WEBVTT

1
00:00:01.715 --> 00:00:03.645
<00:00:01.715>Welcome <00:00:01.995>to <00:00:02.275>another <00:00:02.554>Coffee <00:00:02.835>with <00:00:03.115>Developers.

2
00:00:03.665 --> 00:00:05.525
<00:00:03.665>And <00:00:03.865>now <00:00:04.065>we've <00:00:04.265>got <00:00:04.465>two <00:00:04.665>developers <00:00:04.865>for <00:00:05.064>you

3
00:00:05.525 --> 00:00:08.245
<00:00:05.525>that <00:00:05.665>are <00:00:05.805>gonna <00:00:05.945>be <00:00:06.085>at <00:00:06.225>our <00:00:06.365>Congress <00:00:06.505>in <00:00:06.645>July <00:00:06.785>in <00:00:06.925>Berlin.

4
00:00:09.105 --> 00:00:11.005
<00:00:09.105>And <00:00:09.338>I'm <00:00:09.571>gonna <00:00:09.805>mangle <00:00:10.038>their <00:00:10.271>names <00:00:10.505>now.

5
00:00:11.005 --> 00:00:13.925
<00:00:11.005>It's <00:00:11.355>Bofski <00:00:11.705>and <00:00:12.055>Koslow <00:00:12.405>Stefanski,

6
00:00:14.105 --> 00:00:16.845
<00:00:14.105>and <00:00:14.260>they're <00:00:14.416>both <00:00:14.571>actually <00:00:14.727>giving <00:00:14.882>a <00:00:15.038>workshop <00:00:15.193>at <00:00:15.349>our <00:00:15.505>Congress

7
00:00:17.065 --> 00:00:19.525
<00:00:17.065>and <00:00:17.240>wanna <00:00:17.415>talk <00:00:17.590>about <00:00:17.765>today <00:00:17.940>what <00:00:18.115>they're <00:00:18.290>gonna <00:00:18.465>cover.

8
00:00:19.985 --> 00:00:22.325
<00:00:19.985>So <00:00:20.265>let's <00:00:20.544>start <00:00:20.825>with <00:00:21.105>boar. <00:00:21.384>Hello.

9
00:00:22.325 --> 00:00:25.045
<00:00:22.325>And <00:00:22.500>then <00:00:22.675>Microsoft. <00:00:22.849>How <00:00:23.025>about, <00:00:23.200>how <00:00:23.375>are <00:00:23.550>you <00:00:23.724>doing?

10
00:00:25.595 --> 00:00:27.205
<00:00:25.595>It's <00:00:25.945>sunny <00:00:26.294>here <00:00:26.645>in <00:00:26.994>Macedonia,

11
00:00:27.305 --> 00:00:29.365
<00:00:27.305>so <00:00:27.538>I <00:00:27.771>guess <00:00:28.005>it's <00:00:28.238>great. <00:00:28.471>Yeah. <00:00:28.705>Cool.

12
00:00:29.425 --> 00:00:31.885
<00:00:29.425>So, <00:00:29.625>uh, <00:00:29.825>why <00:00:30.025>don't <00:00:30.225>you <00:00:30.425>start <00:00:30.625>introducing <00:00:30.825>yourself.

13
00:00:32.145 --> 00:00:33.365
<00:00:32.145>Who <00:00:32.301>are <00:00:32.458>you <00:00:32.615>and <00:00:32.772>what <00:00:32.929>do <00:00:33.086>you <00:00:33.243>do?

14
00:00:33.675 --> 00:00:35.245
<00:00:33.675>Boar, <00:00:33.955>why <00:00:34.235>don't <00:00:34.515>you <00:00:34.794>start, <00:00:35.074>Chris,

15
00:00:35.245 --> 00:00:36.245
<00:00:35.245>Thanks <00:00:35.470>for <00:00:35.695>having <00:00:35.919>us <00:00:36.144>first.

16
00:00:36.545 --> 00:00:37.845
<00:00:36.545>Uh, <00:00:36.837>my <00:00:37.130>name <00:00:37.422>is <00:00:37.714>Boar.

17
00:00:38.485 --> 00:00:40.205
<00:00:38.485>I <00:00:38.685>am <00:00:38.885>a <00:00:39.085>CISO <00:00:39.285>at <00:00:39.485>Blue <00:00:39.685>and <00:00:39.885>Source

18
00:00:40.465 --> 00:00:41.965
<00:00:40.465>and <00:00:40.802>founder <00:00:41.140>of <00:00:41.477>Beyond <00:00:41.815>Machines.

19
00:00:42.505 --> 00:00:46.005
<00:00:42.505>Uh, <00:00:42.680>my, <00:00:42.855>let's <00:00:43.030>say <00:00:43.205>background <00:00:43.380>started <00:00:43.555>in <00:00:43.730>engineering <00:00:43.905>many,

20
00:00:46.005 --> 00:00:47.245
<00:00:46.005>many <00:00:46.563>years <00:00:47.120>ago,

21
00:00:47.465 --> 00:00:51.285
<00:00:47.465>but <00:00:47.620>for <00:00:47.776>the <00:00:47.931>past <00:00:48.087>15 <00:00:48.242>years <00:00:48.398>I've <00:00:48.553>been <00:00:48.709>losing <00:00:48.865>sleep.

22
00:00:51.385 --> 00:00:53.085
<00:00:51.385>So <00:00:51.665>other <00:00:51.945>people <00:00:52.224>lose <00:00:52.504>less <00:00:52.785>sleep.

23
00:00:53.865 --> 00:00:56.205
<00:00:53.865>Uh, <00:00:54.040>I <00:00:54.215>guess <00:00:54.390>that's <00:00:54.565>the <00:00:54.740>role <00:00:54.915>of, <00:00:55.090>of <00:00:55.265>security

24
00:00:56.785 --> 00:01:00.885
<00:00:56.785>and, <00:00:56.925>uh, <00:00:57.065>in <00:00:57.205>a <00:00:57.345>lot <00:00:57.485>of <00:00:57.625>these, <00:00:57.764>uh, <00:00:57.904>lost <00:00:58.044>sleeps, <00:00:58.184>uh,

25
00:01:01.285 --> 00:01:02.485
<00:01:01.285>I <00:01:01.824>am <00:01:02.365>working

26
00:01:02.745 --> 00:01:05.365
<00:01:02.745>or <00:01:02.978>struggling <00:01:03.211>with <00:01:03.445>what <00:01:03.678>the <00:01:03.911>product <00:01:04.144>does,

27
00:01:05.475 --> 00:01:08.485
<00:01:05.474>what <00:01:05.630>the <00:01:05.786>code <00:01:05.941>does, <00:01:06.097>and <00:01:06.252>how <00:01:06.408>it <00:01:06.563>can <00:01:06.719>be <00:01:06.875>compromised.

28
00:01:09.225 --> 00:01:11.045
<00:01:09.225>And <00:01:09.399>in <00:01:09.574>the <00:01:09.750>past, <00:01:09.925>uh, <00:01:10.100>let's <00:01:10.274>say <00:01:10.449>five <00:01:10.625>years,

29
00:01:11.045 --> 00:01:13.725
<00:01:11.045>we've <00:01:11.245>been <00:01:11.445>working <00:01:11.645>intensely <00:01:11.845>with, <00:01:12.045>uh, <00:01:12.245>with <00:01:12.445>Veco,

30
00:01:14.655 --> 00:01:17.165
<00:01:14.655>right <00:01:14.855>across <00:01:15.055>each <00:01:15.255>other <00:01:15.455>is <00:01:15.655>head <00:01:15.855>of <00:01:16.055>development

31
00:01:17.745 --> 00:01:18.805
<00:01:17.745>to <00:01:18.063>make <00:01:18.381>things <00:01:18.699>better

32
00:01:19.305 --> 00:01:22.645
<00:01:19.305>and <00:01:19.460>to <00:01:19.616>have <00:01:19.771>a <00:01:19.927>good <00:01:20.082>conversation <00:01:20.238>on <00:01:20.393>what <00:01:20.549>things <00:01:20.705>are.

33
00:01:22.645 --> 00:01:24.645
<00:01:22.645>Because <00:01:22.925>coming <00:01:23.205>from <00:01:23.485>the <00:01:23.765>security <00:01:24.045>side,

34
00:01:24.665 --> 00:01:26.885
<00:01:24.664>the <00:01:24.839>default <00:01:25.014>answer <00:01:25.190>is, <00:01:25.365>no, <00:01:25.539>you <00:01:25.714>can't <00:01:25.889>do <00:01:26.065>this.

35
00:01:27.265 --> 00:01:29.645
<00:01:27.265>And <00:01:27.465>then <00:01:27.665>it <00:01:27.865>doesn't <00:01:28.065>work <00:01:28.265>like <00:01:28.465>that <00:01:28.665>ever.

36
00:01:30.145 --> 00:01:32.805
<00:01:30.145>So <00:01:30.345>it's <00:01:30.545>better <00:01:30.744>to <00:01:30.945>have <00:01:31.145>the <00:01:31.345>conversation <00:01:31.545>of

37
00:01:33.305 --> 00:01:34.685
<00:01:33.305>how <00:01:33.553>do <00:01:33.801>we <00:01:34.050>make <00:01:34.298>this <00:01:34.547>better?

38
00:01:35.105 --> 00:01:37.965
<00:01:35.104>And <00:01:35.244>one <00:01:35.384>other <00:01:35.524>item <00:01:35.664>that <00:01:35.804>I <00:01:35.945>would <00:01:36.085>like <00:01:36.225>to <00:01:36.365>raise <00:01:36.505>here

39
00:01:38.145 --> 00:01:40.405
<00:01:38.145>for <00:01:38.320>the <00:01:38.495>developers <00:01:38.670>that <00:01:38.845>are <00:01:39.020>going <00:01:39.195>to <00:01:39.370>listen <00:01:39.545>is

40
00:01:40.405 --> 00:01:42.645
<00:01:40.405>that <00:01:40.605>people <00:01:40.805>sitting <00:01:41.005>on <00:01:41.205>my <00:01:41.405>side <00:01:41.605>of <00:01:41.805>the,

41
00:01:42.745 --> 00:01:44.645
<00:01:42.745>of <00:01:43.095>the <00:01:43.445>table <00:01:43.795>always <00:01:44.145>assume

42
00:01:44.675 --> 00:01:47.325
<00:01:44.675>that <00:01:44.955>everybody <00:01:45.235>knows <00:01:45.515>about <00:01:45.795>all <00:01:46.075>the

43
00:01:47.525 --> 00:01:48.605
<00:01:47.525>security <00:01:47.768>controls <00:01:48.011>that <00:01:48.253>they <00:01:48.496>should.

44
00:01:49.765 --> 00:01:53.045
<00:01:49.765>I <00:01:49.905>guess <00:01:50.045>they <00:01:50.185>should, <00:01:50.325>but <00:01:50.465>the <00:01:50.605>reality <00:01:50.745>is <00:01:50.885>that <00:01:51.025>they <00:01:51.165>don't,

45
00:01:53.315 --> 00:01:55.125
<00:01:53.315>this <00:01:53.548>is <00:01:53.781>not <00:01:54.015>an <00:01:54.248>insult <00:01:54.481>towards <00:01:54.715>anyone,

46
00:01:55.185 --> 00:01:57.205
<00:01:55.185>but <00:01:55.418>it <00:01:55.651>is <00:01:55.885>sort <00:01:56.118>of <00:01:56.351>the <00:01:56.585>reality.

47
00:01:57.865 --> 00:02:00.485
<00:01:57.865>So <00:01:58.065>it <00:01:58.265>is <00:01:58.465>a <00:01:58.665>lot <00:01:58.865>about <00:01:59.065>reminding <00:01:59.265>people

48
00:02:00.585 --> 00:02:03.565
<00:02:00.585>and <00:02:00.759>showing <00:02:00.934>people, <00:02:01.110>even <00:02:01.285>senior <00:02:01.460>people <00:02:01.634>that <00:02:01.809>just <00:02:01.985>assume

49
00:02:03.565 --> 00:02:06.125
<00:02:03.565>that <00:02:03.720>they <00:02:03.876>know <00:02:04.031>there <00:02:04.187>are <00:02:04.342>things <00:02:04.498>that <00:02:04.653>can <00:02:04.809>slip <00:02:04.965>up.

50
00:02:06.425 --> 00:02:10.285
<00:02:06.425>And <00:02:06.552>in <00:02:06.679>this <00:02:06.806>exercise <00:02:06.934>that <00:02:07.061>we're <00:02:07.188>going <00:02:07.315>to <00:02:07.443>go <00:02:07.570>through, <00:02:07.697>I <00:02:07.825>think

51
00:02:10.285 --> 00:02:12.365
<00:02:10.285>that <00:02:10.440>we're <00:02:10.596>going <00:02:10.751>to <00:02:10.907>show <00:02:11.062>people <00:02:11.218>a <00:02:11.373>lot <00:02:11.529>of <00:02:11.685>things

52
00:02:12.365 --> 00:02:13.685
<00:02:12.365>that <00:02:12.662>are <00:02:12.959>seem <00:02:13.256>tri <00:02:13.553>reveal,

53
00:02:14.185 --> 00:02:17.045
<00:02:14.185>but <00:02:14.385>both <00:02:14.585>of <00:02:14.785>us <00:02:14.985>have <00:02:15.185>literally <00:02:15.385>seen <00:02:15.585>time

54
00:02:17.105 --> 00:02:20.925
<00:02:17.105>and <00:02:17.304>again, <00:02:17.505>on <00:02:17.704>live <00:02:17.905>products <00:02:18.105>just <00:02:18.304>as <00:02:18.505>trivial

55
00:02:21.025 --> 00:02:22.045
<00:02:21.025>as <00:02:21.208>we're <00:02:21.392>going <00:02:21.575>to <00:02:21.759>show <00:02:21.943>them.

56
00:02:22.515 --> 00:02:26.045
<00:02:22.515>Yeah. <00:02:22.670>Mm-hmm. <00:02:22.826>So <00:02:22.981>Ko <00:02:23.137>what, <00:02:23.292>what, <00:02:23.448>what <00:02:23.603>are <00:02:23.759>you <00:02:23.915>going

57
00:02:26.045 --> 00:02:27.405
<00:02:26.045>to <00:02:26.289>be <00:02:26.534>presenting <00:02:26.779>at <00:02:27.024>the <00:02:27.269>Congress?

58
00:02:27.475 --> 00:02:29.365
<00:02:27.475>It's <00:02:27.708>a <00:02:27.941>workshop, <00:02:28.174>uh, <00:02:28.408>and <00:02:28.641>I <00:02:28.875>guess,

59
00:02:29.825 --> 00:02:30.725
<00:02:29.825>and, <00:02:30.027>uh, <00:02:30.230>what, <00:02:30.432>what <00:02:30.635>are,

60
00:02:30.725 --> 00:02:31.765
<00:02:30.725>what, <00:02:30.881>what <00:02:31.036>are <00:02:31.192>you <00:02:31.349>gonna <00:02:31.505>go <00:02:31.661>through?

61
00:02:31.795 --> 00:02:33.205
<00:02:31.795>What <00:02:32.048>will <00:02:32.302>people <00:02:32.556>learn <00:02:32.810>from <00:02:33.064>it?

62
00:02:33.585 --> 00:02:36.005
<00:02:33.585>Uh, <00:02:33.865>what's <00:02:34.145>special <00:02:34.425>about <00:02:34.705>this <00:02:34.985>workshop,

63
00:02:36.005 --> 00:02:38.285
<00:02:36.005>because <00:02:36.204>as <00:02:36.405>Bo <00:02:36.605>mentioned, <00:02:36.805>there <00:02:37.005>are <00:02:37.204>a <00:02:37.405>lot

64
00:02:38.285 --> 00:02:39.725
<00:02:38.285>of <00:02:38.716>great <00:02:39.149>security <00:02:39.581>people

65
00:02:39.785 --> 00:02:41.925
<00:02:39.785>and <00:02:39.984>there <00:02:40.185>are <00:02:40.385>a <00:02:40.585>lot <00:02:40.785>of <00:02:40.984>great <00:02:41.185>developers,

66
00:02:42.465 --> 00:02:45.565
<00:02:42.465>but, <00:02:42.640>uh, <00:02:42.815>they <00:02:42.990>don't <00:02:43.165>come <00:02:43.340>into <00:02:43.515>contact <00:02:43.690>as <00:02:43.865>often.

67
00:02:45.775 --> 00:02:47.965
<00:02:45.775>We've <00:02:46.125>presented <00:02:46.475>similar <00:02:46.825>workshop <00:02:47.175>elsewhere.

68
00:02:48.105 --> 00:02:50.085
<00:02:48.105>And <00:02:48.304>for <00:02:48.505>example, <00:02:48.704>we <00:02:48.905>had <00:02:49.105>a <00:02:49.304>large <00:02:49.505>company

69
00:02:50.225 --> 00:02:53.205
<00:02:50.225>and <00:02:50.458>enterprise <00:02:50.691>where <00:02:50.924>people <00:02:51.158>from <00:02:51.391>the <00:02:51.625>security

70
00:02:53.225 --> 00:02:55.445
<00:02:53.225>and <00:02:53.458>people <00:02:53.691>from <00:02:53.924>the <00:02:54.158>development <00:02:54.391>world <00:02:54.625>basically

71
00:02:55.625 --> 00:02:57.005
<00:02:55.625>met <00:02:56.039>at <00:02:56.453>our <00:02:56.867>workshop.

72
00:02:57.825 --> 00:03:02.085
<00:02:57.825>So, <00:02:58.024>Bo <00:02:58.225>mentioned <00:02:58.424>is <00:02:58.625>a <00:02:58.825>very <00:02:59.024>senior <00:02:59.225>security

73
00:03:02.865 --> 00:03:05.245
<00:03:02.865>guy, <00:03:03.145>and <00:03:03.425>I <00:03:03.705>am <00:03:03.985>a <00:03:04.265>developer.

74
00:03:05.765 --> 00:03:07.205
<00:03:05.765>I <00:03:06.024>am <00:03:06.283>not <00:03:06.542>a <00:03:06.801>security <00:03:07.061>guy.

75
00:03:07.505 --> 00:03:11.005
<00:03:07.505>My <00:03:07.632>job <00:03:07.759>is <00:03:07.886>to <00:03:08.014>actually <00:03:08.141>get <00:03:08.268>the <00:03:08.395>code <00:03:08.523>running, <00:03:08.650>to <00:03:08.777>ship <00:03:08.905>it,

76
00:03:11.005 --> 00:03:14.005
<00:03:11.005>to <00:03:11.160>deploy <00:03:11.316>it, <00:03:11.471>to <00:03:11.627>have <00:03:11.782>it, <00:03:11.938>uh, <00:03:12.093>the <00:03:12.249>customers <00:03:12.405>happy.

77
00:03:14.505 --> 00:03:16.685
<00:03:14.505>So <00:03:14.785>I'm <00:03:15.065>coming <00:03:15.345>to <00:03:15.625>the <00:03:15.905>problem

78
00:03:17.505 --> 00:03:20.325
<00:03:17.505>of <00:03:17.704>securing <00:03:17.905>the <00:03:18.105>whole <00:03:18.305>system <00:03:18.505>from <00:03:18.704>that <00:03:18.905>side.

79
00:03:20.665 --> 00:03:25.485
<00:03:20.665>So <00:03:20.804>what <00:03:20.945>we <00:03:21.084>will <00:03:21.225>show, <00:03:21.364>we <00:03:21.505>will <00:03:21.644>show <00:03:21.785>some <00:03:21.924>specific <00:03:22.065>attacks

80
00:03:25.635 --> 00:03:28.245
<00:03:25.635>that <00:03:25.868>happen <00:03:26.101>again <00:03:26.334>and <00:03:26.568>again <00:03:26.801>and <00:03:27.035>again.

81
00:03:28.345 --> 00:03:33.285
<00:03:28.345>And <00:03:28.500>this <00:03:28.656>workshop <00:03:28.811>kind <00:03:28.967>of <00:03:29.122>focuses <00:03:29.278>on <00:03:29.433>injection <00:03:29.589>level <00:03:29.745>attacks

82
00:03:33.705 --> 00:03:37.845
<00:03:33.704>of <00:03:33.880>why <00:03:34.054>there <00:03:34.230>is <00:03:34.404>injection, <00:03:34.579>what <00:03:34.755>the <00:03:34.929>problem <00:03:35.105>is

83
00:03:37.845 --> 00:03:41.325
<00:03:37.845>with <00:03:38.000>the <00:03:38.156>injection, <00:03:38.311>how <00:03:38.467>we <00:03:38.622>should <00:03:38.778>think <00:03:38.933>about <00:03:39.089>injection <00:03:39.245>so

84
00:03:41.325 --> 00:03:44.645
<00:03:41.325>that <00:03:41.480>we <00:03:41.636>get <00:03:41.791>it <00:03:41.947>in <00:03:42.102>a <00:03:42.258>situation <00:03:42.413>when <00:03:42.569>it <00:03:42.725>is

85
00:03:45.145 --> 00:03:46.845
<00:03:45.145>not <00:03:45.495>as <00:03:45.845>easy <00:03:46.195>to <00:03:46.545>do.

86
00:03:47.425 --> 00:03:49.405
<00:03:47.425>So <00:03:47.600>what, <00:03:47.775>what, <00:03:47.950>I <00:03:48.125>mean <00:03:48.300>in <00:03:48.475>terms <00:03:48.650>of <00:03:48.825>injections,

87
00:03:49.545 --> 00:03:52.485
<00:03:49.545>of <00:03:49.661>course <00:03:49.778>we <00:03:49.895>know <00:03:50.011>XSS, <00:03:50.128>we <00:03:50.245>know <00:03:50.361>like <00:03:50.478>CSRF, <00:03:50.595>we <00:03:50.711>do <00:03:50.828>all <00:03:50.945>the,

88
00:03:52.665 --> 00:03:53.965
<00:03:52.665>the <00:03:52.832>things <00:03:52.999>that <00:03:53.166>we <00:03:53.333>had <00:03:53.500>in <00:03:53.667>the <00:03:53.835>past.

89
00:03:54.155 --> 00:03:56.365
<00:03:54.155>Like <00:03:54.435>what <00:03:54.715>are <00:03:54.995>new <00:03:55.275>injection <00:03:55.555>formats

90
00:03:56.365 --> 00:03:57.685
<00:03:56.365>that <00:03:56.602>people <00:03:56.840>should <00:03:57.077>be <00:03:57.315>aware <00:03:57.553>of

91
00:03:57.685 --> 00:04:00.045
<00:03:57.685>that <00:03:57.840>you're <00:03:57.996>gonna <00:03:58.151>cover <00:03:58.307>in <00:03:58.462>the <00:03:58.618>workshop <00:03:58.773>that <00:03:58.929>people <00:03:59.085>are,

92
00:04:00.225 --> 00:04:01.965
<00:04:00.225>may <00:04:00.458>not <00:04:00.691>be <00:04:00.924>aware <00:04:01.158>of <00:04:01.391>yet? <00:04:01.625>Yeah,

93
00:04:02.175 --> 00:04:05.685
<00:04:02.175>We're <00:04:02.375>starting <00:04:02.575>with <00:04:02.775>the, <00:04:02.975>basically <00:04:03.175>with <00:04:03.375>the <00:04:03.575>classics.

94
00:04:06.585 --> 00:04:09.285
<00:04:06.585>So <00:04:06.740>SQL <00:04:06.896>injection <00:04:07.051>is <00:04:07.207>still <00:04:07.362>a <00:04:07.518>problem <00:04:07.673>in <00:04:07.829>the <00:04:07.985>wild.

95
00:04:10.235 --> 00:04:13.005
<00:04:10.235>Success <00:04:10.410>is <00:04:10.585>definitely <00:04:10.760>still <00:04:10.935>a <00:04:11.110>problem <00:04:11.285>in <00:04:11.460>the <00:04:11.635>wild.

96
00:04:13.315 --> 00:04:14.405
<00:04:13.315>They're <00:04:14.296>solvable,

97
00:04:15.185 --> 00:04:18.845
<00:04:15.185>but, <00:04:15.340>uh, <00:04:15.496>it's <00:04:15.651>not <00:04:15.807>only <00:04:15.962>a <00:04:16.118>solution <00:04:16.273>problem, <00:04:16.429>it's <00:04:16.584>kind

98
00:04:18.845 --> 00:04:20.085
<00:04:18.845>of <00:04:19.216>a <00:04:19.589>mindset <00:04:19.961>issue.

99
00:04:20.435 --> 00:04:24.365
<00:04:20.435>Once <00:04:20.668>people <00:04:20.901>understand <00:04:21.135>how <00:04:21.368>this <00:04:21.601>thing <00:04:21.834>happen,

100
00:04:24.595 --> 00:04:29.125
<00:04:24.595>when <00:04:24.750>this <00:04:24.906>thing <00:04:25.061>happens, <00:04:25.217>why, <00:04:25.372>uh, <00:04:25.528>just <00:04:25.683>having <00:04:25.839>one <00:04:25.995>layer

101
00:04:29.305 --> 00:04:33.965
<00:04:29.305>of <00:04:29.480>protection <00:04:29.655>is <00:04:29.830>not, <00:04:30.005>uh, <00:04:30.180>i <00:04:30.355>is <00:04:30.530>not <00:04:30.705>magic.

102
00:04:34.515 --> 00:04:38.285
<00:04:34.515>Yeah. <00:04:34.690>A <00:04:34.865>lot <00:04:35.039>of <00:04:35.215>developers <00:04:35.390>specifically <00:04:35.565>think <00:04:35.740>that, <00:04:35.914>uh,

103
00:04:38.595 --> 00:04:40.445
<00:04:38.595>once <00:04:38.945>I <00:04:39.295>use, <00:04:39.645>uh, <00:04:39.995>ORM,

104
00:04:40.745 --> 00:04:43.165
<00:04:40.745>I'm <00:04:41.025>magically <00:04:41.305>protected <00:04:41.585>from <00:04:41.865>SQL <00:04:42.145>injection.

105
00:04:43.665 --> 00:04:45.005
<00:04:43.665>That's <00:04:43.966>not <00:04:44.268>always <00:04:44.569>the <00:04:44.871>case.

106
00:04:46.305 --> 00:04:49.725
<00:04:46.305>And <00:04:46.480>we <00:04:46.655>also <00:04:46.830>going <00:04:47.005>to <00:04:47.180>go <00:04:47.355>through <00:04:47.530>template <00:04:47.705>injection,

107
00:04:50.535 --> 00:04:54.725
<00:04:50.534>which <00:04:50.734>is <00:04:50.934>a <00:04:51.135>perennial <00:04:51.335>favorite, <00:04:51.534>uh, <00:04:51.734>command <00:04:51.934>injection.

108
00:04:55.835 --> 00:04:58.005
<00:04:55.835>Basically <00:04:57.234>each

109
00:04:58.005 --> 00:05:02.725
<00:04:58.005>and <00:04:58.160>every <00:04:58.316>time <00:04:58.471>where <00:04:58.627>there <00:04:58.782>is <00:04:58.938>a <00:04:59.093>context, <00:04:59.249>uh, <00:04:59.405>boundary

110
00:05:03.345 --> 00:05:04.805
<00:05:03.345>within, <00:05:03.783>uh, <00:05:04.221>the <00:05:04.659>application.

111
00:05:04.805 --> 00:05:07.085
<00:05:04.805>Because <00:05:05.085>basically <00:05:05.365>you <00:05:05.645>can <00:05:05.925>have <00:05:06.205>injection

112
00:05:07.485 --> 00:05:11.205
<00:05:07.485>whenever <00:05:07.765>you <00:05:08.045>have <00:05:08.325>some, <00:05:08.605>uh, <00:05:08.885>way

113
00:05:11.225 --> 00:05:13.325
<00:05:11.225>to <00:05:11.458>enable <00:05:11.691>data <00:05:11.925>being <00:05:12.158>treated <00:05:12.391>as <00:05:12.625>code.

114
00:05:14.025 --> 00:05:17.485
<00:05:14.025>And <00:05:14.164>of <00:05:14.304>course, <00:05:14.445>we're <00:05:14.585>going <00:05:14.724>to <00:05:14.864>go <00:05:15.005>with <00:05:15.145>the <00:05:15.284>brand <00:05:15.424>new.

115
00:05:17.585 --> 00:05:21.005
<00:05:17.585>We <00:05:17.818>have <00:05:18.051>prompt <00:05:18.284>injection, <00:05:18.518>we <00:05:18.751>have <00:05:18.984>AI

116
00:05:21.195 --> 00:05:22.925
<00:05:21.195>that <00:05:21.545>actually <00:05:21.895>makes <00:05:22.245>things <00:05:22.594>worse.

117
00:05:23.475 --> 00:05:27.325
<00:05:23.475>Yeah. <00:05:23.615>And <00:05:23.755>on <00:05:23.895>top <00:05:24.035>of <00:05:24.175>that, <00:05:24.315>the <00:05:24.455>two, <00:05:24.595>let's <00:05:24.735>say, <00:05:24.875>uh,

118
00:05:27.685 --> 00:05:31.205
<00:05:27.685>favorites <00:05:27.918>of <00:05:28.151>mine, <00:05:28.385>uh, <00:05:28.618>one <00:05:28.851>is <00:05:29.085>SSRF,

119
00:05:32.175 --> 00:05:35.205
<00:05:32.175>which <00:05:32.350>is <00:05:32.525>in <00:05:32.700>this <00:05:32.875>particular, <00:05:33.050>let's <00:05:33.225>say <00:05:33.400>a <00:05:33.575>day

120
00:05:35.205 --> 00:05:37.165
<00:05:35.205>and <00:05:35.555>age, <00:05:35.905>an <00:05:36.255>interesting <00:05:36.604>challenge.

121
00:05:37.685 --> 00:05:40.285
<00:05:37.685>'cause <00:05:37.860>in <00:05:38.035>a, <00:05:38.210>let's <00:05:38.385>say <00:05:38.560>in <00:05:38.735>a <00:05:38.910>monolithic <00:05:39.085>infrastructure,

122
00:05:41.445 --> 00:05:44.445
<00:05:41.445>SSRF <00:05:41.585>may <00:05:41.724>not <00:05:41.865>be <00:05:42.005>that <00:05:42.145>terrible <00:05:42.284>or <00:05:42.425>may <00:05:42.565>not <00:05:42.705>even <00:05:42.844>exist.

123
00:05:44.875 --> 00:05:47.725
<00:05:44.875>However, <00:05:45.155>in <00:05:45.435>a <00:05:45.715>microservice <00:05:45.995>uh, <00:05:46.275>infrastructure,

124
00:05:47.725 --> 00:05:49.645
<00:05:47.725>especially <00:05:48.075>in <00:05:48.425>a <00:05:48.775>cloud-based <00:05:49.125>deployment,

125
00:05:50.325 --> 00:05:54.365
<00:05:50.325>SSRF <00:05:50.480>can <00:05:50.636>allow <00:05:50.791>an <00:05:50.947>attacker <00:05:51.102>to <00:05:51.258>reach <00:05:51.413>the <00:05:51.569>metadata <00:05:51.724>server.

126
00:05:54.945 --> 00:05:58.045
<00:05:54.945>And <00:05:55.120>every <00:05:55.295>single <00:05:55.469>cloud <00:05:55.645>provider <00:05:55.820>has <00:05:55.995>the <00:05:56.170>same <00:05:56.344>metadata

127
00:05:58.045 --> 00:06:02.925
<00:05:58.045>server, <00:05:58.278>uh, <00:05:58.511>architecture <00:05:58.745>IP <00:05:58.978>address, <00:05:59.211>and <00:05:59.445>more

128
00:06:02.925 --> 00:06:05.485
<00:06:02.925>or <00:06:03.080>less <00:06:03.236>a <00:06:03.391>similar <00:06:03.547>way <00:06:03.702>to <00:06:03.858>extract <00:06:04.013>data <00:06:04.169>from <00:06:04.325>it.

129
00:06:05.555 --> 00:06:07.565
<00:06:05.555>Once <00:06:05.905>you <00:06:06.255>achieve <00:06:06.605>an <00:06:06.955>SSRF.

130
00:06:07.745 --> 00:06:11.325
<00:06:07.745>And <00:06:07.920>SSRF <00:06:08.095>is <00:06:08.270>really, <00:06:08.445>really <00:06:08.620>not <00:06:08.795>that <00:06:08.970>difficult <00:06:09.145>to,

131
00:06:11.705 --> 00:06:14.005
<00:06:11.705>to <00:06:11.984>achieve <00:06:12.265>in <00:06:12.544>many <00:06:12.825>different <00:06:13.104>places.

132
00:06:14.545 --> 00:06:19.405
<00:06:14.545>Things <00:06:14.745>are <00:06:14.945>unfiltered <00:06:15.145>in <00:06:15.345>headers <00:06:15.545>in <00:06:15.745>URL <00:06:15.945>paths,

133
00:06:19.625 --> 00:06:23.845
<00:06:19.625>in <00:06:19.780>various <00:06:19.936>things <00:06:20.091>where <00:06:20.247>just <00:06:20.402>people <00:06:20.558>ignore <00:06:20.713>them, <00:06:20.869>okay, <00:06:21.025>fine,

134
00:06:23.895 --> 00:06:27.645
<00:06:23.895>enter <00:06:24.011>a <00:06:24.128>URL <00:06:24.245>here, <00:06:24.361>I <00:06:24.478>can <00:06:24.594>enter <00:06:24.711>A <00:06:24.828>URL <00:06:24.945>that <00:06:25.061>points <00:06:25.178>to <00:06:25.294>your,

135
00:06:28.225 --> 00:06:29.565
<00:06:28.225>uh, <00:06:28.526>to <00:06:28.828>your <00:06:29.129>metadata <00:06:29.431>server.

136
00:06:30.085 --> 00:06:31.725
<00:06:30.085>Suddenly <00:06:30.364>SSRF <00:06:30.645>is <00:06:30.924>a <00:06:31.205>real <00:06:31.484>problem.

137
00:06:32.185 --> 00:06:35.485
<00:06:32.185>That's <00:06:32.385>one <00:06:32.585>item <00:06:32.785>that <00:06:32.985>people <00:06:33.185>tend <00:06:33.385>to <00:06:33.585>forget.

138
00:06:35.545 --> 00:06:38.765
<00:06:35.545>And <00:06:35.745>another <00:06:35.945>item <00:06:36.145>is, <00:06:36.345>what <00:06:36.545>about <00:06:36.745>the <00:06:36.945>cookies?

139
00:06:38.835 --> 00:06:41.725
<00:06:38.835>What <00:06:38.990>about <00:06:39.146>the <00:06:39.301>tokens? <00:06:39.457>Can <00:06:39.612>we <00:06:39.768>manipulate <00:06:39.923>something <00:06:40.079>in <00:06:40.234>them?

140
00:06:41.725 --> 00:06:44.125
<00:06:41.725>Because <00:06:41.925>at <00:06:42.125>the <00:06:42.325>end <00:06:42.525>of <00:06:42.725>the <00:06:42.925>day, <00:06:43.125>anything

141
00:06:44.355 --> 00:06:46.525
<00:06:44.355>that <00:06:44.588>the <00:06:44.821>user <00:06:45.055>sends <00:06:45.288>from <00:06:45.521>their <00:06:45.755>browser

142
00:06:46.785 --> 00:06:50.685
<00:06:46.784>to <00:06:46.984>the <00:06:47.184>server <00:06:47.385>is <00:06:47.585>injection, <00:06:47.784>including <00:06:47.984>the <00:06:48.184>cookie.

143
00:06:52.025 --> 00:06:54.605
<00:06:52.025>And <00:06:52.164>what <00:06:52.304>we <00:06:52.445>do <00:06:52.585>with <00:06:52.724>the <00:06:52.864>cookie <00:06:53.005>on <00:06:53.145>the <00:06:53.284>client <00:06:53.424>side

144
00:06:55.425 --> 00:06:58.885
<00:06:55.425>may <00:06:55.580>do <00:06:55.736>wonders <00:06:55.891>if <00:06:56.047>the <00:06:56.202>server <00:06:56.358>side <00:06:56.513>does <00:06:56.669>not <00:06:56.825>assume

145
00:06:58.885 --> 00:07:00.285
<00:06:58.885>that <00:06:59.137>I'm <00:06:59.389>evil <00:06:59.641>with <00:06:59.893>the <00:07:00.145>cookie.

146
00:07:00.915 --> 00:07:03.285
<00:07:00.915>Yeah. <00:07:01.055>And <00:07:01.195>you <00:07:01.335>can <00:07:01.475>edit <00:07:01.615>the <00:07:01.755>cookies <00:07:01.895>before <00:07:02.035>you <00:07:02.175>send <00:07:02.315>them.

147
00:07:03.355 --> 00:07:06.005
<00:07:03.355>It's <00:07:03.510>rather <00:07:03.666>easy <00:07:03.821>to, <00:07:03.977>to, <00:07:04.132>to <00:07:04.288>spoof <00:07:04.443>cookies <00:07:04.599>as <00:07:04.755>well.

148
00:07:06.025 --> 00:07:08.325
<00:07:06.025>That's <00:07:06.180>the <00:07:06.336>other <00:07:06.491>thing. <00:07:06.647>'cause <00:07:06.802>they <00:07:06.958>are <00:07:07.113>in <00:07:07.269>plain <00:07:07.424>text

149
00:07:08.325 --> 00:07:10.285
<00:07:08.325>and <00:07:08.604>rather <00:07:08.885>easy <00:07:09.164>to <00:07:09.445>actually <00:07:09.724>edit.

150
00:07:11.155 --> 00:07:12.165
<00:07:11.155>Yeah. <00:07:12.064>Yeah.

151
00:07:12.905 --> 00:07:14.685
<00:07:12.905>And <00:07:13.080>you <00:07:13.255>can <00:07:13.429>do <00:07:13.604>lot <00:07:13.780>of <00:07:13.955>fun <00:07:14.130>stuff, <00:07:14.304>not,

152
00:07:14.705 --> 00:07:16.085
<00:07:14.705>not <00:07:15.119>necessarily <00:07:15.532>hack <00:07:15.947>it,

153
00:07:16.305 --> 00:07:19.125
<00:07:16.305>but <00:07:16.460>sometimes <00:07:16.616>do <00:07:16.771>a <00:07:16.927>denial <00:07:17.082>of <00:07:17.238>service <00:07:17.393>through <00:07:17.549>that. <00:07:17.705>Mm-hmm.

154
00:07:19.265 --> 00:07:21.245
<00:07:19.265>Oh, <00:07:19.465>wow. <00:07:19.664>Like, <00:07:19.865>like <00:07:20.065>a, <00:07:20.265>a <00:07:20.465>cookie <00:07:20.664>rate

155
00:07:21.305 --> 00:07:23.245
<00:07:21.305>or <00:07:21.505>like <00:07:21.705>what, <00:07:21.905>how, <00:07:22.105>how <00:07:22.305>does <00:07:22.505>that <00:07:22.705>work?

156
00:07:23.355 --> 00:07:26.365
<00:07:23.355>Like <00:07:23.495>how <00:07:23.635>do <00:07:23.775>you <00:07:23.915>do <00:07:24.055>a <00:07:24.195>detox <00:07:24.335>with <00:07:24.475>a <00:07:24.615>cookie? <00:07:24.755>Yeah.

157
00:07:26.625 --> 00:07:28.965
<00:07:26.625>Uh, <00:07:27.091>well, <00:07:27.558>one <00:07:28.025>example

158
00:07:29.195 --> 00:07:33.885
<00:07:29.195>that <00:07:29.335>we <00:07:29.474>kinda <00:07:29.615>have <00:07:29.755>is <00:07:29.895>bloating <00:07:30.034>the <00:07:30.175>js <00:07:30.315>O <00:07:30.455>web <00:07:30.594>token.

159
00:07:34.915 --> 00:07:38.565
<00:07:34.915>Okay. <00:07:35.090>And <00:07:35.265>then <00:07:35.440>if <00:07:35.615>de, <00:07:35.790>depending <00:07:35.965>on <00:07:36.140>the <00:07:36.315>server,

160
00:07:38.825 --> 00:07:42.045
<00:07:38.825>if <00:07:38.980>the <00:07:39.136>server <00:07:39.291>spends <00:07:39.447>a <00:07:39.602>lot <00:07:39.758>of <00:07:39.913>time <00:07:40.069>verifying <00:07:40.224>that,

161
00:07:42.095 --> 00:07:45.885
<00:07:42.095>validating <00:07:42.235>that <00:07:42.375>if <00:07:42.515>it <00:07:42.655>doesn't <00:07:42.795>use <00:07:42.935>it, <00:07:43.075>uh, <00:07:43.215>we've <00:07:43.355>seen <00:07:43.495>over

162
00:07:45.905 --> 00:07:49.845
<00:07:45.905>and <00:07:46.044>over <00:07:46.184>again <00:07:46.325>having <00:07:46.465>a <00:07:46.604>state, <00:07:46.744>state <00:07:46.885>as <00:07:47.025>I <00:07:47.164>want <00:07:47.304>to,

163
00:07:50.185 --> 00:07:54.205
<00:07:50.185>as <00:07:50.325>I <00:07:50.465>usually <00:07:50.605>call <00:07:50.745>it, <00:07:50.885>uh, <00:07:51.025>Jason <00:07:51.165>Web <00:07:51.305>token, <00:07:51.445>when, <00:07:51.585>uh,

164
00:07:54.465 --> 00:07:56.965
<00:07:54.465>you <00:07:54.620>are <00:07:54.776>using <00:07:54.931>as <00:07:55.087>an <00:07:55.242>entry <00:07:55.398>point <00:07:55.553>to <00:07:55.709>some <00:07:55.865>kind

165
00:07:56.965 --> 00:07:58.245
<00:07:56.965>of <00:07:57.195>a <00:07:57.425>state <00:07:57.656>on <00:07:57.886>your <00:07:58.117>machine,

166
00:07:58.545 --> 00:08:01.925
<00:07:58.545>you <00:07:58.745>can <00:07:58.945>basically <00:07:59.145>overload <00:07:59.345>the <00:07:59.545>server <00:07:59.745>relatively <00:07:59.945>easily.

167
00:08:02.185 --> 00:08:05.365
<00:08:02.185>Not <00:08:02.385>every <00:08:02.585>time, <00:08:02.785>not <00:08:02.985>for <00:08:03.185>a <00:08:03.385>proper <00:08:03.585>configuration,

168
00:08:05.585 --> 00:08:07.805
<00:08:05.585>but, <00:08:05.784>uh, <00:08:05.984>we've <00:08:06.185>seen <00:08:06.385>it <00:08:06.585>in <00:08:06.784>the <00:08:06.984>wild.

169
00:08:08.395 --> 00:08:10.885
<00:08:08.395>Okay. <00:08:08.550>So <00:08:08.706>you <00:08:08.861>can <00:08:09.017>just, <00:08:09.172>even <00:08:09.328>if <00:08:09.483>you're <00:08:09.639>not <00:08:09.794>authenticated,

170
00:08:11.195 --> 00:08:14.605
<00:08:11.195>even <00:08:11.322>if <00:08:11.449>you, <00:08:11.576>you <00:08:11.704>have <00:08:11.831>no <00:08:11.958>idea <00:08:12.085>what <00:08:12.213>the <00:08:12.340>real <00:08:12.467>credentials <00:08:12.594>are,

171
00:08:14.865 --> 00:08:18.125
<00:08:14.865>you <00:08:15.040>can <00:08:15.215>just <00:08:15.390>construct <00:08:15.565>something <00:08:15.740>that <00:08:15.915>looks <00:08:16.090>like, <00:08:16.265>uh,

172
00:08:18.275 --> 00:08:21.965
<00:08:18.275>like <00:08:18.430>a <00:08:18.586>session <00:08:18.741>cookie, <00:08:18.897>but, <00:08:19.052>uh, <00:08:19.208>generate <00:08:19.363>enough <00:08:19.519>of <00:08:19.674>those

173
00:08:22.025 --> 00:08:25.925
<00:08:22.025>and <00:08:22.180>just <00:08:22.336>send <00:08:22.491>it <00:08:22.647>over <00:08:22.802>whoever <00:08:22.958>the <00:08:23.113>backend <00:08:23.269>system <00:08:23.424>is,

174
00:08:26.155 --> 00:08:27.805
<00:08:26.155>they <00:08:26.434>have <00:08:26.715>to <00:08:26.994>validate <00:08:27.275>the <00:08:27.554>cookie.

175
00:08:27.905 --> 00:08:29.845
<00:08:27.905>The <00:08:28.184>entire <00:08:28.465>exercise <00:08:28.744>has <00:08:29.025>to <00:08:29.304>pass

176
00:08:30.355 --> 00:08:33.245
<00:08:30.355>depending <00:08:30.555>on <00:08:30.755>the <00:08:30.955>architecture <00:08:31.155>of <00:08:31.355>the <00:08:31.555>authentication <00:08:31.755>system,

177
00:08:33.875 --> 00:08:35.885
<00:08:33.875>that <00:08:34.155>may <00:08:34.434>cause <00:08:34.715>the <00:08:34.995>authentication <00:08:35.275>system

178
00:08:36.145 --> 00:08:37.645
<00:08:36.145>to <00:08:36.595>become <00:08:37.044>a <00:08:37.495>bottleneck.

179
00:08:38.585 --> 00:08:41.285
<00:08:38.585>And <00:08:38.740>even <00:08:38.896>if <00:08:39.051>that <00:08:39.207>authentication <00:08:39.362>system <00:08:39.518>is <00:08:39.673>on <00:08:39.829>the <00:08:39.985>backend

180
00:08:41.285 --> 00:08:44.205
<00:08:41.284>connected <00:08:41.518>to <00:08:41.751>some <00:08:41.985>service <00:08:42.218>from <00:08:42.451>the <00:08:42.684>cloud,

181
00:08:44.555 --> 00:08:46.325
<00:08:44.555>like <00:08:45.021>an <00:08:45.488>authentication <00:08:45.954>micro

182
00:08:46.665 --> 00:08:50.565
<00:08:46.665>or <00:08:46.839>service <00:08:47.015>from <00:08:47.189>whatever, <00:08:47.365>Google <00:08:47.540>or <00:08:47.714>Amazon <00:08:47.890>or <00:08:48.064>Azure

183
00:08:50.565 --> 00:08:53.565
<00:08:50.565>or <00:08:50.740>whatever, <00:08:50.915>then <00:08:51.090>you <00:08:51.265>get <00:08:51.440>to <00:08:51.615>the <00:08:51.790>rate <00:08:51.965>limiting.

184
00:08:54.505 --> 00:08:56.965
<00:08:54.505>And <00:08:54.680>lo <00:08:54.855>and <00:08:55.030>behold, <00:08:55.205>I <00:08:55.380>have <00:08:55.555>done <00:08:55.730>nothing <00:08:55.905>terrible.

185
00:08:57.745 --> 00:08:59.285
<00:08:57.745>And <00:08:58.091>your <00:08:58.438>real <00:08:58.784>users <00:08:59.131>complain

186
00:08:59.285 --> 00:09:02.035
<00:08:59.285>because <00:08:59.564>they're <00:08:59.844>being <00:09:00.125>kicked <00:09:00.405>out. <00:09:00.685>Magic.

187
00:09:02.705 --> 00:09:06.795
<00:09:02.705>Yeah. <00:09:02.845>Got <00:09:02.985>like <00:09:03.125>the <00:09:03.265>cloud <00:09:03.405>player <00:09:03.545>down <00:09:03.685>or <00:09:03.825>the <00:09:03.965>ImageX <00:09:04.105>thing.

188
00:09:07.025 --> 00:09:10.235
<00:09:07.025>Yeah. <00:09:07.199>And <00:09:07.375>basically <00:09:07.550>like, <00:09:07.725>yeah, <00:09:07.900>it's, <00:09:08.074>uh, <00:09:08.250>interesting. <00:09:08.425>Yeah.

189
00:09:10.825 --> 00:09:15.355
<00:09:10.825>Yeah. <00:09:11.058>Authentication <00:09:11.291>code <00:09:11.525>is <00:09:11.758>basically <00:09:11.991>run <00:09:12.225>over

190
00:09:15.495 --> 00:09:17.835
<00:09:15.495>and <00:09:15.670>over <00:09:15.845>and <00:09:16.020>over <00:09:16.195>and <00:09:16.370>over <00:09:16.545>again <00:09:16.720>when <00:09:16.895>you,

191
00:09:18.095 --> 00:09:19.875
<00:09:18.095>you <00:09:18.375>basically <00:09:18.655>look <00:09:18.935>at <00:09:19.215>an <00:09:19.495>application

192
00:09:19.895 --> 00:09:22.675
<00:09:19.895>and <00:09:20.069>you <00:09:20.245>have <00:09:20.420>10 <00:09:20.595>different <00:09:20.770>codes <00:09:20.944>to <00:09:21.120>the <00:09:21.295>authentication

193
00:09:22.675 --> 00:09:24.155
<00:09:22.675>and <00:09:23.341>authorization <00:09:24.007>subsystem.

194
00:09:25.455 --> 00:09:27.995
<00:09:25.455>So <00:09:25.655>if <00:09:25.855>you <00:09:26.055>manage <00:09:26.255>to <00:09:26.455>slow <00:09:26.655>that <00:09:26.855>down

195
00:09:28.295 --> 00:09:30.035
<00:09:28.295>or <00:09:28.761>overload <00:09:29.228>that <00:09:29.694>down,

196
00:09:30.095 --> 00:09:33.195
<00:09:30.095>you <00:09:30.295>basically <00:09:30.495>don't <00:09:30.695>have <00:09:30.895>a <00:09:31.095>system, <00:09:31.295>doesn't <00:09:31.495>matter.

197
00:09:33.195 --> 00:09:35.595
<00:09:33.195>Then <00:09:33.428>everything <00:09:33.661>else <00:09:33.895>is <00:09:34.128>working <00:09:34.361>just <00:09:34.595>great.

198
00:09:36.895 --> 00:09:39.535
<00:09:36.895>Hmm. <00:09:37.035>Then <00:09:37.175>you <00:09:37.314>close <00:09:37.454>the <00:09:37.595>door, <00:09:37.735>you <00:09:37.875>lock <00:09:38.015>the <00:09:38.155>door <00:09:38.295>basically.

199
00:09:40.195 --> 00:09:43.255
<00:09:40.195>So <00:09:40.350>how <00:09:40.506>can <00:09:40.661>I <00:09:40.817>think <00:09:40.972>of <00:09:41.128>the <00:09:41.283>workshop <00:09:41.439>being <00:09:41.595>structured?

200
00:09:43.255 --> 00:09:45.055
<00:09:43.255>Like, <00:09:43.535>will <00:09:43.814>people <00:09:44.095>just <00:09:44.375>get, <00:09:44.655>like,

201
00:09:45.075 --> 00:09:47.775
<00:09:45.075>do <00:09:45.230>you <00:09:45.386>have <00:09:45.541>a <00:09:45.697>vulnerable <00:09:45.852>server <00:09:46.008>that <00:09:46.163>people <00:09:46.319>actually <00:09:46.475>go

202
00:09:47.775 --> 00:09:48.935
<00:09:47.775>through <00:09:48.296>and <00:09:48.819>test?

203
00:09:49.115 --> 00:09:52.535
<00:09:49.115>Or <00:09:49.231>do <00:09:49.348>you <00:09:49.465>have <00:09:49.581>demos <00:09:49.698>or, <00:09:49.815>or <00:09:49.931>how <00:09:50.048>is <00:09:50.165>it <00:09:50.281>gonna <00:09:50.398>be <00:09:50.515>built?

204
00:09:52.645 --> 00:09:54.375
<00:09:52.645>Like <00:09:52.845>the, <00:09:53.045>what's <00:09:53.245>the <00:09:53.444>structure <00:09:53.645>of <00:09:53.845>the <00:09:54.045>workshop?

205
00:09:54.435 --> 00:09:57.015
<00:09:54.435>Can <00:09:54.635>we <00:09:54.834>share <00:09:55.035>a <00:09:55.234>screen? <00:09:55.435>Sure. <00:09:55.635>Yeah. <00:09:55.834>Okay.

206
00:09:57.755 --> 00:10:01.735
<00:09:57.755>One <00:09:57.882>issue <00:09:58.009>with, <00:09:58.136>uh, <00:09:58.264>the <00:09:58.391>exercises <00:09:58.518>that <00:09:58.645>we <00:09:58.773>want <00:09:58.900>to <00:09:59.027>do <00:09:59.155>is

207
00:10:01.735 --> 00:10:03.575
<00:10:01.735>that <00:10:02.015>they <00:10:02.295>can <00:10:02.575>be <00:10:02.855>quite <00:10:03.135>destructive.

208
00:10:03.915 --> 00:10:06.535
<00:10:03.915>Mm-hmm. <00:10:04.089>So <00:10:04.265>we <00:10:04.439>don't <00:10:04.615>want <00:10:04.790>to <00:10:04.964>deploy <00:10:05.140>a <00:10:05.314>server,

209
00:10:07.055 --> 00:10:09.175
<00:10:07.055>somebody <00:10:07.405>somewhere <00:10:07.755>that <00:10:08.104>is <00:10:08.454>vulnerable.

210
00:10:09.915 --> 00:10:11.735
<00:10:09.915>And <00:10:10.148>then <00:10:10.381>the <00:10:10.615>first <00:10:10.848>guy <00:10:11.081>that <00:10:11.314>does

211
00:10:11.735 --> 00:10:13.815
<00:10:11.735>that <00:10:12.085>exercise <00:10:12.435>successfully <00:10:12.785>destroys <00:10:13.135>it.

212
00:10:14.165 --> 00:10:17.335
<00:10:14.165>Yeah. <00:10:14.320>So <00:10:14.476>What, <00:10:14.631>so <00:10:14.787>each <00:10:14.942>page <00:10:15.098>get <00:10:15.253>the <00:10:15.409>wrong <00:10:15.564>server

213
00:10:17.445 --> 00:10:19.695
<00:10:17.445>that <00:10:17.645>they <00:10:17.845>can <00:10:18.045>run <00:10:18.245>on <00:10:18.445>the <00:10:18.645>own? <00:10:18.845>Yeah.

214
00:10:20.155 --> 00:10:23.255
<00:10:20.155>And <00:10:20.310>this <00:10:20.466>is <00:10:20.621>what <00:10:20.777>we <00:10:20.932>built, <00:10:21.088>essentially, <00:10:21.243>we <00:10:21.399>built, <00:10:21.555>uh,

215
00:10:23.555 --> 00:10:26.975
<00:10:23.555>an <00:10:23.905>application, <00:10:24.255>obviously <00:10:24.604>vulnerable <00:10:24.954>application.

216
00:10:27.635 --> 00:10:29.935
<00:10:27.635>We <00:10:27.835>call <00:10:28.035>it <00:10:28.235>yield <00:10:28.435>bank <00:10:28.635>because <00:10:28.835>why <00:10:29.035>not?

217
00:10:30.195 --> 00:10:32.815
<00:10:30.195>Uh, <00:10:30.370>beyond <00:10:30.545>Machinist <00:10:30.720>has <00:10:30.895>another <00:10:31.070>platform <00:10:31.245>called <00:10:31.420>Yield <00:10:31.595>cat,

218
00:10:32.815 --> 00:10:34.415
<00:10:32.815>which <00:10:33.281>is <00:10:33.748>intentionally <00:10:34.215>vulnerable,

219
00:10:34.435 --> 00:10:36.655
<00:10:34.435>but <00:10:34.609>I'm <00:10:34.785>going <00:10:34.959>to <00:10:35.135>stop <00:10:35.310>my <00:10:35.484>shameless <00:10:35.660>plug <00:10:35.834>here.

220
00:10:37.195 --> 00:10:41.535
<00:10:37.195>So <00:10:37.395>every <00:10:37.595>uh, <00:10:37.795>attendee <00:10:37.995>will <00:10:38.195>get <00:10:38.395>to, <00:10:38.595>uh,

221
00:10:41.955 --> 00:10:44.415
<00:10:41.955>to <00:10:42.155>deploy <00:10:42.355>their <00:10:42.555>own <00:10:42.755>version <00:10:42.955>of <00:10:43.155>this <00:10:43.355>system.

222
00:10:44.875 --> 00:10:48.775
<00:10:44.875>And <00:10:45.015>this <00:10:45.155>system <00:10:45.295>is, <00:10:45.435>uh, <00:10:45.575>on <00:10:45.715>the <00:10:45.855>front <00:10:45.995>end, <00:10:46.135>this <00:10:46.275>ui.

223
00:10:49.315 --> 00:10:53.215
<00:10:49.315>And <00:10:49.442>it <00:10:49.569>also, <00:10:49.696>they <00:10:49.824>will <00:10:49.951>also <00:10:50.078>see <00:10:50.205>a <00:10:50.333>management <00:10:50.460>of <00:10:50.587>the <00:10:50.715>Docker.

224
00:10:53.355 --> 00:10:55.735
<00:10:53.355>So <00:10:53.510>it <00:10:53.666>has <00:10:53.821>a <00:10:53.977>banking <00:10:54.132>app, <00:10:54.288>it <00:10:54.443>has <00:10:54.599>a <00:10:54.755>database,

225
00:10:56.315 --> 00:10:58.135
<00:10:56.315>it <00:10:56.595>has <00:10:56.875>an <00:10:57.155>Evil <00:10:57.435>Corp <00:10:57.715>server.

226
00:10:58.315 --> 00:11:01.575
<00:10:58.315>So <00:10:58.455>there <00:10:58.595>is <00:10:58.735>an <00:10:58.875>attacker <00:10:59.015>already <00:10:59.155>here, <00:10:59.295>and <00:10:59.435>they <00:10:59.575>can <00:10:59.715>connect,

227
00:11:01.635 --> 00:11:05.895
<00:11:01.635>or <00:11:01.775>they <00:11:01.915>can <00:11:02.055>push <00:11:02.194>data <00:11:02.335>onto <00:11:02.475>the <00:11:02.615>Evil <00:11:02.755>Corp <00:11:02.895>server <00:11:03.035>using

228
00:11:06.075 --> 00:11:07.575
<00:11:06.075>uh, <00:11:06.525>uh, <00:11:06.975>net <00:11:07.425>cat.

229
00:11:08.435 --> 00:11:10.815
<00:11:08.435>And <00:11:08.635>we <00:11:08.834>are <00:11:09.035>going <00:11:09.234>to <00:11:09.435>do <00:11:09.635>that <00:11:09.834>practically.

230
00:11:10.815 --> 00:11:15.375
<00:11:10.815>Essentially <00:11:10.990>our <00:11:11.165>entire <00:11:11.340>exercise <00:11:11.515>is <00:11:11.690>based <00:11:11.865>on <00:11:12.040>practical <00:11:12.215>work.

231
00:11:15.995 --> 00:11:17.855
<00:11:15.995>So <00:11:16.228>whatever <00:11:16.461>we <00:11:16.695>do, <00:11:16.928>we <00:11:17.161>are <00:11:17.395>going

232
00:11:17.855 --> 00:11:22.455
<00:11:17.855>to <00:11:18.030>have <00:11:18.205>everybody <00:11:18.380>on <00:11:18.555>their <00:11:18.730>own <00:11:18.905>computer <00:11:19.080>running <00:11:19.255>this,

233
00:11:22.795 --> 00:11:26.535
<00:11:22.795>uh, <00:11:22.995>infrastructure, <00:11:23.194>getting <00:11:23.395>their <00:11:23.594>own <00:11:23.795>login <00:11:23.995>and <00:11:24.194>password.

234
00:11:27.035 --> 00:11:29.375
<00:11:27.035>Let <00:11:27.209>me <00:11:27.385>just <00:11:27.560>see <00:11:27.735>if <00:11:27.910>I <00:11:28.084>have <00:11:28.260>my <00:11:28.435>login

235
00:11:29.475 --> 00:11:31.655
<00:11:29.475>and <00:11:29.675>password <00:11:29.875>here <00:11:30.075>so <00:11:30.275>I <00:11:30.475>can <00:11:30.675>demo <00:11:30.875>it.

236
00:11:32.275 --> 00:11:37.255
<00:11:32.275>And <00:11:32.430>literally <00:11:32.586>they <00:11:32.741>will <00:11:32.897>do <00:11:33.052>exactly <00:11:33.208>what <00:11:33.363>we <00:11:33.519>show <00:11:33.675>them

237
00:11:37.355 --> 00:11:39.855
<00:11:37.355>and <00:11:37.495>many <00:11:37.635>other <00:11:37.775>things <00:11:37.915>if <00:11:38.055>they <00:11:38.195>just <00:11:38.335>want <00:11:38.475>to <00:11:38.615>continue <00:11:38.755>digging.

238
00:11:40.235 --> 00:11:43.655
<00:11:40.235>So <00:11:40.375>lo <00:11:40.515>and <00:11:40.655>behold, <00:11:40.795>we <00:11:40.935>have <00:11:41.075>a <00:11:41.215>banking <00:11:41.355>system, <00:11:41.495>and <00:11:41.635>lo

239
00:11:43.655 --> 00:11:47.695
<00:11:43.655>and <00:11:43.782>behold, <00:11:43.909>we <00:11:44.036>can <00:11:44.164>try <00:11:44.291>this <00:11:44.418>one <00:11:44.545>as <00:11:44.673>an <00:11:44.800>example, <00:11:44.927>export <00:11:45.055>data

240
00:11:47.795 --> 00:11:49.455
<00:11:47.795>to <00:11:48.074>a <00:11:48.354>file <00:11:48.635>name <00:11:48.915>called <00:11:49.194>transactions,

241
00:11:49.455 --> 00:11:50.975
<00:11:49.455>which <00:11:49.911>is <00:11:50.367>completely <00:11:50.823>fine.

242
00:11:51.315 --> 00:11:54.285
<00:11:51.315>And <00:11:51.490>we <00:11:51.665>click <00:11:51.840>and <00:11:52.015>it <00:11:52.190>magically <00:11:52.365>creates <00:11:52.540>this <00:11:52.715>CSV

243
00:11:54.285 --> 00:11:55.405
<00:11:54.285>file <00:11:54.536>and <00:11:54.789>we <00:11:55.040>download <00:11:55.293>it.

244
00:11:55.985 --> 00:11:59.125
<00:11:55.985>But <00:11:56.218>what <00:11:56.451>if <00:11:56.685>I <00:11:56.918>do <00:11:57.151>this <00:11:57.385>comma

245
00:11:59.665 --> 00:12:02.125
<00:11:59.665>LS <00:11:59.944>minus <00:12:00.224>la <00:12:00.505>who <00:12:00.785>do <00:12:01.064>you?

246
00:12:02.145 --> 00:12:06.405
<00:12:02.145>And <00:12:02.319>suddenly <00:12:02.495>for <00:12:02.670>us <00:12:02.845>being <00:12:03.020>helpful <00:12:03.194>for <00:12:03.370>the <00:12:03.545>demo,

247
00:12:06.405 --> 00:12:08.205
<00:12:06.405>obviously <00:12:06.638>this <00:12:06.871>is <00:12:07.105>now <00:12:07.338>in <00:12:07.571>the <00:12:07.805>message,

248
00:12:08.665 --> 00:12:11.245
<00:12:08.665>but <00:12:08.805>in <00:12:08.944>a <00:12:09.084>real <00:12:09.224>situation, <00:12:09.365>it <00:12:09.505>won't <00:12:09.645>be <00:12:09.785>in <00:12:09.925>the <00:12:10.064>message,

249
00:12:11.465 --> 00:12:14.765
<00:12:11.465>but <00:12:11.640>there <00:12:11.815>may <00:12:11.990>be <00:12:12.165>a <00:12:12.340>situation <00:12:12.515>where <00:12:12.690>this <00:12:12.865>works.

250
00:12:15.265 --> 00:12:18.845
<00:12:15.265>And <00:12:15.405>we'll <00:12:15.545>also <00:12:15.685>have <00:12:15.824>the <00:12:15.965>code <00:12:16.105>available <00:12:16.245>and <00:12:16.385>people <00:12:16.525>can <00:12:16.665>see

251
00:12:18.845 --> 00:12:21.165
<00:12:18.845>and <00:12:19.078>will <00:12:19.311>discuss <00:12:19.545>why <00:12:19.778>this <00:12:20.011>is <00:12:20.245>so,

252
00:12:21.715 --> 00:12:22.765
<00:12:21.715>because <00:12:22.187>a <00:12:22.660>lot

253
00:12:22.765 --> 00:12:26.045
<00:12:22.765>of <00:12:22.939>these <00:12:23.115>platforms <00:12:23.290>essentially <00:12:23.465>run <00:12:23.640>on <00:12:23.814>the <00:12:23.990>backend <00:12:24.165>an

254
00:12:26.055 --> 00:12:28.365
<00:12:26.055>executable <00:12:26.334>program, <00:12:26.614>which <00:12:26.895>does <00:12:27.175>the <00:12:27.454>magic

255
00:12:28.365 --> 00:12:31.245
<00:12:28.365>because <00:12:28.598>an <00:12:28.831>executable <00:12:29.065>program <00:12:29.298>is <00:12:29.531>very <00:12:29.765>quick.

256
00:12:31.745 --> 00:12:34.685
<00:12:31.745>If <00:12:31.900>I <00:12:32.056>need <00:12:32.211>to <00:12:32.367>export <00:12:32.522>a <00:12:32.678>bunch <00:12:32.833>of <00:12:32.989>text, <00:12:33.145>uh,

257
00:12:34.995 --> 00:12:36.125
<00:12:34.995>objects <00:12:35.334>from <00:12:35.673>a <00:12:36.012>file,

258
00:12:36.765 --> 00:12:39.325
<00:12:36.765>I <00:12:36.905>may <00:12:37.045>use <00:12:37.185>something <00:12:37.324>which <00:12:37.465>is <00:12:37.605>a <00:12:37.745>binary <00:12:37.885>on <00:12:38.025>the <00:12:38.165>operating

259
00:12:39.325 --> 00:12:43.565
<00:12:39.325>system, <00:12:39.441>if <00:12:39.558>that <00:12:39.675>may <00:12:39.791>not <00:12:39.908>be <00:12:40.025>the <00:12:40.141>best <00:12:40.258>or <00:12:40.375>the <00:12:40.491>most <00:12:40.608>ideal <00:12:40.725>way,

260
00:12:44.025 --> 00:12:46.125
<00:12:44.025>but <00:12:44.199>it <00:12:44.375>is <00:12:44.550>definitely <00:12:44.725>a <00:12:44.900>way <00:12:45.074>that <00:12:45.250>is <00:12:45.425>happening.

261
00:12:46.625 --> 00:12:48.045
<00:12:46.625>And <00:12:47.050>for <00:12:47.477>everybody <00:12:47.903>that's

262
00:12:48.635 --> 00:12:50.085
<00:12:48.635>Basically <00:12:49.287>industry <00:12:49.940>standard.

263
00:12:50.755 --> 00:12:53.845
<00:12:50.755>Yeah. <00:12:50.930>And, <00:12:51.105>uh, <00:12:51.280>for, <00:12:51.455>for <00:12:51.630>some, <00:12:51.805>for <00:12:51.980>image, <00:12:52.155>uh,

264
00:12:53.845 --> 00:12:57.005
<00:12:53.845>processing <00:12:54.020>image <00:12:54.195>magic <00:12:54.370>is <00:12:54.545>an <00:12:54.720>actual <00:12:54.895>binary <00:12:55.070>that <00:12:55.245>needs

265
00:12:57.005 --> 00:12:59.965
<00:12:57.005>to <00:12:57.238>be <00:12:57.471>invoked <00:12:57.705>on <00:12:57.938>everything <00:12:58.171>and <00:12:58.405>anything.

266
00:13:00.305 --> 00:13:02.845
<00:13:00.305>So <00:13:00.479>this <00:13:00.655>is <00:13:00.829>just <00:13:01.005>another <00:13:01.180>sideways <00:13:01.354>No. <00:13:01.530>Is <00:13:01.704>that

267
00:13:02.845 --> 00:13:04.965
<00:13:02.845>Image <00:13:03.078>processing <00:13:03.311>in <00:13:03.545>JavaScript <00:13:03.778>or <00:13:04.011>in <00:13:04.245>Python?

268
00:13:05.635 --> 00:13:09.685
<00:13:05.635>Yeah, <00:13:05.835>so <00:13:06.035>this <00:13:06.235>is <00:13:06.435>one <00:13:06.635>of <00:13:06.835>the <00:13:07.035>steps

269
00:13:09.835 --> 00:13:11.765
<00:13:09.835>that <00:13:10.035>we're <00:13:10.235>going <00:13:10.435>to <00:13:10.635>show <00:13:10.835>to <00:13:11.035>the <00:13:11.235>people.

270
00:13:11.825 --> 00:13:14.525
<00:13:11.825>And <00:13:11.980>there <00:13:12.136>will <00:13:12.291>be <00:13:12.447>many <00:13:12.602>other, <00:13:12.758>like <00:13:12.913>in <00:13:13.069>the <00:13:13.225>search,

271
00:13:14.945 --> 00:13:16.525
<00:13:14.945>and <00:13:15.178>obviously <00:13:15.411>when <00:13:15.645>you <00:13:15.878>have <00:13:16.111>a <00:13:16.345>search

272
00:13:16.525 --> 00:13:20.125
<00:13:16.525>and <00:13:16.680>you <00:13:16.836>have <00:13:16.991>a <00:13:17.147>form <00:13:17.302>SQL <00:13:17.458>injection <00:13:17.613>comes <00:13:17.769>to <00:13:17.925>mind

273
00:13:20.625 --> 00:13:23.765
<00:13:20.625>and <00:13:20.752>there <00:13:20.879>is <00:13:21.006>a <00:13:21.134>bunch <00:13:21.261>of <00:13:21.388>exercises <00:13:21.515>that <00:13:21.643>is <00:13:21.770>going <00:13:21.897>to <00:13:22.025>go

274
00:13:23.765 --> 00:13:27.485
<00:13:23.765>through <00:13:23.892>and <00:13:24.019>they're <00:13:24.146>going <00:13:24.274>to <00:13:24.401>be <00:13:24.528>so <00:13:24.655>deep, <00:13:24.783>so, <00:13:24.910>so, <00:13:25.037>so <00:13:25.165>deep.

275
00:13:28.065 --> 00:13:30.605
<00:13:28.065>That's <00:13:28.192>going <00:13:28.319>to <00:13:28.446>be, <00:13:28.574>I <00:13:28.701>think <00:13:28.828>people <00:13:28.955>are <00:13:29.083>going <00:13:29.210>to <00:13:29.337>say, <00:13:29.465>okay,

276
00:13:30.605 --> 00:13:32.405
<00:13:30.605>people <00:13:30.885>are <00:13:31.165>usually <00:13:31.445>start <00:13:31.725>copying <00:13:32.005>stuff.

277
00:13:32.475 --> 00:13:35.805
<00:13:32.475>When <00:13:32.650>we <00:13:32.825>start, <00:13:33.000>uh, <00:13:33.175>showing <00:13:33.350>this, <00:13:33.525>we <00:13:33.700>are <00:13:33.875>going

278
00:13:35.805 --> 00:13:39.045
<00:13:35.805>to <00:13:35.944>give <00:13:36.084>them <00:13:36.224>obviously <00:13:36.364>the <00:13:36.505>markdown <00:13:36.645>file <00:13:36.785>with <00:13:36.925>all <00:13:37.064>the, <00:13:37.204>uh,

279
00:13:39.165 --> 00:13:43.045
<00:13:39.165>commands, <00:13:39.320>uh, <00:13:39.476>and <00:13:39.631>we'll <00:13:39.787>ask <00:13:39.942>them <00:13:40.098>not <00:13:40.253>to <00:13:40.409>abuse <00:13:40.564>it.

280
00:13:43.425 --> 00:13:46.405
<00:13:43.425>So <00:13:43.599>everything <00:13:43.775>is <00:13:43.949>going <00:13:44.125>to <00:13:44.300>be <00:13:44.474>hands <00:13:44.650>on, <00:13:44.824>literally.

281
00:13:46.835 --> 00:13:48.805
<00:13:46.835>Yeah. <00:13:47.185>These <00:13:47.535>are <00:13:47.885>constructed <00:13:48.235>examples,

282
00:13:49.025 --> 00:13:52.605
<00:13:49.025>but <00:13:49.132>all <00:13:49.240>of <00:13:49.348>them <00:13:49.455>are <00:13:49.563>based <00:13:49.671>on <00:13:49.778>things <00:13:49.886>that <00:13:49.994>we <00:13:50.101>saw <00:13:50.209>in <00:13:50.317>the <00:13:50.425>wild

283
00:13:52.745 --> 00:13:54.925
<00:13:52.745>or <00:13:52.945>that <00:13:53.145>we <00:13:53.345>did <00:13:53.545>actually <00:13:53.745>in <00:13:53.945>the <00:13:54.145>wild.

284
00:13:55.675 --> 00:13:56.725
<00:13:55.675>That <00:13:55.990>is <00:13:56.305>very <00:13:56.620>interesting.

285
00:13:57.045 --> 00:13:59.125
<00:13:57.045>I <00:13:57.200>like <00:13:57.356>the, <00:13:57.511>I <00:13:57.667>like <00:13:57.822>the <00:13:57.978>idea <00:13:58.133>of <00:13:58.289>having <00:13:58.444>a,

286
00:13:59.125 --> 00:14:02.165
<00:13:59.125>a <00:13:59.325>platform <00:13:59.525>already <00:13:59.725>built <00:13:59.925>that <00:14:00.125>actually <00:14:00.325>is <00:14:00.525>vulnerable.

287
00:14:02.285 --> 00:14:03.965
<00:14:02.285>I <00:14:02.564>mean, <00:14:02.844>there's <00:14:03.125>also <00:14:03.405>vulnerable <00:14:03.685>clusters

288
00:14:03.965 --> 00:14:06.205
<00:14:03.965>that <00:14:04.165>you <00:14:04.365>can <00:14:04.565>download <00:14:04.765>images <00:14:04.965>that, <00:14:05.165>that <00:14:05.365>see

289
00:14:06.205 --> 00:14:07.485
<00:14:06.205>that <00:14:06.589>other <00:14:06.973>companies <00:14:07.357>offer.

290
00:14:07.865 --> 00:14:09.565
<00:14:07.865>And <00:14:08.065>always <00:14:08.265>fascinated <00:14:08.465>me <00:14:08.665>when <00:14:08.865>I <00:14:09.065>did <00:14:09.265>training

291
00:14:09.625 --> 00:14:11.125
<00:14:09.625>and, <00:14:09.895>uh, <00:14:10.165>I <00:14:10.435>worked <00:14:10.705>for <00:14:10.975>Microsoft

292
00:14:11.125 --> 00:14:13.085
<00:14:11.125>that <00:14:11.325>we <00:14:11.525>had <00:14:11.725>these <00:14:11.925>like <00:14:12.125>North <00:14:12.325>wind <00:14:12.525>databases

293
00:14:13.145 --> 00:14:14.805
<00:14:13.145>and <00:14:13.319>these <00:14:13.495>kind <00:14:13.670>of <00:14:13.845>things, <00:14:14.020>and <00:14:14.194>you're <00:14:14.370>like, <00:14:14.545>oh,

294
00:14:14.805 --> 00:14:16.125
<00:14:14.805>it's <00:14:15.102>like <00:14:15.399>the <00:14:15.696>perfect <00:14:15.992>database.

295
00:14:16.125 --> 00:14:17.845
<00:14:16.125>And <00:14:16.300>in <00:14:16.475>the <00:14:16.650>wild, <00:14:16.825>I <00:14:17.000>never <00:14:17.175>had <00:14:17.350>a <00:14:17.525>customer

296
00:14:17.845 --> 00:14:19.565
<00:14:17.845>that <00:14:18.078>actually <00:14:18.311>gave <00:14:18.545>me <00:14:18.778>anything <00:14:19.011>like <00:14:19.245>that.

297
00:14:20.185 --> 00:14:22.525
<00:14:20.185>It <00:14:20.359>was <00:14:20.535>always <00:14:20.709>a <00:14:20.885>mess. <00:14:21.060>It <00:14:21.234>was <00:14:21.410>always <00:14:21.584>unclean.

298
00:14:22.525 --> 00:14:25.125
<00:14:22.525>There <00:14:22.665>was <00:14:22.805>always <00:14:22.944>all <00:14:23.084>kind <00:14:23.225>of, <00:14:23.365>uh, <00:14:23.505>unsafe <00:14:23.645>things <00:14:23.785>in <00:14:23.925>there.

299
00:14:25.715 --> 00:14:28.165
<00:14:25.715>It's <00:14:25.915>interesting <00:14:26.115>that <00:14:26.315>you <00:14:26.515>talked <00:14:26.715>about <00:14:26.915>image <00:14:27.115>generation

300
00:14:28.385 --> 00:14:30.605
<00:14:28.385>and <00:14:28.665>like, <00:14:28.944>uh, <00:14:29.225>binary, <00:14:29.505>uh, <00:14:29.785>binaries,

301
00:14:30.605 --> 00:14:31.925
<00:14:30.605>like <00:14:30.842>image <00:14:31.080>magic <00:14:31.317>being <00:14:31.555>a <00:14:31.793>binary.

302
00:14:32.515 --> 00:14:35.445
<00:14:32.515>There's <00:14:32.655>so <00:14:32.795>many <00:14:32.935>things <00:14:33.074>that <00:14:33.215>are <00:14:33.355>binary <00:14:33.495>that <00:14:33.635>we <00:14:33.775>don't <00:14:33.915>know,

303
00:14:35.445 --> 00:14:37.445
<00:14:35.445>and <00:14:35.620>how <00:14:35.795>many, <00:14:35.970>how <00:14:36.145>many, <00:14:36.320>uh, <00:14:36.495>uh, <00:14:36.670>how <00:14:36.845>much

304
00:14:37.445 --> 00:14:39.885
<00:14:37.445>of <00:14:37.645>a <00:14:37.845>security <00:14:38.045>threat <00:14:38.245>they <00:14:38.445>can <00:14:38.645>actually <00:14:38.845>be.

305
00:14:40.355 --> 00:14:43.525
<00:14:40.355>Just <00:14:40.530>the <00:14:40.705>amount <00:14:40.880>of <00:14:41.055>like <00:14:41.230>malformed <00:14:41.405>fonts <00:14:41.580>is <00:14:41.755>something

306
00:14:43.525 --> 00:14:45.565
<00:14:43.525>that <00:14:43.758>fascinates <00:14:43.991>me <00:14:44.225>as <00:14:44.458>an <00:14:44.691>attack <00:14:44.925>vector

307
00:14:45.635 --> 00:14:47.125
<00:14:45.635>that <00:14:45.903>I've <00:14:46.171>never <00:14:46.439>thought <00:14:46.707>of <00:14:46.976>before,

308
00:14:47.545 --> 00:14:49.605
<00:14:47.545>but <00:14:47.719>it's, <00:14:47.895>it's <00:14:48.069>happening <00:14:48.245>more <00:14:48.420>and <00:14:48.594>more <00:14:48.770>right <00:14:48.944>now.

309
00:14:51.065 --> 00:14:54.925
<00:14:51.065>The <00:14:51.220>supply <00:14:51.376>chain, <00:14:51.531>I <00:14:51.687>think <00:14:51.842>is, <00:14:51.998>is <00:14:52.153>the <00:14:52.309>horror <00:14:52.465>movie

310
00:14:55.025 --> 00:14:56.885
<00:14:55.025>of <00:14:55.305>the <00:14:55.584>year <00:14:55.865>or <00:14:56.145>the <00:14:56.425>decade.

311
00:14:57.665 --> 00:15:01.365
<00:14:57.665>Uh, <00:14:57.805>we <00:14:57.944>are <00:14:58.084>seeing <00:14:58.224>literally <00:14:58.365>every <00:14:58.505>three <00:14:58.645>months <00:14:58.785>a <00:14:58.925>new <00:14:59.064>wave

312
00:15:01.905 --> 00:15:05.605
<00:15:01.905>of <00:15:02.105>NPM <00:15:02.305>exploited, <00:15:02.505>uh, <00:15:02.704>libraries <00:15:02.905>that <00:15:03.105>are <00:15:03.305>out

313
00:15:05.605 --> 00:15:07.885
<00:15:05.605>and <00:15:05.955>downloaded, <00:15:06.305>auto <00:15:06.655>deployed <00:15:07.005>Python

314
00:15:07.885 --> 00:15:10.445
<00:15:07.885>through <00:15:08.085>PIP <00:15:08.285>is <00:15:08.485>also <00:15:08.685>in <00:15:08.885>the <00:15:09.085>same <00:15:09.285>situation.

315
00:15:11.105 --> 00:15:14.085
<00:15:11.105>Uh, <00:15:11.232>binary <00:15:11.359>is <00:15:11.486>like <00:15:11.614>you <00:15:11.741>say, <00:15:11.868>it, <00:15:11.995>it's <00:15:12.123>all <00:15:12.250>over <00:15:12.377>the <00:15:12.505>place.

316
00:15:14.265 --> 00:15:18.365
<00:15:14.265>And <00:15:14.405>now <00:15:14.545>with <00:15:14.685>cloud <00:15:14.824>bot, <00:15:14.965>it's <00:15:15.105>even <00:15:15.245>more, <00:15:15.385>let's <00:15:15.525>say, <00:15:15.665>blind

317
00:15:18.385 --> 00:15:19.805
<00:15:18.385>and <00:15:19.024>trust, <00:15:19.663>trustworthy.

318
00:15:19.905 --> 00:15:21.285
<00:15:19.905>And <00:15:20.319>I <00:15:20.733>remember <00:15:21.146>one

319
00:15:21.285 --> 00:15:23.925
<00:15:21.285>of <00:15:21.485>the <00:15:21.685>most <00:15:21.885>downloaded <00:15:22.084>skills <00:15:22.285>from <00:15:22.485>Cloud <00:15:22.685>bot

320
00:15:23.945 --> 00:15:25.525
<00:15:23.945>is <00:15:24.645>actually <00:15:25.345>malware.

321
00:15:26.165 --> 00:15:28.165
<00:15:26.165>I <00:15:26.365>read <00:15:26.564>this <00:15:26.765>a <00:15:26.964>couple <00:15:27.165>of <00:15:27.365>weeks <00:15:27.564>ago.

322
00:15:28.345 --> 00:15:31.485
<00:15:28.345>So <00:15:28.545>we <00:15:28.745>are <00:15:28.945>here, <00:15:29.145>we <00:15:29.345>are <00:15:29.545>installing <00:15:29.745>malware.

323
00:15:31.835 --> 00:15:35.285
<00:15:31.835>Yeah. <00:15:31.990>But, <00:15:32.146>uh, <00:15:32.301>the <00:15:32.457>supply <00:15:32.612>chain <00:15:32.768>chain <00:15:32.923>attacks <00:15:33.079>are <00:15:33.235>kinda

324
00:15:35.435 --> 00:15:39.165
<00:15:35.435>totally <00:15:35.635>different <00:15:35.834>workshop <00:15:36.035>that <00:15:36.234>we're <00:15:36.435>kinda <00:15:36.635>working <00:15:36.834>on.

325
00:15:39.475 --> 00:15:43.045
<00:15:39.475>Yeah. <00:15:39.675>But, <00:15:39.875>uh, <00:15:40.075>yeah, <00:15:40.275>this <00:15:40.475>is <00:15:40.675>for <00:15:40.875>developers

326
00:15:43.045 --> 00:15:44.565
<00:15:43.045>that <00:15:43.318>actually <00:15:43.592>do <00:15:43.865>it <00:15:44.139>to <00:15:44.413>themselves.

327
00:15:45.185 --> 00:15:47.525
<00:15:45.185>So <00:15:45.340>when <00:15:45.496>it <00:15:45.651>comes <00:15:45.807>to, <00:15:45.962>when <00:15:46.118>it <00:15:46.273>comes <00:15:46.429>to <00:15:46.584>security,

328
00:15:47.715 --> 00:15:50.165
<00:15:47.715>what <00:15:47.915>is <00:15:48.115>one <00:15:48.315>topic <00:15:48.515>that <00:15:48.715>seriously <00:15:48.915>annoys <00:15:49.115>you?

329
00:15:50.185 --> 00:15:51.605
<00:15:50.185>You <00:15:50.397>kind <00:15:50.611>of <00:15:50.824>like, <00:15:51.037>uh, <00:15:51.250>you <00:15:51.463>kind

330
00:15:51.605 --> 00:15:53.005
<00:15:51.605>of <00:15:51.857>like <00:15:52.109>already <00:15:52.361>alluded <00:15:52.613>to <00:15:52.865>it.

331
00:15:53.465 --> 00:15:55.765
<00:15:53.465>Do <00:15:53.620>you <00:15:53.776>think <00:15:53.931>that <00:15:54.087>people <00:15:54.242>don't <00:15:54.398>take <00:15:54.553>it <00:15:54.709>as <00:15:54.865>serious

332
00:15:55.945 --> 00:15:58.245
<00:15:55.945>and <00:15:56.178>basically <00:15:56.411>that <00:15:56.645>the <00:15:56.878>speed <00:15:57.111>of <00:15:57.345>technology

333
00:15:58.275 --> 00:16:00.125
<00:15:58.275>that <00:15:58.475>we <00:15:58.675>do <00:15:58.875>right <00:15:59.074>now, <00:15:59.275>like, <00:15:59.475>okay, <00:15:59.675>let's,

334
00:16:00.125 --> 00:16:03.485
<00:16:00.125>let's <00:16:00.252>wipe <00:16:00.379>code <00:16:00.506>an <00:16:00.634>app <00:16:00.761>and <00:16:00.888>if <00:16:01.015>it's <00:16:01.143>vulnerable, <00:16:01.270>let <00:16:01.397>delete <00:16:01.525>it

335
00:16:03.485 --> 00:16:04.765
<00:16:03.485>and <00:16:03.773>create <00:16:04.061>a <00:16:04.349>vibe <00:16:04.637>code.

336
00:16:04.845 --> 00:16:07.605
<00:16:04.845>Another <00:16:05.020>one. <00:16:05.195>Do <00:16:05.370>you <00:16:05.545>think <00:16:05.720>that <00:16:05.895>the, <00:16:06.070>the <00:16:06.245>the,

337
00:16:07.905 --> 00:16:10.205
<00:16:07.905>we <00:16:08.060>are <00:16:08.216>in <00:16:08.371>a <00:16:08.527>world <00:16:08.682>right <00:16:08.838>now <00:16:08.993>where <00:16:09.149>security <00:16:09.305>is,

338
00:16:10.305 --> 00:16:11.885
<00:16:10.305>is <00:16:10.771>considered <00:16:11.238>an <00:16:11.704>afterthought?

339
00:16:11.945 --> 00:16:15.325
<00:16:11.945>Or <00:16:12.085>is <00:16:12.225>it <00:16:12.365>something <00:16:12.505>that <00:16:12.645>people <00:16:12.785>should <00:16:12.925>be <00:16:13.065>more <00:16:13.205>worried <00:16:13.345>about?

340
00:16:16.005 --> 00:16:17.085
<00:16:16.005>I, <00:16:16.167>I <00:16:16.329>don't <00:16:16.491>know <00:16:16.653>where <00:16:16.815>to <00:16:16.977>start.

341
00:16:17.245 --> 00:16:18.805
<00:16:17.245>I, <00:16:17.445>it <00:16:17.645>is <00:16:17.845>going <00:16:18.045>to <00:16:18.245>sound <00:16:18.445>like <00:16:18.645>rent,

342
00:16:18.945 --> 00:16:22.565
<00:16:18.945>but, <00:16:19.072>uh, <00:16:19.199>what <00:16:19.326>I <00:16:19.454>can, <00:16:19.581>I <00:16:19.708>can <00:16:19.835>try <00:16:19.963>to, <00:16:20.090>let's <00:16:20.217>see, <00:16:20.345>uh,

343
00:16:22.965 --> 00:16:26.445
<00:16:22.965>consolidate <00:16:23.105>my <00:16:23.245>thoughts <00:16:23.385>and, <00:16:23.525>and <00:16:23.665>try <00:16:23.805>to <00:16:23.945>be <00:16:24.085>nice <00:16:24.225>about <00:16:24.365>this.

344
00:16:26.665 --> 00:16:30.845
<00:16:26.665>Uh, <00:16:26.792>we <00:16:26.919>live <00:16:27.046>in <00:16:27.174>a, <00:16:27.301>in <00:16:27.428>a <00:16:27.555>world <00:16:27.683>where <00:16:27.810>technology <00:16:27.937>is <00:16:28.064>sort

345
00:16:30.845 --> 00:16:35.035
<00:16:30.845>of <00:16:31.125>accelerating <00:16:31.405>literally <00:16:31.685>day <00:16:31.965>by <00:16:32.245>day.

346
00:16:35.255 --> 00:16:37.555
<00:16:35.255>And <00:16:35.455>it's <00:16:35.655>not <00:16:35.855>that <00:16:36.055>just <00:16:36.255>technology <00:16:36.455>is <00:16:36.655>accelerating.

347
00:16:37.615 --> 00:16:41.715
<00:16:37.615>All <00:16:37.815>these <00:16:38.015>vendors, <00:16:38.215>all <00:16:38.415>these <00:16:38.615>products, <00:16:38.815>uh, <00:16:39.015>manufacturers,

348
00:16:41.775 --> 00:16:42.995
<00:16:41.775>I'm <00:16:41.994>trying <00:16:42.214>to <00:16:42.433>be <00:16:42.653>nice <00:16:42.873>here.

349
00:16:43.735 --> 00:16:46.355
<00:16:43.735>Uh, <00:16:44.015>uh, <00:16:44.295>they're <00:16:44.575>pushing <00:16:44.855>out <00:16:45.135>product

350
00:16:46.445 --> 00:16:48.315
<00:16:46.445>after <00:16:46.795>product <00:16:47.145>at <00:16:47.495>the <00:16:47.845>pace

351
00:16:48.335 --> 00:16:50.315
<00:16:48.335>of <00:16:48.535>let's <00:16:48.735>say <00:16:48.935>two <00:16:49.135>weeks <00:16:49.335>and <00:16:49.535>three <00:16:49.735>weeks.

352
00:16:50.495 --> 00:16:53.835
<00:16:50.495>And <00:16:50.670>all <00:16:50.845>that <00:16:51.020>is <00:16:51.195>bundled <00:16:51.370>with <00:16:51.545>so <00:16:51.720>much <00:16:51.895>hype

353
00:16:54.375 --> 00:16:56.755
<00:16:54.375>and <00:16:54.608>misunderstanding <00:16:54.841>that <00:16:55.075>people <00:16:55.308>just <00:16:55.541>say, <00:16:55.775>oh,

354
00:16:56.835 --> 00:16:59.875
<00:16:56.835>I <00:16:56.951>can <00:16:57.068>do <00:16:57.185>this <00:16:57.301>right <00:16:57.418>now <00:16:57.535>and <00:16:57.651>I <00:16:57.768>can <00:16:57.885>do <00:16:58.001>that <00:16:58.118>right <00:16:58.235>now.

355
00:17:00.995 --> 00:17:04.395
<00:17:00.995>A <00:17:01.195>lot <00:17:01.395>of <00:17:01.595>these <00:17:01.795>products <00:17:01.995>now <00:17:02.195>are <00:17:02.395>half-baked.

356
00:17:04.905 --> 00:17:07.955
<00:17:04.905>They're <00:17:05.105>just <00:17:05.305>put <00:17:05.504>as <00:17:05.704>an <00:17:05.905>MVP <00:17:06.105>out <00:17:06.305>there.

357
00:17:08.675 --> 00:17:10.835
<00:17:08.675>I <00:17:08.875>wrote, <00:17:09.075>uh, <00:17:09.274>I <00:17:09.474>actually <00:17:09.675>read <00:17:09.875>an <00:17:10.075>article

358
00:17:11.055 --> 00:17:13.675
<00:17:11.055>or <00:17:11.210>whatever <00:17:11.366>it <00:17:11.521>was <00:17:11.677>from <00:17:11.832>the <00:17:11.988>author <00:17:12.143>of, <00:17:12.299>of, <00:17:12.455>uh,

359
00:17:13.675 --> 00:17:17.235
<00:17:13.675>cloud <00:17:13.849>bot <00:17:14.024>saying, <00:17:14.200>uh, <00:17:14.375>why <00:17:14.550>are <00:17:14.724>you <00:17:14.899>people <00:17:15.075>attacking,

360
00:17:17.265 --> 00:17:19.155
<00:17:17.265>attacking <00:17:17.545>me <00:17:17.825>that <00:17:18.105>this <00:17:18.385>is <00:17:18.665>insecure?

361
00:17:19.265 --> 00:17:21.755
<00:17:19.265>This <00:17:19.465>is <00:17:19.665>a <00:17:19.865>demo <00:17:20.065>product <00:17:20.265>that, <00:17:20.465>an <00:17:20.665>experiment

362
00:17:21.755 --> 00:17:23.515
<00:17:21.755>that <00:17:22.035>I <00:17:22.315>just <00:17:22.595>wrote <00:17:22.875>for <00:17:23.155>fun.

363
00:17:24.095 --> 00:17:27.515
<00:17:24.095>And <00:17:24.222>on <00:17:24.349>the <00:17:24.476>other <00:17:24.604>hand, <00:17:24.731>all <00:17:24.858>these <00:17:24.985>people <00:17:25.113>are <00:17:25.240>using <00:17:25.367>it <00:17:25.495>and,

364
00:17:27.515 --> 00:17:29.915
<00:17:27.515>and <00:17:27.748>bragging <00:17:27.981>that <00:17:28.215>they <00:17:28.448>are <00:17:28.681>using <00:17:28.915>it,

365
00:17:29.915 --> 00:17:31.795
<00:17:29.915>and <00:17:30.148>it <00:17:30.381>sort <00:17:30.615>of <00:17:30.848>optimizes <00:17:31.081>their <00:17:31.315>work

366
00:17:32.045 --> 00:17:33.555
<00:17:32.045>until <00:17:32.384>they <00:17:32.724>delete <00:17:33.064>their <00:17:33.404>emails.

367
00:17:33.705 --> 00:17:37.995
<00:17:33.705>Like <00:17:33.879>the, <00:17:34.054>uh, <00:17:34.230>chief <00:17:34.405>of <00:17:34.580>AI <00:17:34.754>safety <00:17:34.929>meta <00:17:35.105>there,

368
00:17:38.055 --> 00:17:39.435
<00:17:38.055>it <00:17:38.303>was <00:17:38.551>I <00:17:38.800>think <00:17:39.048>last <00:17:39.297>week.

369
00:17:40.295 --> 00:17:44.035
<00:17:40.295>So <00:17:40.470>I'm, <00:17:40.645>I <00:17:40.820>can <00:17:40.995>implore <00:17:41.170>people <00:17:41.345>to <00:17:41.520>slow <00:17:41.695>down.

370
00:17:44.325 --> 00:17:47.755
<00:17:44.325>There <00:17:44.465>is <00:17:44.605>way <00:17:44.745>too <00:17:44.885>much <00:17:45.025>hype <00:17:45.165>around <00:17:45.305>way <00:17:45.445>too <00:17:45.585>many <00:17:45.725>technologies.

371
00:17:48.695 --> 00:17:51.765
<00:17:48.695>We <00:17:48.870>don't <00:17:49.044>get <00:17:49.220>to <00:17:49.395>understand <00:17:49.570>them <00:17:49.745>properly <00:17:49.919>in <00:17:50.095>order

372
00:17:51.865 --> 00:17:56.405
<00:17:51.865>to <00:17:52.005>actually, <00:17:52.145>uh, <00:17:52.285>warn <00:17:52.425>somebody <00:17:52.565>that <00:17:52.705>is <00:17:52.845>the <00:17:52.985>state <00:17:53.125>of <00:17:53.265>play.

373
00:17:56.825 --> 00:17:59.725
<00:17:56.825>Uh, <00:17:57.000>somebody <00:17:57.175>is <00:17:57.350>saying <00:17:57.525>that, <00:17:57.700>uh, <00:17:57.875>AI <00:17:58.050>is <00:17:58.225>going

374
00:17:59.785 --> 00:18:03.165
<00:17:59.785>to <00:17:59.960>accelerate <00:18:00.135>our <00:18:00.310>work, <00:18:00.485>uh, <00:18:00.660>make <00:18:00.835>us <00:18:01.010>more <00:18:01.185>productive.

375
00:18:03.805 --> 00:18:06.525
<00:18:03.805>I <00:18:03.945>see <00:18:04.085>it <00:18:04.225>in, <00:18:04.365>in <00:18:04.505>the, <00:18:04.645>in <00:18:04.785>the <00:18:04.925>last <00:18:05.065>two <00:18:05.205>week

376
00:18:06.525 --> 00:18:08.605
<00:18:06.525>or <00:18:06.758>so, <00:18:06.991>that <00:18:07.225>we <00:18:07.458>are <00:18:07.691>not <00:18:07.925>accelerating.

377
00:18:08.615 --> 00:18:12.925
<00:18:08.615>We're <00:18:08.815>just <00:18:09.015>getting <00:18:09.215>more <00:18:09.415>overloaded <00:18:09.615>because <00:18:09.815>whatever <00:18:10.015>ai,

378
00:18:13.265 --> 00:18:15.485
<00:18:13.265>and <00:18:13.405>I'm <00:18:13.545>not, <00:18:13.685>I'm <00:18:13.825>just <00:18:13.965>going <00:18:14.105>to <00:18:14.245>stop <00:18:14.385>calling <00:18:14.525>it <00:18:14.665>ai,

379
00:18:15.565 --> 00:18:18.805
<00:18:15.565>I <00:18:15.692>would <00:18:15.819>like <00:18:15.946>to <00:18:16.074>call <00:18:16.201>it <00:18:16.328>a <00:18:16.455>sta <00:18:16.583>statistical <00:18:16.710>parrot <00:18:16.837>is <00:18:16.965>going

380
00:18:18.805 --> 00:18:22.445
<00:18:18.805>to <00:18:18.921>spit <00:18:19.038>out, <00:18:19.155>we <00:18:19.271>need <00:18:19.388>to <00:18:19.505>ingest, <00:18:19.621>we <00:18:19.738>need <00:18:19.855>to <00:18:19.971>read <00:18:20.088>about <00:18:20.205>it.

381
00:18:22.445 --> 00:18:25.245
<00:18:22.445>We <00:18:22.600>need <00:18:22.756>to <00:18:22.911>make <00:18:23.067>a <00:18:23.222>decision <00:18:23.378>at <00:18:23.533>a <00:18:23.689>human <00:18:23.845>pace.

382
00:18:25.505 --> 00:18:28.165
<00:18:25.505>So <00:18:25.645>we <00:18:25.785>are <00:18:25.925>still <00:18:26.065>the <00:18:26.205>bottleneck <00:18:26.345>and <00:18:26.485>we <00:18:26.625>still <00:18:26.765>get, <00:18:26.905>we

383
00:18:28.165 --> 00:18:29.925
<00:18:28.165>Literally <00:18:28.631>have <00:18:29.098>a <00:18:29.565>son

384
00:18:29.925 --> 00:18:33.285
<00:18:29.925>of <00:18:30.100>Anton <00:18:30.274>situation <00:18:30.450>once <00:18:30.625>a <00:18:30.800>day <00:18:30.975>the <00:18:31.149>previous <00:18:31.325>week.

385
00:18:34.205 --> 00:18:35.365
<00:18:34.205>Hmm. <00:18:35.249>Yeah.

386
00:18:35.815 --> 00:18:39.925
<00:18:35.815>Where <00:18:35.970>somebody <00:18:36.126>basically <00:18:36.281>used <00:18:36.437>their <00:18:36.592>AI <00:18:36.748>to <00:18:36.903>delete <00:18:37.059>their <00:18:37.215>code.

387
00:18:40.475 --> 00:18:43.405
<00:18:40.475>Yeah, <00:18:40.675>yeah. <00:18:40.875>Huge <00:18:41.074>companies <00:18:41.274>had <00:18:41.475>cases <00:18:41.675>like <00:18:41.875>that.

388
00:18:44.425 --> 00:18:47.365
<00:18:44.425>My <00:18:44.580>favorite <00:18:44.736>about <00:18:44.891>that <00:18:45.047>de <00:18:45.202>deletion <00:18:45.358>of <00:18:45.513>that <00:18:45.669>email <00:18:45.825>was

389
00:18:47.365 --> 00:18:50.565
<00:18:47.365>that <00:18:47.540>she <00:18:47.715>actually <00:18:47.890>wrote <00:18:48.065>a, <00:18:48.240>uh, <00:18:48.415>a, <00:18:48.590>a <00:18:48.765>script

390
00:18:50.625 --> 00:18:53.925
<00:18:50.625>or <00:18:50.752>asked <00:18:50.879>the <00:18:51.006>AI <00:18:51.134>to <00:18:51.261>write <00:18:51.388>a <00:18:51.515>script <00:18:51.643>to <00:18:51.770>delete <00:18:51.897>all <00:18:52.025>emails

391
00:18:54.075 --> 00:18:55.685
<00:18:54.075>that <00:18:54.355>are <00:18:54.635>of <00:18:54.915>a <00:18:55.195>certain <00:18:55.475>age.

392
00:18:56.425 --> 00:18:57.965
<00:18:56.425>That's <00:18:56.771>a <00:18:57.118>filter <00:18:57.464>in <00:18:57.811>Gmail.

393
00:18:58.435 --> 00:19:00.685
<00:18:58.435>Like <00:18:58.590>you <00:18:58.746>don't <00:18:58.901>need <00:18:59.057>a <00:18:59.212>script <00:18:59.368>for <00:18:59.523>that, <00:18:59.679>that <00:18:59.835>there's,

394
00:19:00.685 --> 00:19:03.765
<00:19:00.685>or <00:19:00.812>there's <00:19:00.939>a, <00:19:01.066>there's <00:19:01.194>a <00:19:01.321>UX <00:19:01.448>interface <00:19:01.575>to <00:19:01.703>do <00:19:01.830>that <00:19:01.957>for <00:19:02.085>you.

395
00:19:04.225 --> 00:19:07.085
<00:19:04.225>And <00:19:04.380>it <00:19:04.536>fascinates <00:19:04.691>me <00:19:04.847>that <00:19:05.002>people <00:19:05.158>are <00:19:05.313>just <00:19:05.469>like, <00:19:05.625>the,

396
00:19:07.085 --> 00:19:09.725
<00:19:07.085>the <00:19:07.260>access <00:19:07.435>that <00:19:07.610>people <00:19:07.785>give <00:19:07.960>to <00:19:08.135>these, <00:19:08.310>uh, <00:19:08.485>box

397
00:19:09.745 --> 00:19:13.765
<00:19:09.745>and <00:19:09.861>agents <00:19:09.978>is <00:19:10.094>just <00:19:10.211>something <00:19:10.328>that <00:19:10.445>I <00:19:10.561>had <00:19:10.678>as <00:19:10.794>a, <00:19:10.911>uh, <00:19:11.028>as <00:19:11.145>a,

398
00:19:13.825 --> 00:19:16.165
<00:19:13.825>as <00:19:13.980>a <00:19:14.136>person <00:19:14.291>that <00:19:14.447>wants <00:19:14.602>to <00:19:14.758>install <00:19:14.913>things <00:19:15.069>on <00:19:15.225>people's

399
00:19:16.165 --> 00:19:18.245
<00:19:16.165>machines, <00:19:16.514>good <00:19:16.865>things <00:19:17.215>are <00:19:17.565>basically,

400
00:19:18.285 --> 00:19:19.365
<00:19:18.285>I <00:19:18.479>never <00:19:18.673>had <00:19:18.868>the <00:19:19.062>access <00:19:19.257>to.

401
00:19:19.385 --> 00:19:22.125
<00:19:19.385>But <00:19:19.512>it <00:19:19.639>seems <00:19:19.766>like <00:19:19.894>there's <00:19:20.021>a <00:19:20.148>way, <00:19:20.275>always <00:19:20.403>a <00:19:20.530>way <00:19:20.657>around <00:19:20.785>it.

402
00:19:22.435 --> 00:19:24.845
<00:19:22.435>Like <00:19:22.562>as <00:19:22.689>a <00:19:22.816>user, <00:19:22.944>if <00:19:23.071>I, <00:19:23.198>if <00:19:23.325>I <00:19:23.453>use <00:19:23.580>Macs <00:19:23.707>right <00:19:23.835>now

403
00:19:24.845 --> 00:19:27.325
<00:19:24.845>and <00:19:24.985>I <00:19:25.125>install <00:19:25.265>something, <00:19:25.405>it <00:19:25.545>asks <00:19:25.685>me <00:19:25.825>every <00:19:25.965>single <00:19:26.105>time <00:19:26.245>like,

404
00:19:27.325 --> 00:19:29.285
<00:19:27.325>oh, <00:19:27.500>this <00:19:27.675>is <00:19:27.850>not <00:19:28.025>signed, <00:19:28.200>this <00:19:28.375>is <00:19:28.550>not <00:19:28.725>known.

405
00:19:29.665 --> 00:19:32.405
<00:19:29.665>We <00:19:29.805>don't <00:19:29.945>know <00:19:30.085>that. <00:19:30.225>But <00:19:30.365>for <00:19:30.504>some <00:19:30.645>reason, <00:19:30.784>these <00:19:30.925>agents <00:19:31.065>get,

406
00:19:32.505 --> 00:19:34.365
<00:19:32.505>uh, <00:19:32.705>get <00:19:32.905>the <00:19:33.105>access <00:19:33.305>that <00:19:33.505>I <00:19:33.705>don't <00:19:33.905>get.

407
00:19:34.365 --> 00:19:37.445
<00:19:34.365>Like <00:19:34.505>how <00:19:34.645>do, <00:19:34.785>how <00:19:34.925>do <00:19:35.065>people, <00:19:35.205>how <00:19:35.345>do <00:19:35.485>people <00:19:35.625>see <00:19:35.765>that?

408
00:19:37.505 --> 00:19:39.925
<00:19:37.505>Is <00:19:37.680>it <00:19:37.855>just <00:19:38.030>like <00:19:38.205>black <00:19:38.380>magic <00:19:38.555>and <00:19:38.730>it's <00:19:38.905>convenience?

409
00:19:39.925 --> 00:19:41.165
<00:19:39.925>We <00:19:40.110>don't <00:19:40.297>want <00:19:40.483>to <00:19:40.668>worry <00:19:40.855>about <00:19:41.041>it.

410
00:19:41.715 --> 00:19:43.765
<00:19:41.715>Yeah. <00:19:42.181>Most <00:19:42.648>people, <00:19:43.115>yeah,

411
00:19:43.765 --> 00:19:46.485
<00:19:43.765>You <00:19:43.920>inter <00:19:44.076>you <00:19:44.231>don't <00:19:44.387>click <00:19:44.542>buttons, <00:19:44.698>you <00:19:44.853>just <00:19:45.009>tell <00:19:45.165>it,

412
00:19:46.505 --> 00:19:50.605
<00:19:46.505>do <00:19:46.660>this, <00:19:46.816>and <00:19:46.971>it <00:19:47.127>it <00:19:47.282>might <00:19:47.438>actually <00:19:47.593>do <00:19:47.749>actually <00:19:47.905>that

413
00:19:51.665 --> 00:19:53.725
<00:19:51.665>the <00:19:51.865>problem <00:19:52.065>is <00:19:52.264>when <00:19:52.465>it <00:19:52.665>does <00:19:52.865>something <00:19:53.065>different.

414
00:19:54.675 --> 00:19:59.005
<00:19:54.675>Yeah. <00:19:54.802>Yeah. <00:19:54.929>We <00:19:55.056>Say <00:19:55.184>do <00:19:55.311>what <00:19:55.438>you <00:19:55.565>tell <00:19:55.693>them <00:19:55.820>to <00:19:55.947>do, <00:19:56.075>not

415
00:19:59.035 --> 00:20:00.645
<00:19:59.035>what <00:19:59.235>you <00:19:59.435>want <00:19:59.635>to <00:19:59.835>tell <00:20:00.035>them <00:20:00.235>to <00:20:00.435>do.

416
00:20:01.305 --> 00:20:04.965
<00:20:01.305>But <00:20:01.445>right <00:20:01.585>now <00:20:01.725>it's <00:20:01.865>not <00:20:02.005>even <00:20:02.145>that <00:20:02.285>the <00:20:02.425>computer <00:20:02.565>will <00:20:02.705>do

417
00:20:05.565 --> 00:20:07.485
<00:20:05.565>whatever <00:20:05.798>they <00:20:06.031>will <00:20:06.265>do <00:20:06.498>with, <00:20:06.731>uh, <00:20:06.965>some

418
00:20:08.135 --> 00:20:09.445
<00:20:08.135>randomness <00:20:08.528>inside <00:20:08.921>of <00:20:09.313>it.

419
00:20:09.745 --> 00:20:12.965
<00:20:09.745>The <00:20:09.945>statistical <00:20:10.145>part, <00:20:10.344>if <00:20:10.544>the <00:20:10.745>statistical <00:20:10.945>part, <00:20:11.145>misspeaks,

420
00:20:13.905 --> 00:20:16.845
<00:20:13.905>we <00:20:14.045>get <00:20:14.185>cases <00:20:14.325>like <00:20:14.465>this <00:20:14.605>when <00:20:14.745>we <00:20:14.885>have <00:20:15.024>a <00:20:15.165>data <00:20:15.305>center

421
00:20:16.905 --> 00:20:18.125
<00:20:16.905>of <00:20:17.179>offline <00:20:17.454>for <00:20:17.728>a <00:20:18.003>while.

422
00:20:18.795 --> 00:20:20.805
<00:20:18.795>Yeah. <00:20:19.145>And <00:20:19.495>whoever <00:20:19.845>the <00:20:20.195>builder

423
00:20:20.865 --> 00:20:24.365
<00:20:20.865>of <00:20:21.020>the <00:20:21.176>product <00:20:21.331>is <00:20:21.487>never <00:20:21.642>starts <00:20:21.798>with <00:20:21.953>a <00:20:22.109>secure <00:20:22.265>configuration

424
00:20:25.185 --> 00:20:26.285
<00:20:25.185>is <00:20:25.432>just <00:20:25.680>make <00:20:25.927>it <00:20:26.175>work.

425
00:20:28.085 --> 00:20:31.085
<00:20:28.085>I, <00:20:28.212>I <00:20:28.339>remember <00:20:28.466>a <00:20:28.594>lot <00:20:28.721>of <00:20:28.848>products <00:20:28.975>came <00:20:29.103>in <00:20:29.230>with <00:20:29.357>instructions <00:20:29.485>on

426
00:20:31.085 --> 00:20:32.405
<00:20:31.085>how <00:20:31.283>to <00:20:31.481>secure <00:20:31.679>it <00:20:31.877>from <00:20:32.075>day <00:20:32.273>one.

427
00:20:32.885 --> 00:20:33.925
<00:20:32.885>I <00:20:33.072>mean, <00:20:33.259>that <00:20:33.446>was <00:20:33.633>the <00:20:33.821>idea.

428
00:20:34.075 --> 00:20:36.925
<00:20:34.075>This <00:20:34.230>is, <00:20:34.386>uh, <00:20:34.541>security <00:20:34.697>by <00:20:34.852>default <00:20:35.008>and <00:20:35.163>security <00:20:35.319>by <00:20:35.475>design.

429
00:20:37.465 --> 00:20:42.045
<00:20:37.465>Now <00:20:37.620>we <00:20:37.776>have <00:20:37.931>vibe <00:20:38.087>coded <00:20:38.242>stuff, <00:20:38.398>security <00:20:38.553>by <00:20:38.709>what, <00:20:38.865>who,

430
00:20:45.025 --> 00:20:47.285
<00:20:45.025>But <00:20:45.258>we <00:20:45.491>do <00:20:45.725>have <00:20:45.958>like <00:20:46.191>secure <00:20:46.425>cps.

431
00:20:47.345 --> 00:20:48.965
<00:20:47.345>We <00:20:47.578>do <00:20:47.811>have <00:20:48.045>things <00:20:48.278>like <00:20:48.511>in <00:20:48.745>between

432
00:20:49.065 --> 00:20:51.125
<00:20:49.065>and <00:20:49.298>services <00:20:49.531>that <00:20:49.765>say <00:20:49.998>like, <00:20:50.231>okay, <00:20:50.465>we,

433
00:20:51.145 --> 00:20:53.565
<00:20:51.145>we <00:20:51.320>are <00:20:51.495>gonna <00:20:51.670>filter <00:20:51.845>skills <00:20:52.020>out <00:20:52.195>that <00:20:52.370>are <00:20:52.545>vulnerable.

434
00:20:53.565 --> 00:20:55.485
<00:20:53.565>We've <00:20:53.765>gotta <00:20:53.965>filter <00:20:54.165>skills <00:20:54.365>out <00:20:54.565>that <00:20:54.765>are <00:20:54.965>malicious.

435
00:20:56.545 --> 00:20:57.725
<00:20:56.545>How <00:20:56.757>do <00:20:56.969>you <00:20:57.182>see <00:20:57.394>that <00:20:57.607>market?

436
00:20:57.825 --> 00:21:00.165
<00:20:57.825>Is <00:20:58.025>that, <00:20:58.225>is <00:20:58.425>that <00:20:58.625>already <00:20:58.825>happening, <00:20:59.025>uh, <00:20:59.225>enough

437
00:21:00.265 --> 00:21:02.565
<00:21:00.265>or <00:21:00.420>is <00:21:00.576>it <00:21:00.731>just <00:21:00.887>uh, <00:21:01.042>uh, <00:21:01.198>an <00:21:01.353>outlier <00:21:01.509>that <00:21:01.665>most

438
00:21:02.565 --> 00:21:05.005
<00:21:02.565>of <00:21:02.720>the <00:21:02.876>time <00:21:03.031>people <00:21:03.187>need <00:21:03.342>an <00:21:03.498>extra <00:21:03.653>effort <00:21:03.809>to <00:21:03.965>install?

439
00:21:05.825 --> 00:21:08.685
<00:21:05.825>Uh, <00:21:06.000>the <00:21:06.175>problem <00:21:06.350>with <00:21:06.525>security <00:21:06.700>is <00:21:06.875>that <00:21:07.050>a <00:21:07.225>lot

440
00:21:08.685 --> 00:21:10.365
<00:21:08.685>of <00:21:09.034>developers <00:21:09.385>are <00:21:09.735>kind <00:21:10.085>of,

441
00:21:10.905 --> 00:21:13.605
<00:21:10.905>and <00:21:11.185>developer <00:21:11.465>like <00:21:11.745>persons <00:21:12.024>are <00:21:12.305>kind

442
00:21:13.605 --> 00:21:15.165
<00:21:13.605>of <00:21:13.885>very <00:21:14.165>eager <00:21:14.445>to <00:21:14.725>do <00:21:15.005>stuff.

443
00:21:15.745 --> 00:21:20.445
<00:21:15.745>So <00:21:15.861>you <00:21:15.978>could <00:21:16.094>secure, <00:21:16.211>uh, <00:21:16.328>an <00:21:16.445>MCP, <00:21:16.561>you <00:21:16.678>could <00:21:16.794>use <00:21:16.911>a <00:21:17.028>secure <00:21:17.145>MCP

444
00:21:20.465 --> 00:21:23.645
<00:21:20.465>to <00:21:20.639>actually <00:21:20.814>filter <00:21:20.990>out <00:21:21.165>whatever <00:21:21.340>you <00:21:21.514>want <00:21:21.689>to <00:21:21.865>do.

445
00:21:24.025 --> 00:21:25.605
<00:21:24.025>But, <00:21:24.258>uh, <00:21:24.491>how <00:21:24.725>many <00:21:24.958>people <00:21:25.191>do <00:21:25.425>that?

446
00:21:26.755 --> 00:21:29.285
<00:21:26.755>It's <00:21:26.930>not <00:21:27.105>the <00:21:27.280>problem <00:21:27.455>that <00:21:27.630>it <00:21:27.805>cannot <00:21:27.980>be <00:21:28.155>secure.

447
00:21:29.795 --> 00:21:32.445
<00:21:29.795>It's <00:21:29.970>not <00:21:30.145>the <00:21:30.320>problem <00:21:30.495>that <00:21:30.670>it <00:21:30.845>cannot <00:21:31.020>have <00:21:31.195>guardrails.

448
00:21:33.665 --> 00:21:36.965
<00:21:33.665>The <00:21:33.840>problem <00:21:34.014>is <00:21:34.190>that, <00:21:34.365>uh, <00:21:34.540>we <00:21:34.715>are <00:21:34.889>still <00:21:35.065>not,

449
00:21:37.065 --> 00:21:39.325
<00:21:37.065>uh, <00:21:37.765>educated <00:21:38.465>enough.

450
00:21:40.125 --> 00:21:41.245
<00:21:40.125>I <00:21:40.326>don't <00:21:40.528>think <00:21:40.729>we <00:21:40.931>ever <00:21:41.132>were,

451
00:21:42.145 --> 00:21:45.685
<00:21:42.145>Uh, <00:21:42.300>I'm <00:21:42.456>gonna <00:21:42.611>come <00:21:42.767>back <00:21:42.922>to <00:21:43.078>developers <00:21:43.233>now <00:21:43.389>from <00:21:43.545>this,

452
00:21:45.825 --> 00:21:47.525
<00:21:45.825>I'm <00:21:45.980>going <00:21:46.136>to <00:21:46.291>use <00:21:46.447>it <00:21:46.602>sort <00:21:46.758>of <00:21:46.913>as <00:21:47.069>a <00:21:47.225>segue.

453
00:21:48.105 --> 00:21:52.165
<00:21:48.105>Uh, <00:21:48.338>it's <00:21:48.571>not <00:21:48.805>just <00:21:49.038>about, <00:21:49.271>uh, <00:21:49.505>education.

454
00:21:52.275 --> 00:21:55.765
<00:21:52.275>It's <00:21:52.450>about, <00:21:52.625>uh, <00:21:52.800>investing <00:21:52.975>the <00:21:53.150>time <00:21:53.325>to <00:21:53.500>do <00:21:53.675>it.

455
00:21:56.665 --> 00:21:59.045
<00:21:56.665>Uh, <00:21:56.898>much <00:21:57.131>like <00:21:57.365>a <00:21:57.598>lot <00:21:57.831>of <00:21:58.065>sprints

456
00:21:59.045 --> 00:22:02.325
<00:21:59.045>and, <00:21:59.245>uh, <00:21:59.445>development <00:21:59.645>efforts, <00:21:59.845>which <00:22:00.045>say, <00:22:00.245>I <00:22:00.445>need

457
00:22:02.325 --> 00:22:03.685
<00:22:02.325>to <00:22:02.529>do <00:22:02.733>this, <00:22:02.937>this, <00:22:03.141>this, <00:22:03.345>and <00:22:03.549>this.

458
00:22:03.705 --> 00:22:05.525
<00:22:03.705>And <00:22:03.938>suddenly <00:22:04.171>lo <00:22:04.405>and <00:22:04.638>behold <00:22:04.871>it <00:22:05.105>works.

459
00:22:06.155 --> 00:22:10.925
<00:22:06.155>It's <00:22:06.282>an <00:22:06.409>I <00:22:06.536>door, <00:22:06.664>but <00:22:06.791>it <00:22:06.918>works. <00:22:07.045>So <00:22:07.173>my <00:22:07.300>task <00:22:07.427>is <00:22:07.555>done.

460
00:22:11.015 --> 00:22:15.885
<00:22:11.015>Click <00:22:11.190>finish, <00:22:11.365>QA <00:22:11.540>past <00:22:11.715>happy <00:22:11.890>deploy. <00:22:12.065>It <00:22:12.240>works. <00:22:12.415>Yes.

461
00:22:16.505 --> 00:22:20.325
<00:22:16.505>And, <00:22:16.705>uh, <00:22:16.905>I'm <00:22:17.105>going <00:22:17.305>to, <00:22:17.505>uh, <00:22:17.705>reference, <00:22:17.905>uh,

462
00:22:20.415 --> 00:22:22.885
<00:22:20.415>Steve <00:22:20.648>Gues <00:22:20.881>rent <00:22:21.115>from <00:22:21.348>many <00:22:21.581>years <00:22:21.815>ago.

463
00:22:22.935 --> 00:22:24.325
<00:22:22.935>Chris, <00:22:23.113>I <00:22:23.292>don't <00:22:23.471>know <00:22:23.649>if <00:22:23.828>you've <00:22:24.007>read <00:22:24.186>it,

464
00:22:24.325 --> 00:22:26.525
<00:22:24.325>but <00:22:24.675>I <00:22:25.025>definitely <00:22:25.375>recommend <00:22:25.725>it.

465
00:22:26.705 --> 00:22:29.645
<00:22:26.705>Uh, <00:22:26.985>and <00:22:27.264>he <00:22:27.544>said, <00:22:27.824>uh, <00:22:28.105>product

466
00:22:29.755 --> 00:22:33.365
<00:22:29.755>with <00:22:29.895>zero <00:22:30.035>security <00:22:30.175>can <00:22:30.315>be <00:22:30.455>a <00:22:30.595>lot <00:22:30.735>more <00:22:30.875>successful <00:22:31.015>than <00:22:31.155>product

467
00:22:33.395 --> 00:22:36.445
<00:22:33.395>with <00:22:33.550>perfect <00:22:33.706>security <00:22:33.861>as <00:22:34.017>long <00:22:34.172>as <00:22:34.328>it's <00:22:34.483>a <00:22:34.639>useful <00:22:34.795>product.

468
00:22:36.825 --> 00:22:39.205
<00:22:36.825>So <00:22:37.058>everybody's <00:22:37.291>going <00:22:37.525>for <00:22:37.758>the <00:22:37.991>useful <00:22:38.225>product

469
00:22:39.205 --> 00:22:42.925
<00:22:39.205>with <00:22:39.379>zero <00:22:39.554>security, <00:22:39.730>but <00:22:39.905>then <00:22:40.080>again, <00:22:40.254>with <00:22:40.429>zero <00:22:40.605>security

470
00:22:43.375 --> 00:22:46.885
<00:22:43.375>after <00:22:43.550>a <00:22:43.725>finite <00:22:43.900>amount <00:22:44.075>of <00:22:44.250>time, <00:22:44.425>you <00:22:44.600>are <00:22:44.775>breached.

471
00:22:47.225 --> 00:22:49.885
<00:22:47.225>And <00:22:47.380>then <00:22:47.536>people <00:22:47.691>come <00:22:47.847>back <00:22:48.002>to, <00:22:48.158>to <00:22:48.313>people <00:22:48.469>like <00:22:48.625>me

472
00:22:49.885 --> 00:22:52.285
<00:22:49.885>and <00:22:50.118>say, <00:22:50.351>why <00:22:50.585>did <00:22:50.818>we <00:22:51.051>miss <00:22:51.285>it?

473
00:22:54.475 --> 00:22:56.165
<00:22:54.475>Yeah. <00:22:54.708>It's <00:22:54.941>Citi. <00:22:55.175>It's <00:22:55.408>kind <00:22:55.641>of <00:22:55.875>like,

474
00:22:56.265 --> 00:22:57.605
<00:22:56.265>do <00:22:56.506>it <00:22:56.747>right <00:22:56.988>from <00:22:57.229>the <00:22:57.471>beginning

475
00:22:57.705 --> 00:23:00.725
<00:22:57.705>and <00:22:57.845>it, <00:22:57.985>it, <00:22:58.125>it <00:22:58.264>feels <00:22:58.405>like <00:22:58.544>the, <00:22:58.685>the <00:22:58.824>the <00:22:58.965>siren <00:22:59.105>song

476
00:23:00.725 --> 00:23:02.285
<00:23:00.725>of <00:23:01.004>getting <00:23:01.284>an <00:23:01.564>MVP <00:23:01.844>out <00:23:02.125>there

477
00:23:02.345 --> 00:23:03.925
<00:23:02.345>and <00:23:02.545>say <00:23:02.745>like, <00:23:02.945>okay, <00:23:03.145>this <00:23:03.345>is <00:23:03.545>the <00:23:03.745>product

478
00:23:04.105 --> 00:23:06.245
<00:23:04.105>and <00:23:04.338>like <00:23:04.571>the, <00:23:04.805>this <00:23:05.038>is <00:23:05.271>basically <00:23:05.505>I

479
00:23:06.245 --> 00:23:07.485
<00:23:06.245>want <00:23:06.468>people <00:23:06.691>to <00:23:06.914>play <00:23:07.137>with <00:23:07.360>it.

480
00:23:07.905 --> 00:23:10.085
<00:23:07.905>And <00:23:08.105>if <00:23:08.305>I <00:23:08.504>find <00:23:08.705>it <00:23:08.905>fascinating <00:23:09.105>that, <00:23:09.305>uh,

481
00:23:10.085 --> 00:23:11.405
<00:23:10.085>over <00:23:10.382>the <00:23:10.679>last <00:23:10.976>half <00:23:11.273>year

482
00:23:11.425 --> 00:23:15.845
<00:23:11.425>or <00:23:11.565>so, <00:23:11.705>like <00:23:11.845>testing <00:23:11.985>in <00:23:12.125>production <00:23:12.264>seems <00:23:12.405>to <00:23:12.544>be <00:23:12.685>the <00:23:12.825>thing.

483
00:23:15.915 --> 00:23:18.245
<00:23:15.915>Like, <00:23:16.148>like <00:23:16.381>people <00:23:16.615>don't <00:23:16.848>use <00:23:17.081>any, <00:23:17.315>uh,

484
00:23:18.245 --> 00:23:19.445
<00:23:18.245>staging <00:23:18.784>servers <00:23:19.324>anymore.

485
00:23:19.475 --> 00:23:21.685
<00:23:19.475>They <00:23:19.708>just <00:23:19.941>call <00:23:20.175>it <00:23:20.408>spicy <00:23:20.641>life <00:23:20.875>staging

486
00:23:22.025 --> 00:23:23.805
<00:23:22.025>and <00:23:22.305>basically <00:23:22.585>let <00:23:22.865>the <00:23:23.145>people, <00:23:23.425>uh,

487
00:23:23.865 --> 00:23:25.045
<00:23:23.865>let <00:23:24.077>the <00:23:24.289>people <00:23:24.502>play <00:23:24.714>with <00:23:24.927>it.

488
00:23:25.625 --> 00:23:26.805
<00:23:25.625>And <00:23:25.890>the <00:23:26.156>problem <00:23:26.421>is <00:23:26.687>like,

489
00:23:27.195 --> 00:23:30.005
<00:23:27.195>it's <00:23:27.335>not <00:23:27.475>a <00:23:27.615>problem <00:23:27.754>if <00:23:27.895>you <00:23:28.034>write <00:23:28.175>something <00:23:28.314>in <00:23:28.455>white <00:23:28.595>coding

490
00:23:30.025 --> 00:23:33.205
<00:23:30.025>and <00:23:30.132>as <00:23:30.240>an <00:23:30.348>MVP, <00:23:30.455>the <00:23:30.563>problem <00:23:30.671>is <00:23:30.778>if <00:23:30.886>you <00:23:30.994>keep <00:23:31.101>it <00:23:31.209>out <00:23:31.317>there, <00:23:31.425>uh,

491
00:23:33.205 --> 00:23:36.005
<00:23:33.205>without <00:23:33.360>ever <00:23:33.516>hardening <00:23:33.671>it <00:23:33.827>and <00:23:33.982>ever <00:23:34.138>thinking <00:23:34.293>about <00:23:34.449>it. <00:23:34.605>So,

492
00:23:36.465 --> 00:23:39.485
<00:23:36.465>Uh, <00:23:36.665>as <00:23:36.865>a <00:23:37.064>long <00:23:37.264>time <00:23:37.465>developer, <00:23:37.665>all, <00:23:37.865>uh,

493
00:23:39.925 --> 00:23:41.485
<00:23:39.925>temporary <00:23:40.391>solutions <00:23:40.858>are <00:23:41.325>permanent,

494
00:23:42.035 --> 00:23:43.035
Obviously.

495
00:23:43.225 --> 00:23:46.725
<00:23:43.225>And, <00:23:43.380>uh, <00:23:43.536>I <00:23:43.691>always <00:23:43.847>say <00:23:44.002>everybody <00:23:44.158>has <00:23:44.313>a <00:23:44.469>testing <00:23:44.625>server.

496
00:23:47.835 --> 00:23:50.365
<00:23:47.835>Some <00:23:48.035>people <00:23:48.235>just <00:23:48.435>have <00:23:48.635>a <00:23:48.835>separate <00:23:49.035>production <00:23:49.235>server.

497
00:23:53.825 --> 00:23:57.445
<00:23:53.825>And <00:23:53.965>the <00:23:54.105>practice <00:23:54.245>of <00:23:54.385>testing <00:23:54.525>in <00:23:54.665>production, <00:23:54.805>I <00:23:54.945>think <00:23:55.085>is, <00:23:55.225>uh,

498
00:23:57.715 --> 00:24:01.165
<00:23:57.715>well <00:23:57.915>established <00:23:58.115>starting <00:23:58.314>from <00:23:58.514>the <00:23:58.715>gaming, <00:23:58.915>uh, <00:23:59.115>community,

499
00:24:01.195 --> 00:24:05.685
<00:24:01.195>from <00:24:01.370>that <00:24:01.544>game <00:24:01.720>developer <00:24:01.895>community, <00:24:02.070>not <00:24:02.245>the, <00:24:02.419>the, <00:24:02.595>the,

500
00:24:06.705 --> 00:24:08.205
<00:24:06.705>not <00:24:07.042>the <00:24:07.379>casino <00:24:07.717>gaming <00:24:08.054>community,

501
00:24:08.825 --> 00:24:12.365
<00:24:08.825>the <00:24:09.025>pre <00:24:09.225>alpha <00:24:09.425>early <00:24:09.625>release, <00:24:09.825>whatever <00:24:10.025>on <00:24:10.225>Steam,

502
00:24:13.185 --> 00:24:17.245
<00:24:13.185>you <00:24:13.325>pay <00:24:13.465>full <00:24:13.605>price, <00:24:13.745>it's <00:24:13.885>garbage, <00:24:14.024>it <00:24:14.165>fails <00:24:14.304>half <00:24:14.445>the <00:24:14.585>time

503
00:24:17.705 --> 00:24:18.845
<00:24:17.705>And <00:24:17.910>you <00:24:18.115>get <00:24:18.320>to <00:24:18.525>alpha <00:24:18.731>test.

504
00:24:19.315 --> 00:24:21.125
<00:24:19.315>Yeah. <00:24:19.490>And <00:24:19.665>you <00:24:19.840>get <00:24:20.015>to <00:24:20.190>test <00:24:20.365>it <00:24:20.540>with <00:24:20.715>us.

505
00:24:21.995 --> 00:24:25.525
<00:24:21.995>Seriously, <00:24:22.150>I <00:24:22.306>pay <00:24:22.461>$60 <00:24:22.617>for <00:24:22.772>something <00:24:22.928>that <00:24:23.083>I <00:24:23.239>can <00:24:23.395>test

506
00:24:27.225 --> 00:24:28.995
<00:24:27.225>that <00:24:27.504>that <00:24:27.784>is <00:24:28.064>not <00:24:28.344>the <00:24:28.625>standard

507
00:24:28.995 --> 00:24:30.515
<00:24:28.995>that <00:24:29.223>we <00:24:29.451>should <00:24:29.679>be <00:24:29.907>living <00:24:30.135>up <00:24:30.363>to.

508
00:24:31.835 --> 00:24:34.315
<00:24:31.835>Hmm. <00:24:32.035>So <00:24:32.235>when <00:24:32.435>it <00:24:32.635>comes <00:24:32.835>to <00:24:33.035>security <00:24:33.235>or

509
00:24:34.335 --> 00:24:37.235
<00:24:34.335>or <00:24:34.510>in <00:24:34.685>general <00:24:34.860>the, <00:24:35.035>the <00:24:35.210>topic, <00:24:35.385>like <00:24:35.560>where <00:24:35.735>do,

510
00:24:37.285 --> 00:24:40.075
<00:24:37.285>where <00:24:37.565>can <00:24:37.845>people <00:24:38.125>start <00:24:38.405>learning <00:24:38.685>things?

511
00:24:40.385 --> 00:24:42.715
<00:24:40.385>Like <00:24:40.560>where, <00:24:40.735>where <00:24:40.910>do, <00:24:41.085>what <00:24:41.260>are, <00:24:41.435>what <00:24:41.610>are <00:24:41.785>resources

512
00:24:42.715 --> 00:24:46.155
<00:24:42.715>that <00:24:42.870>you <00:24:43.026>use <00:24:43.181>to <00:24:43.337>get <00:24:43.492>people, <00:24:43.648>uh, <00:24:43.803>into <00:24:43.959>the <00:24:44.115>feeling

513
00:24:46.215 --> 00:24:48.835
<00:24:46.215>of <00:24:46.415>security <00:24:46.615>rather <00:24:46.814>than <00:24:47.014>just <00:24:47.215>like <00:24:47.415>the, <00:24:47.615>the,

514
00:24:48.895 --> 00:24:50.035
<00:24:48.895>the <00:24:49.151>nitty <00:24:49.408>gritty <00:24:49.664>of <00:24:49.921>it?

515
00:24:50.385 --> 00:24:52.675
<00:24:50.385>Like <00:24:50.525>where <00:24:50.665>can <00:24:50.805>you, <00:24:50.945>where <00:24:51.085>can <00:24:51.225>you <00:24:51.365>start <00:24:51.504>just <00:24:51.645>learning <00:24:51.785>about

516
00:24:52.675 --> 00:24:53.875
<00:24:52.675>everything <00:24:52.945>that <00:24:53.215>can <00:24:53.485>go <00:24:53.755>wrong?

517
00:24:53.945 --> 00:24:56.315
<00:24:53.945>Like <00:24:54.120>what, <00:24:54.294>what <00:24:54.470>are <00:24:54.645>resources <00:24:54.820>that <00:24:54.995>you <00:24:55.169>would <00:24:55.345>recommend

518
00:24:56.315 --> 00:24:57.435
<00:24:56.315>for <00:24:56.483>people <00:24:56.651>to <00:24:56.819>take <00:24:56.987>a <00:24:57.155>look <00:24:57.322>at?

519
00:24:58.425 --> 00:24:59.955
<00:24:58.425>Nothing <00:24:59.113>too <00:24:59.802>specific

520
00:24:59.955 --> 00:25:04.795
<00:24:59.955>because <00:25:00.155>it's <00:25:00.355>not <00:25:00.554>a <00:25:00.754>set <00:25:00.955>of, <00:25:01.155>uh, <00:25:01.355>everything

521
00:25:04.795 --> 00:25:06.835
<00:25:04.795>that <00:25:04.995>we <00:25:05.195>need <00:25:05.395>to <00:25:05.595>know <00:25:05.795>is <00:25:05.995>already <00:25:06.195>known.

522
00:25:06.865 --> 00:25:08.075
<00:25:06.865>It's <00:25:07.228>already <00:25:07.591>out <00:25:07.954>there.

523
00:25:08.995 --> 00:25:10.935
<00:25:08.995>You <00:25:09.228>can <00:25:09.461>start <00:25:09.695>out, <00:25:09.928>there <00:25:10.161>are <00:25:10.395>lots

524
00:25:10.935 --> 00:25:13.175
<00:25:10.935>and <00:25:11.135>lots <00:25:11.335>of <00:25:11.534>books <00:25:11.735>on <00:25:11.935>software <00:25:12.135>craftsmanship, <00:25:12.335>on

525
00:25:13.235 --> 00:25:14.335
<00:25:13.235>how <00:25:13.482>we <00:25:13.730>should <00:25:13.977>do <00:25:14.225>stuff.

526
00:25:15.925 --> 00:25:17.495
<00:25:15.925>Yeah. <00:25:16.158>We <00:25:16.391>just <00:25:16.625>need <00:25:16.858>to <00:25:17.091>do <00:25:17.325>that.

527
00:25:18.505 --> 00:25:22.565
<00:25:18.505>And <00:25:18.632>we <00:25:18.759>just <00:25:18.886>need <00:25:19.014>the <00:25:19.141>support <00:25:19.268>of, <00:25:19.395>uh, <00:25:19.523>all <00:25:19.650>the <00:25:19.777>higher <00:25:19.905>ups

528
00:25:22.565 --> 00:25:26.045
<00:25:22.565>and <00:25:22.720>all <00:25:22.876>the <00:25:23.031>enterprise <00:25:23.187>people <00:25:23.342>in <00:25:23.498>order <00:25:23.653>to <00:25:23.809>do <00:25:23.965>that.

529
00:25:26.905 --> 00:25:30.445
<00:25:26.905>So <00:25:27.032>a <00:25:27.159>lot <00:25:27.286>of <00:25:27.414>the <00:25:27.541>time <00:25:27.668>we <00:25:27.795>will <00:25:27.923>not, <00:25:28.050>I <00:25:28.177>don't <00:25:28.305>think

530
00:25:30.445 --> 00:25:33.565
<00:25:30.445>that <00:25:30.620>we <00:25:30.794>will <00:25:30.970>show <00:25:31.145>on <00:25:31.320>our <00:25:31.495>work <00:25:31.669>workshop <00:25:31.845>anything

531
00:25:33.565 --> 00:25:36.765
<00:25:33.565>that <00:25:33.798>is <00:25:34.031>unknown, <00:25:34.265>anything <00:25:34.498>that <00:25:34.731>is <00:25:34.965>unknowable.

532
00:25:36.995 --> 00:25:39.565
<00:25:36.995>It's <00:25:37.195>not <00:25:37.395>a, <00:25:37.594>some <00:25:37.794>of <00:25:37.995>the <00:25:38.195>hidden <00:25:38.395>trick

533
00:25:39.595 --> 00:25:43.765
<00:25:39.595>that <00:25:39.735>only <00:25:39.875>we <00:25:40.015>know <00:25:40.155>if <00:25:40.295>you <00:25:40.435>have <00:25:40.575>25 <00:25:40.715>years <00:25:40.855>of <00:25:40.995>experience,

534
00:25:43.825 --> 00:25:46.005
<00:25:43.825>you <00:25:44.058>are <00:25:44.291>called <00:25:44.525>on <00:25:44.758>a <00:25:44.991>mountain <00:25:45.225>top

535
00:25:46.025 --> 00:25:47.765
<00:25:46.025>and <00:25:46.258>the <00:25:46.491>street <00:25:46.725>is <00:25:46.958>revealed <00:25:47.191>to <00:25:47.425>you.

536
00:25:48.315 --> 00:25:51.005
<00:25:48.315>That <00:25:48.548>doesn't <00:25:48.781>happen. <00:25:49.015>We <00:25:49.248>just <00:25:49.481>know <00:25:49.715>it.

537
00:25:51.025 --> 00:25:52.885
<00:25:51.025>We <00:25:51.258>just <00:25:51.491>need <00:25:51.725>to <00:25:51.958>actually <00:25:52.191>do <00:25:52.425>it.

538
00:25:52.885 --> 00:25:57.005
<00:25:52.885>We <00:25:53.085>just <00:25:53.285>need <00:25:53.485>to <00:25:53.685>communicate <00:25:53.885>with <00:25:54.085>the <00:25:54.285>people,

539
00:25:57.565 --> 00:25:59.965
<00:25:57.565>specifically <00:25:57.765>people <00:25:57.965>from <00:25:58.165>the <00:25:58.365>other <00:25:58.565>side, <00:25:58.765>like <00:25:58.965>boar

540
00:26:00.155 --> 00:26:03.845
<00:26:00.155>that <00:26:00.388>focus <00:26:00.621>on <00:26:00.855>security <00:26:01.088>in <00:26:01.321>order <00:26:01.555>to

541
00:26:04.515 --> 00:26:08.165
<00:26:04.515>move <00:26:04.655>things <00:26:04.795>forward <00:26:04.935>so <00:26:05.075>we <00:26:05.215>can <00:26:05.355>have <00:26:05.495>a <00:26:05.635>more <00:26:05.775>secure <00:26:05.915>product.

542
00:26:08.635 --> 00:26:09.805
<00:26:08.635>Basically <00:26:09.161>having, <00:26:09.688>uh,

543
00:26:10.345 --> 00:26:13.445
<00:26:10.345>the <00:26:10.625>Fable <00:26:10.905>secure <00:26:11.185>software <00:26:11.465>development <00:26:11.745>lifecycle,

544
00:26:14.625 --> 00:26:15.925
<00:26:14.625>not <00:26:14.917>just <00:26:15.210>calling <00:26:15.502>it <00:26:15.795>that,

545
00:26:16.065 --> 00:26:18.965
<00:26:16.065>but <00:26:16.345>actually <00:26:16.625>doing <00:26:16.905>it, <00:26:17.185>injecting <00:26:17.465>security

546
00:26:19.265 --> 00:26:21.445
<00:26:19.265>as <00:26:19.498>early <00:26:19.731>in <00:26:19.965>the <00:26:20.198>process <00:26:20.431>as <00:26:20.665>possible.

547
00:26:22.515 --> 00:26:25.645
<00:26:22.515>Yeah. <00:26:22.715>Security <00:26:22.915>people <00:26:23.115>love, <00:26:23.315>uh, <00:26:23.515>when <00:26:23.715>that <00:26:23.915>happens,

548
00:26:26.025 --> 00:26:27.365
<00:26:26.025>but <00:26:26.326>it <00:26:26.628>doesn't <00:26:26.929>usually <00:26:27.231>happen.

549
00:26:27.395 --> 00:26:29.605
<00:26:27.395>Usually <00:26:27.675>it's, <00:26:27.955>we've <00:26:28.235>already <00:26:28.514>built <00:26:28.795>this

550
00:26:30.145 --> 00:26:31.645
<00:26:30.145>and <00:26:30.482>we <00:26:30.820>already <00:26:31.157>shipped <00:26:31.495>it.

551
00:26:32.185 --> 00:26:34.245
<00:26:32.185>Uh, <00:26:32.385>just <00:26:32.585>a <00:26:32.784>sign <00:26:32.985>here <00:26:33.185>that <00:26:33.385>it's <00:26:33.585>secure.

552
00:26:35.595 --> 00:26:38.605
<00:26:35.595>Yeah. <00:26:35.828>My <00:26:36.061>philosophy <00:26:36.295>is, <00:26:36.528>uh, <00:26:36.761>break <00:26:36.995>it

553
00:26:39.225 --> 00:26:40.325
<00:26:39.225>so <00:26:39.554>other <00:26:39.885>people <00:26:40.215>won't.

554
00:26:41.065 --> 00:26:42.325
<00:26:41.065>Um, <00:26:41.632>I <00:26:42.199>would,

555
00:26:42.505 --> 00:26:44.685
<00:26:42.505>and <00:26:42.680>that <00:26:42.855>is <00:26:43.030>a, <00:26:43.205>a <00:26:43.380>lot <00:26:43.555>of <00:26:43.730>my <00:26:43.905>philosophy

556
00:26:44.685 --> 00:26:47.965
<00:26:44.685>that <00:26:44.812>I've <00:26:44.939>invested <00:26:45.066>a <00:26:45.194>lot <00:26:45.321>of <00:26:45.448>time <00:26:45.575>actually <00:26:45.703>my <00:26:45.830>money <00:26:45.957>into <00:26:46.085>it,

557
00:26:48.105 --> 00:26:49.765
<00:26:48.105>to, <00:26:48.455>to <00:26:48.805>build <00:26:49.155>out <00:26:49.505>tooling

558
00:26:49.785 --> 00:26:53.605
<00:26:49.785>and <00:26:49.912>an <00:26:50.039>entire <00:26:50.166>platform <00:26:50.294>where <00:26:50.421>people <00:26:50.548>can <00:26:50.675>safely <00:26:50.803>go <00:26:50.930>in <00:26:51.057>and <00:26:51.185>see

559
00:26:54.105 --> 00:26:58.405
<00:26:54.105>and <00:26:54.245>feel <00:26:54.385>and, <00:26:54.525>and <00:26:54.665>do <00:26:54.805>the <00:26:54.945>breaking, <00:26:55.085>uh, <00:26:55.225>like <00:26:55.365>this <00:26:55.505>tool

560
00:26:58.405 --> 00:26:59.845
<00:26:58.405>that <00:26:58.590>we <00:26:58.775>are <00:26:58.960>going <00:26:59.145>to <00:26:59.330>demo <00:26:59.515>on <00:26:59.701>the,

561
00:27:00.065 --> 00:27:04.845
<00:27:00.065>and <00:27:00.192>then <00:27:00.319>use <00:27:00.446>on <00:27:00.574>on <00:27:00.701>the <00:27:00.828>workshop, <00:27:00.955>do <00:27:01.083>it <00:27:01.210>in <00:27:01.337>practice, <00:27:01.465>see

562
00:27:04.865 --> 00:27:07.885
<00:27:04.865>how <00:27:05.040>that <00:27:05.215>works <00:27:05.390>and <00:27:05.565>why <00:27:05.740>it <00:27:05.915>doesn't <00:27:06.090>protect <00:27:06.265>you.

563
00:27:08.465 --> 00:27:11.165
<00:27:08.465>And <00:27:08.620>then <00:27:08.776>hopefully <00:27:08.931>next <00:27:09.087>time <00:27:09.242>you <00:27:09.398>are <00:27:09.553>going <00:27:09.709>to <00:27:09.865>remember

564
00:27:11.945 --> 00:27:15.565
<00:27:11.945>to <00:27:12.085>do <00:27:12.225>it <00:27:12.365>a <00:27:12.504>bit <00:27:12.645>differently, <00:27:12.784>it's <00:27:12.925>going <00:27:13.064>to <00:27:13.205>be <00:27:13.345>easier

565
00:27:15.665 --> 00:27:19.605
<00:27:15.665>to <00:27:15.792>do <00:27:15.919>it <00:27:16.046>once <00:27:16.174>instead <00:27:16.301>of <00:27:16.428>getting <00:27:16.555>the <00:27:16.683>call <00:27:16.810>at <00:27:16.937>2:00 <00:27:17.065>AM

566
00:27:19.705 --> 00:27:22.005
<00:27:19.705>by <00:27:19.905>somebody <00:27:20.105>like <00:27:20.304>me <00:27:20.504>saying <00:27:20.705>we <00:27:20.905>got <00:27:21.105>hacked

567
00:27:22.115 --> 00:27:24.685
<00:27:22.115>because <00:27:22.315>I <00:27:22.515>have <00:27:22.715>had <00:27:22.915>such <00:27:23.115>calls <00:27:23.315>to <00:27:23.515>make,

568
00:27:25.545 --> 00:27:28.365
<00:27:25.545>and <00:27:25.672>then <00:27:25.799>somebody <00:27:25.926>has <00:27:26.054>to <00:27:26.181>do <00:27:26.308>it <00:27:26.435>in <00:27:26.563>five <00:27:26.690>minutes <00:27:26.817>or <00:27:26.945>less.

569
00:27:29.065 --> 00:27:31.125
<00:27:29.065>And, <00:27:29.298>uh, <00:27:29.531>it's <00:27:29.765>a <00:27:29.998>lot <00:27:30.231>more <00:27:30.465>stress.

570
00:27:31.745 --> 00:27:35.365
<00:27:31.745>But, <00:27:31.872>uh, <00:27:31.999>I <00:27:32.126>can't <00:27:32.254>say <00:27:32.381>whether <00:27:32.508>the <00:27:32.635>investment <00:27:32.763>in <00:27:32.890>in <00:27:33.017>time <00:27:33.145>is,

571
00:27:35.665 --> 00:27:36.845
<00:27:35.665>is <00:27:35.930>good <00:27:36.196>now <00:27:36.461>or <00:27:36.727>not.

572
00:27:37.405 --> 00:27:40.765
<00:27:37.405>I <00:27:37.580>can <00:27:37.754>help <00:27:37.930>people <00:27:38.105>by <00:27:38.280>providing <00:27:38.455>all <00:27:38.629>this <00:27:38.805>tooling

573
00:27:41.185 --> 00:27:44.605
<00:27:41.185>and <00:27:41.312>by <00:27:41.439>shouting <00:27:41.566>off <00:27:41.694>the <00:27:41.821>top <00:27:41.948>of <00:27:42.075>my <00:27:42.203>head <00:27:42.330>for <00:27:42.457>people <00:27:42.585>to,

574
00:27:44.905 --> 00:27:45.925
<00:27:44.905>uh, <00:27:45.134>who <00:27:45.364>want <00:27:45.593>to <00:27:45.822>listen.

575
00:27:47.445 --> 00:27:49.725
<00:27:47.445>Hmm. <00:27:47.620>Yeah. <00:27:47.794>There <00:27:47.970>is <00:27:48.145>a <00:27:48.320>lot <00:27:48.495>of <00:27:48.669>magical <00:27:48.845>thinking

576
00:27:49.725 --> 00:27:52.765
<00:27:49.725>that <00:27:50.074>involved <00:27:50.425>with <00:27:50.774>the <00:27:51.125>developers.

577
00:27:53.675 --> 00:27:56.725
<00:27:53.675>They <00:27:53.908>know <00:27:54.141>which <00:27:54.375>code, <00:27:54.608>they <00:27:54.841>write <00:27:55.075>code,

578
00:27:57.025 --> 00:27:59.685
<00:27:57.025>but <00:27:57.225>they <00:27:57.425>treat <00:27:57.625>a <00:27:57.825>library <00:27:58.025>that <00:27:58.225>they're <00:27:58.425>using

579
00:28:00.105 --> 00:28:03.205
<00:28:00.105>or <00:28:00.280>some <00:28:00.455>pattern <00:28:00.630>that <00:28:00.805>they're <00:28:00.980>using <00:28:01.155>us <00:28:01.330>that <00:28:01.505>is,

580
00:28:03.205 --> 00:28:07.205
<00:28:03.205>that <00:28:03.405>it's <00:28:03.605>secure <00:28:03.804>by <00:28:04.004>magic <00:28:04.205>is <00:28:04.405>just <00:28:04.605>secure.

581
00:28:07.345 --> 00:28:09.565
<00:28:07.345>So <00:28:07.520>if <00:28:07.695>we <00:28:07.870>use <00:28:08.045>this, <00:28:08.220>we're <00:28:08.395>gonna <00:28:08.570>be <00:28:08.745>secure.

582
00:28:11.015 --> 00:28:14.485
<00:28:11.015>Don't <00:28:11.215>asking <00:28:11.415>the <00:28:11.615>not <00:28:11.815>asking <00:28:12.015>themselves <00:28:12.215>easy <00:28:12.415>actually,

583
00:28:14.955 --> 00:28:17.685
<00:28:14.955>because <00:28:15.188>then <00:28:15.421>the <00:28:15.655>answer <00:28:15.888>is <00:28:16.121>always <00:28:16.355>obvious.

584
00:28:18.345 --> 00:28:21.405
<00:28:18.345>It <00:28:18.472>is, <00:28:18.599>if <00:28:18.726>you <00:28:18.854>use <00:28:18.981>it <00:28:19.108>right, <00:28:19.235>am <00:28:19.363>I <00:28:19.490>using <00:28:19.617>it <00:28:19.745>right?

585
00:28:22.505 --> 00:28:25.325
<00:28:22.505>And <00:28:22.680>once <00:28:22.855>they <00:28:23.030>start <00:28:23.205>thinking <00:28:23.380>on <00:28:23.555>that, <00:28:23.730>on <00:28:23.905>uh,

586
00:28:25.375 --> 00:28:29.045
<00:28:25.375>every <00:28:25.530>workshop <00:28:25.686>we've <00:28:25.841>done, <00:28:25.997>we <00:28:26.152>had <00:28:26.308>cases <00:28:26.463>when <00:28:26.619>somebody <00:28:26.775>said,

587
00:28:29.165 --> 00:28:31.165
<00:28:29.165>I <00:28:29.365>think <00:28:29.565>we <00:28:29.764>have <00:28:29.965>this <00:28:30.165>case <00:28:30.365>in <00:28:30.565>production,

588
00:28:32.425 --> 00:28:33.925
<00:28:32.425>We <00:28:32.762>need <00:28:33.100>to <00:28:33.437>refactor <00:28:33.774>something.

589
00:28:34.175 --> 00:28:36.205
<00:28:34.175>There <00:28:34.375>was <00:28:34.575>always <00:28:34.774>somebody <00:28:34.975>saying, <00:28:35.175>oh, <00:28:35.375>I <00:28:35.575>need

590
00:28:36.205 --> 00:28:37.525
<00:28:36.205>to <00:28:36.403>do <00:28:36.601>something <00:28:36.799>in <00:28:36.997>my <00:28:37.195>code <00:28:37.393>now.

591
00:28:38.805 --> 00:28:39.965
<00:28:38.805>Hmm. <00:28:39.153>Well <00:28:39.501>that's <00:28:39.849>good.

592
00:28:40.085 --> 00:28:41.485
<00:28:40.085>I <00:28:40.265>mean, <00:28:40.445>like <00:28:40.625>that, <00:28:40.805>that's <00:28:40.985>a <00:28:41.165>good <00:28:41.344>learning

593
00:28:41.485 --> 00:28:42.645
<00:28:41.485>because <00:28:42.006>I <00:28:42.529>mean,

594
00:28:42.905 --> 00:28:45.285
<00:28:42.905>that's <00:28:43.060>always <00:28:43.216>the <00:28:43.371>thing <00:28:43.527>when <00:28:43.682>people <00:28:43.838>get <00:28:43.993>like <00:28:44.149>very <00:28:44.305>arrogant

595
00:28:45.285 --> 00:28:46.805
<00:28:45.285>about <00:28:45.480>like, <00:28:45.675>you <00:28:45.871>should <00:28:46.066>have <00:28:46.262>done <00:28:46.457>it <00:28:46.653>differently.

596
00:28:47.145 --> 00:28:48.205
<00:28:47.145>We <00:28:47.463>all <00:28:47.781>make <00:28:48.099>mistakes.

597
00:28:48.305 --> 00:28:50.165
<00:28:48.305>We <00:28:48.460>all <00:28:48.616>write <00:28:48.771>code <00:28:48.927>that <00:28:49.082>we <00:28:49.238>are <00:28:49.393>not <00:28:49.549>proud <00:28:49.705>of.

598
00:28:50.225 --> 00:28:53.405
<00:28:50.225>And <00:28:50.365>like, <00:28:50.504>sadly <00:28:50.645>enough, <00:28:50.784>I, <00:28:50.925>I <00:28:51.064>realized <00:28:51.205>that <00:28:51.344>in <00:28:51.485>open <00:28:51.625>source.

599
00:28:53.645 --> 00:28:56.085
<00:28:53.645>I <00:28:53.925>wrote <00:28:54.205>things <00:28:54.485>in <00:28:54.764>2003, <00:28:55.045>2005

600
00:28:56.085 --> 00:28:57.645
<00:28:56.085>that <00:28:56.435>were <00:28:56.785>basically <00:28:57.135>absolutely <00:28:57.485>horrible.

601
00:28:57.985 --> 00:29:00.085
<00:28:57.985>But <00:28:58.140>people <00:28:58.296>loved <00:28:58.451>them <00:28:58.607>because <00:28:58.762>they <00:28:58.918>were <00:28:59.073>easy <00:28:59.229>to <00:28:59.385>use

602
00:29:00.315 --> 00:29:03.245
<00:29:00.315>because <00:29:00.490>yes, <00:29:00.665>they <00:29:00.840>were <00:29:01.015>actually <00:29:01.190>insecure <00:29:01.365>to <00:29:01.540>a <00:29:01.715>degree

603
00:29:03.245 --> 00:29:05.325
<00:29:03.245>that <00:29:03.445>actually <00:29:03.645>was <00:29:03.844>easy <00:29:04.044>to <00:29:04.245>do <00:29:04.445>these <00:29:04.645>kind

604
00:29:05.325 --> 00:29:06.805
<00:29:05.325>of <00:29:05.547>things <00:29:05.769>without <00:29:05.991>understanding <00:29:06.213>what <00:29:06.435>you <00:29:06.657>do.

605
00:29:07.185 --> 00:29:08.485
<00:29:07.185>And <00:29:07.379>you <00:29:07.574>don't <00:29:07.770>feel <00:29:07.965>proud <00:29:08.159>of <00:29:08.355>it,

606
00:29:08.485 --> 00:29:10.805
<00:29:08.485>but <00:29:08.685>you <00:29:08.885>just <00:29:09.084>cannot <00:29:09.284>take <00:29:09.485>it <00:29:09.685>away <00:29:09.885>anymore.

607
00:29:10.945 --> 00:29:12.085
<00:29:10.945>The <00:29:11.150>other <00:29:11.355>thing <00:29:11.560>that <00:29:11.765>I <00:29:11.971>found,

608
00:29:12.085 --> 00:29:13.925
<00:29:12.085>like <00:29:12.435>when <00:29:12.785>you <00:29:13.135>publish <00:29:13.485>something

609
00:29:13.985 --> 00:29:16.725
<00:29:13.985>and <00:29:14.101>you <00:29:14.218>get <00:29:14.334>it <00:29:14.451>out <00:29:14.568>there, <00:29:14.685>it's <00:29:14.801>really <00:29:14.918>hard <00:29:15.034>to <00:29:15.151>get <00:29:15.268>it, <00:29:15.385>uh,

610
00:29:16.785 --> 00:29:18.885
<00:29:16.785>get <00:29:16.960>it <00:29:17.135>not <00:29:17.310>used <00:29:17.485>anymore, <00:29:17.660>even <00:29:17.835>if <00:29:18.010>it's <00:29:18.185>horrible.

611
00:29:19.625 --> 00:29:20.625
<00:29:19.625>Yep. <00:29:20.525>So

612
00:29:22.235 --> 00:29:23.235
<00:29:22.235>Yeah. <00:29:22.534>Yeah, <00:29:22.834>yeah. <00:29:23.135>Classic

613
00:29:23.235 --> 00:29:23.965
example.

614
00:29:24.085 --> 00:29:25.685
<00:29:24.085>I <00:29:24.225>mean, <00:29:24.365>the <00:29:24.505>other <00:29:24.645>thing, <00:29:24.785>what <00:29:24.925>cracks <00:29:25.065>me <00:29:25.205>up <00:29:25.345>is <00:29:25.485>like

615
00:29:25.685 --> 00:29:27.565
<00:29:25.685>how <00:29:25.885>many <00:29:26.085>times <00:29:26.284>you <00:29:26.485>see <00:29:26.685>like, <00:29:26.885>uh, <00:29:27.085>uh,

616
00:29:27.745 --> 00:29:31.885
<00:29:27.745>you <00:29:27.885>see <00:29:28.024>like <00:29:28.165>misspelling <00:29:28.304>of <00:29:28.445>of, <00:29:28.584>of, <00:29:28.725>uh, <00:29:28.864>of <00:29:29.004>MPM <00:29:29.145>packages?

617
00:29:32.185 --> 00:29:36.525
<00:29:32.185>Oh, <00:29:32.312>basically <00:29:32.439>the, <00:29:32.566>the <00:29:32.694>people <00:29:32.821>have <00:29:32.948>like, <00:29:33.075>uh, <00:29:33.203>had <00:29:33.330>like <00:29:33.457>vi <00:29:33.585>uh,

618
00:29:36.525 --> 00:29:39.805
<00:29:36.525>uh, <00:29:36.758>hallucinated <00:29:36.991>package <00:29:37.225>names <00:29:37.458>from <00:29:37.691>chat <00:29:37.925>GPT

619
00:29:39.805 --> 00:29:42.365
<00:29:39.805>that <00:29:39.960>didn't <00:29:40.116>exist <00:29:40.271>and <00:29:40.427>then <00:29:40.582>wrote <00:29:40.738>malware <00:29:40.893>with <00:29:41.049>that <00:29:41.205>name.

620
00:29:42.795 --> 00:29:43.795
Yeah.

621
00:29:44.195 --> 00:29:48.205
<00:29:44.195>Yeah. <00:29:44.395>That <00:29:44.595>is <00:29:44.794>a <00:29:44.995>vector <00:29:45.195>supply <00:29:45.395>chain <00:29:45.595>attack.

622
00:29:48.665 --> 00:29:51.605
<00:29:48.665>It <00:29:48.805>is <00:29:48.945>an, <00:29:49.085>it <00:29:49.225>is <00:29:49.365>an <00:29:49.504>injection <00:29:49.645>in, <00:29:49.784>in <00:29:49.925>a <00:29:50.065>way

623
00:29:51.605 --> 00:29:54.685
<00:29:51.605>because <00:29:51.805>you <00:29:52.005>are <00:29:52.205>injecting <00:29:52.405>something <00:29:52.605>into <00:29:52.805>your <00:29:53.005>configuration.

624
00:29:55.395 --> 00:29:57.725
<00:29:55.395>It's <00:29:55.570>still <00:29:55.745>an <00:29:55.920>injection <00:29:56.095>of <00:29:56.270>sorts. <00:29:56.445>So <00:29:56.620>what <00:29:56.795>are

625
00:29:57.725 --> 00:29:59.445
<00:29:57.725>Your, <00:29:57.958>what <00:29:58.191>are <00:29:58.425>your <00:29:58.658>customers <00:29:58.891>normally <00:29:59.125>like?

626
00:29:59.445 --> 00:30:00.885
<00:29:59.445>What <00:29:59.630>do <00:29:59.815>you, <00:30:00.000>who <00:30:00.185>do <00:30:00.370>you <00:30:00.555>work <00:30:00.741>for?

627
00:30:00.985 --> 00:30:03.045
<00:30:00.985>And <00:30:01.140>I <00:30:01.296>mean, <00:30:01.451>don't <00:30:01.607>name <00:30:01.762>names <00:30:01.918>and <00:30:02.073>stuff <00:30:02.229>like <00:30:02.385>that.

628
00:30:03.105 --> 00:30:06.245
<00:30:03.105>And <00:30:03.221>what <00:30:03.338>is <00:30:03.455>one <00:30:03.571>horror <00:30:03.688>story <00:30:03.805>that <00:30:03.921>you <00:30:04.038>had <00:30:04.155>that <00:30:04.271>just <00:30:04.388>were <00:30:04.505>fla

629
00:30:06.245 --> 00:30:09.725
<00:30:06.245>that <00:30:06.400>we <00:30:06.556>were <00:30:06.711>flabbergasted <00:30:06.867>in <00:30:07.022>terms <00:30:07.178>of <00:30:07.333>like <00:30:07.489>security, <00:30:07.645>that

630
00:30:09.795 --> 00:30:11.325
<00:30:09.795>that <00:30:10.070>shouldn't <00:30:10.345>have <00:30:10.621>been <00:30:10.896>that <00:30:11.172>way?

631
00:30:11.955 --> 00:30:15.045
<00:30:11.955>Okay. <00:30:12.235>Um, <00:30:12.514>me, <00:30:12.794>can <00:30:13.074>you <00:30:13.355>start?

632
00:30:15.265 --> 00:30:19.485
<00:30:15.265>Um, <00:30:15.465>uh, <00:30:15.665>most <00:30:15.865>of <00:30:16.065>our <00:30:16.265>professional <00:30:16.465>clients, <00:30:16.665>uh,

633
00:30:20.305 --> 00:30:22.485
<00:30:20.305>are <00:30:20.655>kind <00:30:21.005>of <00:30:21.355>technological <00:30:21.705>startups.

634
00:30:23.425 --> 00:30:27.245
<00:30:23.425>So <00:30:23.705>we <00:30:23.985>sometimes <00:30:24.264>tell <00:30:24.544>ourselves <00:30:24.825>kinda

635
00:30:28.405 --> 00:30:30.445
<00:30:28.405>software <00:30:28.685>mercenaries <00:30:28.965>or <00:30:29.245>something <00:30:29.524>like <00:30:29.805>that.

636
00:30:30.835 --> 00:30:34.405
<00:30:30.835>When <00:30:31.010>some, <00:30:31.185>when <00:30:31.360>somebody <00:30:31.535>has <00:30:31.710>a <00:30:31.885>technological <00:30:32.060>problem <00:30:32.235>on

637
00:30:34.475 --> 00:30:38.205
<00:30:34.475>some, <00:30:34.649>uh, <00:30:34.824>way, <00:30:35.000>then <00:30:35.175>that's <00:30:35.350>where <00:30:35.524>we <00:30:35.699>move <00:30:35.875>in

638
00:30:38.225 --> 00:30:40.405
<00:30:38.225>and <00:30:38.458>actually <00:30:38.691>help <00:30:38.925>them <00:30:39.158>move <00:30:39.391>past <00:30:39.625>that,

639
00:30:40.555 --> 00:30:42.045
<00:30:40.555>whether <00:30:40.823>it's <00:30:41.091>on <00:30:41.359>the <00:30:41.627>front <00:30:41.896>end

640
00:30:42.045 --> 00:30:44.525
<00:30:42.045>or <00:30:42.220>the <00:30:42.395>back <00:30:42.570>end <00:30:42.745>on <00:30:42.920>the <00:30:43.095>infrastructure, <00:30:43.270>on <00:30:43.445>whatever.

641
00:30:45.715 --> 00:30:47.885
<00:30:45.715>Yeah. <00:30:45.995>That's <00:30:46.274>where <00:30:46.554>our <00:30:46.834>kind <00:30:47.115>of

642
00:30:49.305 --> 00:30:52.805
<00:30:49.305>making <00:30:49.480>startups <00:30:49.655>fail <00:30:49.830>because <00:30:50.005>of <00:30:50.180>funding <00:30:50.355>reasons <00:30:50.530>and <00:30:50.705>not

643
00:30:52.805 --> 00:30:54.565
<00:30:52.805>because <00:30:53.271>of <00:30:53.738>technological <00:30:54.205>reasons.

644
00:30:56.145 --> 00:30:59.165
<00:30:56.145>So <00:30:56.378>the <00:30:56.611>technology <00:30:56.845>is <00:30:57.078>working, <00:30:57.311>it's <00:30:57.545>operational,

645
00:30:59.545 --> 00:31:03.725
<00:30:59.545>but <00:30:59.700>the <00:30:59.856>other <00:31:00.011>part, <00:31:00.167>the <00:31:00.322>hard <00:31:00.478>part <00:31:00.633>of <00:31:00.789>running <00:31:00.945>startups

646
00:31:04.115 --> 00:31:06.645
<00:31:04.115>that <00:31:04.290>I <00:31:04.465>say <00:31:04.640>is <00:31:04.815>left <00:31:04.990>to <00:31:05.165>the <00:31:05.340>actual <00:31:05.515>startup

647
00:31:07.185 --> 00:31:08.645
<00:31:07.185>In <00:31:07.513>terms <00:31:07.841>of <00:31:08.170>being <00:31:08.499>flabbergasted.

648
00:31:08.905 --> 00:31:12.725
<00:31:08.905>I'm <00:31:09.045>going <00:31:09.185>to <00:31:09.325>go <00:31:09.465>with <00:31:09.605>this <00:31:09.745>one. <00:31:09.885>Um, <00:31:10.024>so <00:31:10.165>of <00:31:10.305>course,

649
00:31:13.065 --> 00:31:16.635
<00:31:13.065>Was <00:31:13.345>it <00:31:13.625>something <00:31:13.905>I <00:31:14.185>did, <00:31:14.465>Uh,

650
00:31:17.815 --> 00:31:19.355
<00:31:17.815>I'm <00:31:18.092>not <00:31:18.369>gonna <00:31:18.646>comment <00:31:18.923>on <00:31:19.201>that.

651
00:31:19.935 --> 00:31:22.355
<00:31:19.935>You <00:31:20.062>are <00:31:20.189>free <00:31:20.316>to <00:31:20.444>find <00:31:20.571>yourself <00:31:20.698>in <00:31:20.825>the <00:31:20.953>store <00:31:21.080>if <00:31:21.207>you <00:31:21.335>want.

652
00:31:22.935 --> 00:31:27.635
<00:31:22.935>Uh, <00:31:23.090>but <00:31:23.246>I, <00:31:23.401>uh, <00:31:23.557>every <00:31:23.712>time <00:31:23.868>when <00:31:24.023>I <00:31:24.179>start <00:31:24.335>working

653
00:31:27.635 --> 00:31:29.835
<00:31:27.635>with <00:31:27.790>a <00:31:27.946>new <00:31:28.101>customer, <00:31:28.257>my <00:31:28.412>first <00:31:28.568>question <00:31:28.723>is <00:31:28.879>giving <00:31:29.035>me

654
00:31:29.835 --> 00:31:30.915
<00:31:29.835>access <00:31:30.159>to <00:31:30.483>the <00:31:30.807>reps.

655
00:31:31.175 --> 00:31:34.515
<00:31:31.175>And <00:31:31.315>I'm <00:31:31.455>going <00:31:31.595>to <00:31:31.735>run <00:31:31.875>gi <00:31:32.014>uh, <00:31:32.155>git <00:31:32.294>leaks <00:31:32.435>on <00:31:32.575>everything.

656
00:31:34.975 --> 00:31:37.555
<00:31:34.975>And <00:31:35.175>obviously, <00:31:35.375>and <00:31:35.574>trust <00:31:35.774>me, <00:31:35.975>this <00:31:36.175>happens <00:31:36.375>time

657
00:31:37.555 --> 00:31:40.795
<00:31:37.555>and <00:31:37.788>again, <00:31:38.021>there <00:31:38.255>are <00:31:38.488>files <00:31:38.721>with <00:31:38.955>passwords

658
00:31:41.615 --> 00:31:43.875
<00:31:41.615>all <00:31:41.895>over <00:31:42.175>the <00:31:42.455>place, <00:31:42.735>hardcoded <00:31:43.015>secrets

659
00:31:44.125 --> 00:31:45.315
<00:31:44.125>everywhere <00:31:44.660>and <00:31:45.196>anywhere.

660
00:31:45.895 --> 00:31:49.715
<00:31:45.895>Uh, <00:31:46.050>and <00:31:46.206>this <00:31:46.361>is <00:31:46.517>obviously <00:31:46.672>an <00:31:46.828>and <00:31:46.983>a <00:31:47.139>continuous <00:31:47.295>exercise.

661
00:31:49.955 --> 00:31:52.515
<00:31:49.955>I <00:31:50.110>have <00:31:50.266>not, <00:31:50.421>I <00:31:50.577>have <00:31:50.732>yet <00:31:50.888>to <00:31:51.043>see <00:31:51.199>an <00:31:51.355>organization

662
00:31:52.585 --> 00:31:53.915
<00:31:52.585>that <00:31:52.884>doesn't <00:31:53.183>have <00:31:53.482>such <00:31:53.782>records.

663
00:31:55.415 --> 00:31:57.395
<00:31:55.415>Uh, <00:31:55.764>and <00:31:56.115>on <00:31:56.465>the, <00:31:56.815>the,

664
00:31:57.535 --> 00:32:01.515
<00:31:57.535>but <00:31:57.710>the <00:31:57.885>flabbergasting <00:31:58.060>moment <00:31:58.235>is <00:31:58.410>I, <00:31:58.585>that <00:31:58.760>was <00:31:58.935>not

665
00:32:01.695 --> 00:32:02.795
<00:32:01.695>for <00:32:02.190>one <00:32:02.685>customer.

666
00:32:02.825 --> 00:32:04.115
<00:32:02.825>That <00:32:03.057>was <00:32:03.289>not <00:32:03.521>just <00:32:03.753>the <00:32:03.986>case.

667
00:32:04.495 --> 00:32:07.115
<00:32:04.495>But <00:32:04.650>then <00:32:04.806>I <00:32:04.961>started <00:32:05.117>asking, <00:32:05.272>how <00:32:05.428>do <00:32:05.583>you <00:32:05.739>handle <00:32:05.895>how,

668
00:32:07.185 --> 00:32:09.635
<00:32:07.185>what <00:32:07.360>is <00:32:07.534>the <00:32:07.710>process <00:32:07.885>of <00:32:08.060>handling <00:32:08.235>of <00:32:08.409>this <00:32:08.585>secrets?

669
00:32:09.855 --> 00:32:13.955
<00:32:09.855>And <00:32:09.995>they <00:32:10.135>tell <00:32:10.275>me, <00:32:10.415>oh <00:32:10.555>no, <00:32:10.695>those <00:32:10.835>passwords <00:32:10.975>are <00:32:11.115>um, <00:32:11.255>outdated.

670
00:32:14.445 --> 00:32:18.035
<00:32:14.445>We're <00:32:14.645>not <00:32:14.845>using <00:32:15.044>them <00:32:15.245>anymore. <00:32:15.445>Okay, <00:32:15.645>sounds <00:32:15.845>better.

671
00:32:18.575 --> 00:32:21.715
<00:32:18.575>And <00:32:18.730>then <00:32:18.886>they <00:32:19.041>say, <00:32:19.197>now <00:32:19.352>we <00:32:19.508>share <00:32:19.663>this <00:32:19.819>yamo <00:32:19.975>file

672
00:32:21.785 --> 00:32:23.795
<00:32:21.785>with <00:32:21.925>all <00:32:22.065>the <00:32:22.205>passwords <00:32:22.345>and <00:32:22.485>we <00:32:22.625>send <00:32:22.765>it <00:32:22.905>to <00:32:23.045>each <00:32:23.185>other

673
00:32:25.145 --> 00:32:27.045
<00:32:25.145>and <00:32:25.425>I <00:32:25.705>see <00:32:25.985>your <00:32:26.264>face, <00:32:26.545>Chris.

674
00:32:27.985 --> 00:32:31.525
<00:32:27.985>So <00:32:28.264>yes. <00:32:28.544>So <00:32:28.824>nothing <00:32:29.104>bad <00:32:29.385>happened

675
00:32:31.525 --> 00:32:34.245
<00:32:31.525>because <00:32:31.700>I <00:32:31.875>then <00:32:32.050>I <00:32:32.225>started <00:32:32.400>screaming <00:32:32.575>off <00:32:32.750>the <00:32:32.925>top

676
00:32:34.245 --> 00:32:35.445
<00:32:34.245>of <00:32:34.605>my <00:32:34.965>head, <00:32:35.324>figuratively.

677
00:32:35.495 --> 00:32:36.685
<00:32:35.495>There <00:32:35.851>was <00:32:36.208>an <00:32:36.566>exercise,

678
00:32:36.685 --> 00:32:38.285
<00:32:36.685>there <00:32:36.918>was <00:32:37.151>a <00:32:37.385>process, <00:32:37.618>there <00:32:37.851>was <00:32:38.085>scanning.

679
00:32:39.205 --> 00:32:43.125
<00:32:39.205>I <00:32:39.360>ordered <00:32:39.516>people <00:32:39.671>to <00:32:39.827>reset <00:32:39.982>passwords, <00:32:40.138>then <00:32:40.293>I <00:32:40.449>ordered <00:32:40.605>people

680
00:32:43.145 --> 00:32:45.365
<00:32:43.145>to <00:32:43.378>just <00:32:43.611>reset <00:32:43.845>without <00:32:44.078>waiting <00:32:44.311>for <00:32:44.545>them,

681
00:32:45.675 --> 00:32:47.485
<00:32:45.675>microservices <00:32:46.141>failed, <00:32:46.608>et <00:32:47.075>cetera.

682
00:32:47.785 --> 00:32:50.885
<00:32:47.785>At <00:32:47.901>the <00:32:48.018>end <00:32:48.135>of <00:32:48.251>the <00:32:48.368>day, <00:32:48.485>people <00:32:48.601>got <00:32:48.718>it <00:32:48.835>into <00:32:48.951>a <00:32:49.068>secure <00:32:49.185>vault

683
00:32:51.705 --> 00:32:53.085
<00:32:51.705>and <00:32:52.015>the <00:32:52.326>process <00:32:52.636>is <00:32:52.947>better.

684
00:32:53.505 --> 00:32:55.845
<00:32:53.505>And <00:32:53.645>obviously <00:32:53.785>something <00:32:53.925>is <00:32:54.065>going <00:32:54.205>to <00:32:54.345>surprise <00:32:54.485>me <00:32:54.625>at <00:32:54.765>the <00:32:54.905>end

685
00:32:55.845 --> 00:32:57.485
<00:32:55.845>of <00:32:56.125>the <00:32:56.405>day <00:32:56.685>because <00:32:56.965>somebody <00:32:57.245>forgot.

686
00:32:57.985 --> 00:33:00.965
<00:32:57.985>But <00:32:58.264>that <00:32:58.544>particular <00:32:58.824>exercise <00:32:59.104>was <00:32:59.385>one

687
00:33:00.965 --> 00:33:02.525
<00:33:00.965>of <00:33:01.245>those <00:33:01.524>shock <00:33:01.804>moments <00:33:02.084>for <00:33:02.365>me.

688
00:33:02.755 --> 00:33:03.965
<00:33:02.755>What <00:33:02.972>the <00:33:03.190>hell <00:33:03.408>are <00:33:03.626>you <00:33:03.844>doing?

689
00:33:03.995 --> 00:33:07.845
<00:33:03.995>Like <00:33:04.169>finding <00:33:04.344>that <00:33:04.520>somebody's <00:33:04.695>keeping <00:33:04.870>their <00:33:05.044>passwords <00:33:05.219>on <00:33:05.395>a

690
00:33:07.845 --> 00:33:09.125
<00:33:07.845>post-it <00:33:08.133>note <00:33:08.421>under <00:33:08.709>the <00:33:08.997>keyboard

691
00:33:09.785 --> 00:33:11.925
<00:33:09.785>and <00:33:09.985>sharing <00:33:10.185>that <00:33:10.385>post-it <00:33:10.585>note <00:33:10.785>with <00:33:10.985>the <00:33:11.185>keyboard

692
00:33:12.025 --> 00:33:13.765
<00:33:12.025>to <00:33:12.491>everybody <00:33:12.958>else, <00:33:13.425>more

693
00:33:13.765 --> 00:33:15.845
<00:33:13.765>or <00:33:13.940>less <00:33:14.115>the <00:33:14.290>same <00:33:14.465>situation. <00:33:14.640>So <00:33:14.815>yeah, <00:33:14.990>this <00:33:15.165>happens.

694
00:33:16.065 --> 00:33:18.725
<00:33:16.065>Wow. <00:33:16.192>Yeah, <00:33:16.319>I <00:33:16.446>mean <00:33:16.574>I <00:33:16.701>love <00:33:16.828>the <00:33:16.955>idea <00:33:17.083>of <00:33:17.210>like, <00:33:17.337>oh, <00:33:17.465>these,

695
00:33:18.725 --> 00:33:20.845
<00:33:18.725>these <00:33:18.958>single <00:33:19.191>passwords <00:33:19.425>are <00:33:19.658>actually <00:33:19.891>not <00:33:20.125>used

696
00:33:20.845 --> 00:33:22.085
<00:33:20.845>anymore, <00:33:21.217>so <00:33:21.589>they're <00:33:21.961>secure.

697
00:33:22.105 --> 00:33:24.725
<00:33:22.105>So <00:33:22.245>we <00:33:22.385>have <00:33:22.525>a <00:33:22.665>list <00:33:22.805>of <00:33:22.945>all <00:33:23.085>of <00:33:23.225>them, <00:33:23.365>like <00:33:23.505>basically

698
00:33:24.865 --> 00:33:26.525
<00:33:24.865>for <00:33:25.145>getting <00:33:25.425>this <00:33:25.705>one <00:33:25.985>VML <00:33:26.265>file,

699
00:33:26.525 --> 00:33:28.325
<00:33:26.525>would <00:33:26.758>it <00:33:26.991>get <00:33:27.225>you <00:33:27.458>access <00:33:27.691>to <00:33:27.925>everything?

700
00:33:28.505 --> 00:33:30.045
<00:33:28.505>Mm-hmm. <00:33:28.851>That's <00:33:29.198>just <00:33:29.544>like, <00:33:29.891>wow.

701
00:33:30.185 --> 00:33:32.565
<00:33:30.185>Uh, <00:33:30.360>I'm, <00:33:30.534>uh, <00:33:30.710>I'm <00:33:30.885>quite <00:33:31.060>shocked <00:33:31.235>to <00:33:31.409>have <00:33:31.585>that.

702
00:33:32.745 --> 00:33:35.285
<00:33:32.745>Uh, <00:33:32.872>I <00:33:32.999>mean <00:33:33.126>we <00:33:33.254>had <00:33:33.381>that <00:33:33.508>with <00:33:33.635>the <00:33:33.763>customer <00:33:33.890>once <00:33:34.017>as <00:33:34.145>well.

703
00:33:35.365 --> 00:33:37.165
<00:33:35.365>I <00:33:35.565>found <00:33:35.765>like <00:33:35.965>a <00:33:36.165>file <00:33:36.365>called <00:33:36.565>passwords <00:33:36.765>text,

704
00:33:37.165 --> 00:33:39.525
<00:33:37.165>which <00:33:37.398>basically <00:33:37.631>had <00:33:37.865>servers <00:33:38.098>all <00:33:38.331>over <00:33:38.565>Europe

705
00:33:39.675 --> 00:33:41.685
<00:33:39.675>with <00:33:39.908>the <00:33:40.141>root <00:33:40.375>password <00:33:40.608>and <00:33:40.841>the <00:33:41.075>username.

706
00:33:42.105 --> 00:33:43.845
<00:33:42.105>And <00:33:42.305>I'm <00:33:42.505>like, <00:33:42.705>you <00:33:42.905>got <00:33:43.105>to <00:33:43.305>be <00:33:43.505>choking.

707
00:33:43.985 --> 00:33:46.365
<00:33:43.985>And <00:33:44.112>the <00:33:44.239>other <00:33:44.366>thing <00:33:44.494>is <00:33:44.621>like <00:33:44.748>when <00:33:44.875>you <00:33:45.003>do <00:33:45.130>analysis <00:33:45.257>on <00:33:45.385>those

708
00:33:46.365 --> 00:33:47.925
<00:33:46.365>things, <00:33:46.598>you <00:33:46.831>realize <00:33:47.065>it's <00:33:47.298>the <00:33:47.531>same <00:33:47.765>password

709
00:33:47.925 --> 00:33:48.925
<00:33:47.925>for <00:33:48.225>like <00:33:48.524>50 <00:33:48.825>servers.

710
00:33:50.685 --> 00:33:51.685
<00:33:50.685>The <00:33:51.135>other <00:33:51.585>thing,

711
00:33:53.285 --> 00:33:56.065
<00:33:53.285>And <00:33:53.460>the <00:33:53.635>password <00:33:53.810>tip <00:33:53.985>is <00:33:54.160>password <00:33:54.335>one, <00:33:54.510>two, <00:33:54.685>$3.

712
00:33:57.225 --> 00:33:58.485
<00:33:57.225>Oh <00:33:57.508>God. <00:33:57.792>Yeah. <00:33:58.075>I <00:33:58.359>mean

713
00:33:58.485 --> 00:34:00.165
<00:33:58.485>that's <00:33:58.718>always <00:33:58.951>fascinating <00:33:59.185>to <00:33:59.418>me <00:33:59.651>as <00:33:59.885>well.

714
00:34:00.165 --> 00:34:01.245
<00:34:00.165>When <00:34:00.408>you <00:34:00.650>see <00:34:00.894>these <00:34:01.137>leaks

715
00:34:01.245 --> 00:34:05.325
<00:34:01.245>of <00:34:01.400>like <00:34:01.556>the <00:34:01.711>passwords <00:34:01.867>used <00:34:02.022>most <00:34:02.178>baseball, <00:34:02.333>uh, <00:34:02.489>uh, <00:34:02.645>secret

716
00:34:05.905 --> 00:34:07.125
<00:34:05.905>God, <00:34:06.124>like <00:34:06.344>all <00:34:06.563>kinds <00:34:06.783>of <00:34:07.003>stuff.

717
00:34:07.125 --> 00:34:08.245
<00:34:07.125>And <00:34:07.461>you're <00:34:07.797>like, <00:34:08.132>I,

718
00:34:09.265 --> 00:34:10.925
<00:34:09.264>Who, <00:34:09.731>who <00:34:10.198>gets <00:34:10.665>That's

719
00:34:11.835 --> 00:34:12.835
<00:34:11.835>That <00:34:12.135>allow <00:34:12.435>for <00:34:12.735>that.

720
00:34:13.255 --> 00:34:15.285
<00:34:13.255>Lemme <00:34:13.488>tell <00:34:13.721>you <00:34:13.955>a <00:34:14.188>story <00:34:14.421>about <00:34:14.655>a,

721
00:34:15.445 --> 00:34:19.325
<00:34:15.445>a <00:34:15.585>major <00:34:15.725>financial <00:34:15.865>institution <00:34:16.005>that <00:34:16.145>I, <00:34:16.285>I <00:34:16.425>had <00:34:16.565>to <00:34:16.705>work <00:34:16.845>for

722
00:34:19.465 --> 00:34:21.285
<00:34:19.465>for <00:34:19.665>a <00:34:19.865>while <00:34:20.065>as <00:34:20.265>a, <00:34:20.465>as <00:34:20.665>a <00:34:20.865>consultant.

723
00:34:21.715 --> 00:34:24.045
<00:34:21.715>They <00:34:21.995>had <00:34:22.275>a <00:34:22.555>password <00:34:22.835>policy <00:34:23.115>obviously.

724
00:34:24.585 --> 00:34:27.405
<00:34:24.585>Uh, <00:34:24.740>and <00:34:24.896>the <00:34:25.051>password <00:34:25.207>policy <00:34:25.362>was <00:34:25.518>obviously <00:34:25.673>that <00:34:25.829>they <00:34:25.985>have

725
00:34:27.405 --> 00:34:29.645
<00:34:27.405>to <00:34:27.685>reset <00:34:27.965>password, <00:34:28.245>uh, <00:34:28.525>every <00:34:28.805>month

726
00:34:29.945 --> 00:34:31.685
<00:34:29.945>and, <00:34:30.295>uh, <00:34:30.645>rotate <00:34:30.995>password <00:34:31.345>monthly

727
00:34:32.225 --> 00:34:33.605
<00:34:32.225>and <00:34:32.535>it <00:34:32.846>has <00:34:33.156>to <00:34:33.467>comply

728
00:34:33.605 --> 00:34:35.765
<00:34:33.605>with <00:34:33.885>whatever <00:34:34.165>complexity, <00:34:34.445>rules, <00:34:34.725>et <00:34:35.005>cetera.

729
00:34:36.105 --> 00:34:40.405
<00:34:36.105>And <00:34:36.338>the <00:34:36.571>default <00:34:36.804>password <00:34:37.038>was <00:34:37.271>password, <00:34:37.505>$1

730
00:34:41.025 --> 00:34:45.565
<00:34:41.025>for <00:34:41.180>January, <00:34:41.336>and <00:34:41.491>then <00:34:41.647>come <00:34:41.802>February <00:34:41.958>it <00:34:42.113>becomes <00:34:42.269>password <00:34:42.425>$2

731
00:34:45.715 --> 00:34:47.285
<00:34:45.715>because <00:34:46.065>it's <00:34:46.415>easy <00:34:46.765>to <00:34:47.115>remember.

732
00:34:47.705 --> 00:34:52.565
<00:34:47.705>And <00:34:47.812>then <00:34:47.920>you <00:34:48.028>go <00:34:48.135>to <00:34:48.243>3, <00:34:48.351>4, <00:34:48.458>5, <00:34:48.566>6, <00:34:48.674>7, <00:34:48.781>12 <00:34:48.889>come <00:34:48.997>in <00:34:49.105>January.

733
00:34:52.735 --> 00:34:56.205
<00:34:52.735>Again, <00:34:52.968>password, <00:34:53.201>$1, <00:34:53.435>nobody <00:34:53.668>complains, <00:34:53.901>everybody's <00:34:54.135>happy.

734
00:34:56.205 --> 00:34:58.045
<00:34:56.205>Nobody <00:34:56.554>ever <00:34:56.904>forgot <00:34:57.255>their <00:34:57.605>passwords.

735
00:34:58.285 --> 00:35:01.925
<00:34:58.285>I <00:34:58.440>bet <00:34:58.596>if <00:34:58.751>I <00:34:58.907>come <00:34:59.062>into <00:34:59.218>that <00:34:59.373>particular <00:34:59.529>financial <00:34:59.685>institution,

736
00:35:01.925 --> 00:35:03.925
<00:35:01.925>even <00:35:02.275>today, <00:35:02.625>many, <00:35:02.975>many <00:35:03.325>years

737
00:35:03.925 --> 00:35:07.285
<00:35:03.925>after <00:35:04.125>that <00:35:04.325>encounter <00:35:04.525>with <00:35:04.725>that <00:35:04.925>policy, <00:35:05.125>I'm <00:35:05.325>going

738
00:35:07.485 --> 00:35:10.045
<00:35:07.485>to <00:35:07.685>find <00:35:07.885>again <00:35:08.085>some <00:35:08.285>of <00:35:08.485>the <00:35:08.685>same <00:35:08.885>passwords.

739
00:35:10.395 --> 00:35:13.085
<00:35:10.395>It's <00:35:10.535>March <00:35:10.675>now, <00:35:10.815>so <00:35:10.955>I'm <00:35:11.095>going <00:35:11.235>to <00:35:11.375>try <00:35:11.515>for <00:35:11.655>password <00:35:11.795>three.

740
00:35:13.835 --> 00:35:15.605
<00:35:13.835>Yeah. <00:35:14.068>Oh <00:35:14.301>wow. <00:35:14.535>And <00:35:14.768>that's <00:35:15.001>the <00:35:15.235>problem

741
00:35:15.675 --> 00:35:19.125
<00:35:15.675>that <00:35:15.850>I'm <00:35:16.025>saying <00:35:16.200>about, <00:35:16.375>uh, <00:35:16.550>the <00:35:16.725>disconnect <00:35:16.900>between <00:35:17.075>people

742
00:35:19.355 --> 00:35:24.085
<00:35:19.355>because <00:35:19.530>that <00:35:19.705>kind <00:35:19.880>of <00:35:20.055>behavior <00:35:20.230>satisfies <00:35:20.405>all <00:35:20.580>the <00:35:20.755>policies

743
00:35:24.085 --> 00:35:25.205
<00:35:24.085>that <00:35:24.589>whoever <00:35:25.093>made.

744
00:35:25.745 --> 00:35:29.165
<00:35:25.745>And <00:35:25.920>I've <00:35:26.095>had <00:35:26.270>cases <00:35:26.444>when <00:35:26.620>I've <00:35:26.795>actually <00:35:26.970>shown, <00:35:27.145>uh,

745
00:35:30.305 --> 00:35:33.045
<00:35:30.305>an <00:35:30.585>officer <00:35:30.865>of <00:35:31.145>a <00:35:31.424>major <00:35:31.705>institution

746
00:35:33.745 --> 00:35:36.005
<00:35:33.745>how <00:35:33.944>I <00:35:34.145>can <00:35:34.345>basically <00:35:34.545>use <00:35:34.745>the <00:35:34.944>login <00:35:35.145>screen

747
00:35:36.025 --> 00:35:38.165
<00:35:36.025>to <00:35:36.225>create <00:35:36.425>a <00:35:36.625>table <00:35:36.825>in <00:35:37.025>inside <00:35:37.225>the <00:35:37.425>database.

748
00:35:38.305 --> 00:35:40.525
<00:35:38.305>And <00:35:38.504>they <00:35:38.705>said, <00:35:38.904>well, <00:35:39.105>it's <00:35:39.305>an <00:35:39.504>internal <00:35:39.705>system.

749
00:35:40.755 --> 00:35:43.805
<00:35:40.755>It's <00:35:41.035>not <00:35:41.315>covered <00:35:41.595>by <00:35:41.875>our <00:35:42.155>SLAs.

750
00:35:43.835 --> 00:35:45.965
<00:35:43.835>It's <00:35:44.068>everything <00:35:44.301>is <00:35:44.535>fine <00:35:44.768>by <00:35:45.001>the <00:35:45.235>agreement,

751
00:35:46.145 --> 00:35:47.925
<00:35:46.145>so <00:35:46.345>we're <00:35:46.545>just <00:35:46.745>going <00:35:46.945>to <00:35:47.145>not <00:35:47.345>fix <00:35:47.545>that.

752
00:35:48.905 --> 00:35:50.365
<00:35:48.905>Wow. <00:35:49.167>Because <00:35:49.430>you <00:35:49.693>don't <00:35:49.956>have <00:35:50.219>emails

753
00:35:50.365 --> 00:35:52.525
<00:35:50.365>that <00:35:50.481>you <00:35:50.598>click <00:35:50.714>on <00:35:50.831>a <00:35:50.948>link <00:35:51.064>that <00:35:51.181>could <00:35:51.298>do <00:35:51.415>the <00:35:51.531>same <00:35:51.648>thing <00:35:51.765>if

754
00:35:52.525 --> 00:35:54.805
<00:35:52.525>you, <00:35:52.700>if <00:35:52.875>you <00:35:53.050>know <00:35:53.225>which <00:35:53.400>systems <00:35:53.575>they <00:35:53.750>use <00:35:53.925>internally.

755
00:35:55.595 --> 00:35:59.685
<00:35:55.595>Yeah. <00:35:55.794>But <00:35:55.995>it's <00:35:56.194>not <00:35:56.395>covered <00:35:56.595>by <00:35:56.794>the <00:35:56.995>documentation.

756
00:35:59.985 --> 00:36:02.645
<00:35:59.985>The <00:36:00.160>state <00:36:00.335>is <00:36:00.510>not <00:36:00.685>requiring <00:36:00.860>us <00:36:01.035>to <00:36:01.210>fix <00:36:01.385>this.

757
00:36:03.455 --> 00:36:04.645
<00:36:03.455>We're <00:36:03.722>not <00:36:03.990>gonna <00:36:04.258>fix <00:36:04.526>it.

758
00:36:05.275 --> 00:36:08.445
<00:36:05.275>Look, <00:36:05.415>we <00:36:05.555>can, <00:36:05.695>we <00:36:05.835>can <00:36:05.975>share <00:36:06.115>stories, <00:36:06.255>war <00:36:06.395>stories <00:36:06.535>like <00:36:06.675>this.

759
00:36:08.685 --> 00:36:13.165
<00:36:08.685>I <00:36:08.792>mean, <00:36:08.900>uh, <00:36:09.008>there <00:36:09.115>is <00:36:09.223>a <00:36:09.331>reason <00:36:09.438>why <00:36:09.546>both <00:36:09.654>of <00:36:09.761>us <00:36:09.869>have <00:36:09.977>great <00:36:10.085>here

760
00:36:13.185 --> 00:36:15.605
<00:36:13.185>and <00:36:13.535>myself <00:36:13.884>is <00:36:14.235>losing <00:36:14.585>hair.

761
00:36:15.715 --> 00:36:20.685
<00:36:15.715>Okay. <00:36:15.855>I <00:36:15.995>have <00:36:16.135>a <00:36:16.275>lot <00:36:16.415>of <00:36:16.555>hair <00:36:16.695>on <00:36:16.835>the <00:36:16.975>other <00:36:17.115>hand.

762
00:36:21.325 --> 00:36:24.045
<00:36:21.325>Excellent. <00:36:21.464>So, <00:36:21.605>uh, <00:36:21.745>I <00:36:21.884>mean, <00:36:22.024>let, <00:36:22.165>let's, <00:36:22.305>let's <00:36:22.444>wrap <00:36:22.585>this <00:36:22.725>up.

763
00:36:24.045 --> 00:36:26.805
<00:36:24.045>Like <00:36:24.200>what <00:36:24.356>are <00:36:24.511>you <00:36:24.667>most <00:36:24.822>excited <00:36:24.978>about <00:36:25.133>the <00:36:25.289>World <00:36:25.445>Congress?

764
00:36:26.805 --> 00:36:28.485
<00:36:26.805>Like <00:36:26.980>why, <00:36:27.154>why <00:36:27.330>do <00:36:27.504>you, <00:36:27.680>why <00:36:27.855>do <00:36:28.029>you <00:36:28.205>choose

765
00:36:28.505 --> 00:36:30.285
<00:36:28.505>to <00:36:28.785>actually <00:36:29.065>submit <00:36:29.345>a <00:36:29.625>workshop <00:36:29.905>there?

766
00:36:30.285 --> 00:36:32.605
<00:36:30.285>What <00:36:30.460>what <00:36:30.634>are <00:36:30.810>you <00:36:30.984>excited <00:36:31.160>about <00:36:31.335>at <00:36:31.509>the <00:36:31.685>event

767
00:36:33.185 --> 00:36:34.185
<00:36:33.185>As <00:36:33.634>a <00:36:34.085>developer?

768
00:36:34.385 --> 00:36:35.405
<00:36:34.385>We <00:36:34.844>are <00:36:35.303>developers.

769
00:36:35.665 --> 00:36:39.405
<00:36:35.665>The <00:36:35.840>World <00:36:36.015>Congress <00:36:36.190>is <00:36:36.365>basically <00:36:36.540>a <00:36:36.715>place <00:36:36.890>to <00:36:37.065>be.

770
00:36:40.315 --> 00:36:45.085
<00:36:40.315>I've <00:36:40.470>been <00:36:40.626>looking <00:36:40.781>at <00:36:40.937>the <00:36:41.092>speakers <00:36:41.248>list <00:36:41.403>for <00:36:41.559>the <00:36:41.715>past,

771
00:36:45.225 --> 00:36:47.885
<00:36:45.225>uh, <00:36:45.380>previous <00:36:45.536>years, <00:36:45.691>and <00:36:45.847>there <00:36:46.002>are <00:36:46.158>a <00:36:46.313>lot <00:36:46.469>of <00:36:46.625>superstars.

772
00:36:48.465 --> 00:36:52.045
<00:36:48.465>So <00:36:48.605>I'm <00:36:48.745>personally, <00:36:48.885>I'm <00:36:49.025>very <00:36:49.165>excited <00:36:49.305>to <00:36:49.445>be <00:36:49.585>able <00:36:49.725>to <00:36:49.865>say

773
00:36:52.045 --> 00:36:53.365
<00:36:52.045>that <00:36:52.441>I <00:36:52.837>was <00:36:53.232>there

774
00:36:53.545 --> 00:36:56.885
<00:36:53.545>and <00:36:53.745>I <00:36:53.945>was <00:36:54.145>rubbing <00:36:54.345>shoulders <00:36:54.545>with <00:36:54.745>the <00:36:54.945>superstars.

775
00:36:58.745 --> 00:37:02.285
<00:36:58.745>So <00:36:58.920>yeah, <00:36:59.095>a <00:36:59.270>lot <00:36:59.444>of, <00:36:59.620>uh, <00:36:59.795>important <00:36:59.970>people, <00:37:00.145>uh,

776
00:37:02.425 --> 00:37:04.805
<00:37:02.425>in <00:37:02.658>the <00:37:02.891>software <00:37:03.125>development <00:37:03.358>world <00:37:03.591>in <00:37:03.825>the,

777
00:37:04.825 --> 00:37:06.885
<00:37:04.825>and, <00:37:05.174>uh, <00:37:05.524>I <00:37:05.875>love <00:37:06.225>developers

778
00:37:06.885 --> 00:37:10.485
<00:37:06.885>because <00:37:07.235>it's <00:37:07.585>not <00:37:07.935>about <00:37:08.285>ego

779
00:37:10.545 --> 00:37:15.405
<00:37:10.545>or <00:37:10.661>it's <00:37:10.778>not <00:37:10.895>about <00:37:11.011>money <00:37:11.128>are, <00:37:11.245>uh, <00:37:11.361>heroes <00:37:11.478>so <00:37:11.595>to <00:37:11.711>say <00:37:11.828>are <00:37:11.945>people

780
00:37:15.405 --> 00:37:17.845
<00:37:15.405>that <00:37:15.755>actually <00:37:16.105>did <00:37:16.455>something <00:37:16.805>themselves.

781
00:37:18.515 --> 00:37:20.965
<00:37:18.515>They <00:37:18.795>didn't <00:37:19.075>earn <00:37:19.355>a <00:37:19.634>zillion <00:37:19.915>dollars,

782
00:37:21.505 --> 00:37:23.165
<00:37:21.505>but <00:37:21.785>why <00:37:22.065>do <00:37:22.345>you <00:37:22.625>need <00:37:22.905>that?

783
00:37:23.425 --> 00:37:26.925
<00:37:23.425>But <00:37:23.600>they <00:37:23.775>invented <00:37:23.950>a <00:37:24.125>lot <00:37:24.300>of, <00:37:24.475>uh, <00:37:24.650>useful <00:37:24.825>stuff.

784
00:37:28.235 --> 00:37:31.645
<00:37:28.235>They <00:37:28.468>impacted <00:37:28.701>the <00:37:28.935>industry <00:37:29.168>in <00:37:29.401>a <00:37:29.635>way.

785
00:37:31.945 --> 00:37:35.845
<00:37:31.945>And, <00:37:32.072>uh, <00:37:32.199>that's <00:37:32.326>why <00:37:32.454>I <00:37:32.581>love <00:37:32.708>about, <00:37:32.835>uh, <00:37:32.963>we <00:37:33.090>are <00:37:33.217>developers <00:37:33.345>that

786
00:37:36.425 --> 00:37:40.125
<00:37:36.425>you <00:37:36.580>get <00:37:36.736>a <00:37:36.891>lot <00:37:37.047>of, <00:37:37.202>uh, <00:37:37.358>excellent <00:37:37.513>ideas, <00:37:37.669>a <00:37:37.825>lot

787
00:37:40.125 --> 00:37:43.365
<00:37:40.125>of <00:37:40.300>excellent <00:37:40.475>people, <00:37:40.650>a <00:37:40.825>lot <00:37:41.000>of, <00:37:41.175>uh, <00:37:41.350>interesting <00:37:41.525>stuff.

788
00:37:43.835 --> 00:37:45.445
<00:37:43.835>Well, <00:37:44.115>I'm <00:37:44.395>looking <00:37:44.675>forward <00:37:44.955>to, <00:37:45.235>to,

789
00:37:45.505 --> 00:37:46.845
<00:37:45.505>I'm <00:37:45.746>gonna <00:37:45.987>be <00:37:46.228>on <00:37:46.469>stage <00:37:46.711>again

790
00:37:46.905 --> 00:37:48.485
<00:37:46.905>and <00:37:47.185>like <00:37:47.465>introducing <00:37:47.745>all <00:37:48.025>the <00:37:48.305>people.

791
00:37:48.625 --> 00:37:51.845
<00:37:48.625>And <00:37:48.780>now <00:37:48.936>I'm <00:37:49.091>gonna <00:37:49.247>go <00:37:49.402>through <00:37:49.558>the <00:37:49.713>other <00:37:49.869>3000 <00:37:50.025>submissions

792
00:37:51.845 --> 00:37:53.445
<00:37:51.845>that <00:37:52.194>came <00:37:52.544>in <00:37:52.895>for <00:37:53.245>talks

793
00:37:53.585 --> 00:37:57.005
<00:37:53.585>and <00:37:53.701>see <00:37:53.818>which <00:37:53.935>one <00:37:54.051>I <00:37:54.168>can <00:37:54.285>pick <00:37:54.401>for <00:37:54.518>which <00:37:54.635>stage <00:37:54.751>I'm <00:37:54.868>gonna <00:37:54.985>see.

794
00:37:57.065 --> 00:37:58.405
<00:37:57.065>I'm <00:37:57.266>gonna <00:37:57.467>look <00:37:57.668>forward <00:37:57.869>to <00:37:58.070>your <00:37:58.271>workshop.

795
00:37:58.465 --> 00:38:00.285
<00:37:58.465>I'm <00:37:58.605>gonna <00:37:58.745>look <00:37:58.885>forward <00:37:59.025>to <00:37:59.165>see <00:37:59.305>what <00:37:59.445>people <00:37:59.585>think <00:37:59.725>of <00:37:59.865>it.

796
00:38:00.745 --> 00:38:02.805
<00:38:00.745>And <00:38:00.920>uh, <00:38:01.095>thanks <00:38:01.270>very <00:38:01.444>much <00:38:01.620>for <00:38:01.795>your <00:38:01.970>time <00:38:02.145>today.

797
00:38:03.025 --> 00:38:06.445
<00:38:03.025>Uh, <00:38:03.258>that <00:38:03.491>was <00:38:03.725>Vicla, <00:38:03.958>Stefanski <00:38:04.191>and <00:38:04.425>Bofski.

798
00:38:07.125 --> 00:38:08.125
<00:38:07.125>I <00:38:07.305>hope <00:38:07.485>I've <00:38:07.665>done <00:38:07.845>that. <00:38:08.025>Right.

799
00:38:08.705 --> 00:38:10.285
<00:38:08.705>Any <00:38:08.938>last <00:38:09.171>words <00:38:09.404>you <00:38:09.638>have <00:38:09.871>for <00:38:10.105>audience?

800
00:38:10.505 --> 00:38:11.965
<00:38:10.505>Any <00:38:10.724>last <00:38:10.943>words <00:38:11.162>you <00:38:11.381>have <00:38:11.600>for <00:38:11.819>people

801
00:38:12.065 --> 00:38:14.405
<00:38:12.065>to <00:38:12.298>stay <00:38:12.531>safe <00:38:12.765>out <00:38:12.998>there? <00:38:13.231>Any <00:38:13.465>advice?

802
00:38:15.005 --> 00:38:18.085
<00:38:15.005>I <00:38:15.145>would <00:38:15.285>say <00:38:15.425>don't <00:38:15.565>rush, <00:38:15.705>wait <00:38:15.845>for <00:38:15.985>something <00:38:16.125>to <00:38:16.265>get <00:38:16.405>broken

803
00:38:18.425 --> 00:38:21.405
<00:38:18.425>and <00:38:18.565>then <00:38:18.705>see <00:38:18.845>whether <00:38:18.985>you <00:38:19.125>want <00:38:19.265>to, <00:38:19.405>to <00:38:19.545>install <00:38:19.685>it, <00:38:19.825>because

804
00:38:21.405 --> 00:38:23.845
<00:38:21.405>otherwise, <00:38:21.638>if <00:38:21.871>you <00:38:22.105>are <00:38:22.338>going <00:38:22.571>in <00:38:22.805>first,

805
00:38:23.865 --> 00:38:25.685
<00:38:23.865>you're <00:38:24.145>also <00:38:24.424>going <00:38:24.705>to <00:38:24.984>get <00:38:25.265>hacked

806
00:38:25.685 --> 00:38:26.685
<00:38:25.685>First. <00:38:26.134>And <00:38:26.585>thinking

807
00:38:26.685 --> 00:38:29.205
<00:38:26.685>is <00:38:27.035>still <00:38:27.384>an <00:38:27.735>important <00:38:28.085>skill.

808
00:38:29.765 --> 00:38:31.485
<00:38:29.765>I <00:38:29.998>think <00:38:30.231>so <00:38:30.464>too. <00:38:30.698>Thanks <00:38:30.931>very <00:38:31.165>much.

809
00:38:31.555 --> 00:38:32.965
<00:38:31.555>This <00:38:31.872>was <00:38:32.189>Coffee <00:38:32.506>with <00:38:32.824>Developers.

810
00:38:33.105 --> 00:38:35.045
<00:38:33.105>Uh, <00:38:33.385>I <00:38:33.665>see <00:38:33.945>you, <00:38:34.225>uh, <00:38:34.505>online

811
00:38:35.265 --> 00:38:37.405
<00:38:35.265>and <00:38:35.440>I <00:38:35.615>guess <00:38:35.790>we <00:38:35.964>see <00:38:36.140>you <00:38:36.315>at <00:38:36.490>the <00:38:36.665>Congress.

812
00:38:37.405 --> 00:38:39.965
<00:38:37.405>Thanks <00:38:37.605>again <00:38:37.805>and <00:38:38.005>have <00:38:38.205>a <00:38:38.405>wonderful <00:38:38.605>day. <00:38:38.805>Thanks

813
00:38:39.965 --> 00:38:40.805
<00:38:39.965>Chris. <00:38:40.343>Thank <00:38:40.721>you.

814
00:38:41.105 --> 00:38:41.325
Bye.