S1: Wiz is the number one cloud security platform based on
S1: independent customer reviews that helps security leaders and developers protect
S1: everything they build and run in the cloud. Leading organizations
S1: from the fortune 100 to high growth companies all trust
S1: wiz to innovate at the pace of cloud while staying secure.
S1: Click the link in the show notes or head to wizfolio.
S1: Slash lowercase ul to request a personalized product tour with
S1: a Wiz expert. Unsupervised Learning Podcast listeners also get a
S1: free Cloud Security Health scan by going to Wiz IOL.
S1: That's wizard Tolowercase ul. Welcome to Unsupervised Learning, a security,
S1: AI and meaning focused podcast that looks at how best
S1: to thrive as humans in a post AI world. It
S1: combines original ideas, analysis and mental models to bring not
S1: just the news, but why it matters and how to respond.
S1: All right. Welcome to unsupervised learning. This is Daniel Miessler.
S1: This is episode 459 of the podcast. All right. So
S1: had a great conversation with Rob Allen from Threatlocker about
S1: their approach to zero Trust. And it turned out to
S1: be a really interesting conversation. I always like to dive
S1: into what somebody means when they say zero trust, because
S1: it could be anywhere from total horsecrap to pretty decent,
S1: and I really liked Rob's approach in responses there, so
S1: definitely check that out. Got you all membership. Black Friday
S1: sale just started 20% off the first month, so or
S1: the first year. So go check that out. And jumping
S1: right into security. Actually, first of all, um, did a
S1: huge upgrade to my ubiquiti gear now moving towards a
S1: ten gigabit world, which I talked a bit about last week,
S1: and going to Saudi to speak at Blackhat EMEA. Mia
S1: Blackhat Mia. Yeah Saudi Arabia next week. Going to be awesome.
S1: All right. Jumping into security. This one didn't get near
S1: enough coverage. I don't think ChatGPT has basically a new
S1: feature that could read code from Mac OS. So apps
S1: like VSCode, Xcode, terminal, it could basically read the app
S1: and understand what it's saying and doing, and then give
S1: you analysis based on that. And I think this is
S1: getting closer to what a whole bunch of people in
S1: AI are actually working on, which is what I believe
S1: to be like an inevitable future, which is you can
S1: see all the screens, right? I'm looking at three screens
S1: right now. Ideally, my eye would be looking from inside
S1: the computer because it would have like agent access, like
S1: we already talked about. But also I wanted to be
S1: able to see my surroundings. I wanted to be able
S1: to see my cameras. I wanted to be able to
S1: see around me, behind me, especially behind me. If you're
S1: out in the city walking around and also cameras or
S1: also Microphones and other types of sensor, but mostly visual
S1: and audio. And that way it can be consuming, you know,
S1: the environment all the time, constantly parsing what's going on
S1: and constantly doing analysis and giving you like, views inside
S1: of a heads up display or, you know, glasses or
S1: lenses or however that interface is going to be, depending
S1: on how far the tech is. But the most important
S1: thing is it has to be seeing what you're seeing
S1: and even more than what you're seeing. Big problem right
S1: now is the on ramp to using AI. It's not
S1: a problem of the models themselves. The models are getting
S1: really smart. The problem is how do you get stuff
S1: into the model and how do you get it out.
S1: That's the problem. So this type of thing is a
S1: really huge advance because it's able to see inside your apps.
S1: And I'm really excited about this future. I've talked about
S1: it a lot. I've talked about it in the predictable
S1: path of AI. It's just that I'm not really going
S1: to trust this. There's already a couple of companies who
S1: will watch your entire screen and will upload that stuff,
S1: and they will do the parsing and they will send
S1: you back some really cool stuff. Like there's one particular company,
S1: I think they changed their name. It's called rewind. Or
S1: maybe rewind is the new name. But anyway, I signed
S1: up for their new, uh, gadget, which should be coming soon.
S1: I did not give them access to my whole computer
S1: because I could have the calendar open or a message
S1: or something, and it's like you could be doxing your friends.
S1: You don't know what's going to happen. Most importantly, you
S1: don't know how secure that startup is. And having consulted
S1: for startups in security specifically for decades, I'm not sending
S1: my data to those startups. I basically only trust like
S1: one company that much, both on the security side and
S1: also on the privacy side, and just how seriously they
S1: take this stuff, combined with a lack of conflicts of interest.
S1: And that's Apple. I would say Google is just as competent,
S1: maybe even more competent on the security side, I would say.
S1: But the problem is they also make their money off
S1: of ads or a lot of their money off of ads.
S1: So I just don't like the idea of like them
S1: having all that data and then being able to sell
S1: it or sell things to me. I don't like the
S1: conflict of interest there, even though I like the security.
S1: So that's why I mostly only trust two companies and
S1: mostly only Apple. But this is where this is going.
S1: Continuous monitoring all the time with as many sensors as possible. Front, back,
S1: inside your apps, inside your phone. That's where everyone is
S1: rushing to. Even if they don't know that they're rushing
S1: to that location. And that's why I think Google and
S1: Apple have a massive advantage because they have the device, right?
S1: I'm on Apple for phone, I'm on Apple for Mac
S1: and desktop and laptop. So because they are the OS,
S1: they have a massive advantage here. Okay. Palo Alto Networks
S1: has released indicators of compromise IOCs for a new zero
S1: day vulnerability affecting firewalls. VMware confirmed that threat actors are
S1: exploiting two vCenter server vulnerabilities, and ones like a 9.8
S1: and the other ones like a seven something I and
S1: Tech Anthropic has a new prompt improver that takes the
S1: given prompt and writes a better one. Really cool to
S1: see people getting in on this. This is part of
S1: the overall ecosystem, right? Um, and we got another one here. Uh,
S1: OpenAI might launch an AI agent tool called Operator in January,
S1: and it will compete with anthropic computer use. I think
S1: agents is going to be the biggest thing that happens
S1: in 2025 for AI. And this is part of a
S1: bigger trend that I've been talking about, where it's more
S1: about the ecosystem. Okay, so if I if I actually
S1: click and open this thing here, it's not just about
S1: the models. Okay. So the big pieces that I think
S1: are part of these four pillars of an AI ecosystem,
S1: the model itself, the post training of the model internal
S1: tooling and agent functionality. So agent or model self-explanatory. Post-training
S1: a set of highly proprietary tricks that magnify the overall
S1: quality of the Raw model. Way to think of this
S1: is to say that it's a way to connect model
S1: weights to human problems. Okay. Internal tooling. All right. So
S1: look at this list. High quality APIs, larger context sizes,
S1: simple fine tuning. Haystack performance. Strict output control. External tooling
S1: like function calling. Trust and safety features. Mobile apps. Prompt testing.
S1: Voice mode and apps OS integration. Integrations with things like
S1: make Zapier end to end and things like caching mode.
S1: These are like all the internal tooling stuff that just
S1: makes it easier. Think of it this way the problem
S1: isn't the models. The problem is the on ramps onto
S1: the models and the output out of them back into
S1: your life. Okay, we are humans. We have human problems.
S1: We have business problems. We have personal problems. whatever we
S1: need to get that content, the content of that problem
S1: into an AI and then back out into our lives,
S1: into our actual brains, into the real world. That's what
S1: this internal tooling piece is, right? Because if you can't
S1: do this, well, then it doesn't matter if your model
S1: is 13% better on some random benchmark, right? So the
S1: models have to get better, but not as important as
S1: actually getting the interfaces to the models better. So uh
S1: oh yeah. And the next one relevant to the next
S1: story there is agents. Right. So an AI component that
S1: interprets instructions and takes on more of the work in
S1: total AI workflows than just LLM response, for example, executing functions,
S1: performing data lookups, etc. before passing on results. And I
S1: actually have a improved version of that, which I won't
S1: I won't go find it, but it's, uh, it's updated
S1: on the AGI definition inside of raid the real world
S1: I definitions if you want to go check that out. Okay,
S1: so Sam Altman and Arianna Huffington have a thrive AI
S1: health company and looking at doing personalized advice on sleep, food,
S1: fitness and more, Google.org is putting 20 million in cash
S1: and 2 million in cloud credits into a new initiative
S1: to help researchers use AI for scientific breakthroughs. One of
S1: the most important things that I think I could possibly
S1: do is actively going to just invent new things, make new, uh, research, right?
S1: Discover new things. Right? You take the smartest people in
S1: the world who who are capable of doing this, and
S1: there's very few of them. So if we can actually
S1: scale that, that's where the real takeoff starts to happen.
S1: Apple's M4 Max CPU transcribes audio twice as fast as
S1: Nvidia's RTX A5000 GPU while using significantly less power. I
S1: really want to get one of these clusters, like a
S1: m4 Mac mini cluster would be super cool. But yeah,
S1: a lot of people have been asking me, should I
S1: do the cluster thing with smaller boxes? Or should I
S1: just get one big rig? I feel like the next
S1: generation or the current next the current generation in like
S1: another year or so, it's still going to be better
S1: to have one big box. It really depends on what
S1: you need it for, but I would say we're not
S1: quite there yet. With the cluster of smaller boxes, this
S1: exo lab and things like that, they're a little bit experimental.
S1: The best thing to do still is to buy a box.
S1: I bought a pre-made one and it's fantastic. It's got
S1: two 49 seconds in it. It's got tons of memory.
S1: It's very, very fast. And it's just like plug and play.
S1: Easy to do. I would say if this clustering technology
S1: gets better and better, and there's more and more devices
S1: like Mac minis and stuff like that that you could
S1: piece together. Then it starts to be a compelling alternative
S1: to actually buying a giant AI box. But until then,
S1: I think the giant box is probably still going to
S1: be better. Okay. iOS 18.2 is music recognition feature. Now
S1: logs where you were when you actually heard the song.
S1: So that's part of the metadata. Now pharma stocks have crashed.
S1: This is under the humans label. Pharma stocks have crashed
S1: after RFK Jr was announced to be taking over Health
S1: and Human Services. Moderna is down like 40%. Yeah, I
S1: don't know what this is currently at. Uh, down 562,
S1: but that's for the day. So if we go to
S1: three months, down 57% in the last three months, Moderna. Okay.
S1: They're they're one of the people who came out with
S1: the best vaccine for Covid, like 57% because of RFK.
S1: I almost feel like this is a buy opportunity. How
S1: could this not be a buy opportunity? It's not like
S1: they suddenly stopped being able to make things. And I
S1: just don't believe that people are going to let RFK
S1: just destroy these companies. I just don't see that happening.
S1: Hopefully they're going to be able to figure it out,
S1: because RFK is going to do some cool stuff. Like
S1: he's right about a lot of stuff. That's what's most
S1: scary about a lot of these people. They're so right
S1: about so many things, and the things they're wrong about
S1: are mixed in with it. Right? And that's not just RFK.
S1: That's a lot of people, including probably myself. So yeah,
S1: I don't see how it doesn't bounce back from a 60%
S1: cut from three months. Right. Personally, I'm not investing, but
S1: I think it would probably be smart, at least in
S1: the long term. Netflix had a record 65 million concurrent
S1: streams during Mike Tyson versus Jake Paul fight. it did
S1: have a bunch of connection problems though. Everyone I know
S1: at Netflix got massively spammed with like, all their friends
S1: texting and was like, hey, what's going on? It's like, yeah,
S1: you think I'm in charge of actual throughput during a
S1: Tyson fight? Like, stop texting me. New study shows that
S1: treating bullying as a collective issue rather than an individual one,
S1: can significantly reduce its occurrence in primary schools. I love
S1: the concept. It's kind of like how the johns get
S1: in trouble in some European countries for prostitution instead of
S1: the prostitute, because it's like the ecosystem that's the actual problem, right?
S1: So I like this idea of with bullying, I like
S1: the idea of shaming the people around who didn't say
S1: anything or do anything. And of course, we have to
S1: be careful about shaming. We're talking about kids here in
S1: a lot of cases or in most cases. But like,
S1: I feel like all the marketing needs to be heading
S1: in the direction of like if you are one of
S1: these people watching and not saying anything, not reporting it,
S1: not intervening like you don't want to be unsafe or whatever,
S1: but you could go report it. You could do something
S1: to prevent this from happening again. And if you're not
S1: something like you are the bully or you are enabling
S1: this and this is really bad, and I know this
S1: is already an aspect of like a lot of these programs,
S1: but I think it could be significantly magnified. Ideas reboot I,
S1: I absolutely love this one. Absolutely love this one. I
S1: can't remember where I got this idea. I think it's
S1: been hit me from multiple places, but I want to
S1: build a local AI that can run offline. Oh, I
S1: know where I first heard this idea. It was actually
S1: from Joseph Thacker, like a year and a half ago.
S1: He's like, oh, I just want a thing that I
S1: can use offline. But, um, more recently I got this
S1: from somewhere else. I can't was it? Was it X
S1: or Instagram? I don't know, but the idea is let's
S1: say all the power is out, or let's say the
S1: internet is out and let's say, um, oh, I know
S1: what it was. The initial conversation I was having with Joseph,
S1: and he actually brought it to me. It was his idea.
S1: He was like, what if you could go back in time?
S1: What could you bring with you to actually move society
S1: forward or something like that? And it's like, I think
S1: about this a lot way more than the Roman Empire.
S1: I think a lot about like, could I actually move
S1: science forward if I was put 200 years in the
S1: past or 2000 years in the past, what could I
S1: actually offer to them? I think someone makes a joke
S1: about this in current stand up comedy. It's like, yeah, oh,
S1: it's Nate Bathgate, Bargatze, whatever his name is. Um, it's
S1: just like, yeah, um, there's going to be phones and
S1: they're going to have satellite technology. Oh, really? What's the satellite? Well,
S1: it's this thing that goes around. How do you make one?
S1: What does it do? You're saying there's thousands of satellites
S1: in the air and the Earth is actually round? Like,
S1: can you prove anything about this? No, I can't. So
S1: we we don't know how any of this is working, right? And, uh,
S1: and we can't describe it to anyone. And more importantly,
S1: if you lose the internet and there's like, say, a
S1: meteor hits or whatever, I'm not going to go into
S1: negativity right now too early in the show for that.
S1: But let's say something bad happens and you are stuck
S1: in your house and there's no internet. Let's say you're
S1: not dying of hunger or thirst, but you don't have
S1: the internet. Okay, so watch this. Tourniquets, sterilizing water, building shelters,
S1: identifying edible plants. Which mushroom is actually will kill you.
S1: And which mushroom can you put on a salad? These
S1: are important distinctions to make. So check this out. What
S1: if you had an AI that ran? We got to
S1: assume solar power, right? Or maybe the grid actually works,
S1: but there's no internet. Whatever. Just work with me. You
S1: can show it. Pictures. You could take pictures, or you
S1: could show it an actual live plant or whatever. All
S1: you have to do is show this AI the particular
S1: thing or you describe, hey, I need a shelter that
S1: does this. I've got this much water. I got it
S1: from this kind of creek. I live in this kind
S1: of area. What kind of toxins are likely to be
S1: in it? How can I get those toxins out? What
S1: kind of filter can I build? Will these iodine tablets
S1: actually work? I have these symptoms. Which drugs should I take?
S1: You have a local model running. All it needs is power.
S1: It doesn't need the internet. It doesn't need OpenAI. Think
S1: of how much knowledge is inside of a llama two
S1: or a llama three, or a llama four, or whatever.
S1: Local model. And as long as you have power to
S1: run it and it can actually see and you can
S1: type to it, it can answer tons of stuff that
S1: can actually keep you alive. Even better, let's go a
S1: little sci fi, okay. It's just you and 10,000 other
S1: people and the rest of the, let's say, the rest
S1: of the planet got hit by a meteor or whatever.
S1: You have to rebuild all of society. Okay? Irrigation. How
S1: to how does the stoplight work? How does a combustion
S1: engine work? What kind of metal do you need to
S1: build in order to make a combustion engine? What are
S1: all these different alloys? You can bootstrap a society with
S1: one box. Isn't that crazy? You can bootstrap a society
S1: with one box that you can have, like sitting next
S1: to your NAS over here. You just need power. You
S1: need power. Well, I guess you need the peripherals to
S1: be able to talk to it and everything, but you
S1: don't need that much. It's way more impressive than trying
S1: to collect all of Wikipedia. I mean, that was the
S1: other model, right? You just download Wikipedia and you have
S1: a bunch of things you can look for. Not nearly
S1: as good as a chatbot that you can ask questions.
S1: And if it's visually oriented like you could just these
S1: new models are getting amazing, right? It's like, show me
S1: the design, show me a picture of it, draw me
S1: a picture, design me whatever a compound that I could
S1: defend my plants with because people are probably going to
S1: come and get us whatever. Yeah. I don't have any guns.
S1: How do I defend myself from these roving people who
S1: are going to come try to get our stuff? You
S1: could ask it anything. Ideally, it would be uncensored for
S1: that reason. Right. You want to be able to ask
S1: security questions. So all that to say, I'm going to
S1: do a project called reboot I with reboot being like
S1: Reboot Society or whatever, an offline oracle for emergencies. Um,
S1: now it's such a cool idea. I'm sure a million
S1: people have already had it, so they're probably already working
S1: on it. So if anyone is hearing this or they're
S1: reading this, um, send me a link and I'll just like,
S1: go buy one and or procure one. If not, and
S1: someone wants to help build one, I'm going to go
S1: build this. I want this running in my house. I've
S1: already got solar. I've got lots of ways to gather
S1: energy and store it in batteries, and it would be
S1: super nice without internet to be able to ask all
S1: those sorts of questions. So cool. discovery. Cloudflare's robots.txt file.
S1: It's a mix of Ascii art and directives for web crawlers. Obviously,
S1: that allows Twitter bot and demon based website preview to
S1: access specific pages blocks many other from accessing. Actually, you
S1: know what I'm going to do? Let me just. Oh bam!
S1: Look at that. This is why you do a video podcast.
S1: You can just zoom in to stuff. Look at this.
S1: Why are they. That's a lot of that's that's a
S1: lot of bandwidth depending on how many people are pulling it.
S1: It's a lot of bandwidth. Our tree is a redwood. Cool.
S1: This is cool though. Look at all these allows I'm
S1: looking at the scroll bar. How long is this thing.
S1: Okay okay. It's a lot of disallows. Are those languages. No.
S1: Those are directories. Yeah. These are all directories okay. Why
S1: do they have these. Why do we need to say
S1: that okay. And then we got our sitemaps okay. And
S1: more Ascii art. Yeah. Cool I like it. Interesting. Managing
S1: high performers a guide on how to effectively manage high
S1: performing employees and Eon's secure shoelace knot is the best shoelace.
S1: Not that I know of. And no, there's no sponsorship
S1: because that would be silly because no such thing exists.
S1: It's a shoelace knot. I actually tie this for my sneakers, actually,
S1: the ones I'm wearing right now. Wish I could put
S1: my foot up there. That would hurt. Uh, and I
S1: mostly leave them that way. I literally, these are common projects.
S1: I literally just slide my foot into there. Sometimes I
S1: use a shoehorn to do that, and sometimes I just
S1: use my finger. But I tied these with this knot
S1: and it's the coolest looking knot. It's the most secure knot.
S1: It's awesome. And because we're on video, I'm going to
S1: go show you this knot. Look at this thing. So
S1: you make two thingies. Two separate thingies. Then you cross
S1: the front one over the left one, the right one
S1: goes over the the left one. And you do this twice.
S1: You do over and under for both of them. And
S1: then you pull the thing and you end up with that.
S1: You end up with this looking thing right here. And
S1: it's super symmetrical and flat. It's not like twisted and
S1: trying to go up. And it's got like this really
S1: cool looking box not in the middle. And that's the
S1: most you've ever heard about a shoelace. Not on a
S1: podcast probably. All right. Recommendation of the week. Check out
S1: the aphorism of the week below. So we'll jump there.
S1: If you hit a wrong note, it's the next note
S1: you play that determines if it's good or bad. If
S1: you hit a wrong note, it's the next note you
S1: play that determines if it's good or bad. Okay, so
S1: that was the aphorism of the week. Now focus your
S1: efforts on being flexible after wrong notes, as opposed to
S1: being able to play perfect notes all the time. That's
S1: my recommendation of the week. 2020 five inches the next
S1: few years are likely to be so crazy that we
S1: won't be able to plan or play the right notes,
S1: so we just have to be good playing the next
S1: note afterwards. And I will read the aphorism of the
S1: week again, because that's what we do. If you hit
S1: a wrong note, it's the next note you play that
S1: determines if it's good or bad. If you hit a
S1: wrong note, it's the next note you play that determines
S1: if it's good or bad. Miles Davis. Unsupervised learning is
S1: produced and edited by Daniel Miessler on a Neumann U87
S1: AI microphone using Hindenburg. Intro and outro music is by
S1: zombie with a Y. And to get the text and
S1: links from this episode, sign up for the newsletter version
S1: of the show at Daniel miessler.com/newsletter. We'll see you next time.