Latent Space: The AI Engineer Podcast
01:24:26 · Shawn Wang, Mihail Eric
[01:24:26] S0: Yeah. There... There's a couple of related arguments, and then I'm I'm happy to Yeah. To keep going. So, like, security is, like, it's like a nonstop, like, huge Yeah. Huge, huge surface area thing. There's one argument from Malte of Vercel who's like, okay. Guys, let's take every single, like, high depend... Highly dependent on software that's written in c c plus plus, port it to Rust. And it's like, we'll be faster, more secure. And, like, it it won't... It'll probably take, like, $6,000,000, and... But you'll you'll you'll get it done. And and then there's there's another argument for... This this also links to pacing the frontier from the the open source... From the model labs Mhmm. Who are like, okay. Let's slow down so that we... Or, like, we'll do Daybreak. We'll do what's... Glasswing. We'll make sure everyone's patched, and then we can let loose on rampant acceleration. So I think, like, there... There's there's there's an inherent belief that the models will fix all security. [01:25:19] S1: Mhmm. [01:25:19] S0: And I think it's just unproven to me because what if they introduce new bugs and they're just different bugs? [01:25:26] S1: That's right. [01:25:26] S0: That's right. [01:25:27] S1: That's right. [01:25:28] S0: So so I mean, well, I'm I'm looking for pushback. I'm looking for like, well, no. You're you're you're an idiot. Like, obviously, your models are way better at this.
01:25:28 · Shawn Wang, Mihail Eric, S2
[01:25:28] S0: So so I mean, well, I'm I'm looking for pushback. I'm looking for like, well, no. You're you're you're an idiot. Like, obviously, your models are way better at this. [01:25:36] S1: Yeah. I I guess, like, that's almost like in the limit. There... There's this... The question is like, is is a model... Do we believe a model will create perfect software? Right? If a model is creating perfect software, then then you're [01:25:47] S0: Is there such a thing? [01:25:48] S1: Then then that's done. Right? Then then we have... Then we're done here at all. Like, then then then we're just gonna go home and and and chill on the beach with the rest of our lives. [01:25:55] S2: I I think there's also the question of, is it good enough to first give it for security? So let people patch then just delay the release and do it after. Or is there a problem of, Oh no, it'll be much better at finding vulnerabilities. You can full send test it for longer, even if you've patched or like how long, right? You can give it for three months, someone can try to exploit it for six months. The problem is not solved. [01:26:19] S0: Right. Yeah. My whole problem with, and again, like this is a whole rant that we don't need to go into, but like, you know, you name a 100 plus organizations that, like, okay. These are, like, priority. They they have access to to cyber model that... You've just created a 100 attack factors for me to go compromise. And, like, they're... By the way, they're pretty easy to compromise. Mhmm. Mhmm. [01:26:40] S1: Mhmm. Yeah. I don't know.
01:26:40 · Mihail Eric, Shawn Wang, S2
[01:26:40] S1: Mhmm. Yeah. I don't know. [01:26:42] S0: Anyway, above our pay grade. [01:26:46] S2: It's always fun to get juicy in, you know, security. Like [01:26:50] S0: I mean, security is right now very juicy. Right? Like... And and, like, I think actually the security folks love it because they're... Like, they usually don't get that much attention, and now they have, like, a ton of attention. [01:26:58] S1: Is that true? Like, I I mean, that they don't get attention. I find that I find that, at least from, like, a VC perspective, people love... VCs love investing in security companies and have, like, pretty good... Like, whiz or something. Like, it's done very, very well. [01:27:09] S0: Like, what what Wiz is... Wiz... Let's argue... Wiz and Socket, I I literally had this conversation with VC two days ago. Yeah. Apparently, Wiz and socket were the only security companies in the last five years that have worked. What about, like, abnormal? I don't know. It worked for a VC point of view of [01:27:24] S1: I see. Like, from, like, an economic economics perspective. Yeah. Yeah. Interesting. Yeah. [01:27:28] S0: Not not not not for me to say. [01:27:30] S1: Right.
01:27:30 · Mihail Eric, Shawn Wang, S2
[01:27:30] S1: Right. [01:27:30] S0: Obviously, many, like, great players in in in that field, but it's it's a tough tough industry, I think. And so, like, the the best time... But I think it's not controversial. Best time for any security company is when a high profile incident just happened. Yeah. Yeah. Right? Obviously. Right? Like, then, obviously, you're gonna sell a bunch of security. Totally. Yeah. So so I I think I think that's a fair thing. Like, people you... People should be aware. People should know the the basic mitigation... Mitigations. I do think, like, code scanning is important, but, like, I I just wanna give people the the idea that, like, oh, no. Models introduce bugs that you wouldn't make as a human. And, like, if you're you're not checking those bugs [01:28:08] S2: It's it's not even that they make bugs, it's that you have less awareness of what's being written. Right? Like when [01:28:14] S0: Yeah. Because you know you review everything. [01:28:16] S2: Yeah. Forget bugs. Models are pretty good. They'll have on average, I would say less bugs. The problem is also that you don't even know what you're putting out. Like Yeah. There's a lot of that. [01:28:29] S1: Yeah. And that's it. Think we're do top of mitigations and and like the... And there's sort of a combination of security and and c herdy as part of code review as well. Right? I mean, think this is like, doing those checks, I think, is important. Yeah.
01:28:29 · Mihail Eric, Shawn Wang, S2
[01:28:29] S1: Yeah. And that's it. Think we're do top of mitigations and and like the... And there's sort of a combination of security and and c herdy as part of code review as well. Right? I mean, think this is like, doing those checks, I think, is important. Yeah. [01:28:38] S0: So so I think maybe I would say one more thing here or or just check your... Check-in... Check my intuition on on this thing Yeah. Is that not all parts of the code base are created equal. The parts of the code base where security is very important is data storage [01:28:54] S1: Mhmm. Yep. [01:28:55] S0: And billing. So let's call it that data billing [01:28:59] S1: auth, [01:29:00] S0: and auth is obviously related to all those things. And those are basically don't Vibe code, and then everything else go go nuts. [01:29:08] S1: Yeah. Right? I think that's absolutely right. [01:29:09] S0: That's absolutely right. And and it's really funny how, like, okay. Well, if you don't know what the difference between auth n and auth z is, please learn it. [01:29:17] S2: Mhmm. [01:29:17] S0: And then, you know, if you if you don't know... If you have never looked at AWS IAM which you have, please learn it. Like, this... Like, these are basic, like, conceptual things to understand that you can prompt for. You know, once you have the language, you can prompt for it. If you don't have the language, you're fucked.
01:29:17 · Shawn Wang, Mihail Eric, S2
[01:29:17] S0: And then, you know, if you if you don't know... If you have never looked at AWS IAM which you have, please learn it. Like, this... Like, these are basic, like, conceptual things to understand that you can prompt for. You know, once you have the language, you can prompt for it. If you don't have the language, you're fucked. [01:29:32] S1: Totally. Totally. Yeah. Yeah. To an extent, I would even extend that to, like, just general, like, certain certain, like, cloud platform of things. Right? Mean, was the... Forget which company got... Had that huge incident where, like, it was just like a DNS issue that brought down... Was it? Do you remember this? Was it... DNS [01:29:46] S0: issues? Yeah. [01:29:49] S1: Know. I know. Was, like, a particularly prominent one. Was it... [01:29:52] S2: There have also been many prominent DNS issues. [01:29:58] S0: List them off. It's always DNS. It's always DNS. Yeah. So DNS is more of like a reliability uptime. [01:30:03] S1: Sure. [01:30:03] S0: Sure. You know, security, I think people are like, oh, yeah. Did you lose money? Did you leak customer information? [01:30:08] S1: Yeah. Yeah. Yeah. Yeah. Yeah. That... I would... Yeah. Probably put that above that for sure. Only DNS because of uptime. Yeah. General uptime. Yeah. SLAs and stuff. [01:30:15] S0: Background agents. Now you got your buddy from Qualify here. But, mean, your guests aren't necessarily correlated with that week. Right?