.870 --> 0:28:55.950 web scrapers by using specifically crafted CSS selectors. So anti 0:28:55.990 --> 0:29:00.710 scraper trap I recommend you try out deep seek. One 0:29:00.710 --> 0:29:04.630 thing about deep seek that is really, really cool is that, 0:29:04.630 --> 0:29:08.250 uh you when it responds, it just starts talking out 0:29:08.250 --> 0:29:11.130 loud and you just see it. It's very similar to 0:29:11.170 --> 0:29:13.610 O1 in that way. You just see it. That's the 0:29:13.610 --> 0:29:16.770 whole reason it's doing so well in the benchmarks. That's 0:29:16.770 --> 0:29:20.250 the reason it's controversial because it's very much acting like O1. 0:29:20.770 --> 0:29:24.370 But bottom line is you see it having a conversation 0:29:24.370 --> 0:29:27.490 with itself and it goes back and forth and it's like, yeah, 0:29:27.490 --> 0:29:29.290 but this is really cool. Yeah. But have you thought 0:29:29.290 --> 0:29:32.010 of this? Actually that could be wrong. Let me think 0:29:32.010 --> 0:29:34.570 about this. And it does that for a number of 0:29:34.570 --> 0:29:38.970 paragraphs before it actually gives you an answer. I recommend 0:29:38.970 --> 0:29:41.730 you try it out with Olama. It's really easy to install. 0:29:41.930 --> 0:29:47.530 And magenta NVMe is one of the I first, uh, 0:29:47.530 --> 0:29:50.250 vim tools that I'm trying to use. Ultimately, I'd like 0:29:50.250 --> 0:29:52.810 to get out of VSCode and have all my AI stuff. 0:29:52.890 --> 0:29:58.489 Something like Klein inside of vim, but it's hard to 0:29:58.490 --> 0:30:00.410 do that in the terminal, which is why I'm like 0:30:00.410 --> 0:30:03.810 stuck in VSCode and not happy about it. Ben Thompson 0:30:03.850 --> 0:30:08.310 had a pretty cool deep seq FAQ, FAQ, and Lane 0:30:08.350 --> 0:30:10.390 Changes dropped. A cool new tool that lets you do 0:30:10.430 --> 0:30:12.390 deep web research. This is the thing I was talking 0:30:12.390 --> 0:30:17.510 about before completely using a hosted LMS. I've not messed 0:30:17.510 --> 0:30:20.790 with this one yet, but I cannot wait to. Um. 0:30:20.830 --> 0:30:24.030 Somebody created a simple service that converts WordPress blogs to 0:30:24.070 --> 0:30:28.150 Hugo static sites. Highly recommend. Anyone building a website goes 0:30:28.150 --> 0:30:32.790 static these days and basically keep your markdown. Your markdown 0:30:32.790 --> 0:30:35.590 is your website that is your content. You can make 0:30:35.590 --> 0:30:38.750 a rag out of it. It is just text and 0:30:38.750 --> 0:30:42.150 basically any place you want to bring your blog to 0:30:42.550 --> 0:30:45.310 give them the markdown and have it turn it into 0:30:45.350 --> 0:30:48.550 a nice website that you like. You like the aesthetic of. 0:30:48.550 --> 0:30:52.870 So it's content aesthetic and don't mix the two and 0:30:52.870 --> 0:30:56.150 don't have it where it's like the platform owns the 0:30:56.150 --> 0:31:00.150 mixture because then you're screwed. Um, and I've had this 0:31:00.150 --> 0:31:03.150 happen to me multiple times. I just had it happen again, 0:31:03.390 --> 0:31:07.320 getting my Getting my content out of beehive, which I love. 0:31:07.360 --> 0:31:10.360 Beehive for my newsletter, but it's not my favorite place 0:31:10.600 --> 0:31:14.720 to run an actual website. Philips Hue bulbs getting motion sensing. 0:31:15.200 --> 0:31:17.000 I really hope this is true and I can't wait 0:31:17.000 --> 0:31:20.120 to get it and play with it. Be nice to 0:31:20.160 --> 0:31:24.200 have all different hue things basically. Also be motion sensors. 0:31:24.840 --> 0:31:29.280 How to say no as a product manager. This is great. 0:31:29.480 --> 0:31:32.280 This is great. I think it just refreshes. Yeah it 0:31:32.280 --> 0:31:37.080 just refreshes. Let's not do that. So I'm hitting refresh. 0:31:37.800 --> 0:31:40.959 Can we revisit this after the next sprint refresh. We 0:31:40.960 --> 0:31:45.000 need to ensure alignment before moving forward. Refresh. This could 0:31:45.000 --> 0:31:47.240 be part of a larger initiative, but let's hold off 0:31:47.240 --> 0:31:51.320 for now. This is really good. It's really good. Uh, 0:31:51.320 --> 0:31:55.160 and recommendation of the week. Remember that AI is not 0:31:55.200 --> 0:31:59.120 AI stocks. AI is not the survival of AI companies 0:31:59.120 --> 0:32:05.260 that did marketing in 2023 and 2024 A's. Tam is 0:32:05.260 --> 0:32:08.740 the replacement of human labor and the magnification of GDP 0:32:09.180 --> 0:32:12.020 that can come from millions or billions of people becoming 0:32:12.020 --> 0:32:15.820 a founder, builder or creator. That is the ball to 0:32:15.860 --> 0:32:20.060 watch and everything else is noise. And the aphorism of 0:32:20.060 --> 0:32:23.660 the week is to be completely cured of newspapers spend 0:32:23.660 --> 0:32:26.300 a year reading the paper from the previous week to 0:32:26.340 --> 0:32:31.340 be completely cured of newspapers. Spend a year reading the 0:32:31.340 --> 0:32:38.300 newspaper from the previous week. Nassim Nicholas Taleb. Unsupervised learning 0:32:38.300 --> 0:32:42.220 is produced on Hindenburg Pro using an SM seven B microphone. 0:32:43.060 --> 0:32:45.380 A video version of the podcast is available on the 0:32:45.380 --> 0:32:49.020 Unsupervised Learning YouTube channel, and the text version with full 0:32:49.020 --> 0:32:53.780 links and notes is available at Daniel. Com slash newsletter. 0:32:54.420 --> 0:32:55.380 We'll see you next time.