0:00

This week, David

0:02

Hunt from Prelude is with us to discuss scientific

0:04

approaches to security testing. Then

0:06

Jerry Bell, the man behind InfoSec newest

0:09

community water cooler Infosect dot

0:11

Exchange joins us to talk about the state

0:13

of Infosect culture and recent

0:15

Mastodon migrations. Finally,

0:17

in the enterprise security news, security

0:20

funding is back baby. Security

0:22

unicorn layoffs continue though. We

0:24

talked zombie corns, iron net

0:26

struggles. Netflix acquires comedian.

0:29

We talk breeches. Lastpass, Rackspace,

0:31

Octavia GitHub, Slack via GitHub.

0:34

GitHub announces 2FA improvements. I

0:36

wonder why. AI

0:39

generates insecure code, cyber

0:42

insurance challenges, and fire

0:44

festival fraudster funding more

0:46

frauds. All that and more on this episode

0:48

of Enterprise Security Weekly. This

0:53

is security weekly. For security

0:55

professionals, buy security professionals.

1:01

Broadcasting Lai from G Unit Studios

1:04

in Rhode Island. It's the show where

1:06

we talk security vendors and on afraid

1:08

to name names, it's enterprise security

1:10

weaver.

1:12

The cybersecurity landscape is full of

1:14

single solution providers. Making it

1:16

easy for unexpected cyber threats to

1:18

sneak through the cracks. That's why Fortress

1:21

creating a stronger, simpler strategy

1:23

for protection one that increases your security

1:25

maturity while decreasing the operational

1:28

burden that comes with it. This is all possible

1:30

thanks to best in class portfolio

1:32

in deep bench of expert problem

1:34

solvers. Fortress integrated scalable

1:37

solutions help customers face their toughest

1:39

challenges with confidence. Learn

1:41

more at security weekly dot com.

1:43

Forward slash fortress. Welcome

1:48

to Enterprise Security Weekly and Happy

1:50

National Bird Day. This is episode

1:52

three hundred and one recorded on Thursday,

1:54

January fifth twenty twenty

1:56

three. I'm your host, Adrian scenarios,

1:59

and joining me is the master

2:00

marketing, the mayor of mayhem, Tyler Shields.

2:02

How are you, Tyler? You know, Adrian,

2:05

I was this close half tempted to

2:07

showing you the bird. And then was like, no, that might

2:09

be over there. That would have been great. Really

2:11

gonna

2:12

do it. I was close. I would appreciate

2:14

it. I I mean, sixty

2:15

percent of our audience wouldn't have known just,

2:17

you know, so yeah. So they would just

2:19

heard you laughing at at randomness.

2:22

I got you. But, no, I am Yeah. What's what

2:24

what's favorite bird. My favorite bird is is a

2:27

sweetie bird from Snoopy. My

2:29

favorite bird is the Grackle. If

2:31

you've ever watched the Grackle gackle. They're they're

2:34

hilarious. They're

2:36

they're nature stand up comics. Yeah.

2:39

Look look at videos of Grackle. They're just

2:41

absolutely not really fumbling in the background

2:43

for sure.

2:44

Alright. Tyler, I need to call shenanigans.

2:46

Did you really just call Woodstock Tweedbird?

2:49

Damn it. Oh, you

2:50

were so frightened. You knew who I meant, but ESW, you're

2:53

right.

2:53

I knew you meant it. Woodstock is great.

2:55

Woodstock is

2:56

well managed. Controversy right

2:58

at the beginning of the show. Indeed. Twenty twenty

3:00

three starts strong. Let

3:02

me finish the introductions here before we get into

3:04

too much more. We also have

3:06

the Zar of Zero

3:07

Trust, the captain of content, Katie Tyler.

3:10

How are you, Katie? I'm

3:12

well. I also do

3:14

like Woodstock, and

3:16

Woodstock is not sweetie bird, but fun

3:18

fact. Depictions of birds

3:20

break me out. Real Okay?

3:22

But depictions of birds? No.

3:25

I'm just gonna, you know,

3:27

get what you mean by depictions. Oh, oh, you

3:29

mean like cartoon birds? pictures

3:33

of birds, statues of birds. I was

3:35

once at a wedding with an ice sculpture of a

3:37

bird. That was the creepiest thing. I think I'd

3:40

ever seen in my entire life. Were

3:42

they upset when you knocked it over? When

3:45

I kicked it and smashed into pieces? Yeah. No.

3:50

It was like it's doing a split high

3:52

iceberg. It was -- Oh. --

3:54

so creepy. I

3:56

don't don't know why you would find that creepy. That's

3:58

that's fascinating to me.

4:00

But

4:01

I guess, however It was creepy. It

4:03

was not as cute as with stock. So

4:05

-- Alright. -- so the other thing I wanna add to our bird discussion,

4:08

because I know a goose is gonna be like, we gotta get

4:10

to the real meat of this. But the other thing I wanna add

4:12

to the bird discussion is birds are not

4:14

real. Does anyone recognize that

4:16

meme? I do. Yeah.

4:18

Birds aren't real. It's it's a thing. There

4:20

there are actually robots robots installed

4:23

by the US

4:23

government. So just remember I

4:25

believe in our wheel. What

4:27

about all those dead birds that cats dragged

4:29

to my back door?

4:31

Fake. They're all fake. That's fake news. That's

4:33

fake news. Okay. Yeah.

4:36

I've I've had I've had cats. I've

4:38

had clean up quite a few quite a

4:40

few

4:41

that we're we're not quick enough to escape

4:43

the the orange tabby. I

4:46

guess the

4:46

cats don't like me because I don't

4:48

have a cat. There's a bunch of cats in the

4:50

neighborhood and they just keep I

4:51

I don't know. Maybe maybe it's a

4:53

sacrifice or or a gift that they

4:55

think they are providing to the back of my house.

4:58

You're

4:58

just giving off weird dog vibes. Yeah.

5:01

Definitely the dog. Do cats like

5:03

to they they think of them

5:05

as gifts, so they're trying to win you

5:07

over? It

5:08

hasn't happened yet, Kat. Sorry if you're

5:10

listening. Did you think even for a moment,

5:12

Adrian, that this would have been, like, a massive

5:14

opening to the show? No.

5:17

Not at all. I thought this was gonna be a

5:19

quick one. Like, so I I do

5:21

wanna give a shout out for

5:23

National Bird Day to an app called

5:25

Merlin. Because there's there's a

5:27

bird I actually thought were bats because

5:29

I only heard it, like, right at dusk,

5:32

you know, in the in the early evening.

5:34

And I just could not figure out what

5:36

these birds were. And I found this app

5:39

that I think is made by a nonprofit

5:41

or a university called Merlin. And

5:44

you can just hit record in

5:46

this app. And, like, in

5:48

seconds, if you record a

5:50

bird sound. Like, it's identified it

5:52

right away. It's taken that recording. It's

5:54

matched it to a database. And

5:56

and you can help and you you can help update

5:59

their database with new bird

6:01

sounds and I think they can ID by

6:03

photos as well and

6:05

found out it was a kill

6:06

deer. This is the name of the bird.

6:09

So -- Chazam for bird noises.

6:12

Chazam for birds. Yep.

6:15

I will say that Oreo's I'm sorry,

6:17

not Oreoals. Cardinals do not like it when they when

6:19

you replay their birdsong through

6:21

like a Bluetooth speaker, they get very confused. Oh,

6:23

yeah. Oh, yeah. Yeah.

6:25

No. I I I've thought about that. I've I've wondered

6:28

about mess and missing

6:30

birds. Yeah. I put a Bluetooth speaker

6:32

up near the roof, and they kept flying in

6:34

and, like, die bombing it. They did not understand

6:36

what the center loper was in the neighborhood.

6:38

I bet. Oh my god. That's funny.

6:40

Alright. And as you've heard speaking.

6:42

We also have the Baron of Bloodhound, the pirate

6:44

king of PowerShell, Sean Matt Cap

6:46

is with us as well. Hello

6:48

all. And my favorite bird is the

6:50

cassowary because it's probably one of the closest

6:53

birds to a modern day

6:55

dinosaur. Looks like it's

6:57

designed to headbutt the headbutt the

6:59

crap out of you if you know it. Yeah. And it's got

7:01

sharp claws like a velocirap which

7:03

is my favorite dinosaur. that

7:06

that's that's a pretty bad ass

7:08

bird pick, I have to say. Alright.

7:11

We got a quick announcement here. You can

7:13

join our DISH cord channel and talk

7:15

about your favorite birds or dinosaurs.

7:18

And you can chat with host ESW questions

7:20

during the show and do all

7:22

kinds of fun stuff on there. You can go to

7:24

security weekly dot com forward slash discord

7:26

to receive and invite to our

7:28

discord server. Alright. And

7:30

today, we are talking about not

7:32

not birds anymore. We're gonna leave that behind.

7:34

We're talking about scientific approaches to security

7:37

testing. We're excited to have David

7:39

Hunt, co founder and CTO with

7:41

Prelude with us today. David

7:43

has a career spanning many industries, including

7:46

enterprise aerospace, and operational

7:48

technology. Prior to Prelude, he

7:50

led the team that built Meijder Kaldera,

7:52

which if you have dived into

7:55

adversary simulation or security

7:57

testing at all, you're probably familiar with that

7:59

project. Welcome to the show

8:01

David. Thank you

8:03

very much. Happy to be here. I am

8:05

kinda in the background trying to figure out how to spell

8:07

Grackle. So if anybody has that exact

8:10

spelling, just shoot it over.

8:11

It's like crackle, like like the video

8:13

service crackle but with the

8:15

g. Yeah. It's just perfect.

8:21

Yep. So that's yeah.

8:23

I ESW, feel free to share

8:25

your favorite bird if you want to do that before

8:27

we we we move into

8:28

this. The introduction. So

8:31

my favorite bird is a I mean, it's not gonna

8:33

be the most exciting. I don't think out of it

8:35

today, but a cardinal which already came up,

8:37

but it's actually helpful to know that there

8:39

are tips and tricks I can use with the cartonals in

8:41

my backyard to, let's say, get to

8:43

know them better. So I really appreciate

8:45

that color. What

8:47

is it you like about cardinals? Is it like an

8:49

aesthetic thing or something that they

8:51

do? Totally color. I

8:53

love the red color. The blue j's

8:55

are also with the list. Yeah. I love love

8:57

red. Nice.

8:59

Nice. Yeah. Color

9:00

wise, I love eastern bluebirds, but

9:03

we will move on from Bert's.

9:06

So this is actually

9:08

one of my questions. You want to.

9:11

This is this is actually one of my favorite

9:13

topics. So I I

9:15

actually so I started a

9:17

company back in in twenty seventeen with a good

9:19

friend of mine, Kyle. And,

9:21

you know, we we quickly

9:23

observed, like, the whole idea of the company was

9:25

to reimagine consulting

9:27

services if we were just gonna do it from

9:29

scratch. And things we found is that, you

9:31

know, people just don't don't

9:33

realize what they've gotten wrong. They don't know how

9:35

to prioritize on the defense

9:37

side. And a lot of our customers

9:39

were small and medium sized companies. So if they

9:41

had any security staff, they had one to

9:43

three security staff, some smaller companies

9:45

here. And so we we

9:47

designed some services to help them,

9:49

you know, test their

9:51

defenses, you know, not like from a

9:53

ESW perspective, but I guess more of like a

9:55

a purple team, what you call a purple team

9:58

perspective back then, which

10:00

I I think has evolved somewhat. And

10:02

that's the reason David, I wanted to have

10:04

you on, is I'm very

10:06

interested now that I'm seeing some companies

10:08

focusing more on testing

10:10

security teams and testing security

10:12

environments and making sure everything works

10:14

correctly. Because every time I

10:16

analyze, III do like

10:18

post mortem on a breach or something like that.

10:20

Almost every single time there's just

10:22

stuff misconfigured. People don't

10:24

know how to find alerts in their environment.

10:27

You know, just basic stuff that that practice

10:29

ESW testing would would fix. Is that the

10:32

same thing that kind of like, may maybe

10:34

if you wanna talk about how you got drawn

10:36

into minor

10:37

caldera, you know? And then maybe take us

10:39

into Prelude from there.

10:42

Absolute yeah. Absolutely. I think

10:44

in a large way, just to touch

10:46

on one of the things you're mentioning, we've

10:48

been stuck in the industry for for quite a

10:50

while in react being reactive to

10:52

what's going on. So in a large

10:54

way that's centered around topics like CVEs,

10:57

around patches, and vulnerabilities, something

10:59

comes out. We have something very specific that

11:01

comes out when a CVE number

11:03

is it it is published

11:05

and released. We get a product and

11:07

we have a version of that product. That

11:10

becomes the target. We look in our

11:12

environment. We're very reactive. It takes us weeks to

11:14

find and patch all of those things.

11:16

Meanwhile, the rest of the environment is

11:18

wide open. And so we've kinda gotten

11:20

used to in cyber security to

11:22

reacting not being proactive. And

11:25

testing is all about kind of moving

11:27

that forward and being proactive with how you

11:29

locate things, the structure and

11:31

process to to how you actually do

11:33

that. And that's kind of the missing

11:35

component that we've for for quite some time in the

11:37

industry looking back

11:39

over the years. And so for me personally,

11:41

I think

11:43

I started to really, I think, formulate

11:46

a lot of my ideas and

11:48

opinions on the matter when I was at

11:50

Meijer on the

11:52

Caldera project. And what brought

11:54

me to Meijer originally to to take on

11:56

that work was

11:58

the lack of efficacy

12:00

in defensive products. And

12:02

so what I mean by that is

12:05

there's a significant amount of defensive

12:07

products that exist anti virus,

12:09

EDR, WAF, there's all sorts of

12:11

technologies that exist to protect

12:13

us. And what we don't

12:15

have are any ways to make rational

12:17

decisions about which ones aren't

12:19

working well for us, which ones aren't configured

12:21

correctly. We're in a lot of cases, which ones

12:23

are even installed in the first place. So in

12:25

a large environment, it can be tricky to even

12:27

understand where you have coverage even

12:29

a little bit. Howard Bauchner:

12:33

So when I was formally at

12:35

CRA, which which owns a security

12:37

weekly podcast. One of the things I I had

12:39

built was product

12:41

testing. You know, so also

12:43

in the questioning, like like, I

12:45

I have my suspicions and and, you know, I was

12:47

trying to figure out how do how do we do this? You

12:49

know, in in the b to b enterprise space. Like,

12:51

with consumer stuff, it's easy. You you go to

12:54

ESW Buy, you know, or Amazon or something

12:56

like that. You buy a product. You

12:58

know, you you test it, you review it,

13:00

you publish the the results.

13:03

Even with a car, you can do that. But in

13:05

enterprise security, you know, getting your hands on a

13:07

license for a lot of these products is

13:09

not an easy task. You know, you you

13:11

base have to work with the company. They have to be comfortable

13:13

with you doing the testing. And I've

13:15

always had my suspicions, like, I wonder some

13:18

of these products even when configured

13:20

correctly. You

13:22

know, do they work at all? You

13:24

know, and some some of my experiences

13:27

doing that

13:27

testing, the the answer is is no. I

13:30

even in in ideal environment, I'm

13:32

not sure some of these products really

13:35

deliver in, you know, what what they say they do

13:37

in the box, which is important to know.

13:39

Yeah.

13:39

And that that that's the big thing is

13:41

is there actually is no way at scale

13:43

to understand that. And it's funny

13:45

that you mentioned Best Buy actually because an

13:47

example I like to give is this this

13:49

triggers all the way down the consumer side

13:51

to the enterprise side and even

13:53

into the government side, which is if

13:55

I walk into ESW Buy today, you or I

13:57

walk into Best Buy and are, like, need to buy a

13:59

laptop, grab one off the shelf, pick

14:01

it out, and we say we wanna buy an

14:03

antivirus to go along with it. We

14:05

ESW consumers even at that level, that individual

14:08

level, we have no way to determine

14:10

or pick which AV that we want

14:12

to use outside of

14:14

things Like, well, which color kinda

14:16

resonates the best with me today? There

14:18

isn't anything that will guide me to a a

14:20

rational decision.

14:22

Yeah. Yeah,

14:24

definitely. So, yeah,

14:27

so kind of moving into you

14:29

know, III think for me, the big question

14:31

is, like, we know we have this gap here, you

14:34

know, but if if you go

14:36

through PCI, if you go through some of

14:38

the regulations and and even some of the

14:40

standards we have, you know, there there's

14:42

not really you know, like

14:44

like, one of the things I was I was

14:46

doing recently is putting together

14:48

a cloud IR checklist recently.

14:50

301 I

14:53

was looking at some of the old ones that I

14:55

was replacing. And

14:57

and none of them say anything about

14:59

testing. You know, with AI with

15:01

IR and disaster

15:03

recovery and and BCP and things like that

15:05

especially. You know, it's my experience

15:07

that if if you haven't

15:09

actually done it, you have maybe

15:11

accounted for fifty percent of the things you need to

15:13

do for it to go smoothly. you

15:16

know, I think that applies to security

15:18

defenses as well. So so how do how do

15:20

we, you know, aside

15:22

from bringing a product to market and trying

15:24

to educate people? Do

15:26

do you see an opportunity

15:29

for for compliance or

15:31

regulation to to come in here and say,

15:33

hey, no, this is actually something that

15:35

everybody should do. Or or or does some of that

15:37

already exist and maybe I've overlooked it?

15:39

Yeah. It's it's

15:42

interesting. I think we're gonna see a lot more of that

15:44

happening. So driven through policy,

15:46

driven through compliance, and I think a lot of

15:48

things that we've seen, you know, we've seen some evolution

15:50

in this occurring with how the rapid

15:52

pace to at least how public

15:54

some of the attacks recently have

15:56

been in the news ransomware attacks obviously

15:58

getting getting quite a bit of attention.

16:00

And a lot of these are taking advantage

16:02

of of not zero days, things that are

16:04

unknown, but taking advantage of things

16:06

that are already known, things that if

16:08

we had done proactive testing and environments

16:10

we'd be ahead of and patching and

16:12

fixing issues. And so, yeah, I think a lot of

16:14

these a lot

16:16

of the desire to do

16:18

continuous security testing upfront is

16:20

going to be driven through policy and compliance.

16:24

Yeah. ESW

16:27

we've talked about, you know,

16:29

how to convince people that this is

16:31

something that they should do. And

16:33

we've already seen a lot of different

16:35

both open source and commercial

16:37

efforts to to

16:39

you know, bring this to people to to

16:42

productize it. So so

16:44

let let's kinda shift

16:45

there. You know, how what is

16:48

you know, and and there's several use cases here. Right?

16:50

Like like, I often separated it into

16:52

functional testing versus

16:55

I forget what I called the other kind of

16:57

testing, but But basically, the way I think of it

16:59

is is the control actually

17:01

turned on? Is the email actually getting

17:03

somewhere very functional

17:06

testing? You know, is the port or

17:08

or, you know, is is the sensor plugged

17:10

into the right spam port? That kind of very

17:12

simple, like, on off

17:15

you know, you know,

17:17

the the the the toasters are plugged in

17:19

type situations. And then you have

17:21

the much more difficult side of

17:23

it, which is emulating

17:26

adversaries and and saying not

17:28

only can you detect an

17:30

attack, but can you detect a

17:32

sneaky attack or a sneaky attack, you know,

17:34

and kinda stepping up

17:36

the level of efforts there. So

17:38

so how do you approach that

17:40

with with a product and and with

17:42

customers? Do do you separate those out

17:44

into separate things? Or does

17:47

the, you know, the the adversary

17:49

emulation stuff also

17:51

serve as the functional testing? Is it not necessary to do ESW

17:53

both separately? Howard

17:55

Bauchner: Yeah, I think

17:56

it's been an evolution, actually. So

18:01

the way testing has kind of evolved in

18:03

the security space has included areas like

18:05

penetration testing for trying to

18:08

find vulnerability isn't kind of the penetration

18:10

of the network, the the perimeter of the

18:12

network itself. Vulnerability

18:14

scans have have kinda dominated that space

18:16

for locating things. That's

18:18

been very proactive. And then you have what you've

18:20

mentioned, which is more in the red teaming space, in

18:22

the purple teaming space, which is,

18:24

hey, I've been with understanding

18:27

how my network and my

18:29

environment would react if this

18:31

particular APT were to come

18:33

in or if this particular type

18:35

of behavior were to happen in the environment. I

18:37

wanna know how we would react, what alerts

18:39

would trigger, how our defense would would

18:41

actually hold up. And

18:44

that's kind of the the current way

18:46

that a lot of modern organizations are

18:48

running now, which is bring

18:50

in the purple team, bring in the red team, and

18:52

them to test everything continuously

18:54

but also manually. There's a little bit of autonomy that

18:56

goes in there when it comes to

18:58

some systems like Caldera, for example,

19:00

that can be set up. But

19:03

that testing is still

19:05

what I'd call

19:07

almost random, which is if you're

19:09

tasked with emulating a particular APT,

19:12

you can get a playbook of what they're used to doing.

19:14

But what you do is a purple team or a red

19:16

team or is you grab sort of random

19:18

behaviors that they that they're known to

19:20

do. You apply them in the network and you try to

19:23

bypass your defense, but there isn't a rhyme

19:25

or reason and there's a lot of

19:27

nuance between one particular command

19:29

that you could run-in an obfuscated version

19:31

of that. So there's a lot of cat and mouse that

19:33

happens in red teaming and purple teaming. Which

19:36

is incredibly critical, very, very important

19:38

role, but it's hard to scale. So when it

19:40

comes to how do you actually turn that into a

19:43

product, you can actually work on scaling, get it out, make it

19:45

more accessible to more people. I

19:47

think you have to add a little bit of structure

19:49

on top of that. And

19:51

so what we've been focused on is can we

19:54

apply what we call a rule,

19:56

which is basically a surface

19:59

area on a particular type of

20:01

device, call it a Windows

20:03

laptop or or, you know, a Linux

20:05

server and say, hey, can we

20:07

define a surface area on

20:09

that machine And can we

20:11

write automated tests that are targeting

20:13

that particular piece of surface

20:15

area for no notes? An

20:17

example of that is kind of

20:19

the traditional example, which is, will my

20:22

defensive product quarantine

20:25

a known malicious office

20:27

macro document. And we

20:29

target that test. It should catch it every

20:31

single time if the defense is on and

20:33

and configure correctly. And you

20:35

turn that test on and say run this every single day and make sure

20:38

that defense is working. And you continue

20:40

to repeat that process and you have that

20:42

continuous testing running on

20:44

all of your endpoints all at the same time, and that enables you

20:46

to kinda get a complete coverage

20:49

and get a a much better idea of what's

20:51

going on. Yeah. So so it's

20:53

kind of a like a sanity

20:55

check, like a security

20:58

controls regression

20:58

test. Right? Like, you wanna make sure that, you

21:01

know, one day all of a sudden, you know, I mean,

21:03

that's something I used to do as a

21:05

podcasters. ESW mean, I'd always turn AV back

21:07

on once I was done. I would

21:09

just disable AV, you know, back in the days

21:11

there weren't when I pen tested, there weren't

21:13

a whole lot of tamper

21:16

controls there. And you could literally

21:18

just that stop AV, do

21:20

whatever you need to do and then turn it

21:22

back on, which, you

21:24

would fail the regression testing, you know, if I were in the middle

21:26

of doing that. But but

21:28

is that the idea

21:29

there? That's absolutely yeah.

21:32

Yeah. So I think the the missing component

21:34

that we're really trying to push on, and this has

21:36

been missing in the offensive security space for

21:38

for quite a while. Is

21:40

a lot of structure on how do you

21:42

actually attack the problem set.

21:45

Not just following an APT

21:47

playbook, but an actual structure that allows

21:49

you to get each component of the

21:51

endpoint in a methodical,

21:53

very scientific approach on how you how you

21:55

would do that. And so I'll give think

21:57

one of the examples I've seen in recent years of

22:00

this, which I did a couple of years ago,

22:02

which is running a

22:04

continuous test on

22:06

a particular Linux Server that was,

22:08

for the most part, air gaps. A

22:10

SIS admin came in one day

22:12

and started updating packages

22:14

on that And in order to update

22:16

packages on that particular machine, they

22:18

needed to enable

22:20

a proxy. So they set a proxy up from an

22:22

Internet enabled server to this

22:24

air gap server, install their

22:26

things, and then forgot to remove

22:28

that proxy when they signed off for

22:30

the day. And in that case, we had

22:32

lateral movement ESW running on that

22:34

box. And just one day out

22:36

of the blue, that that

22:38

agent that we had running the ESW, was

22:40

capable of moving across the

22:42

network through that

22:42

proxy, moving from that hoping to

22:45

be a hair gap system onto Internet

22:47

enabled devices. And that was a a

22:49

case of catching something within a

22:51

twenty four hour period that that could have

22:53

been caught many many months later

22:55

by an adversary. So

22:57

so that's one use case. And and

22:59

this is I'm gonna hand off to Sean has

23:01

a couple ESW as well after

23:03

after I clarify on this, but seems like

23:05

you've got a couple use cases here. You know? So

23:07

one is what you're describing like ensuring

23:09

your controls are working as

23:11

expected. You know, the environment is configured

23:13

as expected and there's no surprises

23:16

or no regressions, you know, but

23:18

also it seems to me like,

23:20

a key use case here would

23:22

or should be to

23:23

actually test your IR team, you know, to test your

23:25

SOC, to test the, you know, make

23:28

sure you know, the process part of it works that that

23:30

the the humans can find things

23:32

in their systems when you're relying on

23:34

a human to find something. And

23:36

and know what to do in in

23:38

those scenarios. Know what their next step is

23:40

to, you know, contain and and

23:43

recover and eradicate and all all

23:45

all the those fun IR

23:47

steps.

23:47

Right? Absolutely. Yeah. We see that as

23:50

a as a huge use case, especially with

23:52

companies and and enterprises in

23:54

particular that either have

23:56

SOC where they have internal purple teams that are in charge

23:58

of writing rules, segment rules,

24:00

and so forth in order to

24:02

to fire off alerts. And so

24:04

what we've seen is kind of people approaching

24:07

security testing in order to solve one of two

24:09

problems. It's either efficacy

24:12

of a defensive product, whatever that may

24:14

be. It could be on the network. It could

24:16

be on the endpoint itself. Or it

24:18

could be, hey, I wanna test the

24:20

behaviors of my

24:22

response. That could be the IR team. That

24:24

could be the team that's monitoring the alerts

24:26

in the

24:27

SOC. That could be, you know, the user of

24:29

an endpoint itself, do they actually report something

24:31

occurring and is kind of testing

24:33

the overall response to various

24:35

things occurring in real

24:37

time. Great. Thank you.

24:40

Sean here. So that that leads directly

24:43

into something I was going to ask

24:45

around does Prelude correlate the

24:47

attack ESW to

24:49

detection in the SIEM to

24:51

identify or associate

24:53

with the activity that was performed? Or

24:55

is it one of those things where it's identified

24:57

and then the SOC is then doing that

25:00

correlation? Yeah.

25:01

Yeah. So it's a little bit

25:03

of both at the end of the day.

25:05

And so what I mean by that is ESW

25:08

every time that we run an action inside

25:10

of one every time we run

25:12

a test, any alert that would get

25:14

fired will include a tag that has

25:17

our particular know, tagging unit on it. So it

25:19

helps you identify what's coming out of our systems.

25:21

You can filter and and adjust to

25:23

that. So that does allow you

25:25

to filter

25:27

or separate things coming from from things

25:29

coming from other places, if you wanna analyze it

25:31

from that perspective. What we don't do

25:33

is we don't tell you whether that alert is working or

25:36

not. That's kinda up to you to analyze

25:38

your own alerts and decide what's your own

25:40

threshold. So the context of that alert

25:42

could be incredibly important based on what it

25:44

is or it could be something that's incredibly low

25:45

priority? So along those

25:48

lines, how easy would it be for

25:50

an organization to identify if

25:53

the appropriate event logging is

25:55

not actually configured in order

25:57

to detect that sort of activity.

25:59

So for example, if you're leveraging, say, Windows

26:02

event logging, but certain

26:04

events or event categories are

26:06

not configured to be logged

26:08

then would Prelude help identify

26:10

that? Or would it just be

26:12

a blank slate for the sock?

26:15

Now that's actually AAA

26:17

big advantage for running the continuous test on

26:20

the endpoint. On the that particular

26:22

example, which is the Windows event logging, the

26:24

way that we try to approach it and get people

26:26

into this habit is deal with

26:28

that on the endpoint itself, not within the

26:30

SOC. And so the test itself

26:32

has the ability to do

26:34

the action ESW well as verify what

26:37

the actions output

26:40

was. So in this example, you might say

26:42

my test is to dump that old sass. And

26:44

then and you can say, well, what

26:46

is the after effect of that? Let me check

26:48

to see what Windows event

26:51

logs occurred in the system and

26:53

what matches the behavior, what was expected

26:55

versus what was there. And let me ship

26:57

ship that result off somewhere where it can

26:59

be analyzed.

26:59

Okay. So it's not an automatic

27:02

thing. It's more of AAA

27:04

combination of what the tool is providing plus

27:06

what the the SOC or or

27:08

instant response is handling around

27:09

that. Quick question about your

27:12

tagging, where does that get injected? Is

27:14

that injected at the source or

27:16

is that something that can get injected

27:18

as part of the the SIEM event

27:21

forwarding flow. Yeah.

27:23

So in the operator, which is our command and

27:26

control center that we

27:28

have in play right now, you can inject it in

27:30

two places. So you can inject it at the

27:32

agent level, which is the thing

27:34

running the ESW particular, or

27:36

you can inject it into something that we

27:38

call outpost, which is where the agent

27:40

sends the result to. And when it

27:42

gets sent to that, outpost it's a a

27:44

little bit of a Python server.

27:46

When that Python server accepts

27:48

the the output from the

27:49

agent, it can then tag it before inserting

27:51

it into your login database.

27:54

Okay. Cool. I've been involved in a number

27:56

of purple team members sizes over the years with

27:58

different organizations or different sizes. And one of

28:00

the biggest challenges often has

28:02

been the, okay, here are the vulnerabilities

28:04

or here are the weaknesses in this

28:07

environment. And here's what detection saw

28:09

or what event kind of came out the other side

28:11

as far as what we could correlate. But

28:13

the big gap often seems to be how

28:15

do we fix that and how do we prioritize it?

28:18

Is there something around Prelude that helps

28:20

guide the customer to an effective

28:22

feasible solution for any specific issue or

28:24

set of activities?

28:26

Yeah. That's always that's actually a really big

28:28

one, which is prioritization. So you

28:30

you've got n number of issues. What do

28:32

you fix and what order do you fix them

28:34

and so forth? We've we've battled

28:36

that a lot and kinda kicked that around in a in a variety

28:38

of different context. So what we're

28:41

leaning into right now, kind of the the

28:43

lessons we've learned in

28:45

in spending time in writing purple teaming

28:48

is we wanted to try to catch all of

28:50

the what we call the surface area issues

28:52

that are the known BADs

28:54

first. We want to look at the

28:56

endpoint holistically and say there

28:58

are ten things that should never

29:00

occur on this particular type of

29:03

endpoint. We know for

29:05

taking the dumping LOS SaaS example.

29:07

Nobody should ever be able to dump LOS SaaS on

29:09

this computer no matter what. That would be good.

29:11

No known. We'll call that a rule. Another

29:13

one that we take is a

29:17

malicious office macro should

29:19

always be quarantined. And so we've

29:21

come up with a of these tests that are based around these known,

29:24

known rules. And what

29:26

most of our tests are circulating around right

29:28

now is can

29:30

we execute tests that are no

29:32

knowns, verify that your

29:34

defenses actually protecting in those cases?

29:36

And if not, And hopefully, this

29:38

is a small percentage of of

29:41

issues for most people. In

29:43

those

29:43

cases, you're not protected from those

29:45

issues. Go ahead and fix those as your first

29:47

thing. Okay. So less of

29:49

the Nuance, like, edge cases and more of

29:52

the, like, big big

29:54

components.

29:55

Gotcha. So in your dumping L SaaS example, obviously,

29:57

there's a few different ways to do it through task

29:59

manager programmatically, which is leveraging that

30:02

same

30:02

method. couple other ESW such

30:04

as mini cats.

30:06

Certainly, settings protected

30:09

process is a way to help protect and

30:11

identify when that sort

30:13

of activity is occurring, including some

30:15

detection and defense around

30:17

that, is is Prelude looking at

30:19

these different methods that attackers are

30:20

using? Or is it primarily a

30:23

single approach to what

30:25

the issue is as far as the

30:28

activity that prelude puts into it and

30:30

what what comes out the other

30:31

side? Yeah. This is actually where it gets a lot of fun

30:34

because this comes up on purple team

30:36

being the time if you've been on a manual, purple team assessment,

30:38

which is you'll try in the dumping else as

30:40

example, you'll say, hey, I'm gonna try to do it. This

30:42

way, you get caught you hop to a

30:44

different system and you try to do it a different way. And

30:46

and basically, you're playing this cat mouse game in order

30:48

to determine if you can find a way on

30:50

a particular system to to not

30:53

get caught. And so to replicate that

30:55

in a structured, continuous security

30:57

form, that's autonomous. The way

30:59

we the way we do it is we define the rule

31:01

when we say Users should never

31:03

be able to dump LSA. So that's the

31:06

rule. Underneath that, we develop

31:08

tests. And we can have as many tests

31:10

under that rule as we'd like. That

31:12

cover all the different implementations of dumping

31:14

that we can think of that we've

31:16

seen in the wild that have exploit code to

31:18

them and so forth. And we allow you

31:20

to schedule those tests to run on

31:22

your endpoints at whatever sort of schedule

31:25

that you'd like. So, for

31:27

example, you may say, I wanna run this

31:29

type of LSS dump every

31:32

day on this subset of computers. I

31:34

wanna run this other variation on

31:36

this other subset, and you could have

31:38

it it kinda mix and match across

31:40

your

31:40

network, and what you're doing is looking for

31:42

anything that triggers. Okay.

31:46

That's fair. So final

31:48

question. Does Prelude build

31:50

on attack strategy based on what's vulnerable

31:52

in the environment in other words, does it identify a vulnerable system

31:54

and then identify what the next step

31:56

could be based on that one plus

31:59

other information and knowledge about what's

32:01

vulnerable in the in the

32:01

environment, like an attack or

32:03

what? Yeah. No. We

32:05

we don't go that deep in that direction. I'd

32:07

say, our goal is to identify

32:11

at the top level, how

32:13

how are your defenses protecting

32:16

you against all of these

32:18

different rule sets? it's not about finding this

32:20

device in particular vulnerable

32:23

to kind of like say a CVE or something

32:25

to that effect? It's more of are

32:27

you are your defenses protecting you

32:29

against an attack that falls in the category of

32:31

that CPE? So one example

32:33

of that might be

32:36

So let's take our our macro office example again because

32:38

that I think plays well for this,

32:40

which is if you will get

32:43

how many CVEs are tied

32:45

to malicious office

32:47

macros. You'll find quite a

32:49

few. And so if your defensive

32:51

system is capable of catching and

32:53

responding to all of the, you know,

32:55

popular variations of of macros

32:57

that are found in the wild, especially

32:59

ones like MSFvenom and and other things

33:01

can be dropped in into

33:04

the into the VBA scripts.

33:06

Then you start to say, hey,

33:08

I'm actually getting some pretty good confidence that

33:10

my defense can effect against this particular type of

33:13

attack, which means that I feel

33:15

pretty good about my coverage across, you know, and

33:17

number of CVEs 301

33:19

the vulnerability space or surface area of this given

33:22

endpoint. Great. Thank

33:24

you. ESW

33:27

on the topic of these tests,

33:31

yeah, I think something that's interesting

33:33

is how you decide to

33:35

to build and prioritize the test that that you guys build.

33:37

You know, because again, it it seems

33:39

like, you know, talking about the cat and mouse

33:41

game of of evasions and and things

33:44

like

33:44

that. You know, all these different ways

33:46

you can evade defenses

33:48

and controls. How do

33:51

you guys So I guess a two

33:53

part ESW. How do you guys

33:55

decide on what to build? Are you constantly

33:57

looking at, like,

33:59

some of the reports that come out

34:01

from researchers, you know, researching

34:03

different attack or TTPs and stuff like

34:05

that. You know, do you go look at the

34:08

attack matrix? Because III think clearly that's that's one of those things

34:10

where, you know, I think for years what

34:12

we've needed is like a heat map of the

34:14

attack nature because, like, all tests

34:16

aren't important. You know, like like, there are

34:18

some companies who wanna test for every single item

34:20

on there. You know? But clearly, some of

34:22

those are more important than others. You

34:24

know, so how do you prioritize that? And then the other side of that, you know,

34:26

I think one of the tricky things in

34:28

security is is the the idea

34:31

of what to red flags versus yellow flags. You

34:34

know, things that are absolutely bad. A

34:36

hundred percent of the time,

34:38

it should always float to

34:40

the top you know, you you should always see this alert

34:42

versus things that are, you

34:44

know, maybe they're bad. And because we

34:46

have so many of those, and I call those

34:48

yellow flags, We have so many of

34:50

those yellow flags. It's very easy

34:52

to bury all your red flags.

34:54

You know, all your

34:56

your absolute super important

34:58

tests in a bunch of maybe kind

35:00

of important, you know,

35:02

given

35:03

the context tests. Totally.

35:05

Yeah. Absolutely. Let me

35:07

let me ask you

35:08

a question that could be kinda fun here. So what he

35:11

Okay. It could be fun. Right? Is

35:14

a a MacBook Air

35:17

or an

35:17

iPad, which one is

35:20

more secure? III

35:23

would say the the iPad is more

35:25

secure because, yeah, less opportunities for

35:27

for the user

35:29

to act independently. 301 grab

35:32

software if that's not front

35:34

end. Tightly controlled. Absolutely. See what

35:36

that totally.

35:38

So I'd say that is the delta that we are

35:40

looking at this from from just

35:42

a very qualitative standpoint. So

35:44

so it's actually on the the minor

35:46

attack leadership team for those that

35:49

don't know. When I was on the Calithera project. And ESW, yeah,

35:51

I got spent a lot of time around the matrix

35:53

and kinda seen the pros and cons there and and how

35:55

does that apply to things like

35:57

you know, the matrix on with things like behavioral

36:00

analysis and and so forth. Really,

36:02

really fascinating ways of classifying

36:04

things. But you come up with that

36:06

same problem in purple teaming,

36:08

which is you've got this giant matrix. How

36:10

do you decide what to do? And is

36:12

something like an impact tactic more

36:14

or less important than a lateral movement

36:16

tactic. And that is such a contextual

36:18

decision that it becomes very difficult for

36:20

somebody to prioritize. Similar CDs. How

36:22

do I know this one is better than that one?

36:24

For me, in particular.

36:26

So the way we look at it is a

36:28

little bit more surface area related. So if

36:30

you look at the MacBook versus an

36:32

iPad and you say, well, yeah, iPads

36:34

are actually more secure than Macbooks, because

36:37

the user is not allowed to do certain

36:40

actions. So that delta between these two is

36:42

actually a really good way to think about how you

36:44

should prioritize your tests. Which is

36:46

why what are those things in

36:48

particular that you can't do on the

36:50

iPad? So you can't, you know, you

36:52

can't dump elsewhere. Right? So that's

36:54

the thing. You can do that on the

36:56

on the Windows computer in this case. So that's an area that that we'd wanna

36:58

target. You can install things outside

37:00

of the App Store on

37:03

the iPad. So when you look

37:05

at that on the MacBook, you say, well, the

37:07

user is allowed to install things.

37:10

What are types of tests that I need to write run

37:12

continuously around execution

37:14

of or installation of

37:18

executables. And so when you start

37:20

to think in those sort of ways, you start to build boxes or constraints

37:22

around what you wanna do, and then

37:24

you can very quickly create a priority

37:28

around what is important to you. Test around

37:30

installation of of things

37:32

or people touching processes on

37:34

the

37:35

ESW. What are

37:37

those deltas between secure devices and quotes and in

37:39

secure devices? I feel like

37:41

it was kind of a trick question because

37:43

the ESW answer

37:46

to that question wasn't an option.

37:48

And it's always windows.

37:51

Right? Yeah. Exactly.

37:54

The safest

37:55

possible option that you could get.

37:58

Yep. Yep. Alright. Yeah.

38:01

So so I

38:03

I and you've got you've got some acronyms

38:05

around this as well. So, you know, part

38:07

of my question, you know, I was trying

38:09

to queue up VSTs. So so if you wanna explain

38:11

what the the concept of verified

38:14

security tests are because I

38:16

I, you know, I feel like that

38:18

second part of my question, you know, like

38:20

ESW tests that are you know,

38:22

much more reliable, hundred percent, you

38:25

know you know, versus ones

38:27

or or or or ones that are

38:29

focused on things that are more likely

38:31

to happen. Help help me understand maybe

38:34

I don't fully understand the the

38:35

concept of verified security

38:38

tests. Yeah. Totally.

38:40

Yeah. So in development in

38:42

red teams and purple teams, are you used to building

38:44

something called the TTP tactics,

38:47

techniques, and procedures? Really that refers to the procedure level. So if

38:49

you look at the attack matrix, you've got

38:52

tactics and techniques, and what you're

38:54

doing ESW a red team or purple teamers,

38:56

you're building procedures or

38:58

implementations of those techniques.

39:00

And that's that's how you approach things. And so

39:02

you've got the structure of the attack framework itself.

39:05

And that's kinda where the structure falls off.

39:07

That's what you have, which means that as a

39:09

purple team or if I wanna write a security

39:11

test that is on the

39:14

attack matrix, I can write it in any language I want. I can write

39:16

it in any format I

39:18

want. That test has no

39:20

constraints to

39:22

it. The test I write could be wildly different from a test that somebody

39:24

had another company or even within my own

39:26

company writes. And so this is where it becomes

39:28

a little bit of the wild wild west in offensives

39:31

security where everybody ESW writing TDP's their

39:34

own way with their own

39:36

intentions. And in a lot of ways, they are

39:38

not safe to run-in production for those

39:40

reasons. There's no way to validate

39:42

though. And so that's

39:44

common in command and controls

39:46

products, including our own

39:48

prelude operator. When we were

39:50

getting ready to release our current

39:52

product, which is called build, that

39:54

product is designed around the

39:56

concept of ESW, verified

39:58

security test. ESW wanted to

40:00

develop a way, a structure

40:02

that allows you to take the power of a

40:04

TTP, validating

40:06

defenses. And enable it to run-in production. So the VST is

40:08

really if you wanna think about it as a production ready

40:10

TTP, that's probably a pretty

40:12

good way to think about it.

40:15

And so a VST is

40:17

a structured piece of code

40:19

that contains a test function and a clean

40:22

an out function. And the test function

40:24

does in action in, you know,

40:26

take any of our examples like dumping LFS. And

40:28

then the cleanup function will reverse

40:30

any effects if there were any

40:32

in the test function. Now this VST goes a very strict

40:35

comp compelling process,

40:38

testing ESW, and ultimately

40:40

gets stored as a compiled

40:42

file, in your own file, stored just

40:44

for you. And that file

40:46

is now something that has kind of gone through all of your different

40:48

safety checks, which include the

40:50

efficacy of the file itself,

40:52

the tests. As well as many

40:54

system resources does this test use? How long

40:56

does it take to run and and so forth? And

40:58

then that test is now almost

41:01

like a golden image. Of the

41:03

behavior that you want to test against. That VST

41:06

enables you to move your security

41:08

testing outside

41:10

of development environment or security environments and allows

41:12

you to run these tests that have never

41:14

really run at production and scale on

41:16

as many devices as you want.

41:19

So if you wanna understand whether

41:21

you can whether your defense can pick

41:23

up a a office

41:26

macro on ten thousand

41:27

machines, run single VST on all ten thousand and

41:30

record which ones got it and which

41:32

ones did

41:34

not. Yeah. Yeah.

41:36

You can definitely yeah. Scaling it up,

41:38

you know, I think it is

41:40

a big thing. You know, even if you're

41:43

only doing this testing on a portion

41:45

of your computers that I feel like the

41:47

value is huge here. And one of the things I always thought,

41:49

I I wonder if you get a lot of

41:51

ESW for this for customers or if you put these together

41:53

for customers. But when we have a breach that gets

41:55

in the headlines, you know, inevitably

41:58

somebody's gonna ask you know, what would

42:00

happen if we were hit with this, this thing

42:02

that just happened to somebody ESW.

42:04

And provided there's enough

42:06

details. Is is that something you get a lot

42:08

of ESW for, like like, putting together, like, the

42:11

the chain of of tests that that

42:13

would closely simulate, you know,

42:16

that that

42:18

headline breach.

42:18

Absolutely. This is where the rules actually come in come

42:20

into place. If you look at a lot of attacks

42:22

out there, they can fall under

42:26

different rules. That are things that

42:28

are are no known. So if a

42:30

brewery happens, you know,

42:32

yesterday or happened yesterday that is

42:34

CVE, Right?

42:36

Doesn't really matter the the category. But you can look at that CV

42:38

and say, well, what are the behaviors

42:40

of the CVE that make it unique?

42:43

And then what rule does that CVE actually fall

42:46

under? Could that be something related to

42:48

ransomware? Well, do I have a rule that

42:50

tests ransomware? Now if you

42:52

have a rule that's already testing ransomware ESW that

42:54

is a very comprehensive test,

42:56

then that ransomware attack itself

42:58

even though the CVE is new,

43:00

you have a comprehensive set of tests that you're already running.

43:02

So it gives you the ability to have

43:05

confidence in what your defense will

43:07

actually respond like. Before

43:10

that attack actually happens. Now

43:12

after you learn about the attack, you may see a

43:14

variation in it that is unique,

43:16

and you can write a new test implementation that

43:18

closely mirrors what occurred there and

43:20

add it to your collection of ransomware tests that

43:22

you're running at

43:24

whatever schedule. Awesome stuff.

43:26

Yeah. I I think that's all we have time

43:28

for, but I I did before we wrap

43:32

want to mention that you do have a community edition

43:34

of of Prelude that people can download

43:36

and try out for free

43:38

and and use for free. Anything

43:40

else you wanna mention there before we wrap up? Yeah. Yeah. Absolutely.

43:43

So build itself, which is a

43:45

an IDE for

43:48

writing verified security tests that is a

43:50

completely open source project. You can find that on on GitHub, of course,

43:52

fully open

43:52

source, and and we're hoping

43:55

that is actually

43:58

A helpful thing to write tumors and purple tumors,

44:00

pen testers, anybody that is involved

44:02

in writing TTPs that is interested

44:04

in ESW to move them into

44:06

option. We hope we hope it helps the

44:08

community. Awesome stuff. David, thank you so much for

44:10

joining us on enterprise security weekly today.

44:14

Thank you

44:16

very much. Alright. Stay tuned. When we come

44:18

back, we're gonna talk implicit culture and

44:20

mass it on with

44:22

Jerry Bell. The

44:25

shift to remote and hybrid work over

44:27

the past two years has accelerated

44:30

application development on cloud

44:32

infrastructure. However, securing these new assets

44:34

has lagged behind. Qualys CloudView, the next generation of

44:36

cloud security posture management,

44:38

delivers an end to end

44:40

multi cloud security and

44:42

compliance solution encompassing the

44:44

entire application lifecycle from

44:46

build to runtime. CloudView enables

44:48

enterprises to assess their cloud security

44:50

in compliance posture, identify risks and gaps, auto

44:53

remediate issues, proactively enforce

44:55

best practices, and prove compliance

44:57

and audits rapidly and

45:00

efficiently. Identify your most vulnerable cloud assets by

45:02

visiting security weekly dot com

45:05

forward slash Qualys. Welcome

45:09

back to Enterprise Security Weekly. Don't

45:12

miss any of your favorite Security Weekly

45:14

content. Visit security weekly dot

45:16

com forward slash subscribe to

45:18

subscribe to any of our podcast feeds and have

45:20

all new episodes downloaded right to your

45:22

phone. You can also join our mailing

45:24

list, Discord Server, and follow us on

45:26

social media and our streaming

45:28

platforms, which include YouTube and Twitch,

45:30

and we're playing around with some others.

45:34

I don't I don't know how that's going. We were testing

45:36

out Twitter and LinkedIn and, I

45:39

don't know, Instagram. Like, you you can stream

45:41

in a bunch of different places now.

45:44

Alright. So for our second interview

45:46

today, Jerry Bell joins us to

45:48

talk about Infoset community culture and

45:50

the migration to Mastodon. Which

45:53

has been big

45:56

somewhat contentious news over the last couple

45:58

months. Jerry has worked in

46:00

IT for thirty years, doing everything from Writing

46:02

code to racking servers, and is currently the VP and

46:04

CISO of IBM public cloud. Jerry has

46:07

hosted the Defense of

46:10

Security Podcast which I I to in was

46:12

one of my regular podcasts

46:14

on my on my podcast

46:17

list every week. And

46:21

and he, best known, ESW,

46:23

in the last couple months, for running

46:25

the InfoSec. Exchange Mastodon instance

46:27

for the past, six years,

46:30

which recently saw a slight bump

46:32

in popularity. Welcome to

46:34

the show

46:34

Jerry. Thank

46:35

you. Thank you for

46:38

having me. Yeah. Thank you for for being here. You know,

46:40

this is something, you

46:42

know, I think when we talked

46:45

to prep for this, you know, I mentioned back

46:47

in twenty fifteen, you know, I

46:49

was I've been on Twitter for

46:51

a little while. Twitter is kind of how

46:53

I got into infosec.

46:56

I remember, if you know Dave

46:58

Schacklford, he was my my boss back

47:00

when I was a protester, and he

47:03

encouraged me to get

47:05

out go to conferences, give talks,

47:07

and get involved with the community. And

47:09

one of the things he suggested

47:11

in addition to putting together a blog and writing

47:13

blogs was getting on Twitter.

47:16

And and that's how I met a bunch of people in the

47:18

industry. In fact, yeah,

47:20

I've I've

47:22

had decade plus long relationships with with folks

47:24

on on Twitter. You

47:27

know, and and, sadly,

47:30

you know, some of them have have passed away, and I never got

47:32

to meet them in person. You know, so it's it's kind of, you

47:35

know, it's it's

47:38

an interesting medium,

47:40

you know, to to talk to

47:42

people over and things like that.

47:44

And I I found it kind

47:47

of fast ESW how easy it was to to

47:49

make that migration and how how

47:51

quickly folks jumped

47:54

over. So yeah, just kinda

47:56

wanna get your so

47:58

you've been running this a lot longer

48:00

than this big, you know, when this

48:02

big wave happens. Was that correct? Six years

48:05

you've been running this marathon instance? That'd

48:07

be six years

48:08

in April. That's

48:12

right. So, you know, I gosh, probably

48:14

six and a half, seven years ago,

48:16

I massed it on and

48:18

the Fediverse came onto my radar

48:21

and I'm someone who likes to tinker with things. And

48:23

so I set up an instance,

48:26

register the domain. And, you know,

48:28

for for five and a half

48:30

years, it was pretty much just

48:32

a little a little side

48:34

experiment that had a couple hundred

48:36

people in total, you know, maybe a

48:38

handful of people on any

48:40

given day. Until until

48:41

October. Yeah. And III

48:46

think you picked a great name. You know,

48:48

it's it's with

48:50

real ESW, it's location, location, location.

48:52

And I think InfoSec that exchange

48:55

is is a really easy one

48:57

to remember So III think

48:59

you nailed it there. But yeah.

49:01

I mean, I mean,

49:03

what was it what

49:05

was it like those those first couple of

49:07

weeks? Like like, did you have to upgrade the

49:09

hardware almost immediately? Or

49:12

how did how did all that

49:14

go? It was it was pretty exciting.

49:16

So back in in the spring

49:18

of twenty twenty twenty

49:22

two, gosh, an entire year ago. When when

49:24

there was some first for some rumblings

49:26

about Twitter potentially being

49:30

taken over, there was a bit of a pop in

49:32

in in accounts

49:34

on InfoSec that Exchange. And

49:38

up until that point, I had been running this the

49:41

the instance on a VPS ESW

49:45

it had worked pretty well. I spent a couple

49:47

hundred bucks a year for the for

49:49

the five years up until

49:52

that point. And so that

49:54

that was a bit of a wake up call, and I

49:56

actually rented

49:58

a pretty substantial server that I

50:00

never thought I would actually

50:03

grow out of was a

50:05

sixteen core server with

50:07

NVMe drives, and it was a it's

50:10

pretty pretty beefy server for for what, you know,

50:12

effectively had ten or twenty people

50:14

on it per

50:16

day. Roundabout

50:20

October twenty seventh, twenty

50:22

sixth, twenty seventh, twenty eighth, going into

50:24

that weekend. I was

50:26

actually working down

50:28

at at at the beach,

50:30

and my phone started going

50:32

nuts. I I have my

50:34

alerts set on

50:36

on Twitter. And didn't

50:38

think a whole lot of it. I knew that there

50:40

was stuff going on until I looked at it.

50:42

And I saw lots and

50:44

lots of people talking about joining

50:47

Infosec dot Exchange talking about

50:49

it and whatnot. And so I I

50:51

jumped over there and sure

50:54

enough you know, several hundred people had come in. And I thought, hey,

50:56

that's that's pretty cool. And

50:58

over the the next three or four days,

51:02

there were probably 567

51:04

hundred people per day coming over.

51:07

And then then it really

51:09

which which was pretty ESW. And then it

51:11

started to really accelerate to, you know,

51:14

thousand, two thousand, three

51:16

thousand people

51:18

per day. And per

51:20

day. Per day.

51:22

And at that point, I started the panic a little

51:24

bit because not not

51:27

only did moderation become

51:30

a much bigger challenge, but

51:32

also it was pretty apparent

51:34

that my once forever

51:36

server was not gonna cut it

51:38

anymore. And so I

51:40

I ended up standing up

51:42

moderation team who to this day is just the absolute

51:45

godsend phenomenal group of

51:47

people with the the

51:49

patience of saints And

51:51

and then I I spent a

51:54

bunch of time scaling

51:56

out the instance, both from

52:00

the perspective of capacity,

52:02

but also trying to get the

52:04

costs under control because I had

52:07

been paying for it out of my own pocket until I got

52:09

the bright idea to to really go

52:11

ask for for some

52:13

financial help and So that community did come

52:15

together and help me out with that. Howard

52:18

Bauchner: Yeah,

52:21

you know, it's Yeah.

52:23

And I think interesting that not only did you have to

52:26

technically scale

52:28

the the instance you're running, you know, but

52:31

also staff it as well. You know? And it's

52:34

so so what's that what's that like? Like like

52:36

the the

52:40

you know, doing that moderation work,

52:42

is that, like, when people

52:44

flag things on the server, like, they have

52:46

special roles where they get, like, a

52:49

queue of stuff that needs to be looked at

52:51

and handled? What what what is that role

52:54

like? It's

52:56

done, like, on Twitter, if

52:58

you're familiar with Twitter and somebody says

53:00

something offensive or

53:02

or, you know, post some post

53:04

a threat or or what have you we

53:07

have the same kind of

53:09

reporting facility in Mastodon

53:11

or the Federalverse.

53:14

So so you can you can report somebody who's a spammer

53:17

or or posting something obscene or

53:19

illegal or or what

53:21

have you. And So it's

53:24

it's a myriad of different

53:26

things. You know, it

53:28

ranges from, you know,

53:30

misinformation about vaccines

53:32

all the way to

53:34

death threats and, you

53:37

know, and and, you

53:39

know, spam and and your herbal

53:42

remedies and everything in between.

53:45

You know, it's actually

53:47

one of the things that so

53:49

so I still pop over to Twitter because there there

53:51

are some people that I communicate with that that haven't

53:53

made the switch. You know? So

53:55

it's but

53:58

I find that interesting because that's one of things that definitely drove

54:01

me to to use InfoSec dot

54:03

exchange a lot more

54:06

is around

54:08

the same time that this move started

54:10

happening, I I just started, you

54:12

know, that that first huge round of

54:16

layoffs that they did at Twitter. I just

54:18

started getting crypto spam, like

54:20

mentions spam, like my mentions would

54:23

just fill up with you

54:25

know, buy this, buy that, you know,

54:27

new coin or or join a game

54:29

or a crypto game or or

54:31

whatever. You know, a dozen or

54:33

more a day every day and it's still continuing. And, like,

54:36

you know, for a couple weeks, I was reporting

54:39

every single one and I just

54:41

gave up, you know, like like I just

54:44

I I don't need a side job, you

54:46

know, just reporting mentions and stuff like that. So

54:48

I don't know if that's just a scale thing for them, but

54:51

I never had that problem before, but, yeah, I

54:53

I wonder how many people moved over

54:55

to Mastodon, you

54:58

know, because you know,

55:00

politically, you know, the things that were happening around

55:02

Twitter or, you know,

55:04

they they had already,

55:06

you know, not been enjoying doing Twitter for while

55:08

and didn't need much of a push to

55:10

go to something else. Because I I agree with

55:12

a lot of people that it it definitely feels

55:15

like earlier days. Of Twitter. But I wonder if that's just

55:17

because the community ESW smaller and the

55:20

chances of your, you know, whatever you post just

55:22

getting lost in the noise is is

55:24

much less

55:26

on the platform with, you know, thirty, forty thousand people

55:29

versus millions. I think it's

55:31

all of those

55:33

things. You know, there there is the the

55:36

network effect is a real thing. Right? And

55:38

so there there

55:40

were certainly nucleus

55:42

of people that moved over in the early days and some of

55:45

the races they moved over ranged

55:47

from, you know,

55:49

they they just really are

55:51

offended by Elon Musk's politics to

55:54

their their afraid of you

55:58

know, what they just don't wanna see the spam, like

56:01

like what you you pointed

56:03

out or or many other reasons.

56:05

But, you know, once that migration

56:08

started and and I your opening

56:10

comments, by the way, I think

56:12

hit it right on.

56:14

It's it's actually about the community. It's

56:16

not not not so much about the

56:20

platform. I found personally, you know, Twitter

56:22

was just a phenomenal

56:24

tool. Right? III

56:27

met so many great people over the years that I

56:29

never would have had an

56:32

opportunity to connect with, to share ideas

56:34

with, to

56:36

learn from. And and so the the thing that I've learned in

56:38

in the, you know, the the past couple of

56:40

months in particular is it's

56:42

it's less about the actual platform and

56:44

more about

56:46

community. And the community has, in

56:48

large part, you know, picked up

56:50

and moved

56:51

over. But again,

56:54

you know,

56:55

the reality is Twitter is a huge,

56:57

you know, very, very

57:00

large environment.

57:02

And in in info sector exchange, we I think we just passed

57:04

forty five thousand accounts,

57:06

which is, you know,

57:09

fairly big number. But I think

57:12

Twitter is five hundred

57:13

million. like, or many

57:15

orders magnitude larger.

57:18

Yeah. Remember, I did some research back in twenty fifteen because

57:20

I wanted to understand, you know,

57:23

what what the size of infosec

57:27

or or what what yeah. Infosec Twitter back in

57:29

twenty fifteen versus all of Infosec.

57:31

You know? Because we we knew it was a bubble. You

57:33

know, we knew it was in

57:36

everybody. And back then, you know, the the through

57:38

my research, the number I came up with was

57:40

eight percent. That eight percent

57:42

of people in InfoSec were

57:46

on Twitter which actually seems pretty remarkable.

57:48

You know, I mean, obviously Infosec has

57:50

grown a lot, you know,

57:52

since since twenty fifteen. So I don't

57:54

know if

57:56

you know, the the numbers of

57:58

people using it pseudo professionally to talk

58:00

about security stuff, cyber security stuff

58:03

hacking, things like that. You

58:05

know, is ESW still up there.

58:07

But and and, obviously, the like, there's

58:09

a lot of shades of InfoSec. Right? Like, there

58:12

there's a lot of people that

58:14

consider themselves hackers and

58:16

and do security research and stuff like

58:18

that, you know, but but aren't

58:20

security professionals. Right? So it's it's

58:22

kinda hard to to do that kind of

58:24

research. But

58:26

but, yeah, it seemed like,

58:30

you know, you know, what what's

58:32

yeah. I always said when all these

58:35

new social networks came came up, like, it

58:37

doesn't the features don't

58:39

matter as much. As where the people are.

58:42

You know, as soon as the people move, as soon

58:44

as you have that that tipping

58:46

point, you know, that

58:48

that momentum where the the

58:50

people you enjoy bouncing

58:52

questions off of and and discussing things

58:54

with have moved over. You

58:57

know, if that if that's where they're spending their time,

58:59

if that's where they're posting, and you enjoy

59:01

reading their stuff and conversing with them.

59:03

Like, that's it. Like, it it doesn't matter

59:05

if Mastodon's better than Twitter, you know, Twitter

59:07

gets better. Like, it's where the

59:09

people are.

59:10

Absolutely. There there are some

59:13

I I will tell you, there are

59:15

some features that I commonly hear,

59:17

you know, as as being

59:20

problematic, like the

59:22

fact that we don't have the

59:24

equivalent of a quote tweet and Quote

59:26

tweet. Yeah. I think that is

59:28

something that will likely get fixed. Search

59:30

is something that is fairly

59:36

inhibited And

59:38

by the way, one one of the I've

59:40

I've written about this or posted

59:42

about this quite a bit over the the

59:45

course of the past couple of

59:47

months. You know, Mastodon isn't Twitter.

59:50

It's it's an it it

59:52

in some ways feels a lot like Twitter

59:54

has similar purposes But as different

59:56

lineage, the the the driving

59:58

factors behind it, you know,

1:00:00

getting to where it is today are different

1:00:02

it's a different community that built it

1:00:05

up. That the values that the people

1:00:07

had who have created it

1:00:09

are are different than what you saw

1:00:11

with, you know, with Twitter. It's

1:00:14

Twitter was a commercial enterprise that

1:00:16

valued engagement

1:00:18

and growth and time on the site

1:00:22

and whatnot. And that that

1:00:24

drove certain, you know,

1:00:26

features and capabilities. And for me

1:00:28

personally, I think it was kind of

1:00:30

bad my blood pressure because it seemed

1:00:33

like Twitter was always putting stuff in

1:00:35

front of me that I it knew I would

1:00:37

disagree with and and would --

1:00:38

Yeah. -- you know, it it became the

1:00:40

media, the mainstream media, basically. Right?

1:00:42

If it

1:00:43

bleeds, it leads. And on,

1:00:45

you know, on the other side,

1:00:47

with Mastodon and the

1:00:50

federalism in general, it was

1:00:52

more intended

1:00:54

to be a community. And it it doesn't have the

1:00:56

concept of investors

1:00:59

and advertisers and whatnot.

1:01:01

It it's it's about the

1:01:04

people. And so some of the features that

1:01:06

we had come to to

1:01:09

rely on on Twitter you

1:01:11

know, where where are were and to

1:01:13

some extent still our view is, you

1:01:16

know, potentially enabling bad

1:01:18

behavior, like, you know, abusive

1:01:20

behavior targeting and and things

1:01:22

like that. And and to some

1:01:24

extent, I think that

1:01:26

is, you know, a

1:01:28

valid concern to

1:01:31

another extent, I think

1:01:33

it is inhibiting valuable

1:01:36

use of the tool and but that

1:01:38

comes down to moderation. Right? Like the

1:01:41

fact that that you

1:01:43

have quote tweets doesn't,

1:01:46

you know, that that just means that that as a

1:01:48

moderator, like, we have we have

1:01:50

more responsibility to make sure that

1:01:52

people are are not acting

1:01:55

irresponsibly, I guess, is

1:01:57

how I'm viewing that. Howard

1:01:59

Bauchner: Yeah, I remember

1:02:02

reading that quote tweets

1:02:04

weren't there by design, you know,

1:02:06

because they they were

1:02:08

I think that's what I realized. I used

1:02:10

Twitter very differently from how some other people were

1:02:12

using it. And and it I had

1:02:14

to do some reading and some looking around to see,

1:02:17

like like like what is bad

1:02:19

use of quote tweets look like. Because

1:02:22

today, I did a quote tweet

1:02:24

on Twitter because we

1:02:26

sent out we were promoting

1:02:28

today's show. We are

1:02:30

promoting, you know, some of the interviews and and

1:02:32

the stuff on today's show from the

1:02:34

security weekly account. And, you know,

1:02:36

a common way that I'll use a quote tweet

1:02:38

is I'll I'll hit quote a tweet on that, and

1:02:39

I'll, you know, say why I'm

1:02:42

looking forward to this interview, and and

1:02:44

I'll send that on to to

1:02:46

my followers. So I'm I'm just, you know, taking this promotion and

1:02:48

and adding some commentary on it.

1:02:50

You know, so so it took me a bit to

1:02:52

understand, like like, what what is what is

1:02:54

misuse of

1:02:56

quote tweets look like. And and the other thing that kinda

1:02:58

horrified me was the idea of, you

1:03:00

you know, like somebody was really excited.

1:03:02

They found a tool that would delete

1:03:05

their their their tweets, any tweets that

1:03:07

are older than a week, you know, which

1:03:09

the way I used Twitter, like, that was horrifying

1:03:11

to me. Like, I I treasure

1:03:14

these conversations that I had,

1:03:16

you know, eight, nine,

1:03:18

ten years ago, you know, and something times

1:03:20

I go back and I use those in talks

1:03:21

and, you know, people there's some great quotes

1:03:24

on Twitter, you know.

1:03:26

There's some great conversations

1:03:28

that happened. And I

1:03:30

I find it really useful to go

1:03:32

back and and look at what we were

1:03:34

talking about back then,

1:03:36

you know, and and how that

1:03:38

informed what we're doing today. You know, as as commentary

1:03:40

on on, you know, yeah, it

1:03:42

looks like it looks like some of these

1:03:44

predictions were right, you know. So

1:03:46

it's it's I

1:03:48

I look at it and it I lot different maybe some

1:03:50

other people do is is a conclusion

1:03:52

I can't do.

1:03:55

Yeah. For

1:03:58

me for me personally, I've

1:04:01

been a little disappointed.

1:04:03

Not surprised, I guess. But

1:04:06

disappointed and frustrated because III

1:04:08

had the same thing. Like, I've had so

1:04:11

many productive and

1:04:13

enlightening discussions on Twitter what

1:04:15

the most recent example was

1:04:17

related to GDPR. When when the

1:04:19

GDPR was was coming online, I had a

1:04:21

bunch of discussions online with

1:04:23

with attorneys and and, you know,

1:04:26

actually regulators and and

1:04:28

other other people on

1:04:30

Twitter. And those are

1:04:32

all gone. So, like, I

1:04:33

can see that I posted, but

1:04:34

the but the other side of those

1:04:37

are are gone too.

1:04:40

And it's that's unfortunate.

1:04:42

But at the same time,

1:04:44

on mass, you know, in Twitter, you

1:04:46

actually had to go and find third

1:04:49

party thing to do that, ESW. that's

1:04:51

actually, like, a native capability that a

1:04:53

a platform offers.

1:04:56

What what what is that? That's a native ability? An

1:04:59

inquiry to to purge

1:05:02

post after a certain period of

1:05:04

time. Yeah.

1:05:06

Yeah. Disappearing messages, basically. Right?

1:05:08

Yeah. Same concept as that.

1:05:12

Exactly. Again,

1:05:14

so another thing that's

1:05:16

interesting, I I ESW, is Twitter

1:05:19

had absolutely turned into, you

1:05:21

know, a platform that marketing

1:05:24

folks use, that companies use. You

1:05:26

know, there's there's a lot of marketing

1:05:29

automation platforms, you know,

1:05:31

where you can schedule tweets,

1:05:33

and you can have a whole marketing digital

1:05:35

marketing team managing messaging that

1:05:37

they're sending ESW. You

1:05:40

know, a tool that'll, you know, you put together your message and it's gonna send

1:05:42

it to LinkedIn, Instagram, Twitter, a bunch all

1:05:45

at once. And I've noticed a lot of

1:05:47

those tools don't support Mastodon But

1:05:50

I I have started seeing some of those companies coming

1:05:52

over to to Mastodon. So we're

1:05:54

seeing some of those those

1:05:57

ESW cases some of those

1:05:59

non human accounts accounts that represent either organizations,

1:06:02

whether they're nonprofits or or their

1:06:04

projects or their,

1:06:08

you know, bots, you know, the ones that spit out funny

1:06:10

stuff. You know, I think there's a whole mastodon

1:06:12

server I saw that's that's nothing

1:06:14

but

1:06:14

bots. Please. But, you know,

1:06:18

What is

1:06:19

it? It's called bots in space. Bots

1:06:21

in space? That's

1:06:24

great. So

1:06:26

it's it's I don't know, what

1:06:28

is the, I guess, where I'm driving

1:06:30

is, what was the future look

1:06:32

like? Does

1:06:34

you know, the fediverse. And one of the nice features I

1:06:36

think is you don't have to look at the

1:06:38

fediverse. You know, you you can look

1:06:41

at only your your local stuff, which I I

1:06:44

think will somewhat insulate from

1:06:46

some of the negative some of the

1:06:48

downsides of of just scale

1:06:50

and growth. You know, and the noise

1:06:52

that can that can result from that.

1:06:54

But, you know, where where

1:06:56

where do you stand on like companies

1:06:58

creating

1:06:58

accounts, you know, accounts you

1:07:00

know, being automated or non human accounts in general,

1:07:03

you know, and and whether those

1:07:05

should be allowed or should there

1:07:07

be limits on them I

1:07:10

the rules in a while. I don't know if you have rules

1:07:12

specific for your instance

1:07:14

just for non

1:07:16

human

1:07:16

accounts. Or shared accounts?

1:07:18

This you're starting to

1:07:20

get into the, like, the philosophy

1:07:24

of of the

1:07:26

Fediverse some of the nuances that and challenges I

1:07:28

think that lie ahead for

1:07:30

us are when when different

1:07:32

instances have materially

1:07:34

different values. So if instance

1:07:36

a allows corporate

1:07:38

type accounts and instant b

1:07:42

finds those to be terribly offensive,

1:07:44

then the the pro probably going to

1:07:46

end up blocking each other.

1:07:48

And and so it goes.

1:07:50

For for me personally, we we

1:07:52

do have a no span rule.

1:07:54

We do have quite a

1:07:56

few corporate and

1:07:58

and, you know, nonperson type accounts.

1:08:01

And fortunately, a lot of them have actually

1:08:04

approached me beforehand and asked, you

1:08:06

know, for for my, you know,

1:08:08

my permission,

1:08:10

I guess, And the thing that I always tell them is, like, you

1:08:12

know, this isn't a it's not a

1:08:14

marketing platform. Right? You're welcome to be

1:08:16

here. You have

1:08:18

to follow the rules. And the

1:08:20

expectation is that, you know, you're contributing

1:08:23

to the discussion. Right? So

1:08:26

if you wanna post about, you know, some

1:08:28

cool research that you've done or,

1:08:30

you know, a a learning blog

1:08:33

that you you've posted or

1:08:35

video. You know, fine. But it, you know,

1:08:37

just like gratuitous spam is is

1:08:40

not

1:08:43

not welcome. So follow-up question on that.

1:08:46

Thanks for being on here. Is one of the more I'm using

1:08:49

parts of

1:08:51

Twitter for me are definitely the brand account, especially

1:08:54

the the humorous ones like Wendy's. I I understand

1:08:56

your

1:08:56

approach and take

1:08:57

on that as contributing to the

1:09:00

conversation, but how do you personally

1:09:02

feel about these sort of brand accounts potentially being on Mastodon and how do you think

1:09:07

Mastodon different

1:09:08

instances might stand on these brand accounts?

1:09:10

That's a

1:09:11

good that's a really

1:09:14

good question. I don't I

1:09:16

don't know how the

1:09:19

Fediverse would react to Wendy's to be. The

1:09:23

spicy takes. I

1:09:26

part of me thinks that it actually might go

1:09:30

relatively well.

1:09:33

Again, because

1:09:36

it's Right? You know, we

1:09:38

we see we see there are some novel commercial

1:09:43

accounts like I'm drawing a blank on the weather

1:09:46

app. What is the weather app that has, you

1:09:51

know, post offensive messages give

1:09:52

you an weather. Right? Well, they have an account. And

1:09:54

and so so, you know, I I think it it

1:09:59

it depends. Right? I don't know that it's a

1:10:01

it's a black and white

1:10:03

thing to be

1:10:06

to be candid. think as long

1:10:08

as from from my standpoint, as

1:10:11

long as it's not obnoxious, and

1:10:15

in, you know, gratuitous and and and, you

1:10:17

know, like if people don't want to see

1:10:19

that, it's pretty easy

1:10:21

to black. Right? You can block an

1:10:24

account really easily. You can actually

1:10:26

block an entire incident or, sorry,

1:10:28

instance also

1:10:30

quite easily too. So,

1:10:32

you know, again,

1:10:35

if if, you know,

1:10:37

III if

1:10:40

Wendy's joined infoset infoset that exchange, I'm

1:10:42

not sure what I would do. Maybe encourage

1:10:44

them to go to a different

1:10:46

instance. III don't know.

1:10:49

That's

1:10:49

fair. Well, I recently joined

1:10:50

in for a sec exchange, thanks to a relatively famous non horse and

1:10:53

I'm gradually dipping my

1:10:55

toes into Mastodon. What

1:10:59

do you suggest for those who are just starting with the

1:11:01

new Mastodon account, especially those that

1:11:03

are switching over from Twitter?

1:11:07

Number one is I wouldn't I

1:11:10

wouldn't recommend going to one of

1:11:12

the

1:11:15

really big instances like like, massed

1:11:17

on that social. There's I think there's a lot

1:11:20

of fear of missing

1:11:21

out by not being on

1:11:24

a super super

1:11:26

large instance. They have

1:11:28

about a million accounts. The challenge with them

1:11:30

is they have a lot of

1:11:35

I mean, to look, anytime you have a million people, you get a

1:11:37

lot of noise. And so they have

1:11:39

all sorts of of both

1:11:41

performance problems and moderation challenges

1:11:44

and not by the way,

1:11:46

that they they do any any sort of a bad job. They're actually phenomenal group of people.

1:11:48

I just sometimes

1:11:52

they don't I'm not

1:11:54

sure that's the best first for to I I

1:11:57

would say, you

1:12:00

know, find find an

1:12:02

instance that aligns with your your interests. Right? There's

1:12:04

interests like just like

1:12:06

InfoSec. That exchanges somewhat InfoSec. Focused.

1:12:11

Although, like, we don't have a rule that says you

1:12:13

only can talk about InfoSec stuff. Like,

1:12:15

I post plenty of cat

1:12:17

bug pictures and we'll talk

1:12:19

about politics and and, you

1:12:21

know, personal stuff, probably ten times more than I do about

1:12:23

security stuff. But, you

1:12:26

know, there are other instances

1:12:30

that deal with niches like

1:12:32

crafts, there's photography ones, there's knitting ones,

1:12:34

there's, you know, medical instances, there's legal

1:12:39

instances, there's news instances. So finding finding one

1:12:42

that, you know, that

1:12:44

that is,

1:12:46

you know, a bit active because if you if

1:12:48

you join one that is, you know,

1:12:51

pretty sparsely populated, you're probably not gonna

1:12:53

have you're not gonna get

1:12:55

a lot of interaction and

1:12:57

you'll get the I think you'll

1:12:59

get the wrong impression. If you find one that

1:13:02

aligns with your

1:13:02

interests, I think you'll have the best time

1:13:06

because your local timeline will

1:13:08

be filled with people who are who

1:13:10

you probably find interesting talking about

1:13:13

things that you do find

1:13:14

interesting. That makes a lot of sense. Thank you. Gotta find your

1:13:17

people.

1:13:18

Gotta find your people. ESW,

1:13:22

but having said that, right, like, regardless of where you end up, unless the two less

1:13:24

two instances have ended

1:13:27

up blocking each other, you

1:13:30

you can it's kind of like email. Right? You can talk

1:13:33

to anybody in the federer's. You

1:13:35

can follow them. You

1:13:37

can communicate back and forth. It's just if

1:13:39

you if you pick an

1:13:41

instance that interests you, you're

1:13:44

going to see

1:13:46

like, all of the content that is posted to that instance, whereas you might not see it unless you're following

1:13:48

people. That's

1:13:55

interesting. So I I have a question that that I've

1:13:58

been curious about. When you created an instance and

1:14:00

and kind of connected it to

1:14:02

the Federalverse, Are you granted special powers within Mastodon? Are

1:14:04

you able to see how many instances there

1:14:06

are or see the whole universe and

1:14:09

kinda like the watcher

1:14:11

in the Marvel

1:14:12

universe? That's a

1:14:15

great question.

1:14:16

So I mean, so

1:14:18

I think the answer is

1:14:21

ESW yeah. I don't I don't mean to to

1:14:24

evade the question at all. The answer is

1:14:26

is certainly yes. ESW, that stuff exists

1:14:29

in the database that I have access to.

1:14:31

But on the other end, if you go to fediverse dot

1:14:33

observer, you you can see

1:14:35

it too. It's it's

1:14:38

it's pretty open protocol and

1:14:40

there's there's lots

1:14:42

of, you know, lots

1:14:44

of sites online that

1:14:46

actually do track that stuff. Yeah.

1:14:55

ESW, yeah, I

1:14:56

don't I don't know if Katie, if

1:14:59

if you or Tyler, have

1:15:01

any questions, but But yeah, for me,

1:15:03

I I'm still I'm still dancing

1:15:05

between the 2II

1:15:07

go check Twitter every now

1:15:09

and then. But it's mostly just checking it, you

1:15:12

know, because, you know, some people

1:15:14

have been communicating with overdMs there

1:15:16

for years. You know,

1:15:18

I've got my Mastodon account you

1:15:20

know, in in my name. I guess I I

1:15:22

guess that's okay. I guess that's still legal over there

1:15:25

on on Twitter,

1:15:28

so people can clearly figure out how to

1:15:30

find me over over in Mastodon. But certainly, the conversations

1:15:34

I'm having are are almost a hundred percent on on

1:15:37

Mastodon these days. So

1:15:39

it's for me, you know,

1:15:41

I mentioned I use it a

1:15:43

little bit differently. I

1:15:45

I was an industry analyst. So

1:15:47

I spent all day, every day just thinking about Infosix, like, bigger problems, how

1:15:49

to solve them, that that kind

1:15:52

of stuff. And

1:15:55

it it was just an invaluable tool for me to be

1:15:57

able to go to this network that I

1:15:59

had on Twitter and

1:16:01

and pose a question. You know, or or

1:16:03

get somebody's take on something or or do

1:16:05

like a a quick survey or something like

1:16:08

that. Yeah. Oftentimes, in in

1:16:10

just like an hour or couple hours or something like that. I could

1:16:12

have these great insights on on

1:16:14

something I was brainstorming about. And

1:16:19

And, yeah, it seems to be fully over

1:16:21

into Mastodon now. So

1:16:23

it's it's, you know,

1:16:25

I found it interesting

1:16:28

how not how non sticky, you

1:16:30

know, people in in, like, product management talk a lot about the stickiness

1:16:32

of a product and how

1:16:34

you make a product sticky. 301

1:16:38

it's yeah. I mean, all those

1:16:41

features are, you know, just weren't

1:16:43

all that important, it seems. You know,

1:16:45

it's it's where the conversation's at. So

1:16:47

I'm I'm starting to repeat myself here. Well, we'll

1:16:49

we'll see

1:16:50

where we'll see what the long term

1:16:52

holds. You

1:16:54

know, I I obviously, we don't

1:16:57

know where Twitter will go. I

1:16:59

mean, they could turn the corner

1:17:01

and release some new super Uber

1:17:03

feature and everybody, you know, runs runs back to them or, you know,

1:17:07

they they could turn

1:17:10

their corporate headquarters into a Spirit Halloween. Like, we we don't know where

1:17:13

where their

1:17:16

trajectory ESW. But we

1:17:18

do know that in the past, you know, my the likes of and and

1:17:20

Slashdot, like, those

1:17:23

things fell apart. Fast.

1:17:28

And and so part of me wonders

1:17:30

if that's what's going on. For

1:17:32

for my for my

1:17:35

part, I I thought that the

1:17:37

the community that had

1:17:39

formed in in

1:17:41

Twitter was, like, something that was

1:17:43

super valuable. And -- Yeah. --

1:17:46

I feared losing that and

1:17:48

not from a

1:17:50

personal standpoint, but from, like, the

1:17:52

good of the world standpoint. And,

1:17:54

you know, I had this this place

1:17:57

and I wanted to

1:17:59

to at least offer offered up

1:18:01

as a soft landing spot. You know, from from

1:18:03

my perspective, there's a bunch of really great security

1:18:08

instances on the Fediverse.

1:18:10

You know, I have

1:18:12

one of probably

1:18:14

two or three dozen different

1:18:17

security focused instances that that are out

1:18:19

there. You know, but from from

1:18:21

my point from my

1:18:24

perspective, I'm I

1:18:26

view myself as kind of the front door.

1:18:28

So a lot of people have been

1:18:30

kind of piling into the instance from

1:18:33

Twitter, and then they they move on. Some of them

1:18:35

create their own personal incidents, some move on to

1:18:37

others, some stay, and and

1:18:39

that's that's all great. That

1:18:43

is one aspect of it I really

1:18:45

like, is that we can all still

1:18:47

talk together. But,

1:18:51

you know, Mastodon like, proper, like, Germany Mastodon

1:18:53

can't enforce new features on you. Like, you're you're not even

1:18:55

running Vanilla Mastodon

1:18:59

on this instance. So ultimately, you

1:19:01

have a lot of control over what what new

1:19:04

features to adopt

1:19:06

or or not adopt.

1:19:08

Right? That's right.

1:19:10

That's right. So we we we run a a fork and probably

1:19:12

soon gonna run a

1:19:15

fork of that fork. With

1:19:20

some extra patches on top of the

1:19:22

fork of the fork because, you know,

1:19:24

that's just the nature of the

1:19:26

beast. Right? The, you know, the the

1:19:28

the core Mastodon software is great, but

1:19:30

it has certain limitations. Like, it doesn't allow longer

1:19:33

posts than one

1:19:36

of the one of the

1:19:38

things that people are are both enthralled and alarmed by when you when you first join Infosight.

1:19:43

Oh, it's shocked. I

1:19:44

was But I was like, I was

1:19:46

like, there's being generous and then there's just

1:19:48

ridiculous. Come on, Jerry.

1:19:51

What are you doing? That

1:19:53

that was the product of a of a

1:19:55

of a battle with with another instance

1:19:57

owner. We we

1:20:00

we kept like, raising

1:20:02

What what upping each other? And then eventually, we lost interest in it.

1:20:05

And here

1:20:08

we are. But,

1:20:10

you know, there's other there's other things like the ability to to include rich text rich text for

1:20:12

markdown,

1:20:17

you know, there's there's, you know,

1:20:19

various other features

1:20:19

that the fork gives. I'm

1:20:22

no more I'm trying to

1:20:24

improve the

1:20:26

ability to search posts on on

1:20:29

the instance. And there's there's

1:20:31

a there's now a fork

1:20:33

of the fork that provides the

1:20:35

quote quote, tweak functionality. So I'm not interested in that. So but

1:20:38

yeah. Like, I don't Is that gonna

1:20:40

be contentious and

1:20:43

divisive? You think that adding

1:20:45

in route tweets? Probably. But I being

1:20:47

contentious and divisive is not new

1:20:49

to me now. I

1:20:52

I don't

1:20:54

controversy or or conflict, but

1:20:56

molly molly has it found

1:20:58

me since I've been there? Yeah.

1:21:01

III think well, people

1:21:03

used to say that on Twitter too. Like, once you pass a certain number of followers, like,

1:21:08

things change all of a sudden, you

1:21:10

start getting pushed back on stuff, you start getting challenged a lot more. And and

1:21:12

like you mentioned, there there's

1:21:14

a couple dozen info sec servers

1:21:18

out

1:21:18

there, people have gone and and started

1:21:20

their own. So it's it's I'm glad

1:21:22

you have that attitude towards it, you know,

1:21:24

because I I'd much rather you be

1:21:27

you know, divisive about, you know,

1:21:29

what you're gonna do with it than

1:21:31

constantly on the fence and, you

1:21:33

know, swaying back and forth and

1:21:35

stuff like that. And and so far,

1:21:38

I'm I'm I'm pretty happy with it, so I can't I can't complain.

1:21:40

Good. Good.

1:21:43

Sounds good. I'm really curious about

1:21:45

the the software forking in different instances running kind of their own

1:21:48

almost unique versions

1:21:51

of Mastodon. So if you implemented it,

1:21:54

quote, tweeting, how would that be seen by the federal or would that be

1:21:55

interpreted? So it's

1:21:59

a great question. I'll

1:22:02

I'll give you a couple of examples. So, like,

1:22:05

with with the rich

1:22:07

text formatting that

1:22:09

that the glitch

1:22:12

fork provides in in a non glitch

1:22:14

instance, you'll just see the the

1:22:16

formatting characters. Like, so for a

1:22:18

bold, you'll see the two stars.

1:22:22

Before and after. And it's

1:22:25

you know, it it isn't,

1:22:27

like, totally scrambled in the

1:22:29

case of the the quote

1:22:31

quote tweets. It quite literally is just the

1:22:33

the the, you know, you

1:22:35

you have your

1:22:39

your message. And then a link to the quoted tweet. And so if you're

1:22:41

on a non in instance, doesn't

1:22:43

support the quote

1:22:46

tweets, it looks like just a message with a link to

1:22:48

a post. Okay. That

1:22:51

makes sense. Thanks.

1:22:55

Mhmm. But I mean, one of the challenges that

1:22:58

that III think we have to be cognizant

1:23:00

of is that we

1:23:03

we have to not do

1:23:05

the might you know, the the

1:23:07

historical, not the current Microsoft thing, but the historic Microsoft thing

1:23:10

of, you know, embrace and extend in ways that nobody

1:23:12

else supports. Right.

1:23:16

Right. Yeah. Yeah. I wonder about

1:23:18

the I guess markdown doesn't

1:23:20

look too terrible. If you're on

1:23:23

an instance that doesn't support markdown.

1:23:25

But honestly, that's

1:23:28

been really my only frustration

1:23:30

so far. Is finding a markdown guide. Like,

1:23:32

I I every now and then I search

1:23:34

for it, and it's like, oh, we support

1:23:37

markdown as supported by so and so.

1:23:39

And I go over and I look at and I just can't find a guide anywhere

1:23:42

because it seems to be different from the

1:23:44

markdown that I use in notion, which

1:23:46

is different from the markdown that use

1:23:48

in like GitHub and

1:23:50

GitLab. Like, there's so many flavors of markdown. That's my only frustration so far. It's

1:23:55

finding a guide. It's

1:23:56

very limited. I'll I'll ping

1:23:59

you one afterwards. Okay. Awesome. Well,

1:24:02

this has been great Thank you

1:24:04

so much for taking the time to be on

1:24:06

here and answer all our our stupid questions. About

1:24:11

the the Fediverse, which is so

1:24:13

far vastly superior to the

1:24:15

Metiverse. I must

1:24:18

say. But thank you,

1:24:20

Jerry.

1:24:21

Yes. Absolutely. Thank you for having me.

1:24:23

And you spent much less in Facebook on it too. Wait

1:24:26

a bit less. Yes.

1:24:32

Alright. We'll be right back in a

1:24:34

few moments with the weekly enterprise news.

1:24:37

Managing and protecting

1:24:40

the world's early number of

1:24:42

endpoints, enabling Tinuum's customers to see, control, and protect every endpoint

1:24:44

everywhere. Tinuum's mission

1:24:47

is to provide uncertainty

1:24:50

and uncertain times with the

1:24:53

industry's only converged endpoint management. Trusted

1:24:55

by the US military and the

1:24:57

majority of the fortune one

1:24:59

hundred, Tinuum helps and protect nearly

1:25:01

thirty million endpoints. Tanium, the power

1:25:03

of certainty. Visit security

1:25:06

weekly dot com forward slash

1:25:08

obtainium to learn more. Welcome

1:25:10

back to Enterprise Security Weekly.

1:25:13

Follow us on Twitter

1:25:15

for live stream reminders highlighted

1:25:17

clips, memes, and more. You can find us at

1:25:19

Sec Weekly. And

1:25:24

clips are favorite. We we've got so

1:25:26

many great clips in the show. I mean, if if you try and listen to the show altogether, it's really long.

1:25:28

So I I love the

1:25:30

idea of pulling out clips for

1:25:34

for people to enjoy because we we've

1:25:37

had some great moments in here. You know,

1:25:39

they're three minutes, five minutes, you

1:25:41

know, eight minutes long, and it's I'm

1:25:43

I'm we're we're starting to pull those out share those. Now for the

1:25:46

Enterprise Security Weekly news, which

1:25:50

anytime we take off for a

1:25:53

few weeks, we end up with

1:25:55

a lot of news piled

1:25:58

up. And Today is no different. A surprising

1:26:01

amount of news came out

1:26:03

around the holidays. Some

1:26:05

of it was not planned.

1:26:07

We've got some breaches on the list here and some

1:26:10

of it was. So

1:26:13

we're not gonna cover everything. There's thirty eight

1:26:15

stories here. You can go to securityweekly dot

1:26:17

com forward slash ESW301

1:26:21

you wanna check out all the

1:26:23

stories that we've shared today. But we've

1:26:25

got well, really, it's eight

1:26:27

funding items here. And The

1:26:31

first one, a sixteen z, for

1:26:33

some reason, threw a hundred million

1:26:36

dollars at at

1:26:38

another crypto startup. And this one is

1:26:40

encrypting stuff they're putting on

1:26:42

Ethereum. So that's how it

1:26:44

it found its way

1:26:47

into my security feed. Typically, like, I'll

1:26:49

just filter these out, you know, like, we'll cover web three stuff

1:26:51

if there's anything really security related. But

1:26:53

I I threw this

1:26:55

one in because a

1:26:57

hundred million is big for a

1:26:59

series b. And I I just I

1:27:02

wanted to discuss to see if anybody had

1:27:05

some insight into what otherwise just looks like

1:27:07

an encrypted read only database. Like like, why is that worth a

1:27:09

hundred million dollars? I

1:27:12

don't know. Wow.

1:27:16

Old man shutting a cloud

1:27:18

status here. I'm I'm achieving.

1:27:20

Yeah. And my

1:27:23

first gut was, like, Holy smokes.

1:27:25

Are are they still investing in crypto? But then I

1:27:27

you know, after this whole FTX thing, I was

1:27:29

like, gosh, they're still putting money to

1:27:31

work at crypto. Crypto, didn't all

1:27:33

these in institutions learned from FTX? Yeah. But it's is it crypto or is it a blockchain tech?

1:27:36

Right? Those are two fundamentally

1:27:38

different things and I think

1:27:40

investing. It's

1:27:42

indirect crypto. Right? Like,

1:27:45

yeah, it's it's and

1:27:47

they might be making

1:27:49

that distinction now, you know,

1:27:52

where they they might have shifted

1:27:54

their their, you know, their their

1:27:56

funding policy and just going after

1:27:59

blockchain stuff. But still, you know,

1:28:01

III think blockchain is

1:28:03

is probably one of the

1:28:05

most disappointing technologies? Or or maybe I shouldn't say disappointing.

1:28:07

Just it is what it is. It was

1:28:09

just most overhyped maybe in

1:28:11

the last decade. Technologies

1:28:15

over the last decade? Yeah. I mean, it's

1:28:17

it could also be a direct function

1:28:20

of just

1:28:22

a, you you know, earliness of the tech. It's been around

1:28:24

for a handful of years, which when

1:28:26

you're talking about massively transformative tech, you gotta

1:28:28

let that stuff bake in the oven a

1:28:30

long time, generally before it mess simply

1:28:33

transforms anything. Right? Like, think about when we first started talking about cloud compute and things like

1:28:35

that, you know, it's what? Fifteen years ago, I don't know

1:28:37

the exact dates, but it's a long time ago,

1:28:40

and we still

1:28:43

barely barely cracked, you know,

1:28:45

a large percentage of companies

1:28:47

using these these technologies.

1:28:49

And that's a massively

1:28:52

transformative tech. So I wonder if, yeah,

1:28:54

the tech's

1:28:54

important. It's just super early. Yeah. I I think a lot of it was that

1:29:00

Bitcoin hit and went up and up and up

1:29:02

and up and a lot of people felt like they missed that train earlier on. You know,

1:29:04

there's there's the joke about someone spending

1:29:06

a hundred dollars on a pizza because he's

1:29:09

they

1:29:10

bought it with Bitcoin in the early

1:29:12

days. I I

1:29:12

think a lot of it is this fungal, this fear

1:29:14

of missing out, that

1:29:15

something crypto

1:29:15

related, something you

1:29:18

know, that it that is part of the

1:29:20

blockchain. It's

1:29:20

either they're gonna miss what it

1:29:23

is. And if they get in early, they

1:29:25

throw some money at

1:29:26

it. Maybe

1:29:26

they can ride that wave as as they go

1:29:29

forward with it. And I

1:29:30

think that's

1:29:30

part of what we're seeing with web three as

1:29:34

well. But who knows? Yeah. I mean,

1:29:36

certainly, you know, I think one of

1:29:38

the things that limited use cases for

1:29:42

a blockchain was to fact that it was completely transparent.

1:29:44

Anybody could grab a copy

1:29:46

of it. So that limited

1:29:49

your use cases. Right? But I

1:29:51

haven't seen anything before now that would prevent you

1:29:53

from encrypting at least part of the

1:29:55

data that

1:29:57

you put on there. You know, so it's

1:29:59

it's I feel like I

1:30:01

have some very recent relevant

1:30:03

insight into, like, how

1:30:05

this might be used after investigating how

1:30:07

both ESW and one

1:30:11

password selectively use encryption,

1:30:13

you know? Because III

1:30:15

think part of my And

1:30:18

we have both of stories or or the LastPass is a big chunk

1:30:20

of the breach stories that

1:30:22

we have on here today. And

1:30:27

I think the the assumption, like, when you hear of

1:30:29

these password management solutions talking

1:30:31

about vaults, you know, the

1:30:33

metaphor of a vault doesn't work

1:30:35

very well because everything inside the vault

1:30:37

is protected equally. And that's just not how encryption is ESW used for

1:30:40

password managers. Like, one

1:30:42

password is a SQLite database

1:30:44

and

1:30:46

stuff that needs to be encrypted is encrypted and

1:30:48

the, you know, the stuff that doesn't, you know,

1:30:50

like, last day it was or the

1:30:52

data was created, last day it was

1:30:54

modified, last day it was used, So a

1:30:56

lot of dates in there and some of

1:30:58

the other information isn't. And the big contentious thing with LastPass is

1:31:01

they didn't encrypt

1:31:03

the URL field. Which

1:31:05

going through my old blast pass stuff, I found

1:31:07

a ton of secrets attached parameters to URLs

1:31:10

in that URL field. ESW

1:31:16

that, you know, I think it's

1:31:18

interesting as as we start talking about

1:31:20

about encryption on

1:31:22

blockchain. So maybe it enables new use cases. It's my long winded

1:31:28

way of you know, using the

1:31:30

the password manager example.

1:31:31

Why is the old saying, those encryption is easy, key management is hard.

1:31:33

So if they figured out

1:31:35

some novel approach a

1:31:38

key management that it enables some sort

1:31:40

of distributed control and

1:31:42

secure capabilities around

1:31:44

that, then maybe it could

1:31:46

be interesting. But is it

1:31:48

quantum

1:31:49

resistant? The the thing that's commonly

1:31:51

clear is, like, if

1:31:53

if we're yeah. Definitely not quantum

1:31:55

research. If we're talking about like, the the cool thing about

1:31:57

Ethereum when I was researching

1:31:58

Ethereum, I did some investing Ethereum

1:32:01

early

1:32:02

on. It's supposed to be a kind

1:32:04

of like a digital contract, digital compute system.

1:32:06

So you can write code onto the Ethereum

1:32:08

blockchain that gets executed.

1:32:10

Smart contracts. Right. Smart That gets executed.

1:32:12

And more so than smart contract business, it's not a con it is

1:32:14

a contract, but it's also you can code on top of it,

1:32:17

which makes it a

1:32:19

blockchain compute engine I mean, in

1:32:21

theory, that is the coolest idea that I've heard in a long time. It's just

1:32:24

maybe

1:32:27

so freaking early that it's just,

1:32:29

you know, I don't know, as I read

1:32:30

through this, I'm going, yeah, it's they're trying to realize exactly what

1:32:32

Ethereum was trying to realize from day

1:32:34

one just in a better way.

1:32:38

Which is a great storyline. And story lines

1:32:41

are how you get money sometimes.

1:32:43

Yeah. I go ahead and

1:32:45

do the same. So so

1:32:48

sorry. Real real quick, Sean. I was just

1:32:50

gonna say that there's a whole cottage

1:32:53

industry of smart contract scanning

1:32:55

tools. You know, look looking

1:32:55

for issues in your smart contract

1:32:58

code. Sorry. Go ahead. No.

1:33:00

Absolutely. I mean, it's Ethereum

1:33:02

is very cool that the whole

1:33:04

smart contract and approach to leveraging

1:33:06

the blockchain for not just a a method of tracking, what transactions occurred,

1:33:11

but also to have some other elements where you can have some

1:33:13

smart contract type

1:33:14

capabilities. Very, very cool. But obviously,

1:33:16

a lot of scammers have

1:33:18

leveraged that in order to extract

1:33:21

money out of people's wallets and and do some

1:33:23

interesting things. And I I think a scanner is is a fascinating way

1:33:25

to to do it.

1:33:27

I think that when you

1:33:30

have a system or a solution

1:33:32

or a technology that provides

1:33:35

amazing capability. Certainly, there's going to

1:33:37

be some the the kind of underground part

1:33:39

of that as well. It's gonna be

1:33:41

interesting to see how blockchain

1:33:43

actually

1:33:43

progresses. One of

1:33:46

the biggest limitations

1:33:46

that I'm aware of with blockchain is

1:33:48

just transactions per second. Like,

1:33:51

they're severely limiting to the

1:33:53

point where you just can't

1:33:54

realistically transact at an approach that a business or approach

1:33:57

a a business level, you

1:33:59

know, business

1:34:01

level of of what would be

1:34:03

required in

1:34:03

order to have transactions that that would

1:34:06

meaningful run a business.

1:34:08

So that part of it is

1:34:10

always the interesting thing to me.

1:34:13

and that's a really important point for for a couple reasons. You know, and

1:34:15

I I think that is an issue with

1:34:18

some of the earlier blockchains,

1:34:20

but Yeah.

1:34:22

I've heard some were created specifically

1:34:24

to address the the transactional issue. But,

1:34:26

yeah, I think with with Bitcoin,

1:34:29

I don't know if it's still this way.

1:34:31

You know, there's some proposals to to fix this somehow, but think it

1:34:35

was seven trans actions a second globally? Like,

1:34:38

was the the fastest you can add stuff to, you know, to the the Bitcoin

1:34:40

blockchain? But

1:34:44

even if they fix that, you know, the

1:34:46

other issue I saw with a lot of

1:34:48

use

1:34:50

cases for Ethereum is that there was still a gas

1:34:52

fee. You know, like, because

1:34:54

it was wrapped around currency, you

1:34:56

know, like a lot of these use

1:34:58

cases just wouldn't work if it cost you

1:35:01

eighty bucks a record to add a record to that blockchain. To

1:35:03

to add a record to that database like that. That

1:35:05