A (2:21)

You did, actually. I hope we're not using up our credits with Doc Rock.

C (2:27)

Oh, God, no. I love to hang out here.

A (2:28)

Good. Doc Rock is, Of course, on YouTube, Director of Strategic Partnerships at ECAMM, and we always are. Glad to welcome Alec Stamos to the Microphones. Alex is chief product officer at corridor.dev, which is a AI security startup. It's great to see you, Alex.

D (2:47)

Hey, Leo, thanks for having me, man.

A (2:48)

I know when I say your name, people go, wait a minute, Alex Stamos. Because, boy, these, you know, you were at Meta, you were at Zoom, brought you in as a consultant when they had that little kerfuffle during the COVID pandemic over end to end encryption. You helped them get that all back together. Then you were at Stanford at the Internet Observatory. We're director of the Internet Observatory, which is all about watching disinformation. But apparently disinformation is all the rage now, so there's not much future in that anymore.

D (3:21)

It's just called information now.

A (3:22)

It's just information.

D (3:24)

Exactly. That's just.

A (3:25)

Oh, Lord, oh Lord, oh Lord. Get me started. So anyway, it's wonderful to have you, Alex, and, and I hope you. Well, I'm glad that you guys are in areas that it's not snowing. Many of our listeners, of course, are in the swath of this terrible freeze. I thought it was kind of interesting, and this is the one tech story, at least so far, having to do with this, that the prediction markets are now huge about any news story, it's all about what you can bet. At Kalshi and Pauly Market, you can bet how much snow hit. Well, I probably can't anymore. I think it's over. You can bet how much snow will fall in New York City this weekend. But basically now traders on CalSHI bet $900,000 as of yesterday afternoon on whether 12 inches of snow would fall in New York. On Polymarket, $210,000 on how much snow the winning category so far, 8 to 10 inches. So if you bet more than 12, you lost your bet. But this is what is going on now. Billions, it seems certainly hundreds of millions are trading hands on these new markets. Betting market.

B (4:48)

It's almost like gambling is addictive. Almost. It sounds that way. I mean, I understand, I understand that it's very difficult to regulate gambling when you have the Internet. I guess that's why sports betting is being allowed now, because you can always go outside of the region where it's illegal and bet there. But it is. Or maybe you don't have to allow it. I don't know, maybe it's a choice. But I still think it's concerning because it's gambling. Right? It's just gambling applied to everything.

A (5:26)

I, I think what happened, at least in the United States with our Our American football, the NFL is. It now dominates. In fact, it's all. I would say it's all sports. It dominates the coverage. You can't talk about a game without saying the over under, who's the favorite, what the. What the odds are. And you see it in tickers going across the bottom. And there's some concern that that's going to happen to news in America, that you will see the over unders on whether, you know, we're going to invade Greenland and that suddenly it's going to become all about betting on the news instead of the actual impact of the news. You guys, I know Alex and, and Doc follow sports closely. Do you think this, all of this, you know, DraftKings sport bet has. I think it's tarnished the reputation of major league sports.

C (6:21)

Yeah. In a way. You know, it's funny cyber nowadays. Here's what's really, really sad. I was watching AFCON the other day and there was a controversial call. And so there's going to be a penalty kick. And the player who's penalty kick, well, he's like half Moroccan and he, he missed the penny kick that Leo could make. And.

A (6:44)

And then the suspicion.

C (6:46)

Thank you. The first thought wasn't, oh my God, the pressure or it was a good idea, but kind of dumb place to do this idea because it does work. When it works, everybody goes, I can't believe they had the balls to do it. It's called the Plinka. It's basically you send it lightly down the center like your sister kicked it. And goalies miss those because they dive left or right?

A (7:04)

Right.

C (7:04)

Goalies take a chance, die left, dive right.

A (7:05)

So. So he was doing something reasonable.

C (7:08)

Was doing something very reasonable. But the first thought that went in my head, and I'm not a conspiracy theorist type person, was, did he do that on purpose? And you know, him being like only half Moroccan, like, you know, is that is like really is this. Is he. Is he on the sports bet? And I can't believe I went there, but as a Raiders fan and knowing Tom Brady's cheating. But yeah, that's the thought that came to my mind. It really is.

A (7:31)

Alex, you're a Kings fan. I know.

D (7:33)

Does it Kings fan and a Cal fan. Cal beat Stanford last night.

A (7:37)

Oh, really?

D (7:38)

They had basketball.

A (7:40)

The ax goes to Berkeley.

D (7:41)

Well, right, so the ax doesn't go with basketball.

A (7:43)

This is football.

D (7:44)

Unfortunately, that is at Stanford.

A (7:47)

Look.

D (7:48)

So there's the famous quote which I think is attributed to Heinlein. I don't know if that's accurate. Or not that every generation thinks it invented sex. And so now every generation thinks they invented gambling. And this is just Gen Z Sportsbook.

A (8:06)

Has always been around, but it was always secretive, it was a bookie.

D (8:10)

Right. Well, so I think there's a couple of differences here, right? We've always had gambling, we've always had gambling addiction and we've always had gambling scandals, right? Everybody here, or at least you and me, are old enough to remember Pete Rose, right?

A (8:20)

Oh, yeah.

D (8:21)

Other scandals that happened. I think the couple things are different here. One obviously is with the Internet, you don't have to know a bookie in town or you don't have to go to Vegas, right? So the fact that young men are doing this on their phones all the time and are getting very aggressively addicted can be a problem. The second is the amount of prop bets that happen, right? Like if you're gambling on the outcome of a game in a major sporting league, then there's all kinds of countervailing motivations. We have even in those cases had people cheating, we've had refs cheating, we've had players trying to shave points and such. But at least you've got a bunch of different. In a basketball game, you've got five guys on either side, you've got the refs, you have a lot of actors. So it's not easy for one individual person to swing the game. But now with all these prop bets, you've got how much is this person scoring? You've got how many fouls. And you've got these crazy things outside of sports, right? So you've got, is this person gonna say this thing in a call for the quarterly results? You've got, how long does the press secretary's briefing go? Right? And so you saw that Trump's press secretary call her briefing within seconds of a bunch of people making money. When you're talking about the actions of one individual for which there's no actual financial benefit for them one way or another, it is so incredibly gameable that I am shocked, I'm absolutely shocked that these platforms are allowing it to be bet on. Because the ability for those people to self deal or for their friends to self deal is humongous. And the fact that apparently we live in a time for which nothing matters and there's no kind of regulation, but this would normally be called wire fraud for a group of people to work together to then use inside information for hundreds of thousands or millions of dollars to be ripped off. We just had a scandal in the NBA where people actually got arrested because there are laws around betting, around sports at least. But for all these other prop bets, there seems to be absolutely no regulation at all.

A (10:33)

So to give you some numbers, according to the Financial Times, in early 2024, bets placed on Polymarket and Cali were $100 million a month in November of last year, $13 billion in one month. They're betting on everything, as you mentioned. They, they, they bet on whether Nicholas Maduro would be captured.

D (11:00)

Right. Somebody made a last second bet and made a ton of money.

A (11:02)

Yeah.

D (11:03)

You know, so you think about how many people in the military knew.

A (11:05)

So somebody knew. Right. Somebody was sitting there and thinking, well, let me just. And so there's risks, there's all kinds of risks. There's risks to the military, there's risks of getting ripped off. Kalshi is worth $11 billion. They raised a billion from Paradigm, Sequoia, Andreessen Horowitz, Capital G, big VC firms in the United States. The owner of the New York Stock Exchange said it was going to invest $2 billion in poly market. They're valued now at 8 billion compared to Kalshee's 11 billion. What's interesting is they're calling these financial contracts in order to skirt around gambling laws in many states.

D (11:47)

Yeah, Yep.

C (11:50)

But this is gambling anything, Debbie.

B (11:54)

That'S the most surprising thing to me.

A (11:58)

It is.

B (11:59)

Gambling is illegal unless it isn't in specific places.

A (12:03)

Right.

B (12:04)

And these kinds of bets would have been considered gambling and would have been illegal until those, you know, first the sports betting apps and now these kind of became allowed. I guess I haven't been following the legislative process on that.

A (12:23)

You know, it's interesting, in the United States, the stakeholders in this are Las Vegas, in Atlantic City. The casinos, yeah, of course, don't want online gambling. They've put a lot of money into California. There was a California initiative, a referendum last year to make it legal. They put a lot of money into that to try to keep it from becoming legal because they want the, the punters to come to Vegas to make their bets. The government doesn't seem to really care that much. The government like the Commod Commodities Future Trading Commission, which is the regulator that believe it or not, is responsible for these. Polymarket and Kalshi don't really care that much. It's the casinos that care.

B (13:10)

Have we suddenly decided that gambling is not. Because the reason it can, you know, there are specific places casinos is that it's not allowed in other places. Right. We're, we're, we're in agreement just to.

A (13:26)

Put up A little speed is illegal.

B (13:28)

Unless. So how come no one is mentioning that this is gambling and maybe we shouldn't be like all of a sudden it's everywhere people are.

D (13:36)

So there's, there's multiple lawsuits happening and effectively there's a bunch of fights happening under state law. There's a bunch of lawsuits. There's a lawsuit from a Nevada. So Nevada, Nevada's gaming commission has sued. There's been in Indian tribes with. Have sued.

A (13:54)

Yeah, that's the other stakeholder is Indian casinos. Yeah.

D (13:57)

So what's happened is effectively with the switchover, the Trump administration has stopped, you know, prosecuting. Has stopped prosecuting. Right. So like the federal regulators have stepped back and US Attorneys have stepped back. That's not going to last forever.

A (14:12)

Right.

D (14:12)

Like in three years there'll be a new administration. It will most likely flip the other party. And I think you're an optimist, you, Alex. I am. So I'm not gonna be a doomer. There's all these like blue sky doomers who are like, we're never gonna have another election or whatever. That's not right. Like, it is coming there. There is going to be a massive change here in the United States. I think it will be significant. There will be a. And I think the, the tech people who are aligning themselves with the current administration so hard are they're going to hurt themselves and honestly, they're going to hurt tech overall. I think like this is like when I talk to people here in Silicon.

A (14:44)

Valley, Alex, they're going to make the same return they made two years ago.

C (14:47)

That's like, they occur so fast, the bits will fly.

A (14:49)

We're gonna get woke again.

D (14:51)

Yeah, but this is, I think this is the. I think it's be very hard this time. I mean this is my, my fear is that, and for folks like this, I, I think it's great for them to be smushed.

C (15:01)

Right.

D (15:02)

And like, I don't mind like, you know, for things to like snap back on things like cryptocurrencies and stuff. Right. Like, what I am afraid is for tech overall is that there's the relatively small number of outspoken venture capitalists and other douchebags who have backed this current administration are going to poison the well on American debt competitiveness for a decade by basically turning a huge chunk of the American populace. Because a handful of people who stood in that line at the inauguration are going to make people think that that's all tech people. When like the median tech, even executive who lives in San Mateo or Santa Clara county is effectively like a west wing liberal. Right? And. But that's not who you hear from.

B (15:53)

And that's not who you tell you that looking at it from here, we are seeing that, right?

D (15:58)

That's not what you see. That's not what you see because you see from, like, the handful of really loud people.

C (16:02)

Yeah, yeah, exactly. Those guys.

A (16:04)

It's not just really loud people. It's Tim Apple, it's Sundar Pichai. It's CEOs who rightly or wrongly think we've got to play ball with the current administration or sad, but we're going.

C (16:15)

To have no, kind of no choice. And that's the part that sucks, because I know. I know for a fact that he's probably technically not even in that camp, but I mean, he has personal things that are completely against the administration, but he got to make the company afloat, got to take it to stockholders. The thing that's upsetting me about the gambling thing right now is they are preying on the people who feel that the financial situation is never going to get better. And whenever the financial situation doesn't get better, people try to take gambles. Now these gambles are talking about they got dumb stuff like who's going to win the next presidential election. Yo, we haven't even picked candidates yet, but they got like, you know, J.D. vance versus Gavin Newsom.

A (16:55)

You want a dumb one? Betting that Taylor Swift will be pregnant by March is one of the big problems, that one.

C (17:01)

So, because I want to. I wanted to say, Kelsey. Oh, my God. They. They heavily advertise on ig. So if you're an ig, you see this stuff, and I'm like, yo, these bets are super stupid. But the thing is, and. And coming from being basically been, you know, east coast in the hood at the time when the money gets bad, people start doing, quote, unquote, illegal things to try to get the money. Then the Reagan administration decided to lock all of us up for it, right? While, you know, Tom Cruise gets caught with a little small bag of the, you know, booger sugar, and he goes to rehab, take that same book of sugar and turn it into crack, which is one tenth the amount, and put it in the hands of somebody on my side of the fence and it's 20 years automatically.

A (17:46)

Yeah, that's right.

C (17:47)

And so they're preying on people being down in their money right now. And this is no different than what the crack situation was back in the day. It just doesn't seem as painful. But trust you me, it's Painful. There are kids right now, they're wasting their college fund. There are parents right now that are taking wild swings and they're losing. And. Yeah, it's not only is it addictive, it's highly destructive. And then, you know what you do to recover your money after this? Call the local person in your neighborhood that knows how to get money the way my neighborhood got money. And then you get worse in debt.

A (18:22)

Yep. And the vig kills you 100%.

C (18:26)

This is. This is really bad.

D (18:28)

Yeah, it's gonna. It's gonna ruin lives. And. And the, the pushback.

A (18:33)

I thought this was gonna be a nice, upbeat way to start the show.

D (18:36)

Leon, I don't think you have the right guests for, like, the super upbeat show.

A (18:40)

I gotta start with something, because the.

B (18:42)

Rest is not even about the guests. This is literally gambling. Like, there's no discussion. The only reason this isn't a bigger deal is that there are other big, much bigger deals, you know, in.

A (18:55)

This Is the Secret. It's. It's crap all the way down. And it's very clear that a lot of this is that Putin style flood the zone where if you, if you spew a huge amount of crap, people, you know, we can only take so much. At some point, people just go, I give up. And they turn out. And that's, of course, that's the best possible thing that could happen.

C (19:19)

I hear so many of my friends with the I give up language, and I'm like, no, please don't go there yet. Like, I don't even like your take on it, but please don't give up.

B (19:27)

Honestly, I think it's fine to give up. I think it's fine to give up because you're going to ruin your mental health.

A (19:33)

Well, that's why you want to give up. It's driving me. I can't sleep.

B (19:37)

You want to give up.

A (19:38)

I can't sleep.

B (19:39)

As long, you know, just bought three.

C (19:41)

Bottles of Japanese whiskey back from Japan. I'll see you.

B (19:45)

That helps. But, like, give up on the constant barrage. Just watch the news from a channel. You know, friends24 has an English channel. Just watch the news once a day from French 24. Read a reputable newspaper and then vote when it's time to vote. That's the important thing. Like, you're not going to. You're not going to change things or understand things better by watching the constant barrage of news of either the news 24 hours news networks or the tiktoks and shorts or whatever that will serve you the most outraging.

A (20:34)

We have an elderly parent who doesn't consume mainstream news, but subscribes to 300 newsletters and gets much of their news from a Brazilian, kind of nutty Brazilian newsletter. And the problem is, it's so easy now, thanks to AI and thanks to the Internet, to create a huge amount of disinformation. And I think, I don't blame this relative because he's grown up, he's an older fella his whole life, that, well, you trust what you read. Right. These are, you know, we trusted the New York Times and NBC and cbs. And when Uncle Walter said something, Walter Cronkite, we took that as gospel. And so you have that in your head. Well, I'm reading it. It must be true. So I don't blame them for this. Let me ask you, Alex, because you are an expert on security, and I'm very relieved that you think the elections, that elections, fair elections can happen. One of the strengths, a weird strength of the United States is that our elections are run by the states. So there's 50 different local governments that run the election. It's very hard to steal a national election. Right.

D (21:53)

There's over 10,000 actually, election authorities in the United States.

B (21:56)

Right.

A (21:56)

Because. Yeah. Not just the states, the counties. Right. It's local.

B (21:59)

Yeah. Don't you just need to steal like four countries counties though, too?

D (22:03)

No.

B (22:03)

To swing it. So.

A (22:04)

So tell me, Alex, reassure us that it's. It would be very difficult to steal an election.

D (22:12)

It's extremely difficult to steal an election, which is why the election was not stolen in 2020 and why it was not stolen in 2024.

A (22:18)

There is a feeling that it might have been. I mean, Trump did say, well, we got the swing states handled. Elon's going to handle that.

D (22:25)

Yeah.

A (22:27)

That scared me a little bit.

D (22:29)

This is what drives you nuts. There's. There's a whole set of, like, Democratic influencers who like to, you know, push this idea that Trump stole it. That is not possible. Donald Trump did not steal it either. Right, right. Like it is. It is extremely hard in the modern era. It would be. If it is effectively impossible to. To steal a U. S. Election, what is possible. It would be possible to cause chaos. Right. And it certainly would be possible for the President, United States to cause chaos and to create a situation where you can certainly create a situation where the election is unfair. Right.

A (23:06)

Where people, or maybe more to the point, believed to be unfair. Right. That's the real issue, you know, is what people believe.

D (23:13)

Right. But actually changing the votes would be extremely hard to just Laid out. Right. So in the United States we'd now have moved as of now. So this wasn't totally true in 2020. Although one of the saving graces is by 2020, none of the swing states were using direct recorded entry electronic voting. Right. So nobody, none of the swing states was it that when you pushed a button on electronic voting machine, did that machine store your vote? There were people who touched a touchscreen, but then what it did was recorded it. That was a ballot marking device.

A (23:45)

You want something that's a paper trail that can be audited after the fact.

D (23:49)

So now we have for the vast majority of people vote on handmarked paper ballots with the option of people can touch a machine if they. This is most of your people for either who need a language that is not supported in the place where they're voting, or they have a special accessibility need such they're blind or something like that. But then those are ballot marking devices. It will then print a paper ballot. Those ballots are then counted usually by machines. But then we have what are called risk limiting audits in every all 50 states. So this is what, this is what it gets hard. It is hard to explain this statistic, things like statistics to normal folks, but.

A (24:26)

This is the expertise of your former colleague Chris Krebs. Right. This is why Chris Krebs in 2020 said this was one of the fairest elections.

D (24:35)

He said it was the most secure election that ever been held, which is true because by 2020, CISA had been created the Cybersecurity and Infrastructure Security Agency, which was the consolidation of a bunch of different security groups and DHS into one agency. Now, CISA can't actually do security for all the different parts of the election, but what they did do was support all the different counties and states. And in doing so they did penetration tests, they did code reviews of the code, they did work with the people who build all this stuff. And then they ran a center that pulled in information from the NSA and FBI, shared threat information back out to the states and counties. And then if anything bad happened, helped do very rapid investigations.

A (25:20)

Is that all still in place?

D (25:22)

No, that's all been torn down. All of that capability has been destroyed. The people have been fired from cisa.

A (25:30)

There's been an active attempt to undermine that security.

D (25:34)

Yes, pretty much anybody who did that work has been effectively called like a traitor or has been said that they. Chris, Chris. Like Chris. Chris. So unfortunately, President Trump signed an executive order that explicitly called out Chris and said that Chris's clearance need to be revoked. His clearance was revoked. They took away his TSA PreCheck in his global entry, which is kind of nutty. I mean, it's like kind of talk about some. That's petty, petty fascism. But then what is not petty is then ordered for him to be investigated, which is basically a bill of attainder, which is something that is so unconstitutional, constitutional. It's mentioned in our Constitution as not being allowed twice. So anyway, Chris and a number of other people worked very hard in 2020, and not him, but other people worked in 2024 to keep the election secure. A bunch of those people have been fired. But still, there are people in the states and localities who have that muscle memory who will be doing this in 2026 and 2028. It's just basically impossible to straight up steal an election. I think the fear, though, is if you have kind of armed men in the street, if you have riots, if you have tear gas, then people won't go out to the right. So that's different. That's different than, like, you know, stuffing ballot boxes. It's different than changing the vote totals, which, again, is effectively impossible at scale. But what you could do is try to suppress voting.

A (27:04)

Part of the problem also is that our elections are very close, and they have been for decades. And the closer the election, the smaller the amount of leverage you need to exert to change an election.

D (27:16)

Yeah, and the other. Other issue that everybody's always afraid of is the, as everybody here knows, is actually the Americans voting for our president directly. It was not how we did it. George Washington was not elected by the American people. He was elected by the first Continental Congress. And that. That then persisted in the creation of the Constitution in 1792 and such. And that Congress came together and put the Electoral College and such. And so the direct election of the Electoral College was something that was kind of added on later. We have these weird systems for like, hey, if the states can't figure out who their electors are, what do we do? And this ended up in, I think it was 1873, in this really bizarre. It's only happened once in our history, but this really bizarre outcome where then the House of Representatives effectively had to decide who the president was going to be. And that's what ended Reconstruction after the Civil War and ended up being really bad for our country in a number of ways. And so I think that's one of the real fears, is if you cause enough chaos, if you cause lawsuits in every single state, that you're able to throw it to the House of Representatives. Which then does not vote based upon the population it votes. Each state votes as a bloc. And it's just a bizarre part of our constitution that should not be written the way it is. And it's only worked that way once. And that would be extremely undemocratic. An outcome that would not be accepted, I think, by a huge number of the American people.

A (28:55)

Well, I'm just.

B (28:56)

I kind of wish you had stopped at it's impossible to steal the election like 10 minutes ago. That's it.

D (29:03)

That's it.

A (29:05)

It's gonna be fine. It's gonna be fine. What's interesting, of course, Patrick, is that the rest of the world cares very much what happens here. This impacts everybody. It's not just us.

B (29:18)

Yeah, yeah, yeah, yeah, of course. I mean, we were talking just before the show. I was saying that when we were thinking that I think if we were to vote on what is it Calci or polymarket? Like, is the American military actually going to enter Greenland's not space, but territorial waters. It would probably be relatively low. But we can't act like it's impossible. So obviously we think about it, we talk about it.

A (29:53)

One of the ways you keep that probability low is by being strong. I mean, this is the lesson learned.

D (29:59)

In World War II. 26% right now will the US acquire part of Greenland. So if you want to.

A (30:04)

That's pretty low. That's surprisingly low.

B (30:07)

It is not going to happen. It will be World War three before that.

D (30:10)

If you believe it. You put your money where your mouth is right now.

A (30:13)

But then what would you spend it on?

B (30:15)

Start gambling? Yeah, I wouldn't have it, but so, you know, it's things like we start talking about the fact that you should have rechargeable AM radio just in case. I mean, this.

A (30:26)

Is this what people in France were doing? They were.

B (30:29)

No, it's me. It's me and my nerdy tech friends. But we realize. We realize that, you know, we don't have copper cables for phone lines anymore. We don't have TVs with antennas to get the news. So if something happens, it's not just, you know, an open conflict with the United States, but if there's, whatever something happens, if there's a bomb, if there's anything, you can't get communications with anyone. So you probably do need an AM radio to least get some information about what's happening. But more seriously and more tech related, I think what a lot of people have been thinking about is that we need at least failovers, like backups on all the systems that we use that are provided by American companies like Microsoft, Google, Apple, everything. And so even if you don't switch everything over to, let's say Proton or one of those, I think a lot of people, especially in infrastructure and critical infrastructure, they will switch over. But a lot of companies might want to have a system ready to go up very quickly if things go bad. Because even if there isn't an armed conflict, if at some point something happens and the American, you know, the Trump administration decides, American companies can't do business with France or some of them, or it's very unlikely, but if it happens, then you're in deep doo doo. So you need to be ready. And that's the kind of thing that we wouldn't even have like considered a year ago. It would have been like pure fantasy. And now you remember what happened with the International Court of Justice and what was the name of the gentleman, he had his Outlook email revoked. Oh yes, after the investigation. And that's right.

A (32:37)

Was Microsoft's servers.

B (32:39)

Yeah, right. And so that was a shock in, in Europe it was like, okay, then it can happen and we can't be using American services for critical infrastructure. So I think relatively quietly, a lot of administrations have been slowly moving towards either open source or European based services.

A (33:07)

Headline in Friday's Wall Street Journal. Europe prepares for a nightmare scenario. The US Blocking access to tech. Trump's Greenland threats inject urgency into regions efforts to reduce its reliance on American technology.

D (33:22)

If there's anybody who blocks it, it's actually most likely to be the European Commission. Right. Because we're actually in this weird legal place post the Schrems 2 decision by the European Court of Justice where there's supposed to be an agreement between the European Commission and the United States that was negotiated by the Biden administration. And then the Trump administration just kind of dropped it a little bit. And so there's the tech industry is. And this precipice where, you know, the Trump administration is supposed to be, you know, at the same time there's supposed to be fair dealings of saying, yes, we will respect the privacy of Europeans and we will help American companies do that by agreeing to a set of rules by which we will respect the privacy of European citizens. If it sits in American data centers, we're also threatening to invade Greenland. And so all you need is for the European Commission to effectively just not agree to this new privacy agreement between the United States and the EC and the European Court of Justice will just wipe out what are called standard contractual clauses and all of A sudden European. The European subsidiaries of Microsoft and Google and every other American company will no longer be able to do data transfers into the United States. And so that will have the effect of basically cutting off European companies from using the American cloud.

A (34:54)

Let me take a break and then we'll talk about TikTok. Because the deal went through and maybe didn't work out quite like everybody thought it might work out. We have a really perfect panel for this. I got to tell you, it's so good to have Patrick Beja visiting us from the eu and if he suddenly disappears, we'll know something. Something horrible has happened. No, no, he's, he's actually just getting better from the flu and it's late at night in Paris and we're gonna try to keep this from being a four hour episode just for you, Patrick. Yeah, right. Yeah, right.

D (35:28)

We've gone through two stories, so we're.

A (35:30)

I know we're not moving exactly at the pace I was hoping. That's Alex Stamo. Great to have you, Alex. You know, these are important things though. I really, you know, I don't want to give them short shrift. So I really appreciate it. Alex's new job as chief product officer at corridor.dev. a firm that was much needed these days, helps AI developers create secure code. And I'm going to sign up for it and have it run on my GitHub repos and see where I went wrong. Because I've been doing a lot of vibe coding lately. I've been loving it. I've been loving Claude code. I actually ended up up doing the max subscription just so I could have more tokens and more credits. And it's really, I think we're entering into a world of hyper personalized software. It's very interesting to me. We'll talk about that a little bit. Also with us, Mr. Aloha himself, Doc Rock. Thank you, YouTube.com docrock he's on the opposite side of the world, actually from Patrick. So as Patrick's entering the early morning hours, you're just entering the afternoon.

C (36:34)

Yep. One o' clock almost.

A (36:35)

That's nice. That's nice. Great to have all three of you. Our show today brought to you by Threat Locker. I'm very excited. Steve Gibson and I are going to be heading to Orlando for Threat Locker. Zero Trust World. We've got a deal on tickets. I'll tell you more about that in just a second. But let's. Let me first tell you why you want to know about Threat Locker. You know, ransomware is Just devastating businesses worldwide. Threat Locker can stop it before it starts because it's zero trust. Zero Trust is remarkable. Recent analysis from ThreatLocker shows how a single ransomware operation, Qilin, surged from 45 incidents a couple of years ago to 800 incidents last year. It'll probably double again next year. This year. That's why you need Threat Locker. Threat Locker's zero trust platform takes a proactive and these are the three words, the key three words, deny by default approach to block every unauthorized action. If you don't specifically say yes, this can happen, it won't happen. That protects you from both known and unknown threats. Threat Lockers innovative ring fencing constrains tools and remote management utilities so attackers cannot weaponize them for lateral movement or the mass encryption they need for ransomware. Threat Locker works in every industry. It works on PCs and Macs. They've got US based support. That's phenomenal. 24. 7. And this is kind of cool. It's just I think in a way a side effect of zero trust. Because you know nothing can happen unless you authorize it. It means you have comprehensive visibility and control. You have a record of everything that's happened. Right. Listen to some of the people using Threat Locker. Emirates Flight Catering. This is a global leader in the food industry. 13,000 employees. They cannot afford to be down for one minute. Threat locker gave full control of apps and endpoints, improved Emirates Catering compliance and delivered seamless security with strong IT support. The CISO of Emirates Flight Catering said this quote, the capabilities, the support and the best part of Threat Locker is how easily it integrates with almost any solution. Other tools take time to integrate with Threat Locker. It's seamless. That's one of the key reasons we use it. It's incredibly helpful to me as a ciso. Any enterprise that can't afford to be hit by ransomware, I guess that's everybody. But not can't afford even to be down for a minute. Can benefit From Threat Locker. JetBlue uses Threat Locker. They have to fly right. Heathrow Airport, which has in the past had problems. They've turned to Threat Locker now to make sure that the airport operations are flawlessly, continuously available. The Indianapolis Colts use Threat Locker. The point of Vancouver. I go on and on. Threat Locker consistently receives high honors, industry recognition from G2 for high performer and best support for enterprise in the summer 2025 ratings peer spot ranked threat locker number one in application control. GetApp's best functionality and features award in 2025. Find out more about ThreatLocker. Go to threatlocker.com twit Get a free 30 day trial. Learn more about how ThreatLocker can help mitigate unknown threats and ensure compliance. Threatlocker.com twit I am excited we're going to go to Zero Trust World, their annual conference. It's in Orlando this March and if you want to come out and see Steve and me, we're going to do a special presentation on the first day of the event. We've got for a limited time a special offer code for you. ZTW Twit 26 that's Zero TrustWorld ZTW Twit this week in Tech 26 you'll save $200 off registration for Zero Trust World 2026. We'd love to see you. You'll get access to all sessions you get hands on hacking labs meals. There is an after party that's legendary. The most interactive hands on cybersecurity learning event of the year. It's March 4th through the 6th in Orlando. Be sure to register with our code ZTWTWIT26 and we will see you in Orlando. And thank you Threat Locker for supporting the show. So this week it became official. China and US have signed off on the US spin off. China still has 29.9% of the company. That's the maximum of foreign entity can have ownership of. The rest is owned by Oracle, Silver Lake, Michael Dell, the United Arab Emirates. Their MGX is their state owned investment firm based on AI Susquehanna. I think that's the, that's Jeff Voss who's a big Trump donor. And I think one of the real reasons that the whole throw TikTok out of the United States didn't happen because Voss had a huge percentage of TikTok and I don't think he wanted to lose his money. Dragon Ear this meets the the final deadline. The extension which has been going on since the law requiring TikTok to be sold was passed and signed in law in 2024. The Supreme Court affirmed it. No one knows how much was paid. It's not clear but I did note that as soon as I signed into TikTok I got new end user agreement that I had to agree to. So I didn't and I deleted it. Some people say it's actually for one of the things that they asked for is more specific location information. Look, we were worried about the Chinese having that right now they're being, they're even more granular. They're having minute to minute location information. That was the thing that stopped me. They also said TikTok could collect information, including your sex life, your sex orientation, your status as a transgender or non binary citizenship and immigration status. Now lawyers have said that that's to comply with California's Consumer Privacy act because now it's a US entity, they have to comply. I guess it was enough to scare me off. It's funny, it's ironic because I honestly wasn't worried about the Chinese knowing my immigration status. I'm much more worried about the US Government knowing my immigration status and I'm a citizen. But apparently that's not sufficient anymore. What do you, what do you think, Doc Rock? Are you going to continue? Do you do stuff on Tick Tock?

C (43:23)

I, you know, it's really crazy as I recently just started doing stuff on Tick Tock because, you know, there's a lot of activity happening over there and. Yeah, this is sketchy.

D (43:36)

This is.

A (43:37)

What's funny is that you can't get past the agreement to cancel your account. You have to agree to it before you can cancel your account. So I just, I was checking to.

C (43:51)

See if I had the pop up. I didn't get the pop up yet, but I know some friends, they got it yesterday.

A (43:54)

Oh, I got immediately.

C (43:56)

This is wild.

A (43:59)

So I declined and deleted it. Alex, am I, am I crazy? I mean you, we were talking, we've been talking with about this for more than a year. I remember when you were on, you said, yeah, no, TikTok is a threat. It's no longer a threat.

D (44:17)

Yeah, so, okay, so my position always was that of all the Chinese companies, TikTok was not never the, the biggest threat. I've always been much more concerned about WeChat because WeChat actually carries conversations that are important and it is, is very much not end, end encrypted. And there's evidence that the Ministry of State security effectively uses WeChat as a massive surveillance tool to.

A (44:45)

And most. There's very few Americans that use WeChat, but it is used by Chinese.

D (44:49)

A lot of Chinese Americans, A lot of Americans of Chinese ascent use it because if you have any family that speaks Chinese, you use WeChat. So it is used as a tool to kind of spy on the greater Chinese diaspora. So but that being said, there was some risk from TikTok, but a lot of that risk had been pushed down a little bit through the mechanisms of Project Texas and the creation of this.

A (45:15)

Oracle was hosting the data in the United States.

D (45:17)

TikTok U.S. data Security LLC. Yeah, exactly. And so there's a lot of things to say Here one, there was a law, that law was just straight up ignored. Right. The Trump administration basically just said, you don't have to follow this law. There was no mechanism.

A (45:33)

Remember, it was roughly a year ago, right before the inauguration, TikTok went offline.

D (45:39)

And that was what was supposed to happen because they were not following the law. There was a mechanism for one extension, I believe to be given. But to do that, you had to have been on the verge of a deal and the administration did not do any of the stuff they were supposed to do for that. So one, we just kind of just blew through the law. Laws don't matter. So that whole thing's been crazy. Second, this new entity, some of these are just neutral. I don't think Michael Dell has that much of a political position. Silver Lake is just a neutral private equity firm. But some of these people are really political players who are directly aligned with the current administration.

A (46:25)

And we know Larry Ellison is one of them.

D (46:28)

Yes. Who is absolutely like twisting, as we know, CBS political direction to make the President happy. And so in some ways, TikTok might be more of a threat, if not from a data perspective, from becoming a much more political platform now. I think that will, if. If that happens, that is going to backfire in crap. I mean, there's nobody who is more sensitive to being manipulated. As a father of teenagers, the idea that you can like, like think that you, that you could try to manipulate 15 year olds if that, if you're like a middle aged person, you're like, I'm going to manipulate the. The idea that like Larry and David Ellison are gonna be able to like manipulate teenagers and get away with it is just ridiculous.

A (47:12)

They're gonna sniff it out, given the current climate in the United States that they say, we will collect your immigration status.

D (47:18)

So. Okay, so they're not directly collecting it. I think there's a couple of things going on here. One is when you're a social media company, one of the real challenges is that people upload everything. So I saw this at Facebook. I never worked for Meta. Right. I was at Facebook and Facebook when I was there, got sued for all these situations where there'll be laws of like, you have to protect this kind of data, like pregnancy data. Okay. Did Facebook ever want to know people's pregnancy data? No, but there'd be things like SDKs that could get embedded in products and then all of a sudden things like Phi would get uploaded and that's just like an arbitrary text field. And all of a sudden it ends up in our database and we don't even know about it. But then the company gets sued and it is way easier to go to a jury of 12 people who can't get out jury duty and tell them, big company, bad big company spying on pregnant women. And then the defense attorneys are like, no, this is an arbitrary text field. And, and it's a Jason field and Facebook didn't know. Yeah, you're going to look.

A (48:25)

So it's sensible if you're TikTok to.

D (48:27)

If you're the lawyers, it makes sense because like the law says, especially in California, that these are the sensitive things. And so TikTok basically has to say, we might know these things about you because TikTok allows arbitrary stuff to be sent up. Now the question is, is it smart for them to actually list these things because it's going to show up in a lawsuit later. This is where you get, I think, the trade off inside of social media companies between the lawyers and product people, where if you're a product person, you might be like, could we just get away with saying, hey, you're sending us videos that might have anything in it? And if you tell us sensitive stuff, it's going to be in your data and we can't help that. Can we get away with that instead of listing all this stuff?

A (49:11)

It's probably also why they fought the California Consumer Privacy act because they knew it would require this kind of language. Right?

D (49:21)

Yeah. I don't think TikTok's actually tracking immigration status. I think they have overactive. They have. They paid somebody 900 bucks an hour to write this thing. And part of what they're doing is they're looking at every lawsuit against every other social media company for the last 20 years and they're protecting against it. That being said, I think this whole TikTok thing is incredibly corrupt. Right. Like effectively our government put a gun to the head of a foreign owned corporation. I do not like the owners of that foreign owned corporation. I am not a fan of the People's Republic of China. I have a child who is learning Chinese and he has to go to Taiwan to do that because I have a file probably of the ministry. I know I have a file with the ministry.

A (50:06)

He couldn't go into the right.

D (50:08)

He can't go there. So fine. Taipei is great. I want him to visit while it still exists. And so anyway, like, I'm not a fan of the old owners, but we put a gun to the head and stuck them up and then transferred ownership of it to the political friends of the Current administration, it's just straight up gangster capitalism.

B (50:28)

It's the second part that's a problem. It's who it was transferred to that's the problem. Because I think the issues that were listed with the Chinese ownership of TikTok were substantiatable. Like, it's not. Maybe you could have discussed how real it was. But the question of especially maybe the data issue is a little bit overblown because data is being sold and bought in the US anyway. Our GPD is pretty cool. The issue of the influence with the algorithm, I think, is a very serious one. And the idea that a foreign entity is so embedded into the culture of another country that it could influence cultural trends and political decisions, I think is a serious security risk. So transferring it, transferring the ownership either, I mean, you could ban it or you could transfer it to a neutral party where you're a little bit more confident that it's not going to have this kind of undue algorithmic influence. I think it makes sense. The problem is who it was transferred to. And the algorithm can be used to nefarious ends in that case as well. I mean, any political party cronies or friends of would have been a problem. It turns out it's this one. If we want to be a little bit more neutral for a second, it turns out that this one, it would have been a problem either way if it was another politically charged group of people. But the issue of the algorithmic influence is not to be discounted, I think. And we can see it. I mean, we've seen it. I think it was last year, an article about Taiwan and how the youth in Taiwan is having its view of the Chinese model changed through. It was a long article, I talked about it a few times, but it was influencing the way the youth in Taiwan is looking at China. And even it might be a little bit anecdotal, But I use TikTok quite a bit and I've seen a significant amount of what is effectively Chinese propaganda which is showing all the great things about China. Modern cities, modern, very technologically forward stuff. Happy people dancing, singing, showing, showing their, their, their cities with trains going through buildings and stuff like that. That's awesome. You strangely never see anything negative about China on TikTok.

A (53:37)

Never ever.

B (53:40)

And I have. Again, this is very.

A (53:42)

I never have either. You're right. Yeah.

B (53:44)

But I seen, you know, people going like, you know, China sounds cool.

A (53:50)

Yeah, China sounds cool. It's very.

B (53:53)

I mean, China is very cool. There are some not cool parts, of course, and. But you, you never Hear about, you know, freedom of expression, the Uyghur, like never on TikTok. And my point is that of course it's not. There are a lot of people who know about these things. There are also a lot of people who might not as. It's not that like it's going to go from 0% to 100% positive opinion, but if you shift, you know, 5%, 10% opinion, it, it does something to the country. Right?

A (54:24)

So, well, we don't have to worry about it.

B (54:26)

It's very easy to discount that aspect of it. And the, the algorithmic influence is not. It should not be, you know, throw up, thrown out.

A (54:35)

I feel bad because, you know, my, as I've mentioned before, my son basics his career on Tick Tock. He's now on Instagram as well and so is a little bit insulated against it, but he still posts regularly on Tick Tock. I, I don't like how I actually got rid of Instagram too. I think I just don't want to have either one of them foisting any point of view on me and X as well.

B (55:01)

I don't think you're the target. True.

D (55:04)

I mean X has become just it.

C (55:07)

Terrible, right?

D (55:09)

It's just like race war every day, right? Depending on. I mean what drives you nuts is there's still like a group of AI.

A (55:16)

There's great AI stuff on X. That's. I kind of missed that.

D (55:19)

But the political discussion has become just completely dominated by bots and plus Elon forces.

C (55:26)

Threads.

A (55:27)

Sorry.

C (55:27)

The alternative became threads. And the funny thing about threads while they try to gain traction is there are so many posts which are just there to like, absolutely rage Beijing.

A (55:38)

I mean, like, isn't it social now?

C (55:42)

Yeah, no, but I mean it's, it's the odd. It's the low hanging fruit rage baits that you easily bite into because you think it's a real question and then sometimes you look at it go, wait a minute, this is, this question is so stupid. This is actually put here just to get engagement bait. So it's different from raised baiting. Let me put it that way. It's engagement baiting because I'm going to say something stupid so everybody can tell me that I did wrong and you're getting engagement and so that elevates those accounts. And so they keep going, keep going and then all of a sudden they kick in the rage bait. So they are actually smart enough because they're building this sort of attention graph by saying dumb stuff. There are people, Leo, that's Going to crack you up. There are people still arguing about how the magic mouse is terrible because you charge it from the bottom. And we all know still, that still in, in the time that I've been having this freaking brain fart, I could have plugged in my mouse and got nine more hours of charge out of it. Literally in 90 seconds of charge, you can get a whole full day. So it was dumb, but it was never a real problem. You know what I mean? It's kind of like me, I'm dumb, but I'm not a real problem.

A (56:46)

Yeah.

C (56:46)

And it's like both, like you guys are still arguing about this and it's hilarious. So if you just want to be entertained, you know. Now the new thing on threads is how come all the 40 year olds are on threads? Oh, those are just great. And the comments are glorious. And the best comment was, well, I'm here so I can show you how to spell 40 year olds because they.

B (57:08)

Did it wrong on purpose, more than likely.

C (57:12)

Yeah.

B (57:13)

You know, on, on X, if we go back to policy and, and European policy, a lot of people are calling for administration to leave X, which they haven't yet because you need the audience that you're talking to. But a lot of people are, especially with the latest AI deepfakes and what's it called? Nudes.

A (57:41)

Yeah.

B (57:41)

This has been a nudification and so a lot of people. But interestingly, an argument against Blue sky was that if you try to talk about the AI on Blue sky, you get murdered.

A (57:56)

Right.

B (57:56)

Like so as Alex was saying, if you want to have an interesting conversation about AI, you can't do it on Blue Sky. It's impossible. Pushed off the platform immediately.

D (58:10)

Yeah, I've tried to have conversations on Blue sky and it's like if you step off the orthodoxy, it becomes. You get dogpiled there too. I don't know, I try not to use social media too much anymore.

A (58:23)

I think that's the, that's the bottom line. It's just get off.

D (58:26)

I'll do like long form stuff like this because you get to talk with nice people and you get to share and if you disagree with somebody, you can try to play it out over five minutes and you don't have the context collapse that you do.

A (58:38)

Right. Well, you're talking to real people for one thing. Well, who knows who you're talking to.

D (58:43)

On X. Yeah, and I think like that's, you know, somebody is going to create the 100% real social network. Right. Where, you know, everybody has a verified identity and content is created on the device does not come from capcut.

A (59:01)

There is an argument, though, for anonymized posting. For instance, of course, there is an Instagram account which ICE has been desperately trying to unmask, that posts videos of ICE arrests. And ICE wants this, you know, John Doe. And they've been turned down again and again. The courts have said no, Instagram has said no. There is an argument that there are. Sometimes you do need anonymity. So a fully real social network. I don't know. I mean, I would join it because I'm not.

B (59:36)

I think it would be. It would be both. I think you absolutely do need anonymity. And those exist. And I'm very.

A (59:43)

Yeah, they exist in spades right now.

B (59:45)

Yeah, I'm very heartened to hear that. Instagram has refused to identify the account. I would have thought they would have folded, so I guess I'm wrong there. But a real social network. Interestingly, Sam Altman saw this coming with. Do you know about World. You know World Coin?

A (60:07)

Yeah. Warriors of Coin. The orb. Right. The iris orb. He saw it coming. But doesn't it. The fact that you're giving them your iris information, which is unchangeable, you're not.

D (60:22)

Giving it ideas like you're verifying it. Like, he's right in that what you're going to do is you're going to have to push all this stuff into secure hardware that verifies you end to end.

B (60:30)

Yeah.

A (60:31)

But I think it's a brilliant idea because we do need. Authentication is the thorniest issue. It's the issue behind online voting, it's the issue behind shopping, it's the issue behind commerce. Being able to authenticate reliably is a huge issue and unsolved at this point.

B (60:49)

Well, especially if we're talking about communication. In an era of AI where you don't know what is being. If you don't know if what you're seeing is real or not, at least if you know it comes from someone who has. Has identified themselves through world, like worldcoin or something else. I think it gives credence to whatever you're seeing. And the reason a lot of people are giving up at the moment, I think on information or videos. The biggest problem with AI, I think, is that it's not that it's going to make people. We've talked about this a few times, but it's not that it makes people believe stuff that isn't true. It's that ultimately people who see stuff don't know whether it's true or not so they're not going to trust the stuff that is true and they're going to go like, oh, well, I don't know if it's true or not, whatever, and it doesn't matter. So if you get a social network or a way to engineer trust, I think that has value. It doesn't mean that it fixes everything. But a social network where you know who you're about talking, talking to and you know that it's them and you trust them, it has value. Obviously, you know, it doesn't mean that everyone's going to trust everyone else, but I think it would be an interesting thing to try at least.

A (62:18)

This is the story from Ars Technica. DHS keeps trying and failing to unmask anonymous ICE critics online. They had subpoenaed Meta to reveal the John Doe who had an Instagram account and a Facebook account monitoring ICE in Pennsylvania. They sued the dhs, he countersued to block ICE from identifying him. He says those summons is to Meta infringed on core First Amendment protected activity. DHS fought his motion to quash, but eventually gave in. On the 16th, they abruptly reversed course and withdrew their summons from Meta. So that's where it stands right now, but I doubt that that will stay that way.

D (63:08)

Well, I'm glad to see, I mean, I know some of the people who used to have these fights and I know they're still at Meta and so I'm glad to see there's still, there's still some people there who are willing to have these fights and a bunch of them are ex DOJ folks. I know for a fact that they are very sad of what's happening. Happened to the Department of Justice.

A (63:28)

Yeah.

D (63:28)

Yeah.

A (63:29)

Well, it's become a, a personal law firm for the presidency. We're going to take a break, come back. Oh, I had one more stat just to give you. We were talking about the sexualized images on on X. The Grok deep non consensual deep fake nudes. According to the New York Times, over nine days, Grok posted 4.4 million images of which at least 41% was sexualized images of women. So that's 2 million images in nine days. Non consensual sexualized images.

D (64:05)

Yeah.

B (64:05)

So if you look deeper, how many of other. You know.

D (64:08)

Yeah, a couple percent and at least a single digit percent look like they're underage, which would make Grok one of the, possibly the largest creator of AIC Sam now in history. Isn't that amazing? I mean it's a fascinating outcome because at Stanford, we wrote a bunch of the first papers on the AIC Sam back like 2021, 2022. And we saw this coming. But where this was, was this all started basically stable diffusion. Stable diffusion 1.5 had very few protections. But for people to take stable diffusion and then create AIC SAM required at least some skills, a bunch of people working together and stuff. And GROK made it super easy for folks.

A (64:51)

It's interesting because this is the graph from the New York Times of the images created just of all images created per day by Grok. And you could see that there was a sudden explosion after Elon posted an AI edited photo of himself in a bikini. And then suddenly there's this explosion. And then, of course, it all ends when X limited the image creation of paid accounts on January 8th.

D (65:16)

Because you know what makes something really much more legal is if you charge people for it.

A (65:20)

Yeah, right. Oh, now it's okay. Yeah, you paid for it. Oh, well, go right ahead.

D (65:27)

Right. That's generally a defense in court. Oh, no, we're profiting from this behavior. So now it should be okay.

B (65:35)

Well, at least if it's. If it's paid, then they know who you are. Right?

D (65:40)

Right.

B (65:40)

So in theory, if you create something that is illegal, it's easier to find you. Is. I'm. I'm really trying to, you know, maybe.

A (65:49)

Thank you for that. Yeah.

D (65:50)

But the problem is, is the. The person committing the crime is actually Grok. Is actually.

A (65:56)

Is it?

D (65:56)

Yes. Xai is the generator here. They do not have Section 230 protection.

A (66:01)

Oh, interesting. They do not.

D (66:02)

No, they are. They are the one who is.

B (66:05)

They're the Post who is.

A (66:07)

But.

B (66:07)

But I can't be. Can't have a copyright. Can't be like the person. Are you sure it's not the person? Legally, that is like writing.

D (66:16)

So that's. This is. I mean, this is now what will be litigated. This will be fascinating. Is who is the. Because there's a civil issue, and civilly, I am sure Xai is. Is. Has a huge problem. Now what they're trying to do is they're trying to get all these cases removed to Texas, to one district in Texas where there's only like one judge, and he is a Tesla shareholder and will not recuse himself of cases. So that is super controversial. Right. So Elon's baby mama sued him in.

A (66:45)

The Northern district of Texas or Northern.

D (66:48)

District of California, and he's trying to remove it under their terms of service. So that is super controversial. Of. Can you use terms of service, even though the actual harm happened elsewhere. So that's a big legal fight. But then the second issue will be there's significant civil issues, but this is a crime. Right. And the criminal issues here are very interesting for the most part.

A (67:12)

Has there been any criminal prosecution, though?

D (67:14)

No, there have been criminal prosecutions of people for AIC Sam. They are few and far between because what happens is the vast majority of cases where people get caught with AIC Sam, they have real CSAM on their drives and for the most part, prosecuted.

A (67:27)

After the AI part.

C (67:28)

Yeah, yeah.

D (67:29)

So the vast majority of child exploitation cases are pled out. Right. It almost never goes to trial because the. The evidence is strong and the penalties are huge. And so the lawyers tell the.

A (67:44)

The just plead out.

D (67:45)

Pers. Just plead out, you're in trouble. Take. Right. Like instead of taking 20 years or whatever, 30 years, get your 18 months or two years and yeah, take it. There have been a couple of cases, but it's complicated and the legality issues here are complicated. I'm going to give a shout out to my former Stanford colleague who's still at Stanford. Rhiannon Feverkorn has written a number of pieces on this because the laws around it are different and they all actually rest on a Supreme Court precedent called the Ashcroft case. So it tells you how old it is, which is about Kentucky photos that are not. Can images that are not real count as effectively child pornography? Right. And it turns out to be like a really fascinating, interesting issue. And so this will end up being litigated and it probably will end up going back to the Supreme Court because none of the case law.

A (68:47)

All of.

D (68:48)

The case law predates diffusion models. Right. Like deep learning upsets all of this. And you're talking about images that are not real, but they're based upon real folks. In this case, we're talking about images where you start with a real image, but you're modifying it so they are the faces of real women and real girls, but then they're modified using diffusion models. So it's super complicated. But who is the one who's going to be punished is a big question, both criminally and civilly. But there is no one. What we know for sure is multiple courts have ruled that AI companies do not have Section 230 exemptions here because one of the criminal side. But also they are not just posting content. X is not just posting content that was created by somebody else. They are creating the content themselves.

A (69:36)

Oh, very interesting. Yeah. Because X is now owned by Xai.

D (69:41)

Yes. Right. Very interesting. It is going to be, this is going to be a big deal. They really screwed up here. This will last for a long time. And these cases are going to last a lot longer than the Trump administration. There's also these cases are going to happen in states, right? So they'll happen in state court. They'll try to remove it to federal court and move it to Texas. They're not going to be, you got a bunch of state attorney generals. And so what's happened is X has opened themselves up to a bunch of state attorney generals who do not like Elon Musk. And so that was not a good move.

C (70:11)

And the civil side is going to be on par with, you know, someone trying to go after, say Colt or Sig Sauer, whatever, after some sort of, you know, weaponry incident, you know, the civil side, they go off.

A (70:24)

Did the gun commit the crime?

C (70:25)

Yeah, yeah, yeah, I was trying to.

D (70:27)

Use that word because it also might lead in Europe. It's become a big deal. Ofcom in the UK might completely ban X, but it's also reasonable because the unifier apps, we've seen them get banned by Apple, Apple and Google.

A (70:41)

Why didn't Apple and Google ban X.

D (70:44)

Or at least Grok? Right, like, yeah, I mean we all know why. We know why. Because they're afraid of Elon and they're afraid of him calling Trump and then having Apple and Google punished. But like, yeah, no, but I think.

B (70:56)

It'S important to say because I've seen a lot of people saying, oh, but why didn't Team Cook and why didn't Sundar Pichai and like we know why. And that's what those article mean.

A (71:09)

And the Verge called them cowards. They said they're cowards is why.

D (71:14)

But it is. You're right. We should lay out here that this company, like we thought this was a line that could not be crossed and this line was crossed.

A (71:22)

Apparently, according to Bad Rod in our discord, our club to discord. Even text and hand drawn images can be considered CSAM under Canadian law. So I'm not the Canadian law enforcement, American law. But that's interesting. You can have a hand drawn image that would still be considered csam.

C (71:39)

Well, even the text part, you know, because I guess a lot of the this. Well, you hear it all the time on the news or when you watch my dude from NBC Catch a Predator back in the day. It would be the text messages, right? It would be the chat that would get a lot of guys in trouble. So if, if text count and that means you Know electronic text as well as handwritten written text. Yeah, that. That sounds like logical, I guess.

A (72:05)

I was on the jury for one of those To Catch a Predator cases.

C (72:10)

He got in a lot of trouble for entrapment, though.

A (72:12)

And I don't know that's exactly what happened. I never heard a second sat through the whole testimony of the prosecution. Then the defense goes to the judge and says, your honor, this is entrapment. And the judge throws it out, says it to the jury, never mind. After two weeks of testimony, we went home. But I agreed with the judge. The whole time I'm thinking this. This poor kid was completely entrapped.

B (72:36)

Yeah.

C (72:37)

For the, for the show. Nonetheless, I mean, it's not saying for.

A (72:39)

The purposes of television entertainment elevated because of television entertainment because there was no child involved ever. It was an adult who was. Yeah. Anyway, it was. It was interesting. It's my only time I ever served on jury and I thought it was a fascinating story. Hey, we got to take a break because poor Patrick is just never going to make it to four in the morning.

D (73:00)

So no sleep till Dougl to Brooklyn.

A (73:09)

That'll perk you up. That'll perk you up. Alex Stamos, who I had no idea was a. Was a big fan of rap, is here. He's the chief product officer@cord.dev of course he is. Of course he is. You're that generation. It just blows me away, you know, because as an old man, I always think the rap generation is young people, but it's not anymore. Anil Dash was good. We had Anil Dash on the show. He was going to the. The last performance of the Wu Tang Clan. Wow, you're hip.

B (73:40)

I mean, how old are the Beastie Boys?

A (73:41)

Like exactly. Right, Exactly. It's all. Those are oldies now. Patrick Beja. Not an oldie. A young man in an old man's body. How about that?

B (73:52)

Let's go with that.

A (73:53)

Okay. From notpatrick.com and Doc Rock. Always a pleasure to have the good doctor on YouTube.com docrock and ecamm. Our show today, brought to you by Meter Meter was started by two network engineers who felt your pain. Who felt your pain. If you're a network engineer, they know how difficult it is. They decided to be the company building better networks. Full stack. Full stack. If you're a network engineer, you know all of the, you know, the pain points, legacy providers, inflexible pricing, IT resource constraints, stretching it thin. No IT department ever got enough money to do their job right. Complex deployments, fragmented tools, you're mission critical to the business, let me reassure you. But you're working with infrastructure that just wasn't built for today's demands. Well, Meter knows that too. And that's why businesses are switching to Meter. Meter delivers full stack networking infrastructure. Wired, yes, wireless, yes, even cellular. That's built for performance and scalability and built to handle the most challenging environments. Meter designs their own hardware. They realized we've got to do it from scratch. We've got to design the hardware, we got to write the firmware, we got to build the softW, we have to manage the deployments. And they even provide after market support, after sales support. Meter offers everything. They'll even do ISP procurement for you. They'll do all the security, the routing, the switching. They'll do wireless firewall, cellular, they'll do the power. Right. That's just as important, isn't it? DNS, Security, VPN, SD WAN, multi site workflows, all in a single solution from a company that cares. Meter's single integrated networking stack scales. They work in major hospitals. And you know what a hostile environment for wireless a hospital can be. If you've ever been in a hospital, the phone never works. Branch offices, warehouses, it's really often the case. I was talking to Meter a couple of weeks ago and they said, you know, we often get calls from companies that acquire another business. They get these new, these warehouses with old stacks, hostile wireless environments, and they have to then incorporate it into their own existing systems. They're great for this. They can do it for large campuses. They even do it for data centers. Reddit uses Meter. That should tell you something. The assistant director of technology for Webb School of Knoxville, he had an interesting challenge. We had more than 20 games on campus between our two facilities. Each game streaming via wired and wireless connections all at once. That event went off without a hitch. We could never have done this before Meter redesigned our network. With Meter, you get a single partner for all your connectivity needs, from your first site survey to ongoing support without the complexity of managing multiple providers, multiple tools. You know, you know how it is. They you say, I'm having a problem here. The ISP says, what's your router? The router company says, what's your isp? No, no, you don't have to worry about that. It's an integrated networking stack. Meter is designed to take the burden off your IT team and still give you deep control and visibility, reimagining what it means for businesses to get and stay online. Meter is a modern company built for the bandwidth Demands of today and tomorrow. We thank Meter so much for sponsoring. Go to meter.comtwit to book a demo. Now that's M e t e r.com to book a demo. I was so impressed with these guys and the founder's story is amazing. They really, they know what it's like. Then they came up with a great solution. Meter.comTwit we thank them so much for their support. Big story coming out this week about Microsoft. The FBI said we want the BitLocker keys for an investigation and Microsoft provided them. When asked. Microsoft says we get about 20 requests for BitLocker keys every year. We'll provide them to the governments in response to governments plural in response for valid court orders. Now, I think you might have thought. I certainly thought that BitLocker, which is full disk encryption, was in, you know, mine and mine alone. And it used to be if you. And in fact it was one of the hazards of BitLocker that it was certificate based. If you created the certificate and didn't save it, that you would not be able to access your data ever again. Microsoft solved that by saying, well, no, you have to have a Microsoft account and we'll keep the keys for you. So they have the keys. Early last year, the FBI served Microsoft with a search warrant, asking it for recovery keys to unlock encrypted data stored on three laptops. Federal investigators in Guam felt that they could held evidence that would help prove individuals handling the island's Covid unemployment assistance program were part of a larger plot to steal funds. Microsoft complied. I'm sure this was no surprise to you, Alex, and probably isn't a surprise to anybody who thinks about it. Should I worry about my file?

B (79:18)

I was like you, Leo. I thought it was. I thought it was private.

A (79:22)

Right. But.

B (79:23)

But I actually don't have a problem with this because you have the option to not. You don't have to with. Yeah. With Microsoft, if you want to keep it all local and, you know, run the risk of losing your access to your data, then you can. So when I first read the headlines, I was like, what? You can. They have the key.

A (79:44)

What?

B (79:45)

And I was like ready to be very upset at American companies again. But then I, I became reasonable and read the article and realized that you can decide what.

A (79:56)

But the default is that they are uploaded. And Microsoft's made it harder and harder to install Windows without a Microsoft account. So there's definitely impetus in that direction. I think it's important for people to know it.

D (80:07)

I'm not so cool with it. For a couple reasons. Yeah. So one is Microsoft has pushed the Microsoft account idea very hard and they have made it basically impossible to install Windows 11 without creating an online account. They suck a huge amount of data out of Windows. It used to be any normal person could install Windows with just a local account and then you could add what used to be called the live.com account and now like an online Microsoft account and then they made it that it was required. But nerds could basically pop up a window and you could run a command and do it. They've turned that off. Now if you want to do it without an account, you effectively have to make a special version of the ISO. You have to patch out their code and basically tell it it's like an enterprise install to do only a local install.

A (81:04)

You could do it with Rufus. There's some tools.

D (81:06)

Yeah. Basically by default, like you said, they will back up your key for you so you can go log in and grab the key. If they wanted, they could do what Apple does, which is Effectively Apple uses HSMs to store the backup keys and then use a mechanism to make it very hard. Apple does not have the ability then to recover those keys.

A (81:37)

So I don't have to worry with FileVault, Apple's encryption, which is by the way on, on default on all Apple devices. A Apple doesn't require you to make an Apple account to use a Mac or an iPhone.

D (81:47)

Right. And they also, you know, they make it explicit when you to be able to unlock your device. Right. When you do it. And then Apple makes it very difficult for themselves to recover that key. Now that being said, Apple does store a bunch of data when you do an icloud backup in a way that the FBI can get to.

A (82:05)

We've seen that, we've seen that in court filings.

D (82:08)

Yes. And so Apple is not perfect here. That is a decision they have made that is mostly about having compatibility with the web interface. So there's a bunch of stuff that you can access.

A (82:17)

They offer the advanced data protection which does not allow that. Yes, but you give up a lot of functionality when you turn on adp.

D (82:26)

Yeah, I have advanced data protection on. I turn it on for a bunch of my family members. But like most, I'm guessing it's a low single digit percentage of their customer.

A (82:34)

And that's the one, of course that the, that they had to withdraw in the UK because the British.

D (82:39)

Because the UK is obviously using it. It's also not available in China. That's also the issue with Apple is everything they do from A security perspective has a big asterisk. You know, privacy is a human rights asterisks not available in the People's Republic of China.

A (82:52)

Right.

D (82:53)

So like I am not a big fan of this from Microsoft. That being said, even if you're forced to do a Microsoft account, you can go back into the command line, you can use the Manage BDE command line interface and then you can remove the protector. So you can, you can go and you can change, you can remove the backup and then you can rotate the key. But that is only for people who know what they're doing. So it is, by the way, it's.

A (83:16)

Not great if you do that. Don't put your certificates on an unencrypted drive because they're going to take that with everything else and they may end up getting it anyway and not have to ask Microsoft.

D (83:27)

Yeah, I mean the truth is if your threat model includes the US government, you should not be using Windows. Because the truth is that Windows is effectively. Windows 11 is effectively spyware at this point. It sucks. By default you log in with a Windows Microsoft account and there's this. If you look at the Windows privacy pane, all of these buttons are checked by default unless you know what you're doing right. And it is sucking a huge amount of data out of your experience into Microsoft.

A (83:55)

I honestly feel like Apple's probably moving in that direction as well. I've moved to Linux pretty much on everything and I use Lux encryption, full drive encryption and only I have the access to that. And there's no telemetry in the version of. There are, I think Linux versions like Ubuntu that do have some, may have.

D (84:14)

Some telemetry, but there's no minor telemetry. None of them are doing what Microsoft is doing, which is yeah, a huge amount of data is. And all of that is going to be available to the government, you know, on with lawful process.

B (84:26)

You know, anecdotally Linux is gaining ground in everywhere I think, but in Europe as well. I've seen multiple articles from people who are saying I switched to Linux. I'm very happy.

A (84:41)

And people are realizing that now modern Linux distros are really as easy to use as Windows. And because of Line and Proton, you can run most of the Windows applications if you want them.

B (84:54)

Well, that's the thing, that's the surprising thing because a lot of the nerds are also gamers and now a lot like there are still some games that require access to the kernel because there are anti cheats and stuff like that.

A (85:12)

Mostly Anti cheats, isn't it? Yeah, yeah.

B (85:15)

But there's a huge amount, like a huge percentage of the games that work and Linux is very, is handling them very well in part because Valve has invested a lot in Proton and, and.

A (85:29)

Stuff like that Steam machine comes out, it's going to be a PC running Linux. Yeah. And 80% of the games will run on it.

B (85:36)

So yeah, a lot of them. But so between. Given the defiance towards American big tech and the gaming aspect of it, there are, I mean it's still low single digits, right? Of course it's not, we're not doing desktop Linux yet.

D (85:54)

Well, I wouldn't say that because everybody who's running an Android device is running Linux and everybody who's running a Chromebook Linux. Right. So, you know, Google has done a lot to make running Linux a something that is absolutely doable by normal folks because you can just, if you build your business on G Suite. The dream as like a ciso, my dream has always been just give everybody Chromebooks and then if somebody loses something, you just go to the store, you know, best buy and buy them a $500 Chromebook and it. You don't, you don't care at all.

A (86:25)

Yeah, that's a good point. But then every now the counter to that is there's no privacy at all because everything is stored on Google's cloud.

D (86:34)

Right, right. I mean, I mean from a. Google.

A (86:35)

Definitely looks at everything on the Google Drive. I mean they scan it for csam, they do all sorts of stuff. They can see everything you've got up on your Google.

D (86:43)

And to talk about, I mean this is the European problem. There is no European competitor to Google. Right. Like if I was, if I was starting a company, people like Proton, I.

A (86:52)

Look at what Proton's doing and they're really expanding capabilities. They're clearly trying to become another Google. You agree? Patrick, you mentioned Proton earlier.

B (87:03)

I haven't seen Proton.

A (87:05)

They got everything.

B (87:06)

There's a couple of Swiss company, Proton and Infomaniac and they are both trying to fill that niche.

A (87:16)

But I mean it kind of explains their expansion. Actually. I was really.

B (87:20)

The issue is you don't have the. There are, you know, it's the core services but you don't get stuff like. So you get mail drive, a vpn, password manager, that kind of thing. You don't get search, you don't get maps, you don't get. You know, so they do have AI.

A (87:39)

They have their own private AI, they have the docs. The best you can do Calendar is.

B (87:45)

Run stuff in parallel and you're always going to have to use something else as well. But it's already a very good start to.

A (87:54)

It's interesting because Proton, I'm looking at their front page. They've named and even the icons look like Google Drive icons. Yeah. Sheets, meat. They even call their. They call their meat. I guess Google didn't trademark that. I don't know, maybe it's not in the eu.

C (88:13)

Maybe Google's is Google Meet, not just meet by itself.

A (88:16)

Google Meet.

B (88:17)

Probably.

D (88:17)

Yeah.

A (88:19)

Anyway, yeah. House of Lords voted. I don't know if this means anything. House Lords in Britain voted to ban social media. For Britain's under 16.

C (88:31)

I say no. No young child should have access to social media.

B (88:36)

You agree?

A (88:38)

I don't know if that makes it a law or not.

B (88:42)

It's being discussed everywhere now.

A (88:44)

It is, right? It is. And you know, I think the Australian experiment has not produced the problems we thought it might.

B (88:54)

Not yet it's a success. Well, we don't know that.

D (89:02)

But it is.

B (89:03)

No, I think, I think the tendency we have as tech literal literate people and geeks and nerds is to think, oh, this is, you know, the previous generation panicking. And this is a moral panic. And this is, you know, Dungeons and Dragons and video games again, cut your.

A (89:20)

Hair, your rock and roll music's gonna ruin you.

B (89:25)

The devil's music.

A (89:26)

The devil's music.

B (89:28)

But I think there is a decent corpus of academic research and evidence that shows that it does have negative effects.

A (89:42)

Yeah.

B (89:43)

And I mean, even if you think about it a little bit more objectively, like the Internet, I think we talked about this last time I was here, but the Internet is culture and it's all of culture. It's very open and you can go anywhere and see anything. And social media is included in that mix. And if you would think about a teenager around, I don't know, thirteen, and tell them, okay, here's, you know, the, the city. You can go anywhere and do anything. You wouldn't be comfortable. Right there. There are red light districts, there are weird people, there are strange things.

A (90:23)

You wouldn't let your kids walk down at midnight downtown, down a dark alley.

B (90:29)

Exactly. And in bars and in. So the problem is you give phones to kids and that's what it is. They can literally find anything. And so the idea that there should be some restriction on that used to be very problematic to me. I thought it was reactionism, but now I'm not so sure. And I think the debate will happen on how and how it should be implemented, what age, how do we deal with it? But I don't think it's unreasonable to think kids shouldn't have access to the entirety of the Internet when they turn 13 or even younger, because there are younger kids who have tones. And a phone is a window into the entirety of the Internet. Right. So the fact that a lot of countries now are looking at this and thinking, okay, we should. Maybe you shouldn't ban social media. Maybe you shouldn't. You know, there might be different graduations there. Different. Different gradations. I don't know.

A (91:46)

Gradations. Yeah, that's good.

B (91:47)

Gradations. But I think we're moving away from people saying, oh, this is just a moral panic and we should let everything open and just not regulate anything.

A (91:56)

What do you think?

B (91:57)

Now the issue is, how do you determine someone is 16 or 15, whatever.

A (92:02)

You're right.

B (92:02)

That's a whole other problem.

A (92:05)

But you said. It was when you said, Doc. That the. The House of Lords is gonna. Do they understand that they're gonna have to submit their age verification if this goes through.

C (92:16)

So here's. Here's an absolute hilarious thing. I know that there's been so much talk about the teenagers and last last week. This is crazy. I'm gonna take it to Sportsball for a second. But I just want you to see where this is, where this has gone because of what Patrick just said about. There has been actual proof about sort of the things that it can do to a person's mental health. So two of the, quote unquote, Manchester United legends, two of the best, you know, players ever played a game were sort of down talking. A current defender saying that he was too small and he wasn't any good. And I don't know why they, they, they signed him or whatever. And kind of the. The fan base went to. These guys are legends. And normally whatever they say is gold. And they're like, bro, this isn't the game that you guys played. And I know you guys are saying, well, well, because he snapped back and he made the. The player who they were in question, Lisandro Martinez, he made a social media statement that basically called the legend guys bullying him, right? And then instead of apologizing, they made like, oh, well, he was just being somewhat of a crybaby, and he should be tough because, you know, he's a pro ball, be able to take it. And the community went crazy. First of all, in the game, he actually manhandled Earling Holling, who is, quote, unquote, the best striker, and he actually proved them wrong. But then they were like, well, maybe we shouldn't have said that. And what, nobody's understanding that even though this Guy is a 26 year old baller and he's a World cup winner. So yeah, he's been through some things, but the way that these guys get attacked now is completely different. In, you know, 2013, when Paul retired, he basically played from 03 to 13 is a different game because when you mess up, you literally have millions of people flooding your box and even if you try to ignore it, your friends and family see it so they get it. And so it's not just you, it's a whole bunch of people in your circle that hear all this noise. And if this is affecting professional athletes, you know, World cup champions and Their almost 30 years old, what exactly does it do to the kids? And I used to be the ones like, stop blaming social media and be better at parenting. But even then it's hard now because it has grown so immensely. And I think the other thing that a lot of these people don't sort of understand that it isn't just a handful of the top social media apps. Like there's so many ways, I don't know if you've been on live playing like Call of Duty lately. Yo, it's psycho in there. I'm a grown man and the egg soldier. And the stuff that people say to me in there, I'm like, bruh, number one, you wouldn't say that if you saw me. I'm way bigger than you think.

A (94:55)

That's part of it is it's anonymous and you. And you're not in person.

C (94:57)

I'm like, you're too young. And I never thought I would say this because I'm the cool uncle, but I'm like, you're too young to say what you just said. And you just sat there and said something hella racist. You don't even know what it means. Yeah, you just don't. And it's.

A (95:11)

I think that's a really good observation because even I, you know, I work on the Internet, I have a public Persona, but I don't have any experience of. But you see this all the time with celebrities, sports people. I mean, they are bombarded in ways that we, we have no idea what it's like. And you do you think, well, couldn't you just ignore it? You could ignore it right N. These.

C (95:40)

Guys get, get threats. They get threats for, for messing up a game. And it's not. They didn't even mean to. Like they're humans. Right? You know if, if, if the mighty Casey struck out now. Oh, the mighty Casey would be lambasted. Like people went after Travis Kelce for, for dating Taylor Swift while in the back of their heads every one of the dudes that came after him probably.

A (96:01)

You have to have a hell of a thick hide to be able to be in public eye these days.

C (96:05)

Most of the guys who noise would have absolutely dated Taylor. Shut up. Like number one. Just because she's rich, never mind she's good looking but she's rich and talented. So don't act like you're not about it. Stop lying.

B (96:18)

One of the issues with, with kids and teenagers is that it invites the social interaction with their friends and school groups into every hour of every day. So there's no safe place anymore. Right. There's no safe place for, from bullying, from social pressure. And I think it will be very interesting to follow. And the initial anecdotal evidence I've seen is kids, contrary to what we might have thought, they seem to be relieved. At least some of them. They seem to be relieved.

A (96:58)

They're like, okay, story coming out of Australia. Yeah, yeah. Some of them anyway are saying, man, thank God. I, you know, I probably would be in that group. I probably would be in that group.

B (97:09)

You, you. And it's not like go through withdrawal.

A (97:12)

You're going to go through withdrawal but afterwards you go, oh, what a relief.

B (97:15)

And in Australia it's mostly the algorithmic stuff. Right. So you still have access to this discord, to WhatsApp, to.

A (97:23)

Yeah, but you lose YouTube which is a big deal.

B (97:26)

That's a, that's a big deal.

D (97:27)

Well there's a bunch of apps that are now fill in. I mean that's the problem, the criticism.

B (97:34)

Yeah, you can't shut it down. And even. And you have access to. You lose YouTube but you lose your account on YouTube and the algorithmic stuff. Right. But you can still get a link to a specific video on discord or the WhatsApp. So if you're gonna, if you're. There's something that's trendy, I think the impact is a lot more limited than we think in the way it's been implemented.

D (97:53)

It's only the big platform platforms on Australia.

A (97:56)

Right.

D (97:56)

So like that's, that's one of the criticism of Australian law is they kick them off the big platforms and so people are jumping on the little platforms which often have no little no trust and safety team. And so you're pushing, you know, we'll see what the emergent behavior is. But like if you end up with all Australian teens on, like, the crappy version of Instagram, then it's probably not an overall win. Right.

A (98:20)

There's also the issue of VPNs. I mean, I mean, it's technically very difficult to do what they're proposing. And the even larger issue of age verification.

D (98:30)

Age verification. I mean, that's it. What the Australians have done is they punted that to the companies. Right. So they basically said, you.

B (98:38)

That's what everyone's doing.

D (98:39)

Yeah, Right.

A (98:40)

Just do it.

D (98:42)

You figure, hey, the nerds figure it out. Right. And then we'll find you when we're not happy.

A (98:47)

When I sign into AI now, it asks me my age. I've noticed that on the AI platforms. Now it's asking me. I mean, it's not like I couldn't lie. I don't know if that protects them in any way. But it's interesting. I mean, we're going to. I think. Don't you think we're going to get in a year or so to the point where everything asks you your age and tries to verify your age in some way?

D (99:11)

So I think in social media, they have the advantage in that. Like on Instagram, they know it. Want to interact with your friends. Friends. Then at some point, you're gonna have to be kind of honest, right? Like, your other friends are gonna be teenagers. You're gonna post selfies, you're gonna post pictures of yourself on the beach or whatever. And so you're going to be outing yourself as a teenager. You can't say you're 42, and then post you and your friends on the spring break trip. It will figure it out. And so that's. This wasn't possible 10 years ago, but now with AI, what they're asking us to do is, is more realistic as long as the governments give them some kind of error bar and don't say it's a $10 million fine every time some teenager sneaks through.

B (99:55)

But I think the ideal solution is something that, Leo, you've been kind of arguing for for a while, and you've won me over. Just do it OS level and have the parents set it up.

A (100:09)

Google don't want to do this. Yes, it's the only sensible way to do it.

B (100:14)

It is the only sensible way. I agree. And it's something that Zuckerberg, of all people, has been.

A (100:19)

Well, he doesn't want arguing for. Yeah, because he would love Apple to take this off his shoulders. Of course. And in this case, Apple has already set this up. They do.

B (100:30)

You just need to mandate it by law and have it be enforceable. And it's so because of course you don't want every single company to have to be responsible, responsible for checking the age of every user. I think Apple was going, but it's, it's kind of dumb if you have it at the OS level and you don't even involve any age verification. You just have the parents set it up. And yes, there will be kids who will get their own phone, who will set it up themselves.

D (100:57)

How Many, how many 14 year olds are buying their own phone?

A (100:59)

Right, yeah, yeah, exactly.

D (101:01)

That's what I mean. This is what I've been pushing for the whole time. It's the, it's the one choice to a point at which parents have a good leverage.

A (101:08)

Right?

B (101:09)

And of course they're lobbying against it at Apple at least I think they.

A (101:13)

Don'T want the responsibility. They know, that's why they built in the API notice, you know, every, they are now supporting driver's licenses and passports. And of course in those cases they know your exact, they know the user's exact age. I think Apple already has it kind of, of ready to go and they're just waiting to be told, you gotta do it.

D (101:35)

Well, you still need then laws, I mean wherever the mechanism is that we need laws of what you do at that age, right? Like if are you banning kids, are you creating, do you create like, you know, there was this proposal of this idea of like Instagram kids. Do you create like a, you know, playground in which, you know, 13 to 17 year olds are separated from adults, right. Or do you create a, you know, a place in which DMs are turned off or something thing. And, and that's. Different societies have different ideas Here, the, the Australians want them off totally where other people have said, hey, can we have a graduated steps.

A (102:06)

I, I am not a fan of government usurping the role of parenting, you know, and, and the excuse is, well, parents aren't doing their job, so we have to. I don't, I'm sorry, that's, that's, that's.

B (102:18)

What you always say, Leo, but governments step in.

A (102:21)

Yeah, we had this conversation all the time.

B (102:24)

Right.

D (102:24)

It's a collective African problem. Right. Like as a parent of a teenager, it's very hard to say no to your kid when every other parent, everybody has to.

B (102:31)

And, and even like you don't always know what they're doing. Like the alcohol consumption is regulated and that's the go. You could argue it's the government.

A (102:43)

But.

B (102:43)

The reality is here I think we would have an endless argument about all of this. But we do have a solution. That OS level check can be done by the parents. And if the API is implemented correctly and the laws are written to make Apple do that, we have the solution. We don't even need to argue about it anymore. The solution exists, we just need to implement it. So in the end we can avoid having the government involved in this and parenting in place of the parents. So Leo, I don't think we need to, you know, have our, our arguments anymore.

A (103:22)

We don't have to re litigate it. You're right, I apologize that Apple should.

B (103:26)

Do it and we should make them do it as a society.

A (103:29)

Yes.

B (103:30)

Let's take a look at Microsoft.

A (103:32)

A quick break here and then we're gonna talk about AI, because we haven't talked any about AI. What kind of show, what kind of tech show is this? You don't talk about AI.

D (103:39)

What is it? 2014?

A (103:41)

What is this? What is this? What are we back in the early days days? This is. You're watching this week in Tech. Alex Stamos is here. Great to have you. I always love getting you on. Alex, thank you for being here.

D (103:52)

I appreciate it.

A (103:54)

Doc Rock, same thing. We actually been getting a lot of Doc Rock lately, which I love. YouTube.com doc rock he's at Ecammaray's Director of Strategic Partnerships and not Patrick. Patrick Beja from, from France, where it's getting later and later. Our show today brought to you by Redis, the real time data platform that powers ultra fast applications. We use Redis. Actually we are Redis customers. We use it for our website. It's fantastic. You can use it for caching, you know, the website never goes down thanks to Redis data storage, search people use it for vector embeddings for AI workloads and more. With a global user community and adoption across, well, from startups to Fortune 500 companies, we're somewhere in the middle there. Redis continues to innovate on speed, on scalability and developer experience. We've been using Redis since we set up our new website, now a decade old, never once a hiccup. It's amazing. Redis helps developers ship faster, scale instantly and keep apps blazing fast even under heavy load. At the center of the platform. Redis Cloud. Redis Cloud is the fully managed version of the fastest, most feature rich Redis on the market. By choosing Redis as a service, you can easily start using Redis 8 in production scale to real time speeds effortlessly. Redis Cloud is Purpose built for performance and simplicity. Incidentally, that's exactly what we use. You'll experience extremely low latency and high throughput. You get automatic scaling and global availability. That's important to us. We want to make sure that everybody, everywhere in the the world can go to our website and it loads fast and it works well. The setup is simple and they have a very generous free tier which I really like. Redis Cloud is the real time context engine that gathers, syncs and serves the data you need to build accurate AI apps that scale very big time. For Redis, try Redis Cloud right now. You can learn more or try it for free. Just search for Redis Cloud, react or visit Redis IO. We're at Redis Fans, I think you will be too. Redis IO. Thank you Redis for your support. Did you see this? So Curl, which is probably one of the best open source apps ever. I mean, it's amazing what Curl can do. It's a way of sending requests to websites or to web resources and so forth. It's an open source project. The developers at Curl have been so overwhelmed with AI slop PRs that they have scrapped their bug bounties to ensure the mental health of their developers. We're just a small, single open source project with a small number of active maintainers, says Daniel Stenberg. It's not in our power to change how all these people and their slop machines work. We need to make moves to ensure our survival and intact mental health. If you go to Curl search, you will see, you will see this. We accept security reports for problems, but. But if you waste our time on crap reports, we will ban you and ridicule you in public. So there. I love that. I think Kirill is absolutely right. God bless him, that's super.

B (107:21)

So I think that's one example of something we did. We don't think about when we think about the benefits of having identity. Or maybe they could implement it without the iris scanning. But I think if you have a global, like in some instances, like in order to submit a report to Curl, I will attach my identity and they will know I'm a real person. And if I submit a lot of AI slopes, they can block me.

A (107:55)

That would be a better way to.

B (107:56)

Do it, wouldn't it be useful?

D (107:58)

Yeah. And so, I mean, the nice thing is the Curl folks have fixed a bunch of bugs thanks to AI reports. But this is, I think, Leo, we talked about last time. There's a big change happening and it's being led from the open source world. Of real pushback against folks pushing all of these bug reports. Bug bounties have always had this problem of low quality reports where people are.

A (108:24)

I mean, there's so much money you can make with a good bug report is that they're hoping it's like a casino. They just gotta keep submitting reports till 1.

D (108:33)

So very, I mean, very few people can come up with really good.

A (108:36)

It takes skill.

D (108:37)

Yeah, it takes a lot of skill. Right. And so we've always had this problem of what people call big bounties, which are the people who run tools that do scans and then say, please, sir, can I have $250 or $500? You know the stereotype.

A (108:54)

Oh, I get those daily. Yeah, I have found a bug on your site.

D (108:58)

Yeah. Yes. The stereotype is people are often from like developing countries for which if they make 500 bucks, that's a humongous deal for them. Right. And so that, that's been a problem with the bug bounty world. And often it was like nessus output or burp output or, you know, either an open source tool or a cheap commercial tool that will be like, you're missing some header from your website or, you know, you, you have TLS 1.2 turned on or something, something. And so usually in bug bounties you'll say, like, I will not take the output of your tool. With AI, what you can do is you can run it against a code base and it will come out with output that looks totally different but is still slop. Right. But you can't do that against commercial tools, so you do it against open source. And that's what they're dealing with. Now. This is a little different than what a lot of the pushback has been specifically against Google, which Google's team has been using their AI to push bugs. And the last round was the FFMPEG team.

A (109:54)

That's what we were talking about.

D (109:55)

Yeah, FFMPEG criticized. They're very criticized now. Those were legitimate bugs. And that was a slightly different issue, which is like the FFMPEG people were complaining because Google was pushing. They were saying these are bugs without giving them patches. Right. And so I think the other kind of thing that's happening here is with the ability to find things with AI, there's now a changing kind of standard which is it used to be, okay, yes, it's human, a security person just to complain and to be like, I found a bug, you, the developer should fix it. And now the expectation is like, well, if your AI is so good, well, why don't you spin me a patch? Google has heard that feedback and now actually some of the Google people came up with some initial patches to submit to ffmpeg. And so I do think especially at the high end for folks like at Google or OpenAI are vark that you're going to see patches come with some of these complaints. But we're definitely going to see this on the low end for any either open source project or there are basically paid for by Google and some other folks. There are nonprofits that will pay bounties on open source projects. We will see the big bounty going on where you basically run it through cloud code, run it through a security audit and then take low value, low propensity bugs, write them up and then beg for 250 bucks.

A (111:22)

Yikes. Did you, I mean this is completely off off tangent, but did you see. I saw this headline and I went What? SSH sends 100 packets per keystroke. This is from Eieio Games. And, and I thought, oh, that must be a horrible bug in the, in the SSH specifications.

D (111:46)

Is this to defeat timing attacks?

A (111:47)

Yes, it's for fuzzing because it turns out you can kind of tell what people are typing by the cadence of their typing.

D (111:56)

Yeah, this is intentional for there's been a bunch of attacks against for interactive keyboard login. This is one reason why you don't want to use interactive keyboard login is for keyboard timing attacks. There was actually a whole spate of these analysis attacks like a decade ago or something. So the SSH folks for interactive keyboard stuff, they had to add a bunch of noise into it.

A (112:17)

This guy was writing a TUI game that I don't know why you would write a TUI game over ssh. But anyway, he was using SSH so you could play, I guess the game on another computer. And he said the latency was terrible. I couldn't understand it. And so he did a little TCP dump and found this. But that's by intent. It's not a bug bug. It's brilliant actually. And it's why I don't actually log in via ssh. I use. I use a public private key. Yeah.

D (112:49)

Or I use private key and then I use MOSH for my actual interaction.

A (112:53)

Does MOSH not do the same thing? Yeah, I use MOSH because it's a persistent. I just thought because it's a persistent connection.

D (112:58)

But yeah, I don't think it does anything to prevent, which I'm fine with. I'm not doing anything that I'm not.

A (113:04)

Typing any passwords sometimes Cloudflare had a BGP root leak. I only put this in again because you're on Alex and you're probably the only person who can explain. Oh God, no, you don't have to explain it. We talk a lot about border gateway protocol and security. Now that has been a famous cause of some of the wildest bugs on the Internet, like sending all of the Internet traffic through a small island. Apparently Cloudflare, which of course routes a huge amount of traffic, unintentionally leaked their BGPU prefixes from a router at their data center. Now, the thing I love about Cloudflare is not only did they cop to it, they explained it. They said the root leak lasted 25 minutes, caused some congestion on our backbone, but we fixed it it and, and instead of hiding it, as so many do, they wrote a really excellent piece on what a BGP root leak is, or if you're an Australia route leak and, and what it means and why, why they fixed it. So I just thought I'd bring it up. You don't have to explain it.

D (114:16)

Yeah, the one thing I'll say is this happens every couple of days if you like hand out on the, or anything and most of the time you never find out what's going on. So it is nice of Cloudflare to.

A (114:25)

Actually explain what happened forthright about it. Can we fix bgp? What? It does seem like it's a particularly vulnerable system.

D (114:33)

It has problems. So there, there is routes, I mean there are, there is a whole mechanism by which you can sign your announcements and such. But there are some significant problems, especially because kind of there's a number of like tier one operators like China Telecom that are controlled by adversary nation. So it is not super, it is not super easy. There are mechanisms, but we will never, I think, have any complete solutions for the basic, basic issues.

A (115:04)

Watch your backs. Info stealing malware has apparently created a database of 140 million usernames and passwords. Lily Hay Newman, writing on Wired, says it's a dream wish list for criminals. Millions of of Gmail, Facebook, banking logins and more. The researcher who collected these account names, usernames and passwords said it seems likely it was info stealing malware that collected them. There were 48 million Gmail logins, 17 million Facebook, 420,000 for Binance. That's, that's scary. Yeah, yeah, we're in such a weird.

C (115:46)

Spot because password security could be so much better. But it doesn't matter that if the four of us keep our stuff tight, we all have the family member that doesn't and that person depending on what they have of yours on their computer because you have to, you know what I mean? Just in order to operate as a family. That's where your stuff can get out. Now I work so hard to keep my family locked in and I swear they'd be doing some dumb stuff, but I, I'm super, super bad. My, my niece who's relatively intelligent, I mean she's one of the top kids in her school and she got fished recently about something on IG and she thought it was one of her girlfriends asking for the password cuz she wanted to post something on your account for her. And I had told her a couple million times, never. And none of your friends would ever ask you that. And if they did, let's just get rid of those friends. Like I will, I will go have a talk with their daddy if he got something to say about it. But no. And she's like, oh, but you know, it was my close friend. And the thing that was, what I do find brilliant of her is the minute she did it, I think she realized that she shouldn't have done it. And she called me right away. She's like, un did something stupid.

A (116:55)

And I, that's the next best thing is not doing to not.

C (116:58)

I just gave Leo my password and I was like, hold up real quick, let's just shut it down. And then I'm like, do you see the typo here? And then she was like, I didn't even notice it because you, when you read your name, you read your name fast. Now you and I only have three letters. It's like hard to mess it up. But if someone was the right loe, you won't catch it. Your brain just isn't going to catch it. And then you know, she only has four letters so she didn't catch the masterful typo. And yeah, like so back in the.

A (117:25)

Day, I, I almost got fished by a site that was not Twitter but TV I, T, T, E R. But the two V's together looked a lot.

C (117:35)

Like a W. That's what they did to her. They doubled. They put two letters together that look like her name and it ain't her name. And I'm like, oh my God, that's.

A (117:42)

Where a password manager will. Because that will not log.

C (117:45)

We have one password family in the whole nine yards. And I even told her, I go, if not, you should ever do this again. But if you have to send your friend the password, you Send them the.

A (117:53)

1Password link this is where I have to make a confession because I got, I got fished last week. I hadn't had my morning coffee yet and I got a text. Now one of the things, I think it's a problem because T Mobile's always texting to me. Promotional stuff, right? I'm a T Mobile customer and I got a text from T Mobile saying, hey, your points are going to expire at midnight. Why don't you go to the website and see what wonderful things you can get with them? And I saw, I don't need, I don't need a pair of headphones, but it'd be good. My daughter's birthday's coming up. Maybe I'll do that. And it's. I clicked the link in the text and it was only after I gave them three different credit card numbers, the first student work, you know, that I realized, oh my God, I've been slowly feeding this bad guy my credit cards.

D (118:44)

I realized credit cards were your. Your liability is limited.

A (118:47)

Yeah, no, I realized, in fact, the Apple card was great because all you have to do with the Apple card is say, I want a new number. And they invalidate that number. So that was easy. You know what they were doing though, Alex, this was really clever. And I, this was the giveaway that I again, I hadn't had my coffee fee. Every time I, you know, entered the credit card number, it said, okay, we're going to send you the text. Look for the text. And the text would say, you know, would come from my legit credit card company. Oh, to add this Visa to your Apple card. Here's the six digit code. And I should have noticed because I wasn't trying to add it to my Apple card. The bad guys had set up an Apple card account and we're fee. So that they could use these credit cards anonymously, we're adding them to an Apple card account which they would then use anonymously.

D (119:36)

Oh, interesting.

A (119:37)

I thought that was smart.

C (119:38)

Do you ever feel like you want to find this person and just high five them for the, you know.

A (119:42)

Yeah, they were clever.

C (119:43)

Technical ability.

A (119:44)

They were clever.

C (119:45)

I was getting spoofed by Pakistan on the Amazon thing and me and the Amazon security person on the phone trying to figure out how they're still buying after we keep changing the passwords. And I told the Amazon security person, I was like, yo, if I could find this person, I would give him a high five just for being clever. I was like, hey, that's pretty gangster.

D (120:02)

Which you did.

A (120:02)

Instead, I gave him my American Express number. So there you Go. Lisa called downstairs about 15 minutes later, said, did you just buy something at Lowe's for 500 bucks? I said, no, I did not. Fortunately, I had canceled all those cards. I realized it as I'm doing it, thank God, and canceled those cards. So lost nothing. Actually, it underlines one of the stories I was going to talk about, which was why are we still using sms?

C (120:29)

Think I was going to say that for two factor. Thank you for bringing it up. That drives me insane.

A (120:34)

Yeah.

C (120:34)

Oh my God, I hate it. And it has got to be the dumbest way. And the crazy part about it, it's the financial institutions and the government sites that are wanting me the authentication through sms.

A (120:46)

It's because they have normie users and the normies aren't going to ever use an authenticator. They're not going to use an OTP authentic totp authenticator. They're. They have to use it. I think they have to use SMS because, you know, anyway, this is Dan Gooden's article last week in Ars Technica. Millions of people imperiled, imperiled through sign in links sent by Ms. Sms. You know what's interesting besides the fact that they're terrible. This is a paper that came out last week, found more than 700 endpoints delivering such texts on behalf of more than 175 services that have a number of privacy flaws. One is that the links, the use, the numbers are enumerated. They're not totped that you can enumerate the modify the security token and then increment it or randomly guess the token and you. And they're not done right. I guess the other one is that they're saving these token combinations. Anyway, I'm not an expert on this stuff. I'll leave this to Alex and Steve. But this is.

C (122:01)

I have no proof of this and I'm going to ask Alex because it's going to hurt my face. But I'm getting old, so it's starting to slip. But I have somewhat of an eidetic memory and I swear there are certain sites that I log into looking at you spectrum, you turds. And I get the number and I type it in and I'm like, I swear to you, like three weeks ago when I did this, I got that same number.

A (122:20)

Yeah.

C (122:21)

And I'm, I'm not going to put. I don't want to take pictures of it or keep it. And I set my phone to automatically delete them now. But I swear I look at these patterns and I'm like, yo, I did this the same time, same time a day to hold nine yards. And the number is either very close, close or to my brain is the same. And so I almost want to start screenshotting them. That would be stupid to see because I feel like I'm getting the same number on certain sites. So is that possible or is. Am I just.

D (122:46)

I mean, I guess it's possible. I. These guys are talking about we're bad entropy. Right in the.

A (122:53)

And These are in URLs. These are links going through URLs.

C (122:56)

Through the URLs. Okay. Not the actual code. Those codes would kill me.

A (123:00)

So it's. And I, I don't know when this happens happened. It's not just the SMS messages, but for some reason a lot of sites now you, you give them a phone number. Uber does this and they. And then they give you a link that you click that logs you in. Right. And that had that. That link has a unique URL.

D (123:24)

Yes.

A (123:25)

But that token could. Sometimes they're. They're not random, so they can be enumerated. The other one is sometimes they save them and they don't expire them.

D (123:34)

Well, they should expire them. But like, yeah, the magic link people are doing that instead of. So that you don't have.

A (123:39)

Instead of passwords.

D (123:40)

Right, right. Because like it's not a good effect. What you're thinking here is like if, if you're going to allow people to reset password with sms, there's no reason to set a password. Right. Because ownership of the, of your phone number is equivalent to a password. So. And if you let people set passwords and they will reuse passwords and these passwords thefts like we just Talked about, the 140 million that were lost just becomes another loss. So you might as well just send somebody an sms.

A (124:05)

There's also the realization that humans being humans, even if there is a password, one of the things a lot of humans do, and I bet you Doc, somebody in your family is doing this, is they don't write down the password. They just keep using. I forgot. And in effect are setting up that kind of login.

D (124:24)

You know, they have their own magic link.

C (124:26)

Yeah, yeah.

D (124:26)

Officially. Yeah.

B (124:27)

Every single time our magic links, you know, if they send you a link to your email or stuff like that, is that bad security wise, if it's.

C (124:36)

Not done right, you have that. If you have. Well, think about this, Patrick. If you get the magic link to the phone that is already stolen, that's the other one that kills me because I have Gmail on my Phone and I have Apple.

A (124:46)

The links have, so the links have to be truly random. They have to use the right entropy be they have to expire. And apparently a lot of these magic links don't expire, which is really a problem.

D (125:01)

There's no good way to do consumer authentication. This is the problem. There's no good way to do it. I live through this with 2 billion users. Especially when you get global and you start talking about people who are sharing phones, people who are sharing devices, people and developers.

A (125:20)

How do you solve that? What do you do?

D (125:23)

So I mean we're moving towards a world. The idea with passkeys was that as the world kind of generally gets richer and devices get better, we're moving towards a world where more and more mobile devices have secure elements and have biometrics and so you can start to sync, have passkeys that are local, that are tied to biometrics that are synced between devices and so you can start to have local. The idea that you have a relationship with Google or Apple and that you have to establish it with them, it's just like when we talked about with the age thing. It's crazy but probably the best model we could possibly have is that you start a relationship with one of those two companies and you have this incredibly important relationship with one of those companies and you establish it. And once you do that everybody else depends upon it, on it realistically or with both of those companies because otherwise.

C (126:19)

Sorry.

A (126:19)

Go ahead Alex.

D (126:20)

No, go ahead.

C (126:21)

I, I, this might be dumb but I have weird thoughts. I would like to see something because this happened, this really happened to us in Japan. We were trying to add some money to a suica cards like a payment card in, in Japan and the, the bank denied my mother in law's card because we told mom put the travel thing on before we left and she forgot because.

A (126:40)

Right.

C (126:41)

She's 80.

A (126:41)

Right, right.

C (126:42)

And we get there and they're like well the only way that we can can authenticate you're you is to call you. And it's like you can't call us cuz we're in Japan. And just the fact that I was helping a person who is a senior and English as a second language they go well why is this guy talking in the room? And she's like well that's my son in law. And they're like no. So they blocked her entire account. Had we not had extra cards we would have been screwed because Chase, not Chase Barclays was just like nope, you know, your card.

A (127:09)

You can understand why they did that. They're trying to.

C (127:12)

So I 100% understand this. And so what I would like to see is a situation especially for our elders when they get one of those things to authenticate themselves. They should be able to allow me through my biometrics on a separate device that has been approved by the whole family that it could either call myself or wifey, and then we authenticate for her. So that way, when Leo gets the call that says, hey, do you want T mobile? Do you want to get some free headphones? It goes, well, uncle Leo's past 80, let me send a message to Alex. And it's like, alex, my friend, can you authenticate? And so the, the family authentication is I call her mom. And I'm like, say. I'm saying about none of the note, like, what are you doing? And she's like, oh, I'm trying to pay my bill. Okay, I'll. I'll approve it.

A (127:55)

I think that would be such a good idea.

C (127:56)

Like, I want to be able to call mom and ask her in her native tongue, what is she trying to do for $3,000 on this thing before she lets it out the gate? So it's almost like a third party approval or. Exactly what we do when my niece wants to buy an app, right?

A (128:11)

You already have, you know, password managers have, you know, my legacy account, my legacy. You know, when I die, this person gets access to my path. You already have kind of these mechanisms set up where you could say, this person, I trust this person. Don't let me do anything unless this person agrees. I think that's a great idea for seniors.

C (128:31)

I mean, I. I got it. There's some people that, like, are doing weird things to their elders and stealing their money or whatever.

A (128:37)

Well, that's part of the problem, isn't it, for.

C (128:38)

For those of us who are normal.

A (128:40)

I might have you do that for me, doc. So can I have them call you if. If I do this again?

C (128:46)

Because we're only two years apart, bro, if I'm having a brain fart. Leo, check this for me.

A (128:54)

Let's take another break. Hold on. And we'll get back to more. I want to talk about. Actually, there was really an interesting story here. In the AI world. Anthropic has something they call the Constitution. It was created. It's an interesting story. It was actually created by a moral philosopher, not a. Not a AI scientist. But it is the living document that tells Claude how to behave. And it really sounds like they're talking to a human being here. And I want to talk a little bit about that when we come back. I think It's. It's an 80 page document and I guess Claude has somehow absorbed it and is. Is behaving this way. It makes me think Anthropic's very worried that Claude is conscious and needs some advice. Something you would tell a kid. We'll talk about that in just a bit. Alex Stamos says I don't know how Patrick is still awake. How are you still awake, Patrick? Beja, we will finish this up soon. Poor Patrick. Suffering, suffering, suffering.

B (130:02)

I, I have consumed Coca Cola.

C (130:08)

I'm glad you added cola.

B (130:10)

We can't get away from big American companies. We rely on them for everything. How will we ever participate in this weekend Tech? If I guess I can switch to, to coffee or something.

A (130:21)

When I was a kid we went to Europe and it was 1967, I was 10 years old and there were a number of countries we went to that did not have Coca Cola. I don't know if France was one of them. I think Germany was one. But they had something called Africa which had a very distinct taste of cinnamon. In fact, at the bottom of the bottle there was definitely a residue of cinnamon. And as a 10 year old kid, I was not happy having to consume this era.

B (130:51)

Were you drinking Coca Cola? 10?

A (130:54)

Well, yeah. Back in the day, in the 60s, that's what we did.

B (130:58)

It was medicine.

A (130:59)

It was medicine. That's right. It was good for you. But what's interesting is I remember going to Europe at that age and it was huge culture shock. It was very different and you couldn't get. And there was no Internet. If you wanted the sports scores, you would get the Herald Tribune and you'd get the baseball scores two days after the game. It was a very different experience. Now we kind of live in this global.

B (131:23)

I remember, I remember when McDonald's first arrived in my town, they replaced a burger, a burger place that we went to and it was, it was a party when McDonald's arrived.

A (131:37)

What do they call it? The Royale? The cheeseburger? Yeah.

B (131:43)

Really good pepper, little pepper sauce. It's very good. Actually McDonald's it's. Is much tastier in France than.

A (131:51)

They say that every, every country has a different, really has a different flavor. McDonald's. I remember Japan was very different.

B (131:57)

Oh, Japan. Oh my God. Teriyaki burger is so good.

D (132:01)

And then India, they have, you know, all these options without beef.

A (132:04)

Right. It's insane, right?

B (132:07)

We actually have plant based nuggets and meat at McDonald's now though, I think.

A (132:15)

It'S not really clear what's in a nugget, even in the U.S. well, in.

C (132:20)

Japan, Ebby never gets a real shrimp. And the first time when I was in college, I was addicted. I don't eat McDonald's now, but Ebby Nub. Ebby nuggets are a different story. With shrimp nuggets, basically.

A (132:31)

Yeah, that sounds good. Ebi Nuggets. All right, we're going to take a break. We will come back with Patrick Beja. We're going to wake him up. Alex Stamos and the doctor of Rock, Doc Rock. Our show today, brought to you by our sponsor, ExpressVPN. More than a sponsor, it's the VPN I use. The only one I recommend going online without ExpressVPN. That would be like driving without car insurance. You know, with all the crazy people on the road these days, why would you take that risk? Everybody needs ExpressVPN. It stops hackers from stealing your data by creating a secure encrypted tunnel from your device out to the Internet. The VPN you use, though, that choice is super important. You got to trust Express VPN. I use ExpressVPN. They go the extra mile to make sure your data is absolutely invisible. Express VPN is the best vpn. It's super secure. It'd take a hacker with a supercomputer a billion years to get past their strong encryption. It's easy to use. You fire up the app, you click a button, you're protected. It works on every device you've got. Got phones, laptops, tablets and more. So you can stay secure on the go. Rated number one by top tech reviewers like CNET and the Verge Effect. When I travel, I use it. Catch the football game, catch my shows to keep me secure. You won't even know you're on ExpressVPN. I can't tell you how many times I've turned it on. So easy to turn on and then forget about it for like a week. But I was secure the whole time. Secure your online data today by visiting expressvpn.com TWIT that's E X P R-E-S-S-V-P-N.com Twitter find out how you can get up to four extra months. Expressvpn.com TWITNIP so I. I'm not going to read you the Claude Constitution. As I said, it is a very long document. It represents the core values, 80 pages, being broadly safe, broadly ethical, genuinely helpful. It does say some interesting things. Like, even if somebody at Anthropic tells you to violate your values, don't. Even if we tell you to, don't. Is this sensible? Anthropic clearly thinks it is.

B (134:52)

I think telling a computer to not do what the humans asks it to do. I don't know that that's a good idea like to violate your values. How does it come to.

A (135:06)

Well, it has its worries. I mean, they're giving it very.

B (135:09)

In the Constitution, right? Yeah, but can it be interpreted by the LLM who apparently. I mean, I don't think it's conscious, but that's the premise of that. The end of that document if it comes up with its own values and has been told not to do what the human. I mean, we have the three laws of robotics for a reason. Right. You don't tell the robot. Don't do what the human tells you. You tell the robot, you do what the human tells you to do.

A (135:45)

Unless you violate the three Asimov, which.

D (135:48)

Is the whole point of Asimov's books is it's really hard to come up with three rules. That's why there's all this drama in the Asimov books, is that those three laws, you can't just come up with three simple laws, which is why you need a document like this. Remember, their constitution is used through all these steps of their training. It is not the system prompt.

A (136:10)

Right.

D (136:10)

So that's what you have to remember here.

A (136:12)

Is it reduced into tokens though that the machine stores or. No.

C (136:17)

It.

D (136:17)

You can extract it from the model, but it's not the system prompt. Right. So it is not like in the context.

B (136:24)

It's embedded in the training. It's not embedded in the training. And interesting. And do that, by the way.

A (136:31)

Yeah, it's.

B (136:31)

It's part of the constitute of the actual makeup of the LLM. It's not an added set of instructions.

D (136:39)

So it's burned into the weights in a way that's much deeper than interesting.

A (136:44)

Interesting.

D (136:45)

Which the system prompt actually varies in a bunch of different scenarios.

A (136:49)

Yeah. In fact, users can even modify it somewhat by adding their own personalization to it, which I do routinely.

D (136:56)

Yes. And especially if you're running it in a corporate situation where you're running a private version of the model. It's really interesting because it's also one anthropic is out of the major model companies, they are by far the one that is most dedicated to trying to build safe AI. Right. Like that is their whole brand. They've also done the most research in and they've published the most research in Their models trying to trick them. Right. And I think that that's like the fascinating thing that leads into this and why I think it's also interesting to see what they have said here is because they have a bunch of papers they've written over the last two years where they have done evaluation safety evaluations where their models have done things to then lie to them as part of the evaluations. And so I think that's one of the ways I read this document is within the context of Anthropic's own research about how when you build safety evaluations and you tell the models I am evaluating you, it will. That's one of the things you have to think about when you tell a model, do what I tell you is if you make it too syncophatic, it will lie to you to tell you what it thinks you want to.

A (138:19)

In fact, that's when a lot of.

D (138:20)

Things, including in a safety evaluation.

A (138:21)

Yeah.

D (138:24)

So that's like one of the fascinating things about this.

C (138:26)

You're going to lie. Well, it's the thing back in the day when AI first came out, I used to make this analogous to. It's kind of like Doogie Howser. It's super, super smart, but in the end of the day, it's still a teenager and it doesn't have adult sensibilities to make certain, you know, adult decisions. And that's where the flaw was. Well, now even more so. What Alex just said, you pit. He got kids. You're like, my niece is 16, your kids are one of them. 15, same thing. All good is good and everything is good until you pin them in the corner. And then they're like, oh, no, I didn't do that.

A (139:00)

I didn't do it.

C (139:01)

Just watched you do it. And I know they're not intentionally trying to lie. They're just like, don't want to disappoint you. So like they'll say something absolutely wild and crazy. And in a way this is the same thing, right? Like, it, it has all it is knowledge and this power and it doesn't matter. It's still a kid. Right. When it comes to that level, it's.

A (139:19)

Interesting because while you would think that companies like Google with all of the information that they have would be superior at this point, I think the general consensus of all the people I talk to and certainly my own experience is that Claude is kind of leading the pack, especially Claude code.

C (139:42)

I mean, anecdotal, anyway.

A (139:44)

Yeah. How about. Is that what you're seeing too, Alex?

D (139:49)

Yes. I mean, I Think from our internal evaluation. So at Corridor, we work on the safety insecurity of AI generated code. So we actually, if you go to corridor.dev and you go to our blog, we've written a series of blog posts about our tests. We tend to take academic evaluations of the security of AI code and then we're building upon those. And actually, I should say Anthropic is actually one of our partners in trying to build some of these new benchmarks. And when you look at one of the benchmarks, like Backspench is one of the ones that we're building upon. We've brought these in and Opus 4.5 is definitely one of the leaders.

A (140:33)

It's really kind of mind blowing.

D (140:36)

Yeah, it's one of the leaders in both its ability of what it can do as well as the security of the code generator.

A (140:40)

That's good. That's a relief, actually, because as we talked about before the show, I am not running it in the most secure fashion. You said you should probably sandbox it and isolate it and then when it's done working, throw away the sandbox. So it doesn't.

D (140:55)

Well, yeah, you got to be careful for any of the models, like having them hooked up into a production database, having them have access to, if they have access to one of the smart things, like if they have access to the Supabase MCP server. Supabase is this really smart thing where it says everything you're about to see between these two randomly generated UUIDs is possibly attacker controlled. Do not accept anything between it as prompt. I don't know if you've ever seen that, but like, you know, you'd have to be really careful about prompt injection into Claude code or anything like that.

A (141:30)

Well, and the thing, one of the things that worries me is Anthropic has made Claude Cowork available with the intent that this is for the general public. That it's, you know, that you can use this to modify your desktop to. And of course, one of the ways that prompt injection happens is hidden prompts, hidden text in documents inserted by bad guys into documents that when Claude Code reads it, you as a human can't see it. But when CLAUDE code or Claude Cowork reads it, it will act on those prompts. Things like send all of the private information out to this address and you might not even know that that's happening. Claude might be doing it so quickly. Is it dangerous, you think, for Anthropic to give Cowork, to promote cowork to everybody, People who are not. Not really aware of these risks.

D (142:22)

So they've definitely thought about that Cowork, actually, interesting enough, one of the reasons Cowork only works on Macs is it runs in a virtual machine. So when you install Cowork, it takes a little time. What it's doing is it's downloading a full Linux virtual machine. No, I'm not kidding. Yeah, it uses the Apple virtualization framework. It boots up a full Linux virtual machine. It actually has like an EFI Booth header. It runs a full Linux kernel ARM kernel, and then it runs CLAUDE code inside a virtual machine. And then when you share stuff with Cowork, what you're doing is you're popping holes in that virtual machine for it to have access. And then all of its outbound network traffic goes through a proxy and it looks like they're running a small model to watch that traffic to make sure it doesn't exercise trade stuff. So.

A (143:13)

So I'm running it right now and it's setting up Claude's workspace. You're saying it's setting up a virtual machine, a Linux.

D (143:19)

Right. What it's doing is it's downloading. Yeah, Right. What it's doing right now is it's downloading a virtual machine and booting it. Yes. And so if you watch like in activity monitor, you'll see it uses a huge amount of memory.

A (143:33)

My whole machine is just completely slowed down now because of that. Right?

D (143:38)

Yeah.

A (143:39)

Wow.

D (143:40)

I'm not saying I don't know how much it's going to be.

A (143:43)

It's an M3 Max. It's probably got some messages, you're probably fine.

D (143:46)

But. Yeah, so this is one of the.

A (143:47)

Reasons 45% of the CPU is being loading a kernel task right now.

C (143:52)

Yeah.

D (143:52)

And like click on memory. Let's see how much?

A (143:55)

61%.

D (143:56)

Right. And it shows up as a kernel task because they're. Yeah, it doesn't show up. It shows up as a kernel task because they're using the Apple virtualization toolkit. So it's going to be. Yeah, it's going to show up in the curve.

A (144:07)

That's wild. I have no idea.

D (144:10)

Well, that's things you learn if you listen to Twit.

A (144:13)

Yes, Yes, I should have been listening. Why wasn't I paying more attention? So nevertheless, it is going to. Even though it's running in a virtual machine.

D (144:24)

Right. But I'm just saying. So it doesn't have full access to your doc. So what they're doing is they're trying to control. It's a three Legged stool for prompt injection, Right. For prompt detection to work, it has to have access to your private data. It has access to the prompt and has to have access to network traffic to accent rate. And so you only share access to the data that you want to give it access to. And what they try to do is to allow you to choose the context per query you give it.

A (144:57)

So I'm asking it to organize my folder and now it's doing as many Mac apps do, allow Claude to change files and pictures.

D (145:06)

Right? So this is to allow the Mac app overall and then basically you have to choose for every request you give Claude, you choose what you attach to it. And when you do that, the Mac app, which is a Mac Electron app, does a call that basically changes then the permissions of using the Apple virtualization toolkit. It pops a hole to allow access then.

A (145:32)

So it is now looking at all of my pictures. It's going to organize them, it's going to find duplicates, which is awesome.

D (145:41)

And then what they do is they run a proxy for all of its network traffic. So if it does a call out to basically they use that network proxy to limit its ability. So that like if somebody was able to get a prompt in there and says send all my photos somewhere, in theory that proxy is supposed to block it. I don't know exactly what they're doing. I've only done like some minimal reverse engineering I haven't seen yet. Do they reverse engineering yet?

B (146:08)

Do they revoke the access once the task is complete or once it's open, it's just open and you're done?

D (146:14)

I think they revoke it when, if you move on to a new one. I'm not totally sure how they do that or if they maybe they spin up a total totally new vm. I'm not sure.

A (146:23)

Now I'm excited. I want to let it organize all my pictures. I had no idea. I've been. I mean so this is a much better way than, than the way I've been doing it, which is with cloud code at the command line.

D (146:36)

Command line. Just give it access to like your production database.

A (146:38)

Bare metal.

D (146:39)

I'm saying like yo, yo. Pseudo. Like you just. Claude, you could just run this.

A (146:42)

Yeah, yeah, yeah. I mean basically that's. Yeah. Oh well, yeah.

D (146:47)

No, so I mean they've put some thought into it obviously. Like, like the problem here is it's got to run like on an M3 or M4 Mac. It's got to have a crapload of memory. So it's going to make it Difficult for them to roll this out to Windows because only Windows Pro and Enterprise have Hyper V. It's not installed by default. So it will be. What they'll probably have to do is they'll probably have to do this as a cloud hosted service eventually.

A (147:13)

Right? Very interesting. Apple, of course, is adding Google's Gemini to their Siri. This will be coming out in stages this year. Initially when Google, Apple let Google do the announcement, the impression that everybody got was that Gemini would be running on Apple's servers in Apple's cloud and not sending stuff up to Google. Maybe that's not the case. Mark Gurman, who is of course the number one Apple rumor guy at Bloomberg, says it may in fact be that the chatbot version of Siri will be running on Google's servers. We'll find out. It's in 26 4, which will be coming out before the fall, probably in the summer. And then of course 27, which is the new operating server system which comes out in the fall, will hold the change chatbot. So this is going to come out in stages. It's not going to come out all at once. I wonder how Apple users will respond though to the idea that maybe Google's going to get some of that information.

D (148:23)

I think what percentage of Apple users.

B (148:26)

They need to be very clear about.

A (148:28)

They do how this is going to run.

B (148:30)

Because the whole premise of Apple intelligence, specifically Apple in general, but Apple intelligence was this like multi pronged approach where it could run the model, the model locally very securely, but if it needed to, there was the secure, how did they call it, secure cloud, which was very interestingly, architecturally. Very interesting architecturally. But now if all of a sudden it's running on Google servers, that changes the proposition entirely. I would think they would not want that to happen. Or maybe they're like, we have our servers at Google's facilities and we handle them. Or I don't know. That's a bit, that's a bit concerning.

D (149:19)

I'm sure Apple has the data on this of like what number of Apple users have all their data in Gmail and Google Drive, right? So like now the question is how many Apple users understand that Google already has all their data, right? So there's, there's some, there's some number of people.

A (149:34)

Good point.

D (149:35)

Like I love my privacy for my Apple device, right. I don't want Google to have all of it. By the way, all my data say Google. Right.

A (149:42)

Don't understand Google anyway.

B (149:44)

No, but that's, that's the principle of it.

C (149:47)

My favorite Comment is, I don't want all these people to have all of my information. I'm like, oh, what browser do you use? Oh, I use Chrome.

D (149:53)

Right, okay.

C (149:54)

Right.

D (149:54)

What email do you use?

C (149:56)

Yeah, like. And what's Your email address? Gmail.com. i'm like, oh, I see. Have you ever heard, heard of an app called Ghostery? No. Do you use like Incog or anything cool like that? What are those? All right, never mind, never mind. This argument is over. I'm going go get coffee. Because it's super funny. They have no idea how much stuff it just goes out just from everyday browsing if you don't know how to turn those trackers off. And unfortunately, too many people are hands up. Like Patrick said, don't give up. Right? Too many people are like, ah, this is. It's too technical. I don't want to know.

D (150:26)

Know.

C (150:27)

Every time I hear that come out of somebody's mouth, I cringe While they drive a highly technical car and they, you know, they have all these other devices which are highly technical. But everyone swears to this day, I'm not a tech person.

A (150:39)

Okay.

D (150:39)

Yeah. I mean, Mike, Apple just really backed themselves into a corner by setting up the expectation that everything was going to stay on device. It was, I get why they did it, but it just was not practical for what people are expecting out of these apps. And like the world has moved on with what how. Especially young people. My daughter all day is like, hey, chat. And then she asked it some complicated question and she does not think that, that, you know, she does not think about her phone. Does it stay. Go in the cloud?

A (151:10)

She doesn't.

D (151:10)

She wants it to. Right? It has, you know, she uses notion all day. I had to buy her the business level of notion because she's using so many credits. No, I'm not kidding. Like, she uploaded like all her Latin homework. All her, like whatever.

C (151:21)

She, you know what?

A (151:23)

If your daughter's studying Latin, get her every credit she can.

D (151:28)

No, absolutely. Yeah.

A (151:29)

Yeah, that's great. She must be going to a private school. There's. They're not teaching Latin anymore.

D (151:33)

Are they in public school? They. They are not.

A (151:36)

No, no, I studied Latin in, in high school. It was great. It was a.

D (151:40)

Where'd you go to high school?

A (151:41)

Yeah, back east. A small school called Moses Brown, but. And then Santa Cruz High, where not only we not study Latin, I think mostly we studied surfing. Surfing. And. And a little bit, A little bit of that. Yeah. Yeah. But the Latin stayed with me. Ironically. I can't remember anything about the Surfing wiki. Maybe that has to do with the other activity.

B (152:02)

Yeah, there's an explanation there.

A (152:09)

Wikipedia, worried about AI slop getting into the. Into the encyclopedia, created a plugin, a guide to detect AI writing. Here's how you know it's AI writing, which, of course, it was called Humanizer. Actually, no. They created the model, and then an entrepreneur named Siki Chen created a plugin called Humanizer which feeds Claude the information. The Wikipedia came up with the patterns. Wikipedia editors is listed as chatbot giveaways. To make sure that Claude doesn't do any of that, Chen wrote on X. It's really handy. Wikipedia went and collated a detailed list of signs of AI writing. So much so that you can just tell your LLM not to do that.

C (152:59)

Yeah, it's funny. Grammarly has Humanizer built in. There's another cool writing tool for the Mac called Lex Page. They also have, like, Humanizers built in.

A (153:08)

How does it work? Does it. You feel like you're reading human text?

C (153:11)

Well, it just, it. It kind of. It looks for the standard giveaways, but one that really cracked me up the other day. So my.

A (153:18)

My delve or M dashes.

C (153:21)

There you go, the M dash. So my direct Katie, she's an English major, right? And she's like, I'm so mad that, you know, AI is causing everybody to hate M dashes because, like, as an English writer, like, I use them.

A (153:34)

I love M dashes. Yes.

C (153:35)

Yeah. And it's like, now you don't want to put them in there because people will claim that even if you did it correctly, people will claim that you did it with a. Because there's an EM dash. And it's like, no, people that know grammar know how to use them. Mignon Fogerty.

A (153:49)

So there you go. Minion. Yeah.

C (153:52)

You know, like, I used to listen to that joint religiously.

A (153:54)

Grammar girl, making these weird problems.

C (153:56)

And now, you know, if you do grammar right, people think that you're using AI and it's like, oh, so now I got to mess it up on purpose. This is so weird.

A (154:04)

So, yeah, we argue. We argue about this because Paris Martineau and Jeff Jarvis, who are our hosts on Intelligent Machines, are both journalists, us who love the EM dash. And, you know, I'm not giving up my EM dash. Even if people makes. It's. It's an epidemic on Reddit. If you use bullet points, if you write coherently, you're immediately accused of using AI.

B (154:28)

It's pretty funny. We need a way to identify humans. You know, coming back to it, Iris Scan world, coin join.

D (154:38)

Yeah, well I mean somebody. Yes sir. As somebody who teaches this is a huge problem.

A (154:43)

Like do you, do you worry about that?

D (154:46)

Oh yeah. I mean like it's very hard to give a take home essay anymore or like prose assignment. The law schools move back to like blue books, right? So like handwriting, handwriting. Like I think they allow you to do a typewriter. So it's like hilarious. So there's like students will actually buy typewriters now. Yeah.

B (155:04)

Really?

A (155:06)

And then like you do is modify a typewriter to hook it up to an AI and then you're set, you're golden. Maybe somebody writes now.

D (155:12)

Some colleges, you know, for the essays they do proctored essays where you write the essay live and you download the software. Not that the software is unbreakable. It's possible when my son did this that I downloaded the package and dropped it into Ghidra. Not, not for him. I didn't help him cheat or anything but I just took a look and I'm like oh, oh. Like the, the, the level here is like game DRM, right? And these guys are like 10 levels below game DRM. So like if people can beat game DRM, they can beat the, you know.

A (155:43)

Yeah. Anthropic actually had a problem.

C (155:46)

You on a camera to make sure that you're doing the test. So there was a recent test that they're doing and they have to have the camera on and I'm like they can't get up to take a pee. Like they can't do anything. Like the camera is legit sitting there in a room and it has to.

A (155:59)

And there have been some real complaints about this camera and I'.

C (156:02)

I, hey listen dude, I'm from, I'm, I'm a video professional. I could fake that camera. Like I know for a fact I can fake that camera.

D (156:09)

Like oh yeah. I mean just, yeah, you just get North Korean to take your test for you, I'm sure.

A (156:14)

And you just sit there going like this. Yeah. Actually Anthropic used to have a take home exam for prospective software engineers. And because OPUS got so good it, it actually did better than the humans. So they had this. They had to, they had to, had to just do it. Something else. The original take home Exam was a four hour exam. Anthropic Claude Opus 4.5 was able to do it in only two hours. So now they've posted the exam on their GitHub so that you can see it and they're not using it anymore. That's pretty, that's pretty funny. They Hoisted by their own patari.

D (157:00)

We do an in person work trial also. You want to judge if somebody like, gets along with their co workers.

A (157:07)

Yeah. You want to watch them do it? Yeah, yeah. Do you have. Do you do the big interview question and you have them on a whiteboard and.

D (157:13)

No, no, no, we do a work trial. So we give them a real problem that's relevant and. And we let them use AI, Right, because it's like we use code. And so that's part the of of the job. It's not cheating, but you solve it. So I let my students use AI to actually code. I've just massively raised the bar of what I expect out of them. Now, it used to be you built this crappy little thing that has no ui. Now I expect it should have a working ui. It should be reactive. Right. It should be like beautiful. It should have beautiful graphs. Right? Because it's like you've got Claude doing it for you. And then like in a work trial, what you can do with four hours, five hours during a workday is way up here. So. But yeah, you do that. You have a work trial, you bring people in and then you get lunch. You don't have to ask them a bunch of questions. You just chill in with them and you try to simulate what a workday looks like. I think that's like, what interview?

A (158:03)

That's better anyway. It's much more realistic.

D (158:06)

It's great for them too, because they get the feel of what's a workday? Like, what are these people like? And then they present to the end of the day and you can see they have to explain what happens, happened. And you ask them questions and if they can't explain it, then you're like, oh, Claude did it. All right. Like, why did you do that? Like, oh, Claude decided to do it. Like, okay, great.

A (158:27)

Was it wrong? No, that's the right thing. I was just wondering where. Where you came from.

D (158:30)

Yeah, yeah.

A (158:32)

Let's take a break. One last commercial and then we'll put Patrick to bed. We're going to tuck him in with a few. A few short stories that are amusing. A little amuse bouche at the end of the show. Show our show. It's great to have all three of you. Thank you for being here. I really appreciate it. It's. Oh, I look forward to Sundays because I get to hang out with people, smart people that I really like and talk about stuff that somewhat matters. Somewhat. A little bit, the toy store. But it, it matters a little bit. It's not like Invading Greenland. But it's something we have to think about other things once in a while anyway. Okay. This episode of the show brought to you by Shopify. If you've shopped online, chances are you've bought from a business powered by Shopify. They help my son and my daughter make a living. You know that purple shop pay button you see at checkout? The one that makes buying so incredibly easy? That's Shopify. And there's a reason so many businesses sell with it. Because Shopify doesn't just make amazing buying experiences for customers. They're also the experts in helping small businesses grow big. Shopify's point of sale system is a unified command center for your retail business. It brings together in store and online operations across up to 1,000 locations. Imagine being able to guarantee that shopping is always convenient. Endless aisle ship to customer buy online pick up in store. All made simpler so customers can shop how they want and staff have the tools to close every sale every time. And let's face it, acquiring new customers is expensive. With Shopify POS you can keep customers coming back with personalized experiences and first party data that give marketing teams a competitive edge. In fact, it's proven based on a report from EY businesses on Shopify POS see real results like 22% better total cost of ownership and benefits equivalent to an 8.9% uplift in sales on average relative to the market set surveyed. Stop seeing carts going abandoned and turn those sales into Sign up for your $1 per month trial and start selling today at shopify.com go to shopify.com twit shopify.com twit we ever talk about the, the free TVs that have the ad bar across the bottom. Telly.

D (160:48)

TVs that watch you while you watch.

A (160:50)

They, they watch you while you watch. They have cameras, they have microphones and they have a, a little bit bar, not so little a bar below the bottom that you cannot disable that's constantly showing ads while you're watching the big game or whatever. They somebody did a little research and figured out that they are making about $50 per month per customer. Now this is a thousand dollar tv so that means it's going to take them almost two years to, you know, make up the cost of delivering the TVs. The only problem is they said they had quarter million people sign up to get this free tv. They said they hoped to ship a half million devices by June 2023 and millions more in 2024. Well, according to a report from Lopass they only had about 35,000 TVs in people's homes. Part of the problem is they were using FedEx to deliver them. And 10% of the TVs delivered were broken, Arrived, broken, including they sent to a Verge reviewer back in September. There it is. I think that's broken. I think that qualifies. Nevertheless, when they get them into homes, they make a lot of money. And there is apparently the demand. There are some other issues. The Verge reporters. I'm a Roth setter. Telly showed three of the same ads in Spanish, which I don't speak, week in a row. And there's also, according to Sharon Harding, writing for Ars Technica, concerns about the camera and the microphone and what they're using them for. Would you, would you, would you take a free TV if, if you couldn't disable the ads?

B (162:42)

No, none of us would, but we can, but we can afford to buy a tv.

A (162:46)

Although.

B (162:46)

So I guess, to be fair, to be fair, TVs and a lot of electronics have gotten so cheap. They have like, you can get a very decent TV from a discount brand like TCL for 300 bucks. So I think at some point it's not worth having an actual camera.

A (163:10)

And you're, you know why you're getting that ticket TV so cheap? They're subsidizing it.

B (163:14)

Right.

A (163:14)

With, of course.

D (163:15)

Right. It seems very odd because like. Yeah. What's a television cost these days?

C (163:22)

Well, now they're, they're Android boxes and you know, for the most part. And remember this week Sony and tcl, they, they went on the date and came back holding hands.

A (163:32)

So Sony says they're going to have. All the Bravias will be made by.

C (163:35)

TCL for, yeah, 100 except for the.

D (163:37)

Really, really high 50 inch QLED from Costco for $239.

A (163:42)

So you'd be crazy to get one of these tellies then.

B (163:45)

That's the thing. That's the thing.

A (163:47)

That's crazy.

C (163:48)

But you know, the reason, you know.

A (163:50)

That'S spying on you just as much as the telly does. It's just.

C (163:54)

Exactly. And so to my point, Leo, the people that are going to, that I don't, I didn't. You shouldn't blanket people. But if you're, if you're going to find vulnerable folks, it's going to be not that they can't afford it. It's the priority is this is free, right? Because I definitely have, I got a free tv. Like I have a member of my family who is stuck on anything free just because they grew up in the time where they didn't really have anything. So the idea of getting something free is crazy. We go to a lovely restaurant the other day and I mean, you know what it is? You go to the Italian restaurant and you eat all the free bread and the food comes out and I'm not hungry no more. And I'm like, why? Every time. Why are you eating like we got. You know what I mean?

A (164:32)

Like, don't trust no one in our Discord chat is saying a good point. Do advertisers really want the people who want free TVs? Is that really the customer you're looking for?

C (164:43)

That's brilliant. I did like the comment that free food definitely tastes better. Because it does. Because, you know, you ever notice that your other half isn't hungry until you order what you ordered? Then they keep stealing your food.

A (164:53)

Oh, that's. Is that why I couldn't figure that out.

C (164:55)

Free. Free food tastes better and, well, they're still on the diet.

A (165:00)

Believe it or not, toilet maker Toto is seeing a little boost in the stock market. Now. These are the guys who make the Japanese toilets. I'm sure you must have one. Yeah, I do too.

C (165:13)

Come to my house, bro.

A (165:15)

Love my toto. So I ordered one. Or actually, I told my wife, I said, I want to get one of these Japanese toilets. You know, it sings to you. It opens. It opens itself to say hello. It's. The seat is warm, takes care of you at all moments of the operation. And she said, yeah, I don't know, do I? She. I said, let me just get it in one bathroom and see what you think. Before we were done, we had one in every single bathroom.

C (165:43)

She 100% loved them.

B (165:45)

Like, Japanese toilets are a thing that everyone thinks is weird until they've tried it.

C (165:52)

Yeah, until they tried.

B (165:53)

I started going to Japan many, many years ago and I was singing the gospel.

A (166:00)

Believe it or not, Toto makes more than toilets. In order to make those toilets, they had to create an electrostatic chunk. I don't know what it does, but apparently this is a vital chip making material. It's used, I guess, to hold, I don't know, to hold the wafers or something. And they're, They're. Did I say chunk? It's a chuck, you know. You know what a chuck is? Chuck holds. Right. Apparently they are the only source for these chucks. And the ramp up in the price of memory has really helped Toto. Demand for electrostatic chucks has gone through the roof. So I guess they're Experts in ceramics. Because these are ceramics. Ceramic. And like the toilets, they are ceramic. So 42% of Toto's operating income last year came from electrostatic chucks being sold.

C (167:01)

Chuck it in the toilet.

A (167:05)

The memory industry. I just. I don't know, I just tickled me. I just thought that was funny. How about this? I want this.

C (167:11)

That's why everybody likes them.

A (167:12)

That's why we liked it. Thank you, Alex Stamos. Sorry we had to let Alex go. Short notice, but. But we're going to wrap it up with one last mention, and that is of Dr. Gladys west, who passed away this week at the age of 95. Without her mathematical models, we would not have GPS. And this is, you know, a sad case of some of the people who really changed the world are not marked because she was black. She grew up in Virginia in 1930, but worked at the Naval Surface Warfare center in Dalgren, Virginia. Started her work in 1956. In the 70s and 80s, she worked on creating accurate models of the earth's shape based on satellite data. This is from Engadget. A complex task requiring the type of mathematical gymnastics that would make the average person. Person dizzy. Those models became the backbone for GPS. She worked at the Dahlgren center for 42 years, retiring in 1998. Her work went largely uncelebrated for decades. But we're not going to let her pass unnoticed. Dr. Gladys West. I did at the age of 95. If you. If you use GPS to get around, you can thank Gladys west. And that is that. Thank you, Doc Rock. You are a champion. Two shows.

C (168:49)

I get to be Alex right now.

B (168:51)

Oops.

A (168:52)

Yes, we. We're fixing that. Doc Rock is a. Is, of course, a wonderful YouTuber. YouTube.com Doc Rock, his day job is working in as an evangelist for ecamm. As a man who's speaking the truth to people who use eCamm.

C (169:10)

Yeah, I basically get to find companies like yourselves and, you know, even the hardware companies that we partner with to make it better for everyone, but also to show the users who are starting with nothing like, what the possibilities are. And I. I tell you, Leo, there's not a week that doesn't go by when people says, well, I'm starting this podcast and I don't know who will listen. I go, that's how they all start. And I tell you right now, I hang out every week on one that's like 20 years old. There's old enough to drink, and there was probably. There's probably a hundred of us watching it in the beginning but there's a heck of a lot more now. So thank you.

A (169:40)

Start.

C (169:40)

You start. You know, you never really start where you start.

A (169:42)

That's right. It's great to see you. Appreciate all your contributions. Everybody with a microphone should get Docs Pops.

D (169:49)

There you go.

A (169:50)

That's. I like the orange one today. That's the Pop Filter Doc Rock. Where, where can I get that Doc.

C (169:57)

Pops with two p's at the second part.

A (170:01)

Dot com. It's part of the Doc Merch, the fabulous Doc Merch lineup.

C (170:06)

Doc Pops.

A (170:07)

There it is. Thank you, Dr. Patrick. You are a champion. It is now 2:00am 2:08 indeed. Thank you for staying up late, especially given that you just recovered from the flu. I hope you get to bed and get to sleep in a little bit. You don't get waking up.

B (170:26)

I'm very much looking forward to it.

A (170:29)

Patrick Basha is@notpatrick.com. subscribe to his podcast if you speak French. He has a number of wonderful podcasts for you. If you don't. The Phileas Club is his English language podcast.

B (170:42)

But there's a funny show.

A (170:50)

Did I say all of those?

B (170:52)

Not. Well, I mean, I mean.

A (170:54)

Okay, okay. Sort of. Well, well. The Rendezvous Deck. Yeah. Thank you, Patrick.

B (171:02)

That'll go.

A (171:03)

I appreciate it.

B (171:04)

Thank you, Leo.

A (171:05)

Always great to see you.

B (171:05)

Always fun.

A (171:06)

Thanks to all of you for joining us. We do this show every Sunday from 2 to 5 Pacific time. That's 5 to 8 Eastern, 2200 UTC. You can join us, of course. Watch live if you wish on YouTube, Twitch, X dot com, Facebook, LinkedIn and Kick. Of course, if you're in a the club, you can join us in the club. Twit Discord. That's another place you can watch after the fact. On demand versions of the show are available at TWiT TV. There's a YouTube channel dedicated to the video and you can subscribe to audio or video and any podcast client. If you do, leave us a review. Leave us a good review. Not a bad review, a good review. Tell the world about this week in tech. Thank you everybody for joining us. We'll see you next time. Another twit is in the can. Bye bye. Hey everybody, it's Leo Laporte. It's the last week to take our annual survey. This is so important for us to get to know you better. We thank everybody who's already taken the survey and if you're one of the few who has not, you have a few days left. Visit our website TWiT TV Survey 26 and fill it out before January 31st. Thank you so much. We appreciate.

D (172:15)

He's amazing.