WEBVTT - How To Break the Internet with Chris Stokel-Walker 0:00:02.480 --> 0:00:03.520 All Zone Media. 0:00:05.400 --> 0:00:08.440 Hello and welcome to Better Offline. I'm your host ed Zichron. 0:00:20.360 --> 0:00:24.200 Now you may have forgotten, but about a month or 0:00:24.239 --> 0:00:28.480 two ago we had a huge, complete meltdown of the 0:00:28.520 --> 0:00:31.760 computer systems of the world when CrowdStrike failed. I did 0:00:31.760 --> 0:00:34.200 an episode on it, and well we've all just kind 0:00:34.200 --> 0:00:37.680 of forgotten about it. And today I'm joined by Christokal Walker, 0:00:37.760 --> 0:00:42.680 who's an author, journalist, lecturer and starting new column at 0:00:42.680 --> 0:00:43.400 The Guardian as well. 0:00:43.400 --> 0:00:46.800 Aren't you yeah for a whole weeknad, I'm a whole month. 0:00:46.840 --> 0:00:49.880 I'm taking over tech space, which will be very exciting 0:00:50.000 --> 0:00:51.680 for the month of September. 0:00:52.080 --> 0:00:53.640 But the reason I brought you on is you wrote 0:00:53.640 --> 0:00:56.320 a great article for The Independent back at the end 0:00:56.400 --> 0:00:59.160 of July about how CrowdStrike isn't the only cyber company 0:00:59.200 --> 0:01:01.120 that could trigger a glow, will melt down the second 0:01:01.120 --> 0:01:03.560 they fail. And this is a subject that fascinates me 0:01:03.640 --> 0:01:08.720 because I love disaster movies and also this article was terrifying, 0:01:09.200 --> 0:01:10.960 So why don't you walk me through it? 0:01:11.959 --> 0:01:15.920 Yeah, So, basically, back in July we had that odd 0:01:15.920 --> 0:01:20.039 outage that people might remember. Basically people woke up in 0:01:20.880 --> 0:01:25.160 Asia Australia and then eventually the UK and encountered blue 0:01:25.160 --> 0:01:28.240 screens of death on Microsoft Windows, which is something amazing 0:01:28.319 --> 0:01:32.039 that you know. I'm thirty five now and I remember 0:01:32.080 --> 0:01:34.080 that happening when I was a kid, and then it's 0:01:34.280 --> 0:01:37.120 never happened since, like for all that, you know, people 0:01:37.160 --> 0:01:40.560 make fun of Microsoft. Actually their PCs are decent, but 0:01:40.680 --> 0:01:44.399 then suddenly everything went to hell in the handbasket. So 0:01:44.880 --> 0:01:47.080 it turns out that, you know, CrowdStrike, which is one 0:01:47.080 --> 0:01:51.440 of the big service providers for kind of antivirus tools 0:01:51.480 --> 0:01:56.520 and software, had mist configured basically the thing that protects 0:01:56.600 --> 0:01:58.920 us so that it actually harmed us, which is just 0:01:59.000 --> 0:02:01.320 the ultimate in fantastic arriagories. 0:02:01.520 --> 0:02:05.200 And it turned out that it was actually within CrowdStrike, 0:02:05.400 --> 0:02:08.920 the thing that was bugged failed because the bug checking 0:02:09.000 --> 0:02:11.640 thing had a bug in it, which is so good. 0:02:12.120 --> 0:02:14.440 It's so good that we have everything built on. 0:02:15.840 --> 0:02:18.200 Yeah, and this is this is this is the thing, 0:02:18.280 --> 0:02:21.800 right it is? And I guess this is This is 0:02:21.919 --> 0:02:25.160 something that a lot of your listeners and others will 0:02:25.240 --> 0:02:27.880 chime with because you share a similar sensibility to me, 0:02:27.960 --> 0:02:30.720 which is that we have built a huge thing which 0:02:30.800 --> 0:02:33.120 is kind of like on a house of cards that 0:02:33.520 --> 0:02:36.760 is actually hiding the fact that humans are involved in this, 0:02:36.840 --> 0:02:40.720 and humans screw up frequently. Yet we think that actually, 0:02:41.520 --> 0:02:43.480 because this is wiz bang tech, you don't have to 0:02:43.480 --> 0:02:47.040 worry about it. It will worry of automation, Yeah, precisely, 0:02:47.200 --> 0:02:49.919 And yet it's not as some guy who's overworked, overtired 0:02:50.480 --> 0:02:53.320 and can't type properly and has fat fingers like you mean. 0:02:53.880 --> 0:02:57.440 Yeah, And a combination of private software companies like CrowdStrike, 0:02:57.560 --> 0:03:00.560 and then as you'll get into open source solutions that 0:03:00.760 --> 0:03:03.560 are a lot of people doing them for the love 0:03:03.600 --> 0:03:07.280 of the game, which is wonderful. But at the same time, 0:03:07.880 --> 0:03:10.360 we've got this patchwork system that holds up the Internet 0:03:10.360 --> 0:03:12.600 and a lot of the tech we rely on and 0:03:12.639 --> 0:03:14.680 we don't really know, and the fact that so much 0:03:14.680 --> 0:03:16.720 of it is automated is also terrifying. 0:03:17.320 --> 0:03:20.120 Yeah, And this is the thing that that update was 0:03:20.240 --> 0:03:23.640 sent out to millions of PCs over the course of 0:03:23.680 --> 0:03:27.560 an evening while people were sleeping, and people didn't realize 0:03:27.560 --> 0:03:29.240 that it was a massive issue with it until they 0:03:29.320 --> 0:03:32.000 started to wake up, and at that point it is 0:03:32.120 --> 0:03:34.280 essentially too late. And the best part of this story, 0:03:34.320 --> 0:03:37.920 I think, is that to fix the issue, and we 0:03:38.000 --> 0:03:40.200 have kind of fixed the issue a couple months on. 0:03:40.680 --> 0:03:41.960 For a lot of them, you had to actually get 0:03:41.960 --> 0:03:44.960 individual people to go out to either a computer or 0:03:45.000 --> 0:03:48.360 a terminal somewhere and put in the actual updates to 0:03:49.160 --> 0:03:52.400 unscrew up the problem that had existed initially, but you 0:03:52.480 --> 0:03:55.920 highlighted there to kind of the issue of how much 0:03:55.960 --> 0:04:00.000 of this is seen as kind of public utilities nowaday 0:04:00.200 --> 0:04:03.320 is like the plumbing of our kind of entire world, 0:04:03.360 --> 0:04:05.400 and yet it is kind of really rickety and hell 0:04:05.480 --> 0:04:08.160 together with scotch tape and a little bit of chewing gum. 0:04:08.400 --> 0:04:11.280 I did think a story a decade ago about how 0:04:11.960 --> 0:04:13.880 we had a similar issue with a thing called heartleaed, 0:04:14.000 --> 0:04:18.960 which was another co So basically it was another similar 0:04:18.960 --> 0:04:21.320 thing where there was an update to a thing called 0:04:21.320 --> 0:04:25.840 open SSL, which is the software tool that encrypts all 0:04:25.880 --> 0:04:29.800 the data that is sent through payment systems and passwords 0:04:29.800 --> 0:04:31.520 and so on and so forth. So whenever you see 0:04:31.520 --> 0:04:35.919 that kind of yellow lock on your web browser, that 0:04:36.160 --> 0:04:39.680 is usually running open SSL, and there was an issue 0:04:39.720 --> 0:04:42.640 with it, which essentially meant that all of the information 0:04:42.680 --> 0:04:46.240 that people thought was being shared in encrypted form was 0:04:46.279 --> 0:04:48.880 actually being shown in plain texts. So someone could in 0:04:49.000 --> 0:04:52.559 theory come along and snoop on everything that you're putting 0:04:52.560 --> 0:04:55.120 in there, from bank account details to passwords and so 0:04:55.200 --> 0:04:58.520 on and so forth. The reason why that happened is essentially, 0:04:58.600 --> 0:05:00.880 the Internet at the time and to a certain extent 0:05:00.920 --> 0:05:03.480 now or less so, was being run by two guys 0:05:03.560 --> 0:05:06.320 named Steve. The whole thing was developed by a guy 0:05:06.320 --> 0:05:10.040 called Steve Marquess and his friend who was also called Steve. 0:05:10.720 --> 0:05:14.400 They were kind of this weird transatlantic romance where they 0:05:14.520 --> 0:05:18.080 kept going open SSL. It was this initial volunteer run 0:05:18.120 --> 0:05:20.960 project that kind of became a key part of the 0:05:20.960 --> 0:05:24.880 Internet that frankly, these multi billion dollar companies used day in, 0:05:24.960 --> 0:05:27.120 day out, but they decided that they didn't really want 0:05:27.120 --> 0:05:29.720 to pay a penny for the upkeep and. 0:05:29.760 --> 0:05:33.520 Open SSL is one of the named kind of things 0:05:33.560 --> 0:05:36.320 that could break the entire Internet. From your article as. 0:05:36.160 --> 0:05:39.479 Well, Yeah, this is kind of the key part of 0:05:39.520 --> 0:05:41.680 the Internet's plumbing. And there are loads of these, right Like, 0:05:41.800 --> 0:05:45.320 this is the thing that we don't realize until things 0:05:45.360 --> 0:05:48.159 go wrong, and generally in it, people want to have 0:05:48.279 --> 0:05:51.960 ninety nine point nine nine nine percent up time until 0:05:52.000 --> 0:05:55.880 you have that kind of miniature final element where actually 0:05:56.240 --> 0:05:59.120 something does screw up and actually you start to recognize 0:05:59.120 --> 0:06:02.200 that this thing is held together pretty precariously. We don't 0:06:02.240 --> 0:06:06.240 realize it, but there is a sort of cabal of 0:06:06.520 --> 0:06:10.640 half a dozen or so companies whose job is essentially 0:06:10.680 --> 0:06:14.240 to keep this stuff running, and sometimes they do screw. 0:06:14.080 --> 0:06:17.839 Up and open SSL. How was that actually funded? Is 0:06:17.880 --> 0:06:20.200 it donations or Yeah? 0:06:20.240 --> 0:06:22.360 So Initially at the time, back in twenty fourteen, when 0:06:22.360 --> 0:06:26.520 heartle was Hartleed was kind of an issue. They were 0:06:26.720 --> 0:06:29.679 essentially relying on to nations. This was open source software 0:06:29.680 --> 0:06:32.320 and that it's kind of the basic principle of the web. 0:06:32.320 --> 0:06:35.080 We often forget about this. Actually it is hobbyists that 0:06:35.240 --> 0:06:38.760 set this thing up alongside a huge military industrial. 0:06:38.400 --> 0:06:41.680 Company XKCD comic, which is everything's held up by a 0:06:41.680 --> 0:06:42.360 guy called Runk. 0:06:42.880 --> 0:06:45.200 Yeah. Yeah, it turns out it was actually Steve but 0:06:45.560 --> 0:06:49.359 basically the same sort of thing, and that is the 0:06:49.400 --> 0:06:52.000 problem is they weren't fully funded. I did a follow 0:06:52.080 --> 0:06:56.040 up story back in twenty fourteen because Hertleed kind of 0:06:56.120 --> 0:06:58.320 drew the attention to this. And it comes back to 0:06:58.360 --> 0:07:01.400 that idea of how when you started our podcast here 0:07:01.440 --> 0:07:04.840 where you said this thing happened, this huge chaotic thing, 0:07:05.000 --> 0:07:07.039 and you've probably forgotten about it because it's been two 0:07:07.040 --> 0:07:10.840 months and we moved on same thing with heartleads. This happened, 0:07:10.960 --> 0:07:13.760 there was this huge outcry. They got a bit of 0:07:13.760 --> 0:07:16.040 funding around about a million dollars that was meant to 0:07:16.120 --> 0:07:18.280 kind of make them back on an even keel and 0:07:18.280 --> 0:07:21.240 so that they could be sustainable. Reality is kind of 0:07:21.360 --> 0:07:22.160 didn't work. 0:07:23.240 --> 0:07:24.720 What do you mean it didn't work. 0:07:24.960 --> 0:07:27.120 Well in the sense of they still had this issue 0:07:27.200 --> 0:07:30.120 happen again and again. So what was meant to be 0:07:30.280 --> 0:07:33.400 kind of a fronting up. I suppose of big tech 0:07:33.440 --> 0:07:36.920 companies saying, actually, you know what, we recognized that this 0:07:37.360 --> 0:07:42.520 hobbyist service is a vital part of our internet's running. 0:07:42.680 --> 0:07:46.960 We will fund it so it is sustainable. Didn't necessarily happen, 0:07:47.760 --> 0:07:49.960 not to the extent that we've had another heartlead from 0:07:49.960 --> 0:07:54.160 open SSL. But they do struggle still to kind of 0:07:54.360 --> 0:07:58.200 keep things going. And that is I think the big problem, 0:07:58.480 --> 0:08:04.239 which is the news agenda moves on. People forget very quickly, 0:08:04.560 --> 0:08:07.760 and because there is then not a problem for a 0:08:07.800 --> 0:08:12.400 little while longer, we kind of lurch from one catastrophic 0:08:12.640 --> 0:08:13.760 near miss to another. 0:08:14.720 --> 0:08:18.160 So open SSL what does it actually do? Though? I 0:08:18.200 --> 0:08:21.720 know you it's the little padlock on browsers. But what 0:08:21.880 --> 0:08:24.320 is its foundational point? 0:08:25.280 --> 0:08:30.480 Yeah, so it basically it shepherds across data from from 0:08:30.640 --> 0:08:37.679 a user to kind of a service provider. So if 0:08:37.720 --> 0:08:41.000 you think about it as kind of you input text 0:08:41.480 --> 0:08:44.800 on your laptop, your phone, wherever you are. It will 0:08:44.840 --> 0:08:48.400 then encrypt it. It will transfer it over to a 0:08:48.440 --> 0:08:54.480 payment provider, to your bank, to frankly also pretty much 0:08:54.520 --> 0:08:56.760 anywhere that you put a password in and it will 0:08:56.840 --> 0:08:59.920 ensure that that is encrypted all away. But there was 0:09:00.200 --> 0:09:02.480 an issue with the coding of it, which meant that actually, 0:09:03.920 --> 0:09:08.400 again comes back to fat fingers, some elements of what 0:09:08.520 --> 0:09:12.560 was being transferred went into kind of excess memory, which 0:09:12.559 --> 0:09:15.000 basically meant that bits of it were encrypted, but then 0:09:15.280 --> 0:09:17.720 large parts of it weren't. So if you were unlucky, 0:09:18.520 --> 0:09:21.120 then the bits that weren't encrypted could be your credit 0:09:21.120 --> 0:09:24.280 card details, your sort code, and your account number and 0:09:24.320 --> 0:09:27.400 a CBC number. And that's why there was kind of 0:09:27.440 --> 0:09:30.800 this big red flashing light back in a decade or 0:09:30.840 --> 0:09:35.079 so ago where people thought, you know what, actually, this exploit, 0:09:35.280 --> 0:09:39.720 if left unchecked, could become a massive issue and a 0:09:39.760 --> 0:09:42.920 real boon for cyber criminals. I think actually had it 0:09:42.960 --> 0:09:45.679 happened in twenty twenty four, we would have seen much 0:09:45.880 --> 0:09:49.480 more of a sort of significant issue in terms of 0:09:49.559 --> 0:09:53.040 second third or more ramifications because cybercriminals would have been 0:09:53.040 --> 0:09:54.040 all over that stuff. 0:09:54.960 --> 0:09:59.080 And if open SSL breaks again, and that just means 0:09:59.080 --> 0:10:01.640 that the Internet it is not really encrypted, but every 0:10:01.840 --> 0:10:05.000 place that uses it is kind of at risk every 0:10:05.000 --> 0:10:06.199 transaction on every place. 0:10:07.320 --> 0:10:09.240 Yeah, and that is that is the issue, that is 0:10:09.320 --> 0:10:12.840 the high wire act that is the Internet. And we've 0:10:12.880 --> 0:10:17.439 seen outages like this come and go time and time again. 0:10:17.760 --> 0:10:22.160 You know, we've had the crowd strike instant where you 0:10:22.200 --> 0:10:26.200 can actually get onto your desktop or your laptops. We've 0:10:26.320 --> 0:10:32.360 had outages on major payment platforms. We've had banks going offline, 0:10:32.520 --> 0:10:36.640 we've had social networks kind of disappearing for hours at 0:10:36.640 --> 0:10:40.560 a time. And invariably, this is just a very simple 0:10:40.679 --> 0:10:44.240 error that snowballs repeatedly and we're kind of doomed to 0:10:44.280 --> 0:10:46.560 repeat it. And I guess the challenge is, like, how 0:10:46.600 --> 0:10:49.679 do we put the web on a firmer footing that 0:10:49.800 --> 0:10:51.520 prevents this from happening again and again. 0:10:52.080 --> 0:10:56.000 It feels like funding the open SSL movement of foundation 0:10:56.160 --> 0:11:00.000 would probably be a good start, But let's I imagine 0:11:00.000 --> 0:11:02.480 and that's not happening. We need to build the computer 0:11:02.520 --> 0:11:05.760 that makes pictures of Garfield with a gun exactly. This 0:11:05.800 --> 0:11:06.040 is the thing. 0:11:06.080 --> 0:11:08.680 Commercial interests always come into this, and the reality is, 0:11:09.760 --> 0:11:11.520 as you and I both know, and as many of 0:11:11.559 --> 0:11:16.200 our listeners will know, companies tech companies in particular, will 0:11:16.360 --> 0:11:18.640 take action when they realize that the spotlight is on 0:11:18.679 --> 0:11:21.160 them and that there is this kind of intrinsic demand 0:11:21.200 --> 0:11:23.600 for them to do that as soon as it's off, 0:11:23.840 --> 0:11:26.319 they're actually doing the same old thing. They are happy 0:11:26.720 --> 0:11:28.160 with the status quo as it is. 0:11:28.720 --> 0:11:31.520 Which is crazy as well, because what worries me about 0:11:31.600 --> 0:11:36.080 open SSL is that nobody will really be to blame 0:11:36.240 --> 0:11:39.439 and thus nobody will really feel responsible. They might kick 0:11:39.480 --> 0:11:42.640 in some money here and there. Google especially very reliant 0:11:42.640 --> 0:11:45.760 on them, but I just don't see them doing it. 0:11:46.679 --> 0:11:48.600 Yeah, and this is the thing that the only people 0:11:48.640 --> 0:11:52.040 that I really noticed when I was reporting out that 0:11:52.080 --> 0:11:55.880 story a decade ago who felt any kind of like 0:11:56.559 --> 0:12:02.800 guilt or personal alarm kind of just like even responsibility 0:12:02.880 --> 0:12:06.000 for it were actually those two Steves, like they were 0:12:06.200 --> 0:12:11.160 they will gut it. The story I did, Yeah, the 0:12:11.160 --> 0:12:15.199 story I did for bus you back then was it 0:12:15.240 --> 0:12:18.200 was very difficult to report out because they had been 0:12:19.679 --> 0:12:23.160 taken out of not to overly stereotype, but they were 0:12:23.200 --> 0:12:27.120 like super tech, nuity people like they they were very 0:12:27.160 --> 0:12:30.640 happy being in the background tinkering with this thing. They 0:12:30.679 --> 0:12:33.040 realized that it was important and they took their jobs 0:12:33.160 --> 0:12:36.000 very seriously, but they had never been put in a spotlight, 0:12:36.080 --> 0:12:38.680 and they were initially very wary of speaking to me 0:12:38.760 --> 0:12:43.360 because suddenly this thing happened. And it's over the course 0:12:43.400 --> 0:12:45.680 of like hours that they got kind of thrust into 0:12:45.679 --> 0:12:48.200 the limelight. They had the daily mail knocking at their door, 0:12:48.240 --> 0:12:50.559 which was one of the reasons why they were the 0:12:50.679 --> 0:12:53.079 super wary of talking to me. So it took actually 0:12:53.520 --> 0:12:55.600 a few days of winning them over and saying, you 0:12:55.640 --> 0:12:58.480 know what, like this isn't going to be a hit job, 0:12:58.600 --> 0:13:01.680 Like I'm not looking to kind of hold you up 0:13:01.720 --> 0:13:05.680 and say this is the person responsible for this happening. 0:13:06.360 --> 0:13:09.480 It's more I wanted to tell the story of why 0:13:09.520 --> 0:13:13.160 this has happened, why it's an issue, and why we 0:13:13.200 --> 0:13:17.559 shouldn't have the ability for kind of slight errors in 0:13:17.720 --> 0:13:23.080 upkey do cause catastrophic effects. 0:13:31.600 --> 0:13:36.800 It almost feels like people getting mad at the homeless 0:13:37.000 --> 0:13:39.720 to some extent where it's like, oh, this person is 0:13:39.760 --> 0:13:42.360 on the street and there are problems that are happening 0:13:42.720 --> 0:13:45.440 around them, and they are and you blame the person 0:13:45.480 --> 0:13:47.640 who is the victim here. You blame the fact that 0:13:48.000 --> 0:13:50.760 when you look at the Internet right now and it's instability, 0:13:50.800 --> 0:13:53.280 you're like, oh, well, these open source people who are 0:13:53.280 --> 0:13:55.120 doing it for free, it's therefore because they should have 0:13:55.120 --> 0:13:58.160 fucking they should have been better at doing this thing 0:13:58.200 --> 0:14:00.960 for free. That holds up the entire versus the fact 0:14:01.000 --> 0:14:05.000 that the problem is that the entire Internet relies on 0:14:05.040 --> 0:14:07.960 this underfunded group of people, and it really is. I 0:14:08.000 --> 0:14:10.319 just want to be clear for listeners and Chris you 0:14:10.400 --> 0:14:13.000 of course know this. When I say this holds up 0:14:13.040 --> 0:14:16.000 the entire Internet, I do actually mean that. It's very 0:14:16.040 --> 0:14:18.880 easy to fall vout to hyperbole sometimes, but this is 0:14:19.320 --> 0:14:23.160 genuinely that level. When Heartbleod happened, it sounds like it 0:14:23.160 --> 0:14:24.880 could have been truly catastrophic. 0:14:26.280 --> 0:14:29.400 Good. It really good. And this is the thing that 0:14:29.440 --> 0:14:36.360 we overlook is either there are kind of not amateurs, 0:14:36.360 --> 0:14:38.240 because these people are super professional in terms of what 0:14:38.280 --> 0:14:40.360 they do and they take their jobs around seriously, but 0:14:40.400 --> 0:14:43.360 they are either not paid or they're paid a pittance, 0:14:43.440 --> 0:14:47.120 particularly in comparison to the total compensation packages that you 0:14:47.200 --> 0:14:50.960 see washing around Silicon Valley. And yet there is this 0:14:51.040 --> 0:14:56.000 kind of super extractive approach from big tech companies of 0:14:56.560 --> 0:14:59.280 we will kind of roll in whatever it is that 0:14:59.320 --> 0:15:02.000 you provided us soften open source. And this is the 0:15:02.120 --> 0:15:04.720 kind of big secret right of A large part of 0:15:04.720 --> 0:15:08.520 big techs success is they rely on these open source 0:15:08.600 --> 0:15:12.920 developments that have kind of underpinned key parts of their tech, 0:15:13.280 --> 0:15:17.600 and if things go wrong, they can always shift the 0:15:17.600 --> 0:15:20.440 blame onto those open source things and say, well, this 0:15:20.480 --> 0:15:23.840 isn't actually our fault, this is the fault of our supplier, 0:15:24.000 --> 0:15:26.760 the thing that came second or third order down the line. 0:15:27.400 --> 0:15:29.840 And you've got this big movement in cloud as well 0:15:29.840 --> 0:15:33.240 towards like composable architecture, which involves a lot of slotting 0:15:33.240 --> 0:15:36.800 in open source solutions as well. It's just it almost 0:15:36.840 --> 0:15:40.320 feels like we need a big tech mutual aid thing 0:15:40.400 --> 0:15:43.680 for open source. I wish that. I don't think there's 0:15:43.720 --> 0:15:45.440 any way we could get a government to do this, 0:15:45.520 --> 0:15:47.840 but I think they should force big tech to put 0:15:48.280 --> 0:15:52.080 like a percentage of revenues, not profits, into open source 0:15:52.120 --> 0:15:56.320 and have very defined lairs for them, because otherwise you 0:15:56.400 --> 0:15:58.880 get situations where I don't know, the entire Internet is 0:15:58.920 --> 0:15:59.920 underpinned by two steeves. 0:16:01.960 --> 0:16:06.000 Yeah, exactly, And I think this is this is the 0:16:06.080 --> 0:16:09.240 unfortunate thing is that should be the lesson that we learned. 0:16:09.320 --> 0:16:11.120 It should have been a lesson that we learned from 0:16:11.160 --> 0:16:13.800 heart bleed. It should have been the lesson that we 0:16:13.920 --> 0:16:17.120 learned from xe utils, which was another issue that we 0:16:17.240 --> 0:16:20.920 encountered relatively recently, where there was it turned out, we 0:16:21.040 --> 0:16:24.960 believe a bad actor kind of deliberately inserting milicious code 0:16:25.000 --> 0:16:27.800 into another thing that kind of underpinds large parts of 0:16:27.800 --> 0:16:30.440 our digital lives. Turns out that the volunteers that were 0:16:30.480 --> 0:16:33.480 running that couldn't keep track of it. One of them 0:16:33.680 --> 0:16:35.880 literally talked about their burnout and how they've kind of 0:16:35.880 --> 0:16:40.400 taken a step away from the project. And yeah, we 0:16:40.480 --> 0:16:42.920 always see these things kind of passing by in the 0:16:42.960 --> 0:16:45.800 rearview window. We say, oh, you know what, isn't that 0:16:45.840 --> 0:16:48.080 such a shame? We ought to do something about that, 0:16:48.400 --> 0:16:50.120 And then we move on to the next thing, and 0:16:50.200 --> 0:16:50.880 we don't. 0:16:50.640 --> 0:16:54.280 Pay attention taking a step back. What was exe utils 0:16:54.280 --> 0:16:57.960 for the American listeners, ex for British and Canadian what 0:16:58.160 --> 0:16:58.960 happened there? 0:16:59.400 --> 0:17:03.880 Yeah, this is kind of again another bit of free software. 0:17:05.080 --> 0:17:10.040 This was back in sort of spring of twenty twenty four. 0:17:12.080 --> 0:17:17.960 A kind of malicious hacker had, we think, basically socially 0:17:17.960 --> 0:17:22.600 engineered their way into the upkeep of this bit of 0:17:22.600 --> 0:17:25.960 open source utility, which is essentially designed to kind of 0:17:25.960 --> 0:17:28.520 compress data. So the idea was that it would kind 0:17:28.560 --> 0:17:31.000 of take a big file, chunk it up, make it smaller, 0:17:31.200 --> 0:17:33.720 get rid of the bits that you don't need. And 0:17:33.800 --> 0:17:35.399 it was kind of in the same way as you 0:17:35.480 --> 0:17:40.760 talked about cloud architecture slotting in lots of really useful 0:17:40.800 --> 0:17:44.639 open source tools, this is a similar thing where you 0:17:44.680 --> 0:17:49.840 could slot in exit utails x utails into whatever you're 0:17:49.840 --> 0:17:54.520 building and it would be fantastic. This guy had kind 0:17:54.560 --> 0:18:01.080 of offered to volunteer at a time when the original developers, 0:18:01.200 --> 0:18:05.240 the custodians of this tool were feeling very burned out, 0:18:05.880 --> 0:18:09.600 said I will help. The original person then took their 0:18:09.640 --> 0:18:13.720 eyes off the ball. This malicious actor started putting in 0:18:14.400 --> 0:18:17.480 back doors intentionally the ways of accessing kind of the 0:18:17.560 --> 0:18:20.840 data within. And it was only spotted basically by a 0:18:20.880 --> 0:18:24.080 Microsoft developer who happened to come across. 0:18:23.720 --> 0:18:26.160 This, and I said, and just to be clear, though 0:18:26.160 --> 0:18:29.040 exit utils looks like it's a big part of Linux, 0:18:30.080 --> 0:18:33.160 which is a bit which people who use the smosftware 0:18:33.280 --> 0:18:37.800 may not realize is basically underpinning most server architects. Like 0:18:37.840 --> 0:18:40.320 a ton of server architecture, a ton of web architecture. 0:18:40.400 --> 0:18:48.080 Right, yeah, so servers, web servers, cloud hosting tools, lovely webcams, 0:18:48.240 --> 0:18:51.280 basically anything that connected. Probably your fridge, if you have 0:18:51.800 --> 0:18:54.400 an Internet of Things fridge, if you are that frivolous, 0:18:54.680 --> 0:18:57.320 then that will be connected in some way to Linux. 0:18:57.359 --> 0:18:59.240 I hope not. I hope that your diet coke is 0:18:59.280 --> 0:19:01.400 not being kept cold by an IoT fridge. 0:19:01.440 --> 0:19:03.800 And there's someone who knows me so. But so this 0:19:03.960 --> 0:19:06.919 Microsoft developer found it. And so it turns out that 0:19:07.080 --> 0:19:10.440 just the corruption of open source happen like it can 0:19:10.560 --> 0:19:14.040 happen as well with these open source projects, particularly I 0:19:14.040 --> 0:19:16.360 imagine when they're underfunded and the people get burned out. 0:19:16.840 --> 0:19:19.040 Yeah, and this is this is the thing is again 0:19:19.080 --> 0:19:22.639 it's another example of a kind of hobby project that 0:19:22.800 --> 0:19:29.760 turned into something bigger. Nobody who has the money either 0:19:29.840 --> 0:19:32.639 realized or decided that it was important enough to fund 0:19:32.640 --> 0:19:37.160 directly the people involved who are often you know, again, 0:19:37.240 --> 0:19:39.080 I don't want to stereotype, and I don't want to 0:19:39.160 --> 0:19:42.600 kind of make them seem too much like a victim here, 0:19:43.040 --> 0:19:47.960 But these folks are often super humble, super helpful, just 0:19:48.600 --> 0:19:53.000 trying to keep their heads above water, essentially because they've 0:19:53.080 --> 0:19:56.760 made something that has proved very, very useful, and they 0:19:56.760 --> 0:19:59.879 don't want to trouble people by shouting for help. In 0:20:00.000 --> 0:20:03.520 In this case, same thing happened. Single person in charge 0:20:03.640 --> 0:20:07.240 of this tool didn't want to shout too loudly about 0:20:07.280 --> 0:20:09.760 the problems that it would cause him in his life. 0:20:10.520 --> 0:20:13.000 He kind of took a step away, decided to get 0:20:13.040 --> 0:20:16.520 help from someone. Turned out they were bad, and nobody 0:20:16.560 --> 0:20:19.159 decided to shout about it. So again this one was 0:20:19.200 --> 0:20:20.800 This one was more deliberate rather than the fucker. 0:20:20.880 --> 0:20:24.119 I would also say they are victims. These people are 0:20:24.359 --> 0:20:26.720 doing some of the most important work in the world 0:20:27.000 --> 0:20:30.200 while san Dhar Pashai gets two hundred million dollars a year. 0:20:31.200 --> 0:20:34.679 That I see these people as heroes and victims at 0:20:34.680 --> 0:20:35.720 the same time. 0:20:36.200 --> 0:20:38.919 Yeah, and I agree, I think. I think what I 0:20:38.960 --> 0:20:41.879 mean by that is they would not want to be 0:20:42.040 --> 0:20:45.280 seen as either the hero or the victim in the piece, right. 0:20:45.440 --> 0:20:51.119 They don't. They don't they have I think to be 0:20:51.280 --> 0:20:55.720 involved in open source software more generally, you have to 0:20:55.760 --> 0:21:01.920 have a very kind of uh it's almost quaint, right, 0:21:01.960 --> 0:21:06.920 You have to be very, very community minded, very kind 0:21:06.920 --> 0:21:09.280 of I am doing this for the good of everybody, 0:21:09.320 --> 0:21:12.639 but I also don't want the praise for it, and 0:21:12.720 --> 0:21:15.480 so either kind of being presented as like this hero 0:21:15.600 --> 0:21:18.080 defending us against all of the bad stuff, or being 0:21:18.119 --> 0:21:21.760 presented as the victim who is you need pity. I 0:21:21.760 --> 0:21:23.800 think that's the thing they don't want. They don't want right, 0:21:24.000 --> 0:21:24.919 but they just want money. 0:21:25.480 --> 0:21:27.800 And I think we get back to the systemic problem then, 0:21:27.840 --> 0:21:29.719 because I don't see them as like any kind of 0:21:30.119 --> 0:21:32.760 pathetic thing or indeed, I mean that I think that's 0:21:32.800 --> 0:21:34.919 something heroic about what they're doing. But I think what 0:21:34.960 --> 0:21:37.439 they're doing is cool. I think what the problem is 0:21:37.480 --> 0:21:42.280 the systemic lack of support for them. We blame these things, 0:21:42.480 --> 0:21:45.720 we don't but people may blame these projects for breaking 0:21:46.119 --> 0:21:48.480 Oh it didn't work as well as it should, But 0:21:48.560 --> 0:21:51.920 it turns out that it's just we we put all 0:21:51.960 --> 0:21:55.679 of this pressure and these requirements on these people and 0:21:55.760 --> 0:21:58.520 on these projects and then don't give them the sport 0:21:58.520 --> 0:22:00.520 at all. So naturally, I'm going to say to my listeners, 0:22:00.560 --> 0:22:03.840 please go and fund your open source movements. Brought on 0:22:03.920 --> 0:22:07.879 Molly with Wikipedia. Molly Molly White of course about Wikipedia 0:22:07.960 --> 0:22:10.320 very early on in the show. Fund these projects because 0:22:10.320 --> 0:22:12.919 they deserve it. But the funny thing is is that 0:22:13.960 --> 0:22:16.440 some of the sometimes I've seen very stupid idiots say 0:22:16.480 --> 0:22:18.919 things like, well, if they were fun, if they were 0:22:18.960 --> 0:22:22.040 private and corporate entities, they'd be fined and nothing would 0:22:22.080 --> 0:22:24.960 go wrong. Except we look at CrowdStrike and it's the 0:22:25.000 --> 0:22:26.000 complete opposite. 0:22:26.800 --> 0:22:30.359 Yeah, And the worst thing is with CrowdStrike is it's 0:22:30.680 --> 0:22:33.800 they thought they knew better, right, like this is this 0:22:34.000 --> 0:22:37.760