S1: Whether you're starting or scaling your company's security program, demonstrating
S1: top notch security practices and establishing trust is more important
S1: than ever. Vanta automates compliance for Soc2, ISO 27,001 and more,
S1: saving you time and money while helping you build customer trust. Plus,
S1: you can streamline security reviews by automating questionnaires and demonstrating
S1: your security posture with a customer facing trust center, all
S1: powered by advanced AI. Over 7000 global companies like Atlassian,
S1: Flow Health and Quora use Vanta to manage risk and
S1: prove security in real time. Get $1,000 off Vanta when
S1: you go to Vanta comm slash unsupervised. That's vanta.com/supervised for
S1: $1,000 off. Welcome to Unsupervised Learning, a security, AI, and
S1: meaning focused podcast that looks at how best to thrive
S1: as humans in a post AI world. It combines original ideas,
S1: analysis and mental models to bring not just the news,
S1: but why it matters and how to respond. All right,
S1: welcome to unsupervised learning. This is Daniel Miessler. Okay. Pretty
S1: much heads down on doing talks and courses right now. Uh,
S1: a bunch of essays, a bunch of video content. It
S1: feels like I've got a lot of ideas but feels
S1: bad to be behind. Matt Williams put out a quality
S1: introduction to fabric on his YouTube channel, so that was cool.
S1: Really well done. Video got the augmented course is updated. Uh,
S1: so essentially we're expanding it to four plus hours where
S1: it was only three hours before. So it's a lot
S1: more content. Got a whole section on augmenting AI with
S1: personal context, building your own work life workflows, which is
S1: going to be super cool. We're actually going to do
S1: it live with 1 or 2 people in the class
S1: as well, so it's going to be kind of hands on.
S1: We got a full section on obsidian as well, and uh, yeah,
S1: just a whole bunch of fabric uses lots and lots
S1: of examples. And, uh, I really like the cohesive way.
S1: It's kind of pulling together the philosophical versus the technical.
S1: So it's very practical in like, okay, you actually do this,
S1: but it's kind of framed in this philosophical way, or
S1: at least that's what I'm trying to pull off. Okay,
S1: so I think I cracked Trump's popularity. I think unless
S1: the DNC figures this out, it actually doesn't matter who
S1: they run, they have to figure this out. So I
S1: got a post on that. Not going to go into
S1: that because that's politics stories. So there's a new zero
S1: day in OpenSSH that allows remote code execution. It's a
S1: little bit convoluted to sort of attack, and I think
S1: people are figuring that out. One thing to keep in mind, though,
S1: is it always gets easier to attack these things. It
S1: never gets harder to attack these things unless people patch,
S1: of course. But even if it's a little convoluted now,
S1: I mean, you still really need to take a look
S1: at what you have exposed and whether or not your
S1: particular SSH stack is vulnerable. There's a full 10.0 critical
S1: vulnerability in juniper network routers that basically allows you to
S1: bypass authentic full control. Cvss 10.0 snowflake had a breach,
S1: as everyone knows, and it's expanding with over now 165 victims,
S1: including Ticketek and Advanced Auto Parts. And some folks from
S1: the Shiny Hunters are saying that they access snowflake via
S1: third party contractors. And as part of that snowflake incident,
S1: Santander's US branch is notifying over 12,000 people that their
S1: personal info is stolen. So this is one of those
S1: things where it's just, like, contagious because the third party
S1: nature of it, it just keeps spreading. And yeah, like
S1: we said above 165 victims currently read Juliet, a Chinese
S1: state sponsored group, has been exploiting network Edge devices to
S1: target Taiwanese government, academic, technology and diplomatic organizations thanks to
S1: tines for sponsoring. And if everyone remembers that orange R1
S1: I device, well, basically you can you can extract or
S1: it was possible to extract all responses that ever came
S1: back from them and uh, yeah, it basically nightmare fuel
S1: and anything you got back from your personal AI device
S1: visible to whoever. I think this is exactly what most
S1: security experts predicted with regard to AI and security. Specifically
S1: that when startups do security, it's usually really, really bad.
S1: But one, they don't have the expertise, they don't have
S1: the resources, they don't have the time. And they're already
S1: facing existential crises like every day. And security usually isn't
S1: one of them. Another way to say that is startups
S1: generally run with scissors, and AI startups run extra fast
S1: with extra scissors. Like I've been saying, if you think
S1: this is bad, wait. Wait until it's actually days that
S1: are getting compromised where people have uploaded like their traumas
S1: and their journals and their personal conversations and just everything,
S1: their most intimate details. And when those startups start getting breached,
S1: it's going to be way worse. And this is the
S1: attack surface map that I put together a while back,
S1: and I think it's still pretty useful. Russian hacking group Apt29,
S1: also known as Cozy Bear, breached team viewers corporate IT environment.
S1: And this is another. So I've migrated over the years
S1: to a very simple stance on security tooling or really
S1: any core tooling. It is use the official offerings from
S1: big companies whenever possible, and that's because they have giant
S1: security teams, they have giant security budgets, and they have
S1: a lot to lose in terms of PR and market share.
S1: So basically, I only want to trust my data to
S1: companies that have both the incentive and the resources to
S1: protect that data. And those tend to be the big
S1: players like Microsoft, Google, Apple, whatever. Chinese hackers are using
S1: ransomware as a cover for cyber espionage. Perplexity AI is
S1: under fire by a lot of people. A lot of
S1: people are really upset with them because they're essentially scraping
S1: and crawling and, you know, basically feeding their their AI
S1: with tactics that nobody really likes. And it's kind of
S1: turning people off to it. Metaculus is launching a series
S1: of quarterly tournaments to benchmark AI forecasting against human forecasting
S1: on real world questions. So I am really obsessed with
S1: this rigorous predictions basically. So there are groups metaculus is
S1: one where people make specific predictions. And I learned about
S1: this from this book. Superforecasting. And this is now very
S1: similar to Superforecasting, except for it's AI players playing addition
S1: to the human players. And specifically they're competing. So I
S1: can't wait to watch this. It's really, really exciting to me.
S1: I'm actually going to build myself a little intelligence, uh, daily,
S1: daily intelligence, brief product, uh, using substrate and, um, a
S1: bunch of the AI stuff that I'm building. So I'm
S1: essentially going to be capturing a whole bunch of, of
S1: these superforecasters combined with a whole bunch of point sources
S1: like Osint people, national security people, financial information, people capturing
S1: all their point sources, capturing all the experts and what
S1: they're predicting, and then having my AI basically collect all
S1: that together, turn it into stories and narratives, and most importantly,
S1: put like based on these experts, what are the most
S1: likely outcomes over the next six months, 18 months, whatever,
S1: three years. And it won't be perfect, obviously. I mean,
S1: first of all, I is good at, you know, building
S1: narratives when they don't exist or whatever. So there's all
S1: sorts of things I need to be careful of, but
S1: with lots of really, really good input from these different sources,
S1: I think there's a lot of potential here. Uh, first
S1: of all, I can have it. I'll have the history
S1: of these things. So as the AI gets better, or
S1: as I write a better prompt for the eye or
S1: set of prompts for the eye pipeline, all those results
S1: will get better. And either way, I'm going to have
S1: the results of the the point predictions and the expert predictions.
S1: They'll all be stored, so I can always go retroactively
S1: and build a better product. And people are talking about
S1: how to run billion parameter scale llms on 13W of power,
S1: which is 50 times more efficient. And this is what
S1: I call slack in the rope, which is what Leopold
S1: Aschenbrenner calls hobbling. And this is why I think we're
S1: at like 1% of like where we are going. And
S1: that might be way too large, actually. It might be
S1: like 0.001%, who knows? But to me the game is
S1: scale times algorithms, times tricks. So improve scale, improve the
S1: algorithms and find tricks that magnify both of these. So
S1: tricks are finding slack on the rope, which can potentially
S1: massively improve the algorithms or advantages from scale. So these
S1: two get magnified by this one. And Leopold is basically
S1: calling this one removing hobbling. Yeah. And by the way
S1: situational awareness by Leopold. It is like the best discussion
S1: of this particular topic of like why you should believe
S1: that we're going to scale in a certain pace. Businesses
S1: are desperate for AI guidance, and big consulting firms are
S1: stepping in to help. McKinsey says generative AI will be 40%
S1: of its business this year. In 2024, 40% of McKinsey's
S1: business is AI, and this basically started like three days
S1: ago or 18 months ago. I mean, it's a blink
S1: of an eye and it's almost half of their business.
S1: And so here's a question how much of their business
S1: is crypto related? Okay. If you're trying to compare, you're
S1: trying to be like, oh, they're both hype. Uh, huge difference.
S1: Alibaba's coin models take the top three spots on hugging face.
S1: And a lot of us competitors are lagging behind. And
S1: this new leaderboard is testing models on tasks like solving
S1: 100 word murder mysteries and high school math equations. I
S1: love the more practical and real and not trackable or
S1: hackable or cheat able. These benchmarks are, and I don't
S1: like the fact that these Chinese models are doing so well.
S1: I think it's disturbing. AI and drone tech are two
S1: places we absolutely need to be beat. China. People in
S1: high income democracies are increasingly satisfied with how democracy dissatisfied
S1: with how democracy is working. Since 2021, satisfaction has dropped
S1: significantly in countries like Canada, Germany, Greece, South Korea, the UK,
S1: the US and this is fine. A study showed that
S1: loneliness in midlife is linked to believing in conspiracy theories.
S1: And if I design an education curriculum, one of the
S1: main themes will be hard work is leads you to
S1: an easy life. Laziness leads you to a hard life
S1: and the concept of resilience. And honestly, I would focus
S1: a lot on the Stoics, but let me just pull
S1: it up. Yeah, I love this graphic. Absolutely love this graphic.
S1: It's just great. I'm gonna zoom in, look at this,
S1: make hard decisions. Really, this kind of means discipline, right?
S1: If you climb this mountain, you're you're doing self-discipline. And
S1: you get to an easy life, easy decisions like, okay,
S1: we're watching Netflix, we're doing cannabis, and boom, you slide
S1: down here and now you're so far away from an
S1: easy life. Now you have a hard life. Really powerful. Okay,
S1: discovery project Nap time, Google's new AI framework for vulnerability
S1: research lets humans take regular naps while it mimics human
S1: security researchers. So it's just going to go off and
S1: do its thing. The human could go away and it's
S1: working on its whole thing. These frameworks just keep getting better.
S1: So remember when we saw Will Smith eating the spaghetti
S1: and it was like rah rah, rah. His mouth was
S1: like giant. It was like totally messed up. The same
S1: thing is going to happen with hacking frameworks, but there's
S1: going to be a place at the top. Top 5%,
S1: top 10%, top 1%. Depends where you cut it. But
S1: either way, it's a small percentage, but still quite a
S1: bit of room that basically only the really, really advanced
S1: human testers can do right. If you find the top 1%
S1: of pen testers bug bounty people or say, the 1%
S1: or 1%, right? Which is still a lot of people,
S1: keep in mind, 1% of 1% is still a lot
S1: of people in in a very large space. Okay. And
S1: bug bounty is pretty small, but pen testers are much,
S1: much larger. But either way, let's just call it manual testers. 1%
S1: of 1% of manual testers. They are doing things that
S1: automation can't really do, and most manual testers can't really do,
S1: and it's going to take a very long time. I
S1: don't know how long maybe it's going to take full
S1: AGI and possibly ASI and a whole lot more tricks
S1: or anti hobbling in terms of the tool sets to
S1: be able to replicate what they do. but the other
S1: 90 to 90 5% or 99% or whatever it is
S1: that is work that an average manual tester is doing.
S1: Those frameworks will these frameworks will be able to copy
S1: that very soon, I would say, in the next couple
S1: of years, even now and even next year. And, you know,
S1: it's just kind of spinning up. So imagine manual testing
S1: massively being attacked. But does that mean it could do
S1: everything that a really advanced attacker can do? No. And
S1: that won't happen for quite some time. And the final
S1: thing I say on this is these frameworks will be
S1: used by all attackers and defenders, because you'll have to.
S1: And the window between new vulnerabilities and either exploitation or
S1: mitigation will shorten dramatically. So basically when everyone's running these
S1: tools and they're constantly going, and the moment you have
S1: a new name published, it's instantly going to go find
S1: all the subdomains. It's instantly going to go find all
S1: the hosts. It's going to look at the hosts, it's
S1: going to fingerprint them. It's going to do that. And
S1: the defender needs to be doing that because the attacker
S1: is going to be doing that right. And if there's
S1: something vulnerable, oh, it's an open Postgres or whatever it
S1: is and there's data in there. Well that is just
S1: going to kick off an agent framework. It's going to
S1: go download the stuff, it's going to parse the stuff.
S1: It's going to turn it into a ransomware email. It's
S1: going to find the people it should send that ransomware
S1: email to. And like all this is just going to
S1: be automated with AI. And so the defenders have to
S1: be doing the exact same thing so they can block
S1: it and do it beforehand. And importantly, when a new
S1: vuln pops up or a new attack surface pops up,
S1: the time between it coming available and either defense moving
S1: on it, or attacker moving on, it is going to become,
S1: you know, minutes or seconds instead of hours or days
S1: or weeks or years. Extending Burp Suite for fun and
S1: Profit a guide by Federico Dota 11 labs text, audio.
S1: They've launched a new iOS app that sounds really good.
S1: I mean, it sounds exactly like real people. I can't
S1: tell the difference. Claud projects new feature in Claude. That's
S1: Anthropic's answer to OpenAI assistance DApp, your new platform where
S1: publishers set a price for using their content in model training.
S1: Kind of like selling your medical data or something. A
S1: Better Paradise Absurd ventures new podcast looks to elevate a
S1: fictional episodic series with a billionaire leading the world towards
S1: a digital dystopia. I actually want to go listen to
S1: this and recommendation of the week. As soon as you
S1: get a chance, go for a ride in a Waymo
S1: in San Francisco. It is. It's open to everyone. Now
S1: you basically just go get the app and you pay
S1: for it or whatever. But it used to be a
S1: closed like alpha or beta, but it is a remarkable experience.
S1: And what I want you to do when you're in
S1: there is watch the screen in the vehicle and look
S1: at all the dozens or hundreds of things that it
S1: is tracking. So you will see the dog across the street,
S1: you will see the bicyclist. You will see the bicyclists,
S1: multiple bicyclists moving in different directions. You will see people
S1: on the side of the road. You will see when
S1: they cross over into the street. And what you realize
S1: is like, that's a lot of stuff to be tracking
S1: all at once. And then you realize how distractible you
S1: are as a human. You realize how distractible most drivers
S1: are as humans. You realize the statistics of how many
S1: bicyclists get hit constantly, every single year and, you know,
S1: either injured or sometimes killed. And the reason isn't like
S1: evil drivers. The reason is humans are bad drivers. I mean,
S1: there's going to come a point at some point in
S1: the future where it's like, you mean you really just
S1: had people and they were manually controlling these cars right
S1: next to pedestrians and right next to bicyclists? Like, how
S1: were they watching everything? Well, well, the idea is the
S1: human driver would look forward and they would just watch everything.
S1: It's like, yeah, yeah, but but they can't see behind them. Well,
S1: you just you just look behind you. That's all you do.
S1: You just look behind you. Well, yeah, but then you're
S1: not looking forward. Well, well yeah. But but when you
S1: need to look forward, you just turn around again. And
S1: then you look forward and you can look side to side.
S1: It worked, it worked. It worked for a while. It's
S1: like explaining that to somebody who has who's been driven
S1: around in automated vehicles that watch everything all the time
S1: and never blink, never get tired, never get sleepy. Never
S1: check text messages. They just watch everything all the time
S1: and can instantly, like swerve the car, stop the car,
S1: do whatever. If someone does something stupid on a bike,
S1: they hit a pothole. They fall in the road in
S1: front of you. Like what are the chances? You're just
S1: going to miss that because it's dark, or because you're tired,
S1: or because you've been working three jobs and you're falling
S1: asleep or whatever the reason. So think about that when
S1: you're looking at the screen in a Waymo and the
S1: aphorism of the week, every event has two handles, one
S1: by which it can be carried and one by which
S1: it can't. Every event has two handles, one by which
S1: it can be carried and one by which it can't. Epictetus.
S1: Unsupervised learning is produced and edited by Daniel Miessler on
S1: a Neumann U87 AI microphone using Hindenburg. Intro and outro
S1: music is by Zomby with the Y, and to get
S1: the text and links from this episode, sign up for
S1: the newsletter version of the show at Daniel miessler.com/newsletter. We'll
S1: see you next time.