Decoder with Nilay Patel
00:27:20 · S3, Nilay Patel
[00:27:20] S3: I think Sundar Pichai and Andy Jassy are. Yeah. I think I think they literally have each other's cell phone numbers. I I... If one of them... Maybe they don't listen to Decoder, but I I I expect one of their direct reports does. And I would like one of them to talk... Go into their one on one and say, sir, I listened to the most handsome, best spoken CISO I've ever heard, and he had a great idea. And you could get incredible credit if you're the one... Yeah. We'll we'll both do it, but we'll we'll leak to the Wall Street Journal if that was your idea first. Yeah. You should call the other, and we should spend a 100,000,000, maybe a billion dollars. Like, we just had a bug in the TCP stack of Linux. That is insane. Like, we can't do this anymore. The problem with rewriting the Linux kernel is, like, half of its driver code, and nobody has that hardware anymore. Right? Like, somebody had to be in the presence of that hardware with a, you know, a ThinkPad t 40 when they wrote that driver, and they don't have that anymore. But the good thing is is a huge number of the really important uses of Linux kernel are production server hardware. And so fork it. Right? Like, Linus will never do it because Linus wants to support all that stuff, and he's got, like, all these politics. But Google and Amazon don't have to care about Linus Torvalds. [00:28:36] S2: Right?
00:28:36 · Nilay Patel, S3
[00:28:36] S2: Right? [00:28:37] S3: And so Google and Amazon can create a new version, a new fork of the Linux kernel, and they don't have to call it Linux. That can be ABI binary compatible with the glibc and everything above it. In fact, they can eventually fork glibc. Right? [00:28:51] S2: Yeah. [00:28:52] S3: And they can build it, and they can call it whatever they want, and it only runs on production hardware, and then they can use it for their clouds. And eventually, all the clouds will move to it. And if you want, other people can run the insecure thing that has to be patched all the time, and that's fine. But, like, for the things that our containers run on, I would feel a lot better if it was written in a type safe, memory safe language that also has the ability now to have contracts. So, like, these languages have the ability... You don't have to do full form of verification, which is incredibly hard, but you can do kind of these things that approach formal verification. I'm a little over my skis here because there's people much smarter than me that study this. But, basically, you define, this is how this function's supposed to work. Here's the contract it has. And very, very smart software engineers would love to write these things because, you know, they had time on their hands. No no person who had a real job used to write these things, but LMs have tons of time on their hands. [00:29:46] S2: Right?
00:29:46 · Nilay Patel, S3
[00:29:46] S2: Right? [00:29:47] S3: Because, you know, we're we're frozen in time while while they're, you know, thinking that incredible machine speed. And so you could totally have them rewrite the Linux kernel with this, you know, not quite formal verification. Please, if you're listening and you work at Google or Amazon, go go pitch us. Anyway, here's my pitch. [00:30:03] S2: I'm just saying, I know Jason's listening. So if you you heard it, I'm not even gonna say who [00:30:07] S3: I am. I'm sorry to hear that. I... But I'd say, like, that is the kind of thinking we're gonna need to make it through this. Right? It's like, you you can't... We can't just patch our way through this because it's killing us. And because the other thing that's killing us is companies can't... We are not set up as... You you talk about, like, how we do security, like, for the last twenty years. Kind of the assumption is is, like, we can get a patch and apply the patch, and you're okay. And what's happened is is the exploitation time lines are so incredibly fast that that does not work. That's what we just saw with the PHP bug is we got incredibly lucky that the PHP bug turned out to be really hard to exploit in the wild. If it was a much more wormable bug, it would be a disaster. And so that was the kinda near miss asteroid thing that now the world should, you know, build an asteroid. [00:30:56] S2: Wait. Can I ask you about this? Yes. Yeah. We should definitely put Bruce Willis on a space shuttle. [00:31:02] S3: Don't wanna miss a thing.
00:31:02 · S3, Nilay Patel
[00:31:02] S3: Don't wanna miss a thing. [00:31:04] S2: There's a lot going on in this conversation already. Yeah. I... My pessimism about all these things is very simply expressed. We are... As Americans in particular, we are very bad at doing anything until a bad thing happens. Right? We are... We we love a cure. We hate prevention. A lot of bad things have happened. There's the hugging face attack. You actually... I think you recently said you were happy that happened. It woke people up. There's the PHP bug that, you know, we've we've just had a crazy month of all these breaches. It doesn't seem like that has led to a whole of industry response or a regulatory response or Sundar calling Andy and being like, we're we're doing Linux. What's it gonna take? How bad does it have to get?
00:31:47 · S3
[00:31:47] S3: The Hugging Face incident was good, and it did wake up a lot of people in security. We are a little bit better off because Hugging Face happened, and we saw what was going to be possible a couple months later in open source. But you're totally right. As Americans... And Americans are the only ones, honestly, who can lead the world on this. We're the ones building the AI for the most part. We're the ones who lead the cybersecurity industry. The Chinese are mostly enabling the attackers, not the defenders. They should enable defense. They they want to be participants in the global economy. They they wanna be leaders. They should be doing more on the defensive side, not just enabling the attackers, but that's not happening. So, anyway... But we need to be proactive. And, look, I... Something I have learned now working at, like, in... At Cognition at an AI startup, you can just do things. Like, we need to... Like, seriously, you can just go do things, and we just need to have more agency as a tech industry. We should just go do things. That should be the lesson of the AI era, and we should not be so risk adverse in doing the right things security wise. And I think that's what security teams... If I if I had a a message for other CISOs, is just go do the right thing. Because CISOs are... By our nature, we are risk averse. We are the people who manage downside risk. We have all l and no p in the p and l. Yeah. And I have had to personally, like, break through that natural inclination because, like, you just... You can't just play defense.
00:33:23 · Nilay Patel, S3
[00:33:23] S2: This... But this is my prevention versus cure. Right? The the prevention is cheap, but it's all loss on the p and l statement. Right? It's all just cost. Yeah. If the bad thing happens, like, well, we have to do anything to fix this because there's economic benefit to having a functional business again. And it seems like in this moment, even though... So sort of like basic understanding of that risk versus cost is totally scrambled and no one has quite figured it out yet. [00:33:48] S3: Yeah. I totally agree. So, like, I'll give you a a very practical example of of of a way CISOs and their bosses are going to have to change on this. Every company in the next... I was gonna say six months, but really in the next ninety days is going to have to RTX themselves. You're just going to have You're gonna [00:34:05] S2: have to run the attack on yourself.