Speaker 1: Brought to you by Toyota. Let's go places. Welcome to
Speaker 1: Forward Thinking. Hey there, and welcome to Forward Thinking, the
Speaker 1: podcast that looks at the future and says, if you
Speaker 1: should get it an email with the subject stinky cheese
Speaker 1: better of protecting your chances under no circumstances should you
Speaker 1: open it. I'm Jonathan Strickland and I'm Joe McCormick, and
Speaker 1: I'm not gonna ask about that. Let's move on to
Speaker 1: the topic today, which is cybersecurity. Yeah, we wanted to
Speaker 1: talk about a recent story about the idea of automating cybersecurity.
Speaker 1: But before we even get into that, let's talk about why.
Speaker 1: You know, I'm just gonna set the groundwork of what
Speaker 1: cybersecurity is all about and why it's such a huge
Speaker 1: challenge in today's world. So, really, when you think about it,
Speaker 1: cybersecurity experts and hackers have always played kind of a
Speaker 1: tick talk game. Really, the hackers, you could argue, Yeah, exactly,
Speaker 1: it's it's it's it's very much a reactionary kind of relationship.
Speaker 1: So it starts whenever a developer releases some software into
Speaker 1: the world. Operating system upgrades would be a major example.
Speaker 1: So let's say that you know, Microsoft releases a Windows
Speaker 1: update or Google and Android update, that kind of thing.
Speaker 1: Hackers then start to look at the operating system and
Speaker 1: start to explore it, probe it for vulnerabilities, things that
Speaker 1: could be exploited. Um. And the reason for that is
Speaker 1: the way a computer works, the way it executes code.
Speaker 1: If you're able to exploit vulnerabilities, you can get access
Speaker 1: sometimes to very important elements of a computer, like to
Speaker 1: the point where you could potentially take it over. Sure,
Speaker 1: you can either bend it to your will, use it
Speaker 1: to do some some upward processing, or or get data
Speaker 1: from that person's computer to to use in some kind
Speaker 1: of criminal way. Oh yeah, absolutely. Uh. It may be
Speaker 1: something as simple as simple in quotes as stealing files.
Speaker 1: It may be something more complicated, like installing a key
Speaker 1: logger that's going to copy everything someone types in so
Speaker 1: you start to get all their their info, like their
Speaker 1: logins and passwords, that kind of stuff. It may even
Speaker 1: be a backdoor access where you can you can control
Speaker 1: that processing power for specific nefarious purposes without the person
Speaker 1: necessarily knowing what's up except for the fact that their
Speaker 1: computer seems to be really kind of sludgy and slow,
Speaker 1: or it could just be fair mischief. Yeah, it could
Speaker 1: just be that, you know, yeah, as they say. So. Meanwhile,
Speaker 1: you've got the cybersecurity professionals who are looking for vulnerabilities too,
Speaker 1: but they're not looking to exploit them. They're looking to
Speaker 1: patch them to to address those vulnerabilities and and tweak
Speaker 1: them so that they're no longer and opening for hackers
Speaker 1: to exploit. They also try to nullify malware that hackers
Speaker 1: are developing. So uh, they're trying to make sure that
Speaker 1: the various worms and virus is and other types of
Speaker 1: malicious software that hackers unleash upon the world are nullified
Speaker 1: in some way. It's super tricky to do because you
Speaker 1: remember those old days of the huge downloads of the
Speaker 1: Norton anti virus updates. Yeah, yeah, well yeah, I remember
Speaker 1: the days of like when you're shutting down your computer
Speaker 1: and says, hang on, I need to download about, you know,
Speaker 1: half the gig's worth of data before you can leave,
Speaker 1: and then you think, well, as we'll go get another
Speaker 1: cup of coffee because I'm gonna be here for a while. Uh.
Speaker 1: At any rate, this this is very much the relationship. Right.
Speaker 1: You've got the release of software hackers trying to exploit it.
Speaker 1: Cybersecurity professionals trying to address the vulnerabilities and nullify the malware.
Speaker 1: Hackers go back to trying to find other vulnerabilities to exploit. Also,
Speaker 1: this is not necessarily all just happening back to back,
Speaker 1: because there's a lot of overlap. I mean, just because
Speaker 1: cybersecurity professional identifies and even patches vulnerable opening and software
Speaker 1: that doesn't magically propagated out to everybody who's ever downloaded
Speaker 1: that software. Now, so this is your your responsibility message here.
Speaker 1: Update your browser. Update your browser, update your operating system,
Speaker 1: update your security settings. Make sure that you keep those
Speaker 1: as close to up to date as possible, because while
Speaker 1: it can be irritating to take up time to do
Speaker 1: that sort of thing, it often addresses these vulnerabilities and
Speaker 1: makes you less liable to experience issues created by evil,
Speaker 1: nasty hackers out there. This also means that cybersecurity folks
Speaker 1: are typically a step behind hackers right because often they
Speaker 1: while they're trying to identify the own vulnerabilities, they may
Speaker 1: not be looking in the same place as that hackers
Speaker 1: start looking at, and they have to respond to the
Speaker 1: malware that hackers are creating. So you get this TikTok,
Speaker 1: where the reactionary response to the cybersecurity is to counter
Speaker 1: the move that the hackers have made, but it doesn't
Speaker 1: magically counter the next move the hackers make. You have
Speaker 1: to do it over and over and over again. So
Speaker 1: wouldn't it be cool if we could get an actionary
Speaker 1: system rather than a reactionary or one that is reactionary
Speaker 1: all on its own and doesn't require a human interaction
Speaker 1: at all? Because where the bottle nick really well, especially
Speaker 1: now and I'll get into more of the reason of
Speaker 1: why now it's particularly a problem in a little bit later,
Speaker 1: But as you say, it can be actionary to Lauren,
Speaker 1: you could have software that is actively looking at vulnerabilities
Speaker 1: before any human has even laid eyes apart for the
Speaker 1: developer on the code, and then in that case you
Speaker 1: close off the system before a hacker is even able
Speaker 1: to exploit it. But in other cases where there may
Speaker 1: already be a vulnerability known to hackers, uh, the systems
Speaker 1: could be patching that vulnerability as well as trying to
Speaker 1: counteract any malware that hackers have created. If you were
Speaker 1: able to do this and take humans out of that picture,
Speaker 1: it would be amazing because it would be way faster
Speaker 1: and more efficient than than than a human. But it's
Speaker 1: a tall order. It's really not an easy thing to
Speaker 1: ask for. Who would ask for such a thing? Sort
Speaker 1: of a you're right they did, DARPA asked that thing.
Speaker 1: Wait wait, First of all, though, let's remind everybody who
Speaker 1: is DARPA. It's the R and D division within the
Speaker 1: Department of Defense, with the awkwardest name ever being the
Speaker 1: Defense Advanced Research Projects Agency used to be. Or yeah,
Speaker 1: it used to be ARPA. I like. I like that
Speaker 1: the way you deliver that it made me think of
Speaker 1: like defense against the Dark arts, which in a way
Speaker 1: is kind of what we're talking about today. Yeah. I
Speaker 1: actually I'd never heard it put this way before. This
Speaker 1: might be have always been part of its charter, but
Speaker 1: but I didn't come across this description until some stuff
Speaker 1: we were reading for this episode today. But they described
Speaker 1: it as preventing strategic surprise. I watched a video about that,
Speaker 1: and my favorite quote was, surprises are hard to predict.
Speaker 1: I know exactly what you're talking about. I watched that
Speaker 1: same video. I'm like, you don't say. I think you
Speaker 1: said surprises can be hard to predict, Yes, which I
Speaker 1: thought was amazing. It reminds me of the Giant the
Speaker 1: Giant Souvenir shop at Las Vegas, where one of the
Speaker 1: signs says, if it's in stock, we have it, and like, yeah,
Speaker 1: I guess that's I mean, I would have argued that
Speaker 1: that was pretty much obvious, but I'm glad that you
Speaker 1: put it out there. So, uh, yeah, DARPA is it's
Speaker 1: got a long history obviously with technology. I mean, the Internet,
Speaker 1: you could argue, is really a product of work that
Speaker 1: was done when DARPA was called ARPA. There was a
Speaker 1: predecessor to the Internet called ARPA net and during the
Speaker 1: development of our and that many of the protocols that
Speaker 1: underlie the way the Internet works were developed. So very
Speaker 1: much a part of the world of software and hardware.
Speaker 1: Not just hey, can we develop a new thing that
Speaker 1: flies faster and uh and it's harder to detect than
Speaker 1: anything else we've ever created, but things that have benefits
Speaker 1: far beyond just a basic military application. Now, to be fair, DARPA,
Speaker 1: being part of the Department of Defense, is primarily concerned
Speaker 1: with matters of protecting national security and and uh making
Speaker 1: certain that the United States technological capability remains at the
Speaker 1: very front of the entire world as much as possible.
Speaker 1: You know, you've got to keep that in mind. But
Speaker 1: beyond that, the developments of various DARPA initiatives have uh
Speaker 1: much greater consequence than improving our defensive capabilities. Oh sure, well,
Speaker 1: and and started started to say in way that just
Speaker 1: like NASA, getting people into space has a lot of
Speaker 1: further reaching implications in terms of technology and design. And
Speaker 1: we've in fact talked about a few of the darpest
Speaker 1: projects here on the show before. Right, So first we
Speaker 1: should mention DARPA really is more of an administrative organization. Right.
Speaker 1: It's not so much that you go to DARPA and
Speaker 1: you enter into a world of shiny labs with lots
Speaker 1: of beakers and and beeping computers and stuff and and
Speaker 1: and technicians and scientists running everywhere with like crazy alien
Speaker 1: looking devices. That's not really what DARPA is. What DARBA
Speaker 1: really is is the organization that provides funding to other
Speaker 1: research organizations. They what what DARPA does is identify a need.
Speaker 1: They say, we need for this type of technology to exist.
Speaker 1: Who out there thinks they can do it? And then
Speaker 1: we've got some money for you, exactly, And then you've
Speaker 1: got different organizations that respond and they'll say I think
Speaker 1: we can do it, and then DARPA reviews the various proposals,
Speaker 1: decides which organizations are the most likely to succeed based
Speaker 1: upon those proposals, and funds them in order to try
Speaker 1: and develop that technology. Uh. And sometimes what DARPA does
Speaker 1: is they do this in the form of a competition.
Speaker 1: It's not just hey, hey, we need this one type
Speaker 1: of technology. Who thinks they can do it? It's hey,
Speaker 1: we've got this idea for a crazy thing we want
Speaker 1: people to be able to do with with technology. We're
Speaker 1: gonna pit you against other groups that also want to
Speaker 1: do this thing, and whoever wins gets a big old
Speaker 1: fat prize, which may or may not be equal to
Speaker 1: the amount of money that these organizations have to pour
Speaker 1: into their research and development to create the technology in
Speaker 1: the first place. But they still own that technology and
Speaker 1: can use it to make the money. Absolutely so, we
Speaker 1: have talked about them multiple times. Uh. The first time
Speaker 1: that I was able to find using the handy dan
Speaker 1: control f feature on our RSS feed was from November eighth,
Speaker 1: two thousand thirteen, when we published robot you Can Drive
Speaker 1: My Car? How many times have we made that joke.
Speaker 1: I'm almost convinced. I'm pretty convinced I made that that title.
Speaker 1: I could be wrong. I could be wrong, but yeah.
Speaker 1: So it was one of our earliest episodes about autonomous vehicles,
Speaker 1: and in that episode we talked about how DARPA played
Speaker 1: a key role in getting the development of driverless cars
Speaker 1: rolling because they have wheels. Uh. But yeah, the the
Speaker 1: original Grand Challenge that DARPA issued was about autonomous vehicles.
Speaker 1: On May eighth, two thousand fifteen, we published an episode
Speaker 1: titled What's Up with DARPA, which really was more of
Speaker 1: an episode to explain what DARPA really is all about
Speaker 1: and some of the projects that DARPA was overseeing at
Speaker 1: that time, um and mostly leading up to the Grand
Speaker 1: Robotics Challenge, which of course we already kind of covered
Speaker 1: in the previous episode, and then we had on June seventeen,
Speaker 1: two fifteen, So not long after that one, we released
Speaker 1: our episode about the DARPA Robotics Challenge. They are not
Speaker 1: the not the Grand Challenge, which was autonomous cars, but
Speaker 1: rather the challenge of building a humanoid robot, or at
Speaker 1: least a robot capable of following over a lot. They
Speaker 1: people excelled at that part of the challenge, which really
Speaker 1: wasn't part of the challenge. You didn't want your robot
Speaker 1: to fall over, but to be able to do a
Speaker 1: series of of steps, a series of tasks that would
Speaker 1: potentially be part of a rescue operation or an emergency
Speaker 1: response operation in the wake of a disaster, similar to
Speaker 1: the uh the Fukushima plant when the tsunami hit. So like,
Speaker 1: one of the tasks was walked to a door and
Speaker 1: open it. Man, that was that was a tough one. Yeah,
Speaker 1: it turned out to be a lot hard. Like robots
Speaker 1: were not being able to grab the weren't able to
Speaker 1: perceive where the doorknob was accurately, and so they kept
Speaker 1: trying to grab at places the doorknob definitely was not.
Speaker 1: Stepping through the doorway was bad, Yeah, which is a
Speaker 1: very difficult thing to mechanize. That. They had to pick
Speaker 1: up a drill and like use it. Yep, they had
Speaker 1: to climb us as stairs, which also turned out to
Speaker 1: be super tricky. Yeah, there are a lot of things
Speaker 1: that we humans typically find fairly easy. I mean, even
Speaker 1: if we couldn't do all of the different tasks, we
Speaker 1: might find at least, some of the tasks pretty natural
Speaker 1: for us to complete, but for robots that's not the case.
Speaker 1: There is no natural for a robot. Uh. And it
Speaker 1: turned out that a lot of those what we thought
Speaker 1: of as simple tasks were really complicated. So those are
Speaker 1: the episodes where we specifically focused on DARPA. But today
Speaker 1: we want to talk about the more recent Cyber Grand Challenge,
Speaker 1: which comes into the concept we're talking about here about
Speaker 1: creating an automated system capable of recognizing vulnerabilities and patching
Speaker 1: them in real time. That's the basic idea, right, Like
Speaker 1: DARPA's like, hey, this is what we want, uh, you team,
Speaker 1: you know, start forming teams out there to do competitions,
Speaker 1: and we'll have a big challenge and whoever wins gets
Speaker 1: a prised. That's the basic idea, um. But it's interesting
Speaker 1: because it's using an approach that humans have been following
Speaker 1: for a while. It's it's not not like they've invented
Speaker 1: a game that the robots have to compete in. The
Speaker 1: game already existed and in fact has a a bit
Speaker 1: about an interesting name. It's it's a capture the flag game. Yeah,
Speaker 1: which is funny because it doesn't actually resemble Capture the Flag. Yeah,
Speaker 1: so what what is the capture? They have these tournaments, right,
Speaker 1: so capture the Flag tournament might be a thing. A
Speaker 1: bunch of hackers show up too, and it's a model
Speaker 1: for testing people's skills at cybersecurity challenge. Just so a
Speaker 1: CTF tournament you might see something like this, a bunch
Speaker 1: of cybersecurity pros all show up and get a piece
Speaker 1: of target software and then they go to work trying
Speaker 1: to be the first to discover security flaws in the
Speaker 1: software and then release a secure patch to fix the problems.
Speaker 1: So they've got to sort of they have to like
Speaker 1: reverse engineer the software, figure out what its vulnerabilities are,
Speaker 1: address those vulnerabilities, and get them fixed. Uh. And so
Speaker 1: that sounds like a good test of your steel as
Speaker 1: a cybersecurity professional. But what if you removed the human
Speaker 1: hackers from the competition, right, Like, so in this case,
Speaker 1: the people competing aren't competing directly in searching that software,
Speaker 1: finding the vulnerabilities, and patching them, but rather developing software
Speaker 1: that can do that on their behalf automatically. Yeah, so
Speaker 1: that they aren't the ones guiding the software. Very much
Speaker 1: like in the rival less car scenario. You were not
Speaker 1: allowed to have any kind of remote control of the vehicle, right,
Speaker 1: The vehicle had to be able to do everything on
Speaker 1: its own, and if it failed, it failed. Same sort
Speaker 1: of thing with this kind of software. The idea being
Speaker 1: that you don't get to guide the software. It has
Speaker 1: to be able to analyze that that target software and
Speaker 1: identify the vulnerabilities and patch them all on its own.
Speaker 1: So why even bother doing this? Well, it's because computers
Speaker 1: are everywhere now, They're pervasive, they're integrated into our daily experience,
Speaker 1: and they're on all scales. Right, the stakes have never
Speaker 1: been higher as far as cybersecurity goes, and they're only
Speaker 1: getting higher exactly right. So it used to be higher,
Speaker 1: or it used to be you know, the early days
Speaker 1: of viruses, you know, way back in the day where
Speaker 1: things weren't even necessarily networked yet and people were spreading
Speaker 1: viruses via physical discs and oh yeah, uh, you know,
Speaker 1: the worst that was going to happen is you might
Speaker 1: cause a lot of damage to your computer. Yeah, and
Speaker 1: that's not good. I mean that could have you know,
Speaker 1: potentially disastrous consequences for somebody's personal I don't know, personal
Speaker 1: projects or whatever. But you wouldn't have um extremely dangerous, widespread,
Speaker 1: society wide consequence. It's not not a catastrophic event. It's
Speaker 1: something we're not going to kill anybody. Right. On an
Speaker 1: individual basis, it could range from inconvenient to financially difficult,
Speaker 1: depending like let's say you know, my dad, for example,
Speaker 1: is an author, and if he had had a computer
Speaker 1: virus affect our old computer upon which he was writing
Speaker 1: his novels, that would have had a very profound impact
Speaker 1: on his ability to do his work as an author.
Speaker 1: But it's not like that would suddenly also affect all
Speaker 1: the other computers in the world. It's happening on a
Speaker 1: very individual machine. Right. But then, okay, so once you
Speaker 1: start networking computers all over the place, suddenly you can
Speaker 1: spread viruses uh and malware and vulnerability knowledge much more easily,
Speaker 1: and you can exploit sensitive information and you can uh,
Speaker 1: you can you can have much more far reaching consequences.
Speaker 1: You can cause economic disaster. Um. Now, imagine expanding this
Speaker 1: to the next level beyond just network devices. Our devices
Speaker 1: are no longer just information devices. There, uh, you know,
Speaker 1: standard infrastructure devices, devices that control the world around us,
Speaker 1: power plants in our own HVAC systems and all all
Speaker 1: sorts of things. Yeah, so we elevators everything, right, Yeah,
Speaker 1: we started with things like your desktop computer. But then
Speaker 1: we're also like, okay, well we also have laptop computers.
Speaker 1: And now we've also got uh cell phones. Oh and
Speaker 1: smartphones came a little bit later, tablets to other computer systems.
Speaker 1: In uh, traffic lights to not just within an entire
Speaker 1: system of try lights, but within an individual traffic lights
Speaker 1: or appliances or televisions or sensors. I mean we as
Speaker 1: we approach the Internet of things, we have more and
Speaker 1: which you could argue that era is already upon us.
Speaker 1: We are in the Internet of things era. Now we
Speaker 1: have more and more devices that are partially or fully
Speaker 1: dependent upon computerized systems, which may and in fact you
Speaker 1: might as well say, do have vulnerabilities in them. They
Speaker 1: may not all be identified, but there's almost certainly a
Speaker 1: vulnerability in every system that human beings have produced, because
Speaker 1: we can't necessarily predict the vulnerabilities while we're making them,
Speaker 1: Like they really shouldn't have released that smart of and
Speaker 1: has the vulnerability where somebody can get it to throw
Speaker 1: you inside and turn on self cleaning mode. HANSL. And
Speaker 1: Gretel five thousand. I told them not to do it,
Speaker 1: but you know, they just might not have been able
Speaker 1: to predict that that vulnerability was there. Yes, when you're
Speaker 1: in the middle of developing, it can be difficult to
Speaker 1: see that, right because your number one goal is to
Speaker 1: get the thing you want to happen to happen. Yeah,
Speaker 1: you want, you want the whatever it is, whatever the
Speaker 1: the end goal is of the code you are writing.
Speaker 1: You want to achieve that goal. So let's say that
Speaker 1: you're just writing a program. It's a really simple program.
Speaker 1: It's like, let's say it's a word processing program. So
Speaker 1: you're just trying to create a word processing program, and
Speaker 1: you wanted to have all the basic elements of word
Speaker 1: processing involved in it. You're concerned with writing code that
Speaker 1: creates a working word processor. You may not notice that
Speaker 1: in the way that you develop this code, you have
Speaker 1: created a vulnerability that would allow a hacker to access uh,
Speaker 1: let's say some administrative level commands on an operating system
Speaker 1: through the code you've made. Because that wasn't what you
Speaker 1: were thinking about when you were building your word processor.
Speaker 1: You weren't trying to you weren't even thinking that that
Speaker 1: was a possibility. You were just trying to make a
Speaker 1: working word processor. Yeah. Yeah, And and and for all of
Speaker 1: these all of these computers, people are writing so much
Speaker 1: code every day, trillion lines of code a year. That
Speaker 1: was in the early two thousands, so we're talking about
Speaker 1: way more. And and you think about you think about
Speaker 1: the number of platforms that have increased since the early
Speaker 1: two thousand's. That's before the smartphone was really a thing.
Speaker 1: You know, think about two thousand seven. That's when the
Speaker 1: iPhone gets introduced. That's when the smartphone, at least in
Speaker 1: the United States, really becomes a consumer product. Before that time,
Speaker 1: it was something that you might see some executives having
Speaker 1: as part of the way they interact with their businesses,
Speaker 1: But the average consumer in the United States didn't have
Speaker 1: a smartphone until after two thousand seven. At that point,
Speaker 1: you've got so many different devices now that people are
Speaker 1: developing code for, and some of them aren't even you know,
Speaker 1: your traditional computers or smartphones or tablets. They might be
Speaker 1: hardware that the consumer is never interacting in a way
Speaker 1: where they're even all where their software involved. Sure, like
Speaker 1: every single Intel chip that's sold has has stuff hard
Speaker 1: coded into it, and that's it's not just Intel every
Speaker 1: every chip, sure yasically many chips and your basic firmware. Right,
Speaker 1: the idea that you've got programming that is physically codified
Speaker 1: into a system, it's not. It's not like some ephemeral
Speaker 1: software that exists for a moment and then it's gone.
Speaker 1: It's it's actually part of the device itself. So we've
Speaker 1: got all this code, huge amounts. Now, imagine it's your
Speaker 1: job to go through code and find vulnerabilities, and you're thinking,
Speaker 1: there's more code generated every day than I could possibly
Speaker 1: get through in a week. It's kind of like the
Speaker 1: issue with YouTube where you talk about how many hours
Speaker 1: per minute get uploaded to YouTube. There's no way to
Speaker 1: watch all the content because it's physically impossible. Yeah, you
Speaker 1: could say, well, how could we monitor all that content
Speaker 1: to make sure people aren't uploading copyrighted movies and stuff
Speaker 1: like that? But you know what you could do. You
Speaker 1: could design a program to look through all of that
Speaker 1: stuff and compared against the database of copywritten material, it's
Speaker 1: alood easier than hiring Bob to try to watch an
Speaker 1: impossible number of YouTube videos every day. Yeah, so, yeah,
Speaker 1: you've got and if you've seen you've seen people trying
Speaker 1: to get around this, I bet right on YouTube where
Speaker 1: they like they upload copyrighted material, but it's like obscured
Speaker 1: and flipped and zooming in and out in weird ways
Speaker 1: to try to prevent auto detection. Right, have you seen this? Yeah?
Speaker 1: Or people you know, people just have like a a
Speaker 1: section of whatever the view would be. Yeah, those are
Speaker 1: the worst, right where you're like, oh, it's the lower
Speaker 1: two thirds of a television screen so that this doesn't
Speaker 1: get picked up. An awful, awful sound quality. What a
Speaker 1: wonderful experience I'm having right now. I'm going to go
Speaker 1: buy the movie. Man. Really we think about it, it's
Speaker 1: more of a great tool to convince people to purchase
Speaker 1: this stuff legitimately in order to have a decent experience.
Speaker 1: But at any rate, Uh. One of the things that
Speaker 1: was interesting when I was researching this was the you know,
Speaker 1: you got those trillion lines of code, what does that
Speaker 1: mean in terms of vulnerabilities? And the estimate I was
Speaker 1: hearing was about they were talking about a billion vulnerabilities
Speaker 1: existing out there, a billion. So you've got trillion lines
Speaker 1: of code and a billion vulnerabilities. Finding a billion vulnerabilities
Speaker 1: within a trillion lines of code. That is such a
Speaker 1: monumental test. Most experts are saying like, yeah, I can't
Speaker 1: even wrap my head around hold on, am I doing
Speaker 1: the math right? That that that would be one vulnerability for
Speaker 1: every thousand lines of code? Yeah. Yeah. So then you
Speaker 1: sit there and you think about it, like if you
Speaker 1: let's say that you've got a job requests saying, yeah,
Speaker 1: so turns out there's a billion vulnerabilities out there. I'm
Speaker 1: gonna need you to clear those up before the end
Speaker 1: of the year. She was just like, I'm going into
Speaker 1: a new line of work and you can't do it. Yes,
Speaker 1: I'm leaving this up and also possibly my sanity goodbye. Um.
Speaker 1: And these these vulnerabilities do shake out into actual issues.
Speaker 1: I read a report where a security firm called Jamalto
Speaker 1: said that approximately a billion records personal records were compromised
Speaker 1: worldwide alone, so one in like one in seven points something. Yeah,
Speaker 1: so you've got well, I mean assuming that that that
Speaker 1: a human person only creates one record per year, and
Speaker 1: I think it's more than that. But but yeah, but
Speaker 1: at any rate, like like like a billion is a
Speaker 1: nice round number, Like it's large, it's not small, it's
Speaker 1: it's impossible for me to even you know, have a
Speaker 1: concept of how much that is. And when you think,
Speaker 1: like we said about how they this this code is
Speaker 1: integrated not just in software but in hardware across all
Speaker 1: sorts of different devices and infrastructures, you realize this is
Speaker 1: legitimately a problem. It is. It is really a threat, right,
Speaker 1: It's not it's not just it's not just something like
Speaker 1: oh that's inconvenient. It's not like, oh man, my cellphone's
Speaker 1: gonna get hacked. It's like, oh man, are a hydro
Speaker 1: power plant is going to get hacked? The US Director
Speaker 1: of National Intelligence one James Clapper in listed cyber attacks
Speaker 1: as the most serious global threat, above terrorism, above weapons
Speaker 1: of mass destruction, above sid ducks. I don't know, yeah, Godzilla, yeah,
Speaker 1: more so than that not saying something so yeah, you've
Speaker 1: got you've got the perfect situation for disaster here, right,
Speaker 1: You've got a target rich environment, and cybersecurity experts might
Speaker 1: know to to really seek out the stuff that's going
Speaker 1: to have wide propagation first, because obviously, if you're a hacker,
Speaker 1: you want to try and hit as many targets as
Speaker 1: you possibly can. So from a cybersecurity point of view,
Speaker 1: you'd say, let's make sure we cover the stuff that's
Speaker 1: going to get the widest circulation first and then worry
Speaker 1: about the smaller programs kind of like you know, think
Speaker 1: of it like concentric raicles. We want to get on
Speaker 1: that middle of that target first, so like operating system
Speaker 1: updates or major product upgrades, that kind of stuff, stuff
Speaker 1: that lots and lots and lots of people are going
Speaker 1: to get. But that also means the hackers can say, well,
Speaker 1: I won't hit as many people if I aim for
Speaker 1: these other more niche oriented software packages, but I'm also
Speaker 1: less likely to encounter resistance. I'm more likely to find
Speaker 1: a vulnerability that people haven't identified yet, and therefore will
Speaker 1: be able to hit a greater percentage of that niche
Speaker 1: than I would if I aimed for operators who's really
Speaker 1: shoring up the defenses of this organ trail clone that
Speaker 1: I downloaded right, which, by the way, is a great game,
Speaker 1: But I mean I I do want to put in
Speaker 1: here that there are certainly uh hackers for good, like
Speaker 1: white hat hackers cybersecurity type experts that we've been talking about,
Speaker 1: who are actively working every day to to plug up
Speaker 1: these kind of vulnerabilities. UM you know, not looking to
Speaker 1: cause harm or mischief, but to seek these things out
Speaker 1: and to change them. Their conventions around the world where
Speaker 1: where where hackers and other interested parties gathered to strategize
Speaker 1: and to learn and to present research and to disclose
Speaker 1: security problems that they've found. Um, you know, either providing
Speaker 1: outright or selling the information to the parties at hand
Speaker 1: that that would be able to enact changes. Um. One
Speaker 1: of those black hat is actually happening this very weekend,
Speaker 1: July August four in Las Vegas. Right. The other big
Speaker 1: one I hear about all the time is def con right,
Speaker 1: that also happens in Las Vegas. I urge you that
Speaker 1: if you ever decide to attend one of these conventions,
Speaker 1: bring a burner phone and leave your normal one at home. Yeah,
Speaker 1: I'm being totally serious, that's I I agree. These hacker
Speaker 1: thons often have a wall of shame, and if you
Speaker 1: have not secured your technology properly, they will put your
Speaker 1: name up there because they will have found how to
Speaker 1: access your stuff and say, look, uh, this is serious.
Speaker 1: You need to be aware of this. Yeah, I'm not
Speaker 1: These these quote unquote white hat white hat hackers certainly
Speaker 1: are not outside of the realm of the mischief type
Speaker 1: of concept. I mean, but it's not's mischief for good
Speaker 1: and yes, exactly to be fair, one of the issues
Speaker 1: that hackers who are doing this work run into is
Speaker 1: a lack of cooperation on the side of the companies
Speaker 1: that are producing the software. Right, and that's starting to change,
Speaker 1: I think, um, I think that a lot of companies
Speaker 1: have come into the realization that it is less expensive
Speaker 1: to hire this kind of security expert than it is
Speaker 1: to allow someone to create a vulnerability in the programming. Um.
Speaker 1: But and and and and many many companies do these
Speaker 1: days have hackers on their team looking for these kind
Speaker 1: of vulnerabilities. And there's been tons of successful projects to
Speaker 1: come out of freelancers and contractors and full time hackers,
Speaker 1: you know, work bolstering everything from from the security of
Speaker 1: hospital patients records and pacemakers and insulin pumps. Insulin pumps
Speaker 1: have computers in them. Now that's terrifying, um and wonderful.
Speaker 1: But but but to to making a t M S
Speaker 1: and net network routers more secure, to making prison and
Speaker 1: office doors unhackable important stuffs for work right, right, all
Speaker 1: of these things. Um, so you know it's not that
Speaker 1: it's not that humans are totally falling down on the job.
Speaker 1: It's just that we are only humans, right, which is
Speaker 1: why we need the machines to take over. Right, Yes,
Speaker 1: because the idea of being that you know, if you
Speaker 1: have a computer program, stop us out. Exactly. If you
Speaker 1: have a computer program that's properly orchestrated, properly designed and
Speaker 1: coded so that it can look for vulnerabilities and patch
Speaker 1: them autonomously, then it's going to be able to work
Speaker 1: much faster, more efficiently than any human could. It never
Speaker 1: gets tired, it's never going to miss vulnerability because it's
Speaker 1: been staring at this code for like six hours and
Speaker 1: it just you know, you get that blindness six hours
Speaker 1: was Yeah, well, most of my programmer friends are like,
Speaker 1: you know, fourteen hours in with like seventeen cups of
Speaker 1: coffee and sure increasing twitch and exciting eye twitch. Yeah. That.
Speaker 1: The issue there, of course, is that you're more likely
Speaker 1: to miss something, yeah, you know, but a computer program
Speaker 1: doesn't because it just keeps on trucking. No. Obviously, the
Speaker 1: dependability on the program is only as good as the
Speaker 1: developers are, right, but ideally they would catch problems before
Speaker 1: bad guys could ever identify there was a problem there
Speaker 1: in the first place, and everything gets patched, maybe even
Speaker 1: before the release of the software, so that there's never
Speaker 1: the opportunity for a hacker to take advantage and exploit
Speaker 1: of vulnerability. So this all leads up to this Cybergrand Challenge,
Speaker 1: which is happening August fourth, and that's where we get
Speaker 1: this automated Capture the Flag tournament. This is also in
Speaker 1: Las Vegas, kind of on the tail end of of
Speaker 1: black Hat. I'm not sure if it's officially I doubt
Speaker 1: it's officially affiliated, right, Yeah. I love the idea of
Speaker 1: DARPA showing up to black Hat soap UM and everyone's like, hey, buddy,
Speaker 1: hacked your system last week. Looking good. So so this
Speaker 1: is this is actually the final round of competition. It's
Speaker 1: a competition that's been going on for a while now.
Speaker 1: It's not something that is you know, they had made
Speaker 1: it just for this one day UM and in fact,
Speaker 1: in earlier rounds of competition, which began back in ten,
Speaker 1: there were more than thirty teams that registered for this
Speaker 1: UM and they could register as either an open track
Speaker 1: competitor which covered self funded teams, or a proposal track competitor.
Speaker 1: Which were teams that were invited to participate by DARPA
Speaker 1: itself and partially supported by the agency to develop the
Speaker 1: tech necessary to compete. This is not unusual. The same
Speaker 1: thing happened in their driverless car challenges, where they had
Speaker 1: teams that were specifically invited to participate versus those that
Speaker 1: volunt that that essentially stepped forward to enter the competition.
Speaker 1: So so there were more than thirty back in two
Speaker 1: thousand and fourteen, we're down to seven finalists. Now. Each
Speaker 1: finalist team received an award of seven fifty thousand dollars
Speaker 1: to prepare for the Grand Challenge after completing these preliminary rounds.
Speaker 1: So here are the seven finalists in the Cybergrand Challenge.
Speaker 1: There are some researchers from Moscow, Idaho, which I did
Speaker 1: not know was a place UH with the Center for
Speaker 1: Secure and Dependable Systems or CSDS. Now, this was a
Speaker 1: group that formed out of the with the Idaho State
Speaker 1: Board of Education called for this group to come into
Speaker 1: being UH specifically at the University of Idaho to advance
Speaker 1: computer security education and research. According to their their profile
Speaker 1: on DARPA, they represent the only system that was entirely
Speaker 1: built from scratch. Every other stom that is in the
Speaker 1: finals had existed in some previous form before these these
Speaker 1: preliminary tests began. Next, you have Deep Red, which is
Speaker 1: a team from Raytheon. They took their name by combining
Speaker 1: Deep Blue, which was IBM system that took on Grand
Speaker 1: Masters and chess, and the color of Raytheon's logo, which
Speaker 1: is red Deep read. So this is not the the
Speaker 1: Dario Argento movie. No. Now. Next you have Dissect, which
Speaker 1: is spelled d I S e k T. And they
Speaker 1: hailed from Athens, Georgia, so I went to college in Athens, Georgia.
Speaker 1: They are the one team in the challenge that has
Speaker 1: managed to post scores in five other CTF events hosted
Speaker 1: by various other universities and and organizations. So they've they've
Speaker 1: got a record, yeah, of doing well in other competitions. Next,
Speaker 1: you've got four All Secure. That's all one word. They're
Speaker 1: out of Pittsburgh pencil Mania. That team started with researchers
Speaker 1: who worked with Carnegie Mellon University. You have Shellfish with Fish. Yeah,
Speaker 1: they're out of Santa Barbara, California. That group grew out
Speaker 1: of a hacking team at the University of California, Santa Barbara,
Speaker 1: and it includes, according to their profile, the youngest program
Speaker 1: analyst expert in the competition. I love like the little
Speaker 1: facts that you get under each team as you go
Speaker 1: through them. Uh. Next you have tech X, which is
Speaker 1: based out of Ithaca, New York, and Charlottesville, Virginia. Team
Speaker 1: members come from Gramma Tech Incorporated and the University of Virginia.
Speaker 1: They developed a program they call pea soup, which is
Speaker 1: an acronym that stands for preventing exploits of software of
Speaker 1: uncertain provenance. I don't know do I love or do
Speaker 1: I hate those contrived acronyms. You might want to ask
Speaker 1: where they answer that question show? You might want to
Speaker 1: ask where they deep inside yourself, where does the A
Speaker 1: and P soup come from? In that preventing exploits of what? Yeah,
Speaker 1: where's the A come from? One wonders from that, I
Speaker 1: should be peck soup or soup. Uh. Then you have
Speaker 1: I love this name to co Jitsu, which is a
Speaker 1: team that is based in uh, well, the three different places. Actually,
Speaker 1: they have researchers who are in Berkeley, California, Lausane, Switzerland,
Speaker 1: and Syracuse, New York. So it's a collaboration of scientists
Speaker 1: from Berkeley, cyber Haven, and Syracuse, and they're all competing
Speaker 1: for prizes that that collectively amount to just under four
Speaker 1: million dollars um. And so there's some there's some big
Speaker 1: money and obviously some great bragging rights if you're the
Speaker 1: group that creates the automated system that wins. I mean,
Speaker 1: that's that's some nice accolades to have. Sure. I mean
Speaker 1: also see above re being able to sell it to
Speaker 1: a company done that rent it out at any rate. Right,
Speaker 1: But they, you know they Dark was very quick to
Speaker 1: mention that this competition is really more about identifying the
Speaker 1: most effective approaches. It's not necessarily we have identified the
Speaker 1: working strategy. This, this one product here is clearly the
Speaker 1: way we're gonna go everyone else. Thank you for showing up.
Speaker 1: It's not Willy Wonka, right, you know, it's not everyone
Speaker 1: else has to go home. It's rather saying the elements
Speaker 1: that you had in your approach, these these particular ones
Speaker 1: we've identified, were really effective, but this other team had
Speaker 1: these that were very effective in a different way. How
Speaker 1: can we start to look at the things that worked
Speaker 1: best and create best practices. So they're going to create
Speaker 1: a Frankenstein cyber security robot. Well it's really too maybe
Speaker 1: who knows, but really, I mean, it's about about identifying
Speaker 1: what strategies work the best in order to move forward
Speaker 1: with the next step. Um. So you might wonder, all right, well,
Speaker 1: how is this all gonna play out based upon that? Well,
Speaker 1: you know, it hasn't happened yet. Uh. And while we're
Speaker 1: all about talking about the future and speculating, we are
Speaker 1: incapable of telling you who won yet I can't. After
Speaker 1: it happens, we can do it, but right now, not
Speaker 1: so much. Um. It may turn out that none of
Speaker 1: those programs perform better than human experts they'll be pitted against.
Speaker 1: That is a possibility that certainly wouldn't surprise me today,
Speaker 1: right Uh. And it may still be that even if
Speaker 1: that happens, we're able to at least identify the reasons
Speaker 1: why programs didn't measure up to humans or things that
Speaker 1: got close but didn't quite get there. Well, I mean,
Speaker 1: one thing that strikes me is maybe maybe they've found
Speaker 1: a way to uh to circumvent this problem. But it
Speaker 1: seems like you couldn't really combine the advantages of an
Speaker 1: automated system. For is the advantages of a human operator
Speaker 1: in a competition setting, because in a competition setting, there's
Speaker 1: a limited scope of problem solving area, if you know
Speaker 1: what I mean. So there's like a limited problem solving space,
Speaker 1: and what the automated system would seem to have at
Speaker 1: its advantage is sort of just limitless time and and
Speaker 1: speed to search the problems space for problems to identify
Speaker 1: and and like like multiprocessing multiprocessor tracks to accomplish that
Speaker 1: on multiple systems, in multiple programs at the same time. Um,
Speaker 1: but but I'm sure that you can. I mean, the
Speaker 1: hard evidence that you're going to get here is like
Speaker 1: if if a computer program can crack all the vulnerabilities
Speaker 1: and patch them in a fifth of the time that
Speaker 1: a human does it, or vice versa, then then you've
Speaker 1: got a pretty solid idea of of how fast each
Speaker 1: system is working. And and over time that kind of
Speaker 1: time difference will will be affected by how much it
Speaker 1: can get done well. And also we need to remember
Speaker 1: Darba challenges sometimes teach us a lot. Even when everyone fails,
Speaker 1: all the competitors fail, that was the case, this failure
Speaker 1: won't be nearly as funny as watching those robots trying
Speaker 1: to open that door. Yeah, right, well, I was mostly
Speaker 1: thinking of the driverless Car Challenge. That's that's funny too. Well,
Speaker 1: the Driverless Car Challenge. The first time they held that
Speaker 1: back in two thousand four, they didn't award a winner,
Speaker 1: no one. No one team was able to complete the objectives. Uh,
Speaker 1: in the time allotted. Most of them had pretty remarkable
Speaker 1: failures where the vehicle at some point got off track
Speaker 1: or failed to respond anymore, or just you know whatever
Speaker 1: for whatever reason it was, was not able to complete
Speaker 1: the course. But they decided to go ahead and hold
Speaker 1: the challenge again the following year, which gave the team's
Speaker 1: chances to go back and reevaluate their work, make changes
Speaker 1: and improvements so that they were better able to compete
Speaker 1: the following year. And that's when things started to really
Speaker 1: move forward literally in that case. And uh, when you
Speaker 1: look at it that way, you could say, well, if
Speaker 1: they had just in two thousand and four said well
Speaker 1: this this isn't gonna work, We're walking away from this,
Speaker 1: then we wouldn't be on the cusp of the autonomous
Speaker 1: car revolution, which we appear to be right now. Right
Speaker 1: they could very we have companies right now talking about
Speaker 1: it will be a matter of years, not a lot
Speaker 1: of them, a few years, and then we'll start seeing
Speaker 1: autonomous cars in earnest start to hit the roads beyond
Speaker 1: just the limited use we're seeing, where it might be
Speaker 1: like an office park automated bus, or something that navigates
Speaker 1: through like a relatively closed system like an airport, that
Speaker 1: kind of thing like around an airport at various terminals. Um.
Speaker 1: So it may be the same with this Grand Cyber Challenge,
Speaker 1: where that first year of competition we don't see a
Speaker 1: clear winner, but that doesn't necessarily mean this is the
Speaker 1: end of the line um. Although it's also possible that
Speaker 1: one of the automated systems will just totally smoke all
Speaker 1: the other competitors, both computer and human, the most likely
Speaker 1: outcome will be that through this challenge, will learn which
Speaker 1: of these techniques are the most promising and which one
Speaker 1: seemed to be less effective, and thus people can direct
Speaker 1: their attention to to the avenues that appear to be
Speaker 1: best best chance of success, with the goal ultimately of
Speaker 1: creating these automated systems that could be rolled out on
Speaker 1: rather large scale too. You know, check for probe for
Speaker 1: vulnerabilities in software across multiple platforms in some cases before
Speaker 1: they can actually be encoded into hardware. I mean anything
Speaker 1: that's been encoded into hardware that's tough. Like you, you
Speaker 1: can do firmware updates, but that's really a software layer.
Speaker 1: It's not like you're physically changing the chip that's already
Speaker 1: been produced. You're you're just you're trying to compensate for
Speaker 1: a vulnerability that's been hard coded into a device. That's
Speaker 1: a little trickier, but um, moving forward, you could at
Speaker 1: least mitigate that somewhat and limit the number of vulnerabilities
Speaker 1: that get put into hardware. So the biggest outcome of
Speaker 1: this would be that we'd have a safer approach to
Speaker 1: this wondrous future we've talked about, this Internet of things
Speaker 1: future where reality is responding to our wishes and desires
Speaker 1: before we can even voice them, and refrigerators can eat us.
Speaker 1: I don't want to see that happen, Joe. But I
Speaker 1: also don't want to see a future in which this
Speaker 1: wondrous world I'm walking around in is also uh enabling
Speaker 1: a hacker to track my every movement, or get tons
Speaker 1: of personal information about me, or exploit me in some
Speaker 1: other way that I may or may not be aware
Speaker 1: of or you know. Yeah, it's a concept where we
Speaker 1: want to make the world better with this, not scarier. Yeah,
Speaker 1: you don't want to open the door and have a
Speaker 1: guy sitting there like. So here's the thing. I've been
Speaker 1: tracking your every movement for the last two years, and
Speaker 1: unless you pay me this exorbitant amount of money, everyone's
Speaker 1: gonna know about how often you go to Taco Bell.
Speaker 1: You're terrible, terrible puppy kicking excursions throughout the neighborhood when
Speaker 1: you think everyone's asleep or whatever it may be. Uh,
Speaker 1: the taco bell thing, while it does strike deep into
Speaker 1: my heart, I think I could. I could reconcile myself
Speaker 1: with over time, Over time and a couple of taco locos,
Speaker 1: I could probably do it. But yeah, it's oh my god,
Speaker 1: are those the ones that are in Derrito's. Yes, that's
Speaker 1: the thing, right, Yeah, a taco that's inside Derrito's. The
Speaker 1: shell itself is made out of essentially derrito chip. Yeah,
Speaker 1: and and then you've got um like melted cheese on
Speaker 1: top of it. It looks pretty insane. I have never
Speaker 1: actually tried one of these things, and I just happen
Speaker 1: to know what the name is um. But yeah, if
Speaker 1: we want this another future, we want it to be
Speaker 1: a safe one. And obviously, again, if we're talking about
Speaker 1: trillions of lines of code, expecting it to be a
Speaker 1: safe future without the use of computer assistance seems to
Speaker 1: be implausible at the at best. You know, one potentially
Speaker 1: frightening implication of this whole scenario. It's not of what
Speaker 1: what DARB is doing with this competition, necessarily, but just
Speaker 1: the fact that we're in a position to be having
Speaker 1: this kind of competition is that we could as humans
Speaker 1: lose sight of what's happening in the sort of back
Speaker 1: and forth between people who want to compromise our information
Speaker 1: security and and take over our devices and the measures
Speaker 1: that are put in place to protect them. It's kind
Speaker 1: of like that frightening scenario and automated trading, where you
Speaker 1: have computers making lightning fast buy and sell decisions on
Speaker 1: the stock market or commodities markets, and even the people
Speaker 1: who design these systems don't understand what they're doing in
Speaker 1: real time, right writer, or you know, small small glitches
Speaker 1: like like that time that like I don't know, like
Speaker 1: like something on Twitter made the stock market waiver for
Speaker 1: a moment and everyone was like like like taking their
Speaker 1: hands slowly off of the computer wheel. It is terrifying
Speaker 1: when you get to a system that's so sophisticated that
Speaker 1: even the people who design the system cannot be fully
Speaker 1: certain what caused it to make a specific decision at
Speaker 1: a specific time. Right, And so I think that there
Speaker 1: is generally we might want to be concerned about allowing
Speaker 1: a state of affairs where humans just sort of get
Speaker 1: cut out of the loop of understanding the software that
Speaker 1: governs our day to day lives. Like, so you imagine
Speaker 1: this this future scenario, hackers have massively powerful automated vulnerability
Speaker 1: aching software that tests all networked systems that can find
Speaker 1: for weak points. You know, it's essentially like living in
Speaker 1: a world where people could insert lockpick guns into ten
Speaker 1: thousand different houses front doors every eight seconds to see
Speaker 1: what could be picked. So this is kind of like
Speaker 1: the black hat version of the software we were just talking, right,
Speaker 1: But I'm getting there. So if you have that, there'd
Speaker 1: be no way for human security agents to keep up.
Speaker 1: So you need this kind of automated vulnerability seeking and
Speaker 1: containment software, right, But imagine so you've got these two
Speaker 1: systems working in tandem. Both automated sort of in a
Speaker 1: in an automated security arms race back and forth. Um,
Speaker 1: will humans lose track of what their own software does
Speaker 1: and how? I don't suspect so, because humans are still
Speaker 1: the ones creating the software with a specific purpose in mind.
Speaker 1: And what we're looking at is the matching or exploiting
Speaker 1: of vulnerabilities within that software, not fundamentally changing how that
Speaker 1: software behaves or what it is supposed to do. But Jonathan,
Speaker 1: what if what if that software decides that the real
Speaker 1: vulnerability in the system is us? It's a little different.
Speaker 1: But I like where you're going. Yeah, no, no, no,
Speaker 1: I mean, I don't mean that, but I do. I know,
Speaker 1: I know, you know, but I do mean. Like, Okay,
Speaker 1: so let's say a computer this program detective vulnerability and
Speaker 1: then patches it. But as we all know, sometimes maybe
Speaker 1: a security patch can destabilize the system in another way.
Speaker 1: You've just caused a new problem that needs to be addressed.
Speaker 1: And so what if they say, ah, you know, every
Speaker 1: time it patches something, it's not sophisticated enough that it
Speaker 1: can do that without compromising something else in the system.
Speaker 1: So we've got to we've got to let it fix
Speaker 1: the compromised part also, so it's got a patch security
Speaker 1: and it's got to fix the destabilized system, and then
Speaker 1: that caused another problem. Bloom. I I can imagine scenarios
Speaker 1: where they're cascading effects requiring us to create self modifying software,
Speaker 1: and I don't know. Self modifying software always makes me
Speaker 1: feel icky. Well, the problem is we need it now anyway.
Speaker 1: We have so many, so many lines of code that
Speaker 1: there's a need. Like if what's the other option. We
Speaker 1: don't develop the automated software we train about another billion
Speaker 1: people in cybersecurity. It's well, or we don't have an
Speaker 1: Internet of things, I guess, is an option which is
Speaker 1: not That's not happening unless there's just a catastrophic change
Speaker 1: in our technology, you know, one of those sun spots
Speaker 1: or solar right layers, barring some enormous electromagnetic pulse device
Speaker 1: that goes over an entire or large enough section of
Speaker 1: the world, or a scenario where our priorities shift to guzzoline, right,
Speaker 1: I think, I think that's I mean, we we've kind
Speaker 1: of committed, right, We're kind of committed to a pathway
Speaker 1: which requires us to do this, and so it's almost
Speaker 1: a moot question at this point of should we do
Speaker 1: this now, it's we have to do this, or we
Speaker 1: have to at least attempt to do this to see
Speaker 1: if it will work, because we've created a problem that
Speaker 1: isn't going away on its own unless we make a
Speaker 1: fundamental change in the way we are moving forward, which
Speaker 1: doesn't seem likely, uh, at least not within the foreseeable future.
Speaker 1: It would amaze me to see a real move to
Speaker 1: put the brakes on the Internet of Things. Yeah, I mean, so,
Speaker 1: I understand why you're getting where you're where you're headed.
Speaker 1: But I think, first of all, we already have those problems.
Speaker 1: Right If you detect a software vulnerability and you patch
Speaker 1: it and that destabilizes things, we already have to fix that.
Speaker 1: It's just right now we're the ones who have to
Speaker 1: do it. But yeah, no, no, I I see, I
Speaker 1: certainly see your point, Jonathan, And I think that that's
Speaker 1: that's it's absolutely ludicrous to think that we're just going
Speaker 1: to stop networking all of our increasingly valuable electronics to
Speaker 1: the Internet. Um. But but I but I definitely you know,
Speaker 1: think that caution, or at least a kind of concept
Speaker 1: of science fiction horror be be kept close to our
Speaker 1: hearts and and considered. Uh yeah, I mean, I don't
Speaker 1: really have an alternative to suggest. I understand that I
Speaker 1: think we probably need something like automated cybersecurity, but it
Speaker 1: just I don't know. I just guess thought we should
Speaker 1: be aware of this fact that, you know, there's always
Speaker 1: something a little bit strange about the idea of, in
Speaker 1: any extent, of cutting humans out of the loop of
Speaker 1: architecture of software that runs our lives. I do think
Speaker 1: also that like, and I say this with absolute respect
Speaker 1: and love for for programmers, and specifically specifically cybersecurity programmers.
Speaker 1: Um uh, I don't think we have to worry about
Speaker 1: those nice humans being not paranoid. I think I think
Speaker 1: that they've got that covered, and I think that they
Speaker 1: will take that into consideration when they're doing their work.
Speaker 1: I think it's part of part of the gig. Yeah,
Speaker 1: I agree, I think. Uh. I mean, obviously, any time
Speaker 1: you're talking about developing any sort of technology, particularly automated technology,
Speaker 1: you have to be cognizant of the consequences if stuff
Speaker 1: were to go wrong, trying to anticipate as many of
Speaker 1: those possible outcomes as you possibly can, and to plan
Speaker 1: for them and account for them so that they don't happen. Uh.
Speaker 1: For one thing, it's it's always going to be impossible
Speaker 1: to do that to perfection. Um. And at some point
Speaker 1: you just have to say, well, we just we've got
Speaker 1: to move forward and hope that we have uh accounted
Speaker 1: for all the most risky outcome us um. But yeah,
Speaker 1: it just it becomes a matter of practicality eventually, and
Speaker 1: unless we do reverse gears and back off from this
Speaker 1: approach of Internet of things, which at this point I
Speaker 1: think there's so many companies that have so much money
Speaker 1: in Internet of things that that's unrealistic. Uh, It's it's
Speaker 1: something we have to move forward with. I'm very curious
Speaker 1: to see how this turns out. I really look forward
Speaker 1: to reading up on the competition once it's finished and
Speaker 1: seeing how the various teams did and uh, you know,
Speaker 1: did any did any of the teams or did multiple
Speaker 1: teams uh significantly outperformed the human participants. I can't wait
Speaker 1: to learn more about it. So we'll probably at some
Speaker 1: point do a follow up of some sort um either
Speaker 1: forward thinking video or maybe a future podcast where we
Speaker 1: talk about these concepts and how how did the machines do?
Speaker 1: Did we did we see a market improvement in performance
Speaker 1: over humans or is that something that humans are just
Speaker 1: better at doing than machines are right now, because sometimes
Speaker 1: we run into that stuff. It seems to be fewer
Speaker 1: and far between these days, but it does still happen.
Speaker 1: For instance, we're still better at opening up a door
Speaker 1: and walking through it. All right, Well, that wraps up
Speaker 1: this episode. Yeah, that's I love, I love it is
Speaker 1: to be. It's like the classic Escape from Daleks is
Speaker 1: just run up some stairs until the Yeah, the reboot
Speaker 1: ruined all that, but back in the day, the good
Speaker 1: says stairs would protect you from the Dolleks. All right, So,
Speaker 1: if you guys have any suggestions for future episodes of
Speaker 1: forward Thinking, or you got any questions or comments anything
Speaker 1: like that, you can send us a message, otherwise we
Speaker 1: won't hear you. Our email addresses FW thinking at how
Speaker 1: Stuff Works dot com. If you search Facebook for FW thinking,
Speaker 1: our profile will pop right up. You can leave us
Speaker 1: a message there. We are FW thinking on Twitter. You
Speaker 1: can always tweet us at Twitter. We're happy to hear
Speaker 1: from you, and we will talk to you again really soon.
Speaker 1: H For more on this topic and the future of technology,
Speaker 1: visit forward thinking dot com problem brought to you by
Speaker 1: Toyota Let's Go Places,