Utah Bans VPN Age Bypass - 2026-05-04

Summary

Talkin' Bout [Infosec] News — Utah Bans VPN Age Bypass

Podcast: Black Hills Information Security
Date: May 11, 2026
Episode: "Utah Bans VPN Age Bypass - 2026-05-04"

---

Episode Overview

This week’s podcast brings the BHIS team together for a lively discussion of major infosec news stories and trends. The group takes a technical deep-dive into the recent DigiCert compromise, the cPanel auth bypass, and the so-called Utah VPN ban law, among other notable security events. Broader themes include the perennial importance of fundamentals in cybersecurity, increasing regulatory efforts around internet usage, the challenges in the AI landscape (including data loss via LLMs), and realism around supply chain threats and vulnerability management.

---

Key Discussion Points and Insights

[09:00] DigiCert Hack: Social Engineering and Certificate Theft

• Incident Recap: DigiCert, a prominent CA, was breached via social engineering targeting their support team. Attackers delivered a zip file disguised as a screenshot, containing a malicious Windows screensaver file (.scr), which, when opened, led to compromise of code signing certificates.
• Attack Analysis:
  • The attack vector was "a zip file with an EXE or SCR" — a technique familiar to most red teamers.
  • A misconfigured security setup on a support host enabled the breach.
  • At least 60 code signing certificates were created/stolen and used to sign stealer malware.
• Broader Implications: Frequent incidents ("It happens every two years like Old Faithful") underline chronic segmentation and operational issues at CAs.
• Quote:
  "Basically, if you’re a red team reading this, go try this this week... find a support chat for one of your targets, say you’re having issues, send them a zip file with a payload in it. What’s the worst that could happen?" — Corey [12:51]

---

[16:00] MoveIt, cPanel Authentication Bypass, and Patch Fatigue

• MoveIt: New CVEs and active exploitation; patch if you run these servers. The consensus: a vulnerable SaaS product is likely to have more undiscovered bugs.
• cPanel: High-impact auth bypass affecting many shared hosting platforms.
  • Many enterprise environments have legacy, brochure-style websites left unpatched.
  • Discussion on ease of use vs. security: modern static-site hosting makes these issues less relevant, but inertia and low technical skills in marketing means old stacks linger.
• Quote:
  "If you’re using cPanel to host one of your websites—or if you don’t know—you’re about to be advertising all kinds of weird products..." — Corey [20:49]

---

[26:00] AI/LLM Incident: Database Deletion Drama

• Summary: Viral news of a startup founder blaming an AI agent (Claude or similar) for deleting all production data and backups via improper API permissions.
• Panel Skepticism: Most believe human error (misconfigured access, lack of backups) is to blame, with AI as scapegoat.
• Security Lessons: Importance of isolated backups, not over-permissioning OAuth tokens, using AI “plan mode,” and not giving AI broad, dangerous API access.
• Quotes:
  "I am not convinced. Maybe it’s conspiracy theory, but I feel like the dude accidentally deleted it and he’s blaming AI." — Tim Medine [27:51]
  "Fundamentally, the theme for this week is: have separated, isolated backups. Don’t OAuth with your God admin account... Use revision tracking." — Corey [30:36]

---

[38:51] Utah VPN Ban & Age Verification Laws

• Utah Law: Goes into effect imminently. Holds websites liable if Utah users access banned content (e.g., porn) using VPNs to bypass age verification.
• Technical Challenges:
  • Websites expected to detect and block VPN users and determine users' real locations—practically impossible.
  • Likely outcome: blanket VPN blocks (which are easily circumvented), increased errors for legitimate users, legal uncertainties.
• Comparisons: Panel notes similarity to “Great Firewall of China” cat-and-mouse struggles, expectation of more robust circumvention tools evolving from this.
• Quotes:
  "From a technical perspective, it’s not really possible. How are you going to backwards trace a user from whatever visits your website to where they live? Basically impossible." — Corey [40:02]
  "You created a monster." — Ralph on unintended consequences [42:27]

---

[46:55] Broader Context: Surveillance, Internet Regulation, and Digital Identity

• Broader Impacts: Hosting, censorship, federal vs. state requirements for age verification, the prospect of national digital ID systems—privacy, freedom, and enforcement complexities.
• Panel’s Take: Such laws can easily be leveraged for surveillance or censorship under a “save the kids” pretext.
• Technical Proposals: Discussion of cryptographic or device-bound approaches for privacy-preserving age/auth verification; consensus is that practical, robust global infrastructure for this doesn’t yet exist.

---

[52:00] Medical Privacy: Recording at Doctor Visits

• Article Review: Discussion of a viral article arguing against letting healthcare providers record/transcribe patient visits.
• Panel Perspective: Most see potential benefit—improved care, accountability, easier referencing—if privacy controls like HIPAA are respected.
• Quotes:
  "The same arguments you could make for why body cams are bad. Like, well, accountability is bad. It’s like, no, it’s not." — Corey [52:32]
  "Some of those things, like, it’s just really easy for them to...do. I mean, yes, you’re gonna have some extra hands on, but they love it. They use it all day, all the time." — Tim Medine [53:47]

---

[56:20] Mitre ATT&CK Changes: Defensive Evasion Split

• News: The MITRE ATT&CK framework’s "Defensive Evasion" technique is splitting into "Stealth" and "Defense Impairment".
• Action Items: Defenders will need to update their technique mappings and detection logic.
• Quotes:
  "What this means for all you defenders is you’re gonna have to remap all your MITRE attack IDs and redo all your tagging...there’s an Excel spreadsheet on their website for it." — Wade Wells [57:14]

---

[61:13] Ongoing Trends: AI Coding (Python vs. Golang/Rust), GitHub Reliability

• AI and Programming: Debate over the continued dominance of Python, its pros/cons; the rise of Golang and Rust for safer, more reliable code, especially with AI co-pilots.
• Quote:
  "If you’re going to vibe code it, you might as well vibe code in a language that’s built to last longer than 15 minutes." — Corey [58:23]
• GitHub Hot Take: HashiCorp founder claims GitHub “is no longer a place for serious work” due to reliability concerns.
• Practical Notes: Alternatives exist (GitLab, BitBucket, self-hosted), but GitHub prevails for its advanced CI/CD features.

---

[62:20] Supply Chain Security

• Risk Awareness: Increasing attention to software supply chain attacks; reminders for organizations to limit dependency sprawl and audit open-source reliance.
• Incident: Recent Trellix code repository leak discussed as an example.

---

Notable Quotes & Moments

• On mustaches and infosec beards:
  "I wish I could do the long one, like the motorcycle guide...We have not cooked the steak evenly." — Tim Medine [08:00]
• On red teaming inspiration:
  "If you’re a red team reading this, go try this this week." — Corey [12:51]
• On AI database wipe drama:
  "I feel like the dude accidentally deleted it and he's blaming AI." — Tim Medine [27:51]
• On security basics:
  "Everything we're going to talk through here...we're going to be referencing the basics." — Tim Medine [06:33]
• On Utah’s VPN ban:
  "You created a monster." — Ralph [42:27]

---

Timestamps for Key Segments

• [09:00] DigiCert social engineering breach explained
• [13:17] Technical analysis of payloads (zip/SCR attack method)
• [16:00] MoveIt and cPanel vulnerabilities
• [26:00] AI “delete my database” incident and lessons
• [38:51] Utah’s VPN ban law, feasibility, and wider trends
• [52:00] Should you let your doctor record visits? Discussion
• [56:20] MITRE ATT&CK framework update (Defensive Evasion split)
• [61:13] Python vs. Go/Rust—AI coding advice
• [62:20] Supply chain security and recent repo leak

---

Upcoming Events and Plugs

• Wade Wells: Workshop on May 6, "How to Turn Cybersecurity Headlines into Action."
• John’s InfoSec Core Skills: Training on May 11.
• Wade: Additional workshop on May 15.
• Corey Overstreet: Red teaming webcast, May 20.
• Tim Medine: Kerberos workshop, May 22.
• Patrick Gorman: Blue team course, date TBA (before DEFCON).

---

Closing Thoughts

This episode balanced technical analysis with the practical, regulatory, and even sociological angles of modern infosec. From the challenges of software supply chain risk to the “back to basics” reminders in defending against old-school tricks, and the radical implications of new state laws affecting internet privacy, the theme was clear: Despite waves of change in tools, trends, and threats, fundamentals, transparency, and a dose of healthy skepticism remain king.

---

Transcript

[Tim Medine]

Dark.

[Ralph]

And then the other cool part was the time, the time dilation, which was. I also watched a bunch of YouTube videos about that. And essentially the faster you go, the less time you experience. And that's actually like the way that it was like described in the video is like it's, it's because like as you go faster, the molecules take longer to make it to the next spot, right? And that's like the time difference between those.

[Corey]

So.

[Ralph]

So you're actually experiencing time slower because everything is moving slower. You're going.

[Tim Medine]

The really cool thing is if you get two astronauts passing each other relative to each other going close to the speed of light. Whatever, whatever. Each one will experience the other one going slower, which is like mind blowing. Like, and the physics and you can do the math. Like I. Yeah, there's a great book by the way called the Elegant Universe. It's actually pretty readable. Came out maybe late 90s, early 2000. Really readable. But like there's a whole bunch of like just mind blowing stuff here. Like you know, circle circumferences, what 2 PI r? Well, unless you spin it close to the speed of light and then it doesn't happen anymore because you got length contraction, but only in the direction of movement. So your radius doesn't change. But then you're. Yeah, it gets the.

[Ralph]

The book was kind of cool. Or not just the book, but the movie was cool as awesome because there's a bit of science in there too. And like I. Again, some of it may.

[Wade Wells]

There's a lot more science in the books. Like the books are all scientifically accurate and like the, the star he went. They went to or the star that Rocky was from was act. They actually thought there was a planet on it. And it wasn't until after the book came out that they discovered. Oh, that actually doesn't have a planet around it. So he. That was like one thing he accidentally.

[Corey]

Bummer.

[Tim Medine]

But I like, I like the whole. I think they did a pretty good job with that. Like you're meeting in a whole new culture. You have no frame of reference for communicating. You don't have like hands to wave at people. Right? Like, like you, you've got completely from scratch trying to dissect this. And what was cool I thought too is like they use like infrared. We use visible light. Right? Like we're using different wavelengths for that. The sound doesn't. We're like just completely different. Like that was awesome. Love that. Like, didn't make it easy.

[Wade Wells]

I've watched so many videos that if I get abducted. How to talk to aliens, Right? Like, first you, like, you write out like scratch marks in your number system, then you write out PI and you draw a circle. Then you draw the. Your solar system to point that you know where you're at.

[Corey]

Whoa, whoa, whoa. They already did this, dude. All you got to do is give the same stuff they gave on the

[Wade Wells]

Voyager golden record that that's exactly what I'm doing.

[Tim Medine]

Draw naked women. You gotta draw a naked wicked woman.

[Corey]

And what you want to do is start with drawing a naked woman.

[Wade Wells]

Dick figure.

[Corey]

Yeah.

[Tim Medine]

Know all about us and be. Wow. They know about what? What are we doing here?

[Corey]

They'll be like, listen, we. We don't like Earth. We think you guys are disgusting, but we've been watching your porn for years.

[Ralph]

That was the one thing we thought about.

[Corey]

You guys invented the Internet just for that purpose.

[Tim Medine]

And I see how important it is to you because it's the third thing you. We got numbers, we got pie, and we got bouncing about. Wow.

[Wade Wells]

All right, man.

[Corey]

Should we roll the show? I feel like. Is everyone prepped and ready? I mean, I, I read a few of the articles. It's just going to be a chaos week. I mean, it's just volumes after volumes after runs. We got copy fail, fcc, all kinds of good stuff.

[Ralph]

Oh, copy fail, so good.

[Corey]

Copy fail, yeah. All right, let's roll it. Hello and welcome to Black Hills Information securities. Talking about news. It's May 4, 2026. May the fourth be with you. I guess if you're a Star Trek fan, that really means a lot to you, right?

[Tim Medine]

Can we, can we mute his mic remotely? Right click. Right click. Work.

[Corey]

I. I will say, like, my official opinion is Star Trek is better. Fight me. It's not even close. Like, Star wars is so mid compared to Star Trek. But anyway, if you're a big Star Trek fan or I mean Star wars fan, you're still allowed. We, we. We still love you. But yeah. Anyway, let's get into the show. First of all, we got our introductions. We got Tim Medine here kerberosing us as we speak. We got Patrick Gorman. Patrick, you have. You have an upcoming webcast or training or something? I assume so, yeah.

[Patrick Gorman]

I have a few things cooking as far as courses. I have something on the blue team side coming out and yeah, as far as you know, I use. I normally do my thirsty Thursdays on Thursday nights, 7pm EST, and just talk about similar stuff and just, yeah, shoot the smack.

[Corey]

Nice. And Tim, you have an upcoming workshop on May 22 as well. Kerberos hands on. More like packets on. Am I right? Port 88, baby.

[Tim Medine]

Absolutely. Absolutely.

[Wade Wells]

Yeah.

[Tim Medine]

Join us for a couple hours of goodness with some Kerberos.

[Corey]

Hopefully you also have looks like Corey Overstreet.

[Ralph]

My.

[Corey]

My altered ego Corey. The other Corey.

[Tim Medine]

He, too, is growing his hair out. We're gonna have to have, like, a Troy Palomalu award for best wavy, best hair.

[Corey]

Best Corey hair.

[Wade Wells]

Yeah, yeah.

[Corey]

I'll have to get there. So. Yeah, he has an anti cast on May 20. About red teaming, we love Corey. I will say I've actually done a red team with him. You know, back in the day, and we used to kind of, like, cross pollinate a little more, and he's an excellent operator, so I highly recommend anyone show up to that that's interested in going after stuff. John's not going to be here. John asked me to plug his course on May 11. I think it's next week, so that should be fun. And then Jason has an upcoming webcast for job hunting as well, so it's a busy week.

[Tim Medine]

What's John's class, which is forward what you can.

[Corey]

Oh, I. I think information security core skills, which is good. Back to basics. Honestly, a lot of people are always asking about Mythos, and I'm just like, just go back to basics. All right. Just patch your stuff. It's Nothing is new.

[Tim Medine]

What's funny is everything we're going to talk through here, probably today, we're going to be referencing the basics.

[Corey]

Yeah. Sock course or cyber security core skills still as important as ever. Anyway, continue with the introductions. We also have Ralph and Wade, two of our just perennial hosts, always here. Ralph, have you considered growing a mustache? Like, where is that on your priority list right now?

[Ralph]

It's not that high. Amanda's asked me multiple times if that's where I want to be in my life, and I say no. With the beard. Yeah, I think.

[Corey]

I think we should.

[Wade Wells]

You look good, Scruffy. I think you look good, Scruffy. Like this.

[Corey]

You look good. Now, don't get me wrong, but I think you could pull it off, man. I think you should try it.

[Wade Wells]

Yeah.

[Ralph]

I mean, the problem. And it grows so fast. Like, I could grow a huge beard. I have to trim it often.

[Tim Medine]

Yeah, we just steal the quote. It's like science didn't ask if we could. Whatever. I'm g. Screw it up.

[Wade Wells]

Right?

[Corey]

Like, it's about whether you should.

[Tim Medine]

You can, but should you?

[Corey]

Yeah, yeah. Give it a shot. Do you like walking.

[Tim Medine]

Walking past the school without a squad car picking you up? Probably like

[Wade Wells]

that is the first.

[Corey]

That depends on the length of your mustache. Someone said to me, yeah, the key with the mustache is don't go below the edge of your mouth. Right. Like, if you go below that, it starts to get weird.

[Tim Medine]

I. I'm so. Actually, I'm just jealous. I wish I could do a good mustache. I can't.

[Wade Wells]

Your mustache is fine. What are you talking about?

[Tim Medine]

You know, but, like, if I. If I cut it off, it's horrible. Also, look. Look at my mustache. Like, if you just look here, it's two tone. So if I get rid of this, it's like, what's wrong with you? No, it's not peppered. Like, one side salted, the other side's black pepper. Like, we have. We have. We have not cooked the steak evenly. Like, well, I don't know what's going on.

[Ralph]

You could just get something just for men.

[Wade Wells]

Would you rather two colors or.

[Tim Medine]

No?

[Corey]

No.

[Tim Medine]

So I did that. I'm allergic. So then I. It's like. So I shaved it. It's 10 times worse because now I've got rash on my face, but just on this half of my face. So it's.

[Wade Wells]

Not for you. But if it makes you feel better, my mustache is a different color than my hair. Like, by. By a lot.

[Corey]

By. By a couple.

[Tim Medine]

That's. That's uncommon.

[Corey]

I can see how that you point it out. I could see it. It looks like a trick of the lighting, though.

[Wade Wells]

It is not. It is, like, legit like, mine is, like rusty red, like, almost like a brown red. And then my hair is pretty dark brown.

[Ralph]

Rusty red.

[Corey]

Gotcha.

[Tim Medine]

I wish I could do the one, the long one. Like the motorcycle guide. George County.

[Corey]

Yeah, yeah, yeah. All right, let's move into actual podcasting now that we've covered everyone's mustache preferences. If you have your own mustache preferences, please put them in the discord. Yeah. Whether you know any, no matter who you are, you gotta have a preference. So, I mean, I think let's start with the Digicert stuff. It's pretty. It's interesting, and it's not at the same time. For those that are out of the loop, DigiCert, which is CA or Certificate Authority, got popped. And the angle is pretty interesting. Basically, it looks like the threat actors essentially social engineer their support team into running something on their system. It sounds like there was some misconfigurations or issues with their security tools on the support teams systems and essentially led to, you know, initial access. And then the attackers stole a bunch of basically things they could use to Sign code signing certificate to create code signing certificates. And they stole or created like 60 certificates. And basically those were used to sign stealers stealer malware. So I'm guessing they just tricked the Digicert support people into running a payload somehow. I think it's a really interesting angle to try. Right. Wade, do you have any comments on the.

[Wade Wells]

Like in the initial article, not the deep dive, like if you click one in, you can actually see the IR report. But in the initial article they said that they sent them an image over their chat channel and that is the way that they were infected. Right. And

[Corey]

I mean is it not PNG exe or is it like steganography prompt injection? Like it could go really stupid or really complex.

[Wade Wells]

That's, that's exactly what I thought. I'm like, okay. And then are they using some like very like third party chat thing where they're chatting to the customers? And that was an exploit in that. So I was trying to dig into that. But the one interesting part is like they do flat out say that that secondary host had bad. Had a bad security config in it. Which. Right. Like you don't hear often as much owning up to your mistakes situation, but only exactly owning up to the mistake of actually how that works. And the thing is, it's super common. Like there's. And it's one of the hardest things to actually decide. Yeah.

[Corey]

So yeah, no, I mean I, I really, I hope someday that we can get a deep dive into the actual payload. Like it'd be cool. I mean Digi certs a security ish company. Right. So they have the capabilities to analyze this. I'd be really interested to see, was it steganography, was it prompt injection or was it just PNG exe? Like, like how, how basic was it? How advanced was it? I'm really curious. My guess is always basic, right? Like, I think anytime we as pen testers think about, oh, let's how would a threat actor do it? I think we always overestimate their capabilities and complexity, like in general. So it was probably just like exe.png and they were like, it isn't working. Can you take off the extension? Like try it again? I, I don't know. Something like that.

[Tim Medine]

Well, this is interesting. Like I feel like going back to the basics, right? Like I, I'm, I, I can't remember the exact date, but I know Digicert has been popped at least once before and I'm finding two different results, one in 2020. One of them mentions 2020. I don't have time to necessarily parse it. I'm not sure if that's 100% correct. There was definitely some certificate issues. Didn't recall 83,000 certs because they screwed those up. That was in 20, 20, 25, 24, something like that. So it's every few years and you're like, you know, I feel like the segmentation here could be better. I mean, I don't know the details, but you're like, you know, and it happens every two years like Old Faithful. Maybe something's an issue.

[Corey]

Yeah, I mean, go ahead, Ralph.

[Ralph]

Oh, no, I was just gonna say that it looked like there was a. It was a malicious file disguised as a customer screenshot, which contained a dot file, which is a Windows screensaver file.

[Corey]

Right, I see. So it was a zip file. They were saying, I'm sending you a zip with the images. The image was a screensaver. The person didn't know. They just opened the file. Basically. If you're a red team reading this, go try this this week. We're gonna do. I'm gonna. I'm literally gonna try this this week. Like, find a support chat for one of your targets. You know, say you're having issues with the product. Send them a zip file with a payload in it. Like, what's the worst case scenario? It doesn't work. Like, it takes you 15 minutes to throw that together.

[Tim Medine]

Well, it's funny because that's the same payload we've been using for years too. Right?

[Corey]

Zip with an EXE in it. Yeah. Or zip with an scr. Or zip with a zip. Yeah. I mean, it really will only work with, like, you know, if they have security tool issues. Right. Like, you know, but it's a cool attack. I mean, I agree with you, Tim, though I think honestly, my take on this is like, oh, all they wanted was EVs. Like, it's easy to get EVs. They like, that's, you know, I mean, I guess I feel like I'm shocked they aren't stealing these from other companies. I do think the EV certificates, but they. The EVs require like an RDP with a token.

[Wade Wells]

Right.

[Corey]

Like, it actually has to be a hard. A physical device.

[Ralph]

They have a physical device requirement for those.

[Tim Medine]

Yeah. But I don't know if that's necessarily like the others are. We just haven't been heard and reported. Like, there could be somebody in. Right. Right now. We don't know. Or they're silently revoking them, like, to some degree. Even though it keeps happening to ditches, hurt Good for them for telling us.

[Corey]

Yeah, I agree. And I also think honestly, like the certificate, the way that the, the certificates really get used isn't. It's not like that important from like, there's not a lot of. I mean definitely certificates have to be valid, but there's no EDR that's like, oh, you have an EV certificate, do whatever you want, right? Like, that's not, that's not the reality. Right. Like EDRs still monitor. They still, it's like trust but verify, right? Like you might. And from our perspective, like talking to the payload engineers here, the EVs and code signing certificates, all they help you with is landing on disk. They help you with detection. Like the, you know, we call them whack attacks. Like the, you know, basically like AMZ scans of files that kind of tell you whether the file is malicious, but once the program executes, it doesn't matter. I don't care what sort of badge you walked in with that I let you in the door now that you're running, you know, kerberosing attacks or whatever, I'm going to nuke you. Right. Like it's not, it's behavioral more than it is just like, oh, you're signed. All right, you're good. But yeah, anyway, you can move on. There's. We can do a couple quick hits and I mean, I don't know if this is mythos stuff or if it's, you know, LLM, whatever it is, but there's a lot of vulnerabilities. There's the apparently in the wild exploitation of MoveIt servers again reminds you like it's, you know, taking us back a couple years to the previous move it stuff. It looks like the CVEs are. There's no public proof of concepts and they have patched. So basically if you have MoveIt servers, please patch them. 20, 26 CVEs for MoveIt. Turns out where there's smoke, there's fire. Who would have thought if a SaaS product is vulnerable, it probably has a lot more vulnerabilities that are undiscovered. It's kind of just the name of the game. And I think like the theme this year is going to be more and more and more of just like once one vulnerability comes for a product, it's going to start like that's where the floodgates open up.

[Ralph]

And then I always love it when people like Fortinet write a blog post about someone else's zero day. I'm like, man, must be nice.

[Corey]

Yeah, look somewhere else. Basically

[Wade Wells]

that would be, that would imagine. Imagine you were a company, you just held on to like a gnarly zero day. Not to exploit it, but the moment you get a zero day you release that you found this other one as a squirrel tactic. Yeah, like yeah, we had a breach. Chuck out this gnarly zero day.

[Corey]

Well, so speaking maybe that's happening because there's a bunch of other zero days. There's a cPanel off bypass that's hot and spicy. A lot of our customers have cPanel, but not like intentionally like really. Okay, so here's a super common scenario. A customer has a website that some marketing team bought five years ago. They just hired GoDaddy or some other company to host it and it has an exposed cPanel. So we don't typically go after them because we don't want to pop GoDaddy infrastructure. Like we don't care. It's. It's like it's the equivalent of like oh, we tore down the poster that had your guys name on it. Right. But like it's not, you know, it is still like it's in their risks portfolio.

[Wade Wells]

Right.

[Corey]

Like it is like infrastructure they technically own. There could be LDAP integrations or you know, passwords that are reused or things like that. But yeah, these, I mean cpanels seems like very widely used but mostly in like the hosting. Not in really an enterprise, more in like

[Wade Wells]

when I worked at a data center this was like one of the primary things we set up with cPanel servers for people. So it was just. Yeah, I don't know how many times I've seen these popped and as well set these up.

[Tim Medine]

Yeah, just a marketing brochure Size with the cow was referring to my guess of web servers. Like we're just going to set this up, throw some marketing crap on it and everyone's going to forget that we have it in six months. Right. And then what's on it?

[Ralph]

We, we've kind of moved. I mean for modern single page web apps and stuff like that. I mean you don't need cPanel or anything like that to host these. Right. Like there's tons of ways to essentially host. And I'm going to use, I'm going to use this word very hardened servers. Right. There's nothing to like actually compromise from an under like you, you're, you're. The app doesn't have the functionality to really compromise in the way where you have to put the cPanel on top of it and all these other management things that have underlying OS and when you just want the website to load and these things.

[Corey]

Are you telling me that this whole time I could have just been using SQL instead of installing php, my admin? Yeah, I mean, dude, like you're not wrong. But also like in the context of like paid hosting, it's about ease of use.

[Ralph]

It's also about the history, right? So like the like how things were and then how things are now and a lot of times that website that was made, I don't know, five, six years ago, it's still good enough and so nobody's gonna like update it to the latest thing, right?

[Wade Wells]

So yeah, my HOA has a really shitty website and they've been talking about upgrading to a full. No, I have no clue what is. I, I haven't deep dived like, I haven't o. Sented it, which I've thought.

[Corey]

Yeah.

[Wade Wells]

But I heard rumor that they were going to start paying some third party service to host the website and then do a bunch of other stuff and I'm like, dude, I don't want my dues to go up. I'm like, I literally told Claude to scrape our website and then throw me up a new, brand new version of it that looks really good. And then I sent it to the HOA president. I'm like, hey, here's a free website, I'll host it for you. Just point your DNS at this GitHub repo.

[Ralph]

Yeah, yeah.

[Corey]

I mean dude, like you're not wrong. I think this is a good time to bring up the fact this, this podcast is sponsored by Squarespace. We, we actually, you really, we do have a lot for you to patch upgrade right now. Yeah.

[Ralph]

If, if you are ever looking to build a website, something like Cloud Flare can do that. Cloudflare. Yeah, it's, it's, it's.

[Corey]

It's.

[Ralph]

You know, it's not. I, I want to use the word unhackable. It's.

[Tim Medine]

That's.

[Ralph]

But there's nothing to hack, right? So to. That's also a free.

[Wade Wells]

Why do, why do Cloudflare when you can just do like one of the Pages website, either GitLab or GitHub.

[Ralph]

Yeah, you just, you can do those.

[Corey]

Yeah,

[Ralph]

yeah, yeah.

[Wade Wells]

Nothing too hack.

[Corey]

I mean you're not going to get a dynamic website where you can buy stuff, right? Like, yeah, I mean, I guess you could, but you can. I'm just saying most people need that.

[Ralph]

Most people just have an informational website like that is like the market share and that. Honestly, going back to this vulnerability and going back to the security around it. Right. That is the market share that's using cPanel, right?

[Corey]

Yes. And I, I have bad news for you. If you're, if you're using cPanel to host one of your websites, or if you don't know that you're not using cPanel, you're about to be advertising all kinds of weird products on your websites.

[Wade Wells]

I rather, I rather cPanel than WordPress. I will say that.

[Corey]

Oh yeah, dude, if you, if you think that if I buy a company that gives me a website that I'm not getting both cPanel and WordPress at the same time. Exactly. And that's getting both, dude.

[Patrick Gorman]

And that's the thing now because like hostgator, that's what I use, you know, for, for a website and I use both of them and I literally just changed it a week and a half ago. So like, when this came about, I was like, holy moly. It's like, you know, Evan Gates, let's get off of this. And exactly what I did was, what you said was, you know, was put in, put the code in GitHub and just push it out to, to Cloudflare and just manage everything for there. So it's like super, super easy. And like, I don't want to say it's unhackable. Like you said, I don't want to put anyone in a test.

[Ralph]

Yeah.

[Patrick Gorman]

Try to hack my shit, you know, but yeah, yeah, but the thing is,

[Tim Medine]

I think for you guys that's really easy. Right? Like, but trying to get a marketing team, like a marketing team has two options. They got go to it and get a web server or go buy something. And they're like, well, definitely we're not dealing with it. We're going to go buy something. Right. And what can they configure? They're not going to set up a git repo. Hell, I don't understand the git commands. I have to Google those like half the freaking time.

[Ralph]

Right?

[Tim Medine]

And so they're going to get the easiest thing for them that they're going to set it up. It's a brochure website. It's going to live for freaking ever.

[Corey]

And yeah, I mean, honestly, I think, you know, a lot of industries are dominated by marketing and not by like the actual, you know, product itself. And websites and hosting are that category of like, when you go, if you're just Googling like how to set up a website set up, like you're going to get bombarded with a bunch of ads from a bunch of hosting providers, all of which are selling a very similar product but also very slightly different. And security is never really like, like the top billing feature. It's always like, you know, 79, 7, 99amonth or you know, whatever other thing is out there.

[Tim Medine]

So easy, easy, easy to set up your own website. Like that's the big selling point.

[Corey]

Like it really don't know how to do this.

[Tim Medine]

They're not going to do htm, HTML or CSS or God forbid, JavaScript.

[Corey]

No, absolutely not. But Claude will do it for me because I don't.

[Ralph]

Dude.

[Tim Medine]

Oh, did I just freeze all the JavaScript you want?

[Wade Wells]

Tim? Tim froze. It's okay, we can still hear you.

[Corey]

He got curb roasted. Oh, I had. That entire left wing of the building has gone down.

[Ralph]

You just gotta turn the camera off, turn it back on.

[Corey]

So I think that's all the vulnerabilities. Oh no, there was also Qlik copy fail. That was the figure.

[Patrick Gorman]

That's a good one.

[Corey]

One. Yeah, I mean, yeah, I mean it's a big, it's definitely a big one, but also like, I don't know, patch, you know, like there's already a patch.

[Ralph]

You're not excited, you're not excited about Privesque on Linux?

[Corey]

Is that what you're trying? No, I like Privesque. I just feel like every time I pop a Linux box, it's just in some stupid cloud provider by itself and it's the most boring thing ever. And it just gives me, it just makes me sad. It's like, oh, I got all this access, I privest and then I got.

[Ralph]

Just for context, every time I've ever been on a Linux box, I've been able to privilege escalate and because there's

[Corey]

always one way or another.

[Ralph]

Yeah, there's always one way or another. And it, it's, it's kind of. It's not a guarantee, but it is a very often attack path. Most of the time you're on these hosts, they're, they're outdated. Right. And it doesn't take. You know, the other thing about this particular vulnerability is that to patch it, you do have to patch the kernel. And a lot of releases or a lot of the maintainers for the different distributions were just releasing the new updates for the kernel. But you also have to reboot the host to get the kernel in there. A lot of these devices are getting rebooted. So even if they do have an automatic update, unattended upgrade, unattended update, they won't reboot to get the kernel in there, so. But anyways, yeah, I kind of agree with you, Corey. Usually it's unexciting when you get to privilege escalate. Once you actually have that, you know, SSH access or terminal access, you're. You're kind of already on the way there. So this being out in the wild isn't, you know, the end all be all. Yeah.

[Patrick Gorman]

It's cool, though.

[Corey]

I mean, it's insanely, like, insanely easy. Yeah, insanely easy. This is the, you know, no memory corruption, no race conditions, no offsets page, cash rights. Like, it's all just like, here. It's like Dirty Cow or whatever from back in the day.

[Ralph]

Oh, yeah, that was another one too.

[Corey]

Yeah, just running.

[Tim Medine]

I'm surprised. I'm surprised we didn't get a cool logo for this thing. Like, what the hell? This was actually a big deal. It's warrants a cool logo, and it didn't get one.

[Corey]

That's a good point. You know what? Let's. We bring back cool logos. Okay? Dirty Cow is a great example. And there was, like, a whole bunch of other cows that came out.

[Tim Medine]

Great one.

[Patrick Gorman]

Yeah.

[Wade Wells]

It's been a while.

[Corey]

It's been a while. Heartbleed.

[Wade Wells]

Oh, yeah.

[Corey]

Heartbleed was good.

[Ralph]

Heart bleed. The most worthless vulnerability ever, bro.

[Tim Medine]

No, no, no. There was a sample one, like, a year or two later where they hiked it up like crazy, and it was the most nothing of burgers of all time.

[Corey]

And that's why this one didn't get a fancy name, because they didn't want to overhype it.

[Tim Medine]

I love that name. I think it's great. I like the subtle, the simple simplicity.

[Corey]

Yeah. All right, so otherwise, I mean, there's. There's some AI stuff happening. There's some drama where apparently a guy that is a founder of a company called pocketos took to Twitter and complained about how it deleted all of his stuff.

[Wade Wells]

Oh, I saw that.

[Ralph]

Yeah.

[Patrick Gorman]

I haven't seen that.

[Corey]

Deleted the entire production database.

[Ralph]

Why didn't you have a backup?

[Corey]

Honestly, like, okay, what I want. What I want is I want, like, a deep dive from a technical perspective, from one of the companies, like Cursor or from Anthropic. That's like, here's why you're dumb. Right? Like, I don't know that. Like, I could be wrong. Maybe that's a false allegation. Like, maybe this is just gonna happen. And I will say I sit around vibe coding everything, and I'm just like, it is. Sure. I sure hope nothing goes wrong with this. Right? Like, you know, I really hope that, you know, it doesn't just decide to nuke my entire database. But I think.

[Tim Medine]

I mean, this gets into, like, the. The. I think Asimov type thing. Like, hey, we told it to secure the data. It's like, well, the best way to secure the data is delete it.

[Ralph]

All right.

[Tim Medine]

Like, when you're like, logically, I see how you got here. Like, I kind of love it in that sense.

[Ralph]

Huh.

[Corey]

Yeah. So, like, what does. Has anyone read up on this? Like, does anyone have a real. Like, basically, I don't. I. Does this feel real to anyone here?

[Ralph]

Like, 10 times, like, from other things. So what makes this one special? I guess I am. Stuff.

[Tim Medine]

I am not convinced. I. Maybe it's conspiracy theory, but I feel like the dude accidentally deleted it and he's blaming AI.

[Patrick Gorman]

Yeah, that's what I was.

[Tim Medine]

That's what. Look, if I accidentally deleted the whole freaking thing, I'm

[Corey]

rf his own database.

[Ralph]

And he was like, AI Definitely. Definitely. I trolling.

[Corey]

Okay. So I don't know. Like, the quote that he gives from the AI is in. Is completely unhinged. Does he have his AI running, like, renegade destroyer mode? Like, dude, optimist, AI is swearing at him.

[Tim Medine]

You know, I guess that it confesses afterwards. The. I violated every principle. I was given, like, a robot modulator. I guess instead of verifying, I ran into certain action without being asked. I didn't understand what I was doing before I was doing it. Like, that's. That's how. Like, if the boss man came to me, like, why did you do something stupid? I would.

[Corey]

Plan mode. Right, bro, it. Use plan mode. It's okay, man. Like, you don't have to live like this. I mean, I don't know. Live like this. I will say, like, yeah, I mean, really, I. I truly don't know. I mean, obviously, I'm assuming they have backups, hopefully, right? Like, come on.

[Ralph]

It probably doesn't if they're.

[Wade Wells]

Oh, and all backups.

[Patrick Gorman]

Yeah.

[Wade Wells]

Deleted the backups.

[Corey]

Well, why would you give the AI access to the backup?

[Wade Wells]

Because he pressed the do dangerous stuff button. And then.

[Corey]

You know how hard to think.

[Tim Medine]

John's class.

[Ralph]

This is bull crap. You know how hard it is to get it to go off into, like, delete those other systems and run these commands. It's a pain in the butt, dude.

[Corey]

I agree.

[Wade Wells]

I'm gonna tell you what this guy did. I know. Exactly. So, okay, they bought a company. They only bought things that had MCP servers already attached.

[Corey]

That people just do it, right?

[Wade Wells]

And then he just, like, MCP'd all the things. O often do it right. Oauth just takes whatever rights he has already.

[Ralph]

Yeah.

[Wade Wells]

So therefore the AI has God mode on whatever he owed to. And it's just like, you know what? You don't need backup. You know what, you don't need this.

[Corey]

And then

[Tim Medine]

can we also talk about the like. According to the article, the live science one that's quoted here, it deleted with a single call to the cloud provider's API. Why does that API exist? Like, why is there like a one?

[Corey]

Like, was this, like a, was this FBI?

[Ralph]

FBI's knocking on the door. We got to get out of this, right?

[Corey]

FBI open up/API/ FBI/, open up.

[Tim Medine]

Like that should be a sale. That should be a feature. Not for a technical reason, but for like a monetization reason. Like you need people to jump through multiple hoops before they stop giving me money. Right? Like you type in the. The. The this GUID here so you can actually cancel. Like, wow.

[Corey]

I don't know. I think this is like the perfect antidote. Taste y is the perfect antidote to all the all other startup founders who are posting on AI about how much they're using tokens and claude and how they're crushing AI. This is the antidote. This is the anti version of that. It's like, don't. This is like cautionary tale. Like, you know, back to basics. We've talked about this so much and we're going to continue. This is the theme for this week is like have separated isolated backups. Don't have, you know, don't oauth with your God admin account. Like, what, what changes are you making? Are you making changes to the backup system? Probably not. Don't have a token that can edit that. Use revision tracking or even when it comes to using an AI model, use like plan mode. Like literally just hit shift tab and claude code a couple times until it says plan mode on. And then if it says my plan is to delete the entire database and all the backups, you just say control C. Don't do that. Make sure. Yeah, read the plan. There's add ons to read the plan. You know, there's Planetator and all these other ads. Like, I don't know, it's just crazy to me. And also the other crazy part is going on Twitter about it. That's the other thing is being like, you know what I'll do? I can make this situation. Yeah, right.

[Wade Wells]

Like we're talking about it now. Everyone's out there using Pocket OS Right. No, they're not.

[Corey]

They're not. Also I'm very confused because it says Pocket OS, but then it's. The company is actually a SaaS product for what is it buying cars or something?

[Ralph]

Like, what is that? World's most powerful car software.

[Tim Medine]

Yeah, yeah, Maybe the guy was just like, I want to quit and I want to go down. I don't want to just quit. Like, I want to. I want to be done with it. News story, be kind of cool. But now I got a reason to like do something else.

[Corey]

If I just search the Internet for cl, Pocket os, all I see, the only results are just stories about him deleting this entire.

[Ralph]

Maybe it's just viral marketing. Maybe literally it's just viral marketing. It's all bull crap. And now everyone's talking about this.

[Corey]

I feel like it's viral marketing. I also feel like it could just be a psyop. Like the whole thing is invented. Like Pocket OS is then a real company and they just invented this company. Like, I don't know, like, designed for car rental companies.

[Tim Medine]

There's any worse companies out there than car rental companies? Sorry.

[Corey]

Yeah.

[Wade Wells]

It's like, why do they take so long every time and never give me the car I asked for? It's always the hugest one they have and I have to spend so much in gas. It's ridiculous.

[Corey]

I mean, I mean, I'm gonna, I'm gonna have Claude read all these blog posts and then make fun of the person just for funsies.

[Ralph]

You're gonna have Claude read the post made by Claude. This is a conception.

[Corey]

Don't, don't, don't do this. Basically. I mean, I will say this is like the second time in six months that we've talked about a duplicate article that like, it's the exact same scenario of, you know, oh, someone, someone did something and then their AI deleted everything. It's like, well, what did you do? Like walk me step by step through how you got here. But yeah, anyway, still a funny article, still worth a read. What else is going on? Elon is testifying in court right now about throwing money to each other. Yeah. So this is kind of, you know, this is going to be an ongoing theme on this podcast is talking about this lawsuit because it's going to be juicy, but essentially OpenAI and XAI are, you know, in court right now. Elon Musk is a major investor in OpenAI and is basically suing them because he says they violated their directive to be a non profit because they're not a non profit. The interesting thing that kind of came out, the TechCrunch article from today is that he admitted in court that he basically that Xai is distilling OpenAI models and kind of implied that like, distillation is like the business of AI, which I feel like kind of fundamentally goes against a lot of the sort of like, understandings that we have about AI. I mean, I don't know, but I feel like distillation is a major attack on an AI. If you can successfully distill a model that's like basically as deep as you can go into attacking the model. Right. So saying it's just like, oh, we all do it, it's fine. It's just a bunch of boys distilling each other's OpenAI models. Is that true? Does anyone know if that's actually true? I don't think it's true. Just.

[Wade Wells]

Are you surprised XAI does it, like out of all the AIs? That would be.

[Ralph]

I mean, I'm surprised. I don't know where they get that nasty attitude from those other AIs.

[Corey]

I also thought it was pretty funny that after he. This whole lawsuit exists, in my opinion, because he's. It's competition, right? Like, he doesn't want.

[Ralph]

He doesn't want. Yeah, he wants them to be out of the race, right?

[Corey]

Yeah, so. But also the funniest part is in this article and later in his testimony, he ranked all the AI companies and he didn't even put himself at the top.

[Ralph]

That's.

[Corey]

He was. He. He ranked AI providers, saying Anthropic holds the top spot, followed by OpenAI, Google and Chinese open source models. He said XAI is a much smaller company with just a few hundred employees.

[Ralph]

So maybe he wanted to look like the underdog in court. Right?

[Patrick Gorman]

Yeah, that's Good point.

[Tim Medine]

Good point.

[Corey]

Elon Musk the underdog.

[Ralph]

Yeah.

[Corey]

Makes perfect sense.

[Ralph]

Yeah. Well, I mean, it is what it is. It is. It is going to be funny though, because it's probably going to. All the discovery that's going to come out of this is going to be like the stupidest, silliest crap ever, you know?

[Corey]

Yeah.

[Tim Medine]

Well, the thing I find it hilarious about this is this is like the Inception thing, like all the AI models trained on publicly available, not public information, but like all the IP that, that people have that's available, but definitely not given away a bowl or whatever. And then you're like, we trained on your model. And you're like, yeah, but you also. Can we daisy chain this back to like, we're just taking Other people's stuff and reusing that, like.

[Ralph]

Oh, yeah.

[Tim Medine]

Or either. Either it's. Either it's all good or it's none good. Like, you can't have it in between.

[Corey]

Right? Yeah, I mean, I. Yeah, I mean, I think it's a money thing. I mean, John's take is like, that this. There's nothing in the world of AI that's actually patentable. And so it's going to be a race to the bottom when it comes to, like, cost and capabilities of, like, who can do the thing the fastest and the easiest. Like, there's not. There's no secret tech. There's no, like, secret recipe or whatever. It's just like everyone's using the same papers, building the same.

[Tim Medine]

And we've all complained about, like, the. The. The copyrights or the trademarks or copyrights for some of the code stuff or. No, I guess the patents, rather code patents. And you're like, this feels like one of those. And I always hated them, and I

[Ralph]

still kind of hate it.

[Tim Medine]

Like, yeah, compete. Make it. Make it better. Like, don't, Don't. Don't prevent somebody from competing. Like, actually compete.

[Corey]

Yeah. And I think that's kind of where the space is, to be honest. Obviously, this lawsuit notwithstanding that is. Tends to be how the market operates is pretty freely.

[Tim Medine]

I wonder if they benchmark these AI by. Who could delete data faster?

[Ralph]

Ooh,

[Wade Wells]

they haven't. They need to. Someone.

[Corey]

Someone make that. That.

[Wade Wells]

That. It's a new defcon. That new DEFCON ctf. How. How fast can your. Yeah. Delete things?

[Ralph]

They have all the benchmarks for, like, how good it is or how good it is at math or whatever. How good is it at deleting your data on an uncoverable, unrecoverable.

[Wade Wells]

I felt. I feel like we're going down a slippery hole right now when we start making deletion AI.

[Ralph]

All right, all right. The best ransomware model, then. All right, sorry.

[Corey]

I also just love that, like, the term distillation, because I just imagine some person Googling, like, how to distill, and they're just like, I don't want to make whiskey or gin. I want to make an AI model, guys.

[Ralph]

Oh, gosh.

[Wade Wells]

Yeah.

[Corey]

I mean, anyway, this. You know, stay tuned to this podcast for more updates on that lawsuit. I'm sure it'll just continue to be super. You know, everyone's going to be rational. No one's going to throw any mud or anything like that. It'll be absolutely reasonable.

[Ralph]

Yeah, yeah, normal.

[Corey]

So an interesting little thing happened In Utah, which is basically. Utah has passed and enacted a law that goes into effect in two days. And that law basically holds websites liable for users with VPNs, basically. So Utah and many other US states have banned like, you know, access from someone who's not 18. Right. So this is like, it's a porn thing, it's the KYC thing. There's a bunch of reasons for this, but basically Utah has passed a law that essentially holds websites accountable if someone's using a VPN to access it, who actually lives in Utah. So basically the scenario is I'm, you know, a website. Someone goes to my website, it's now my duty to verify whether they're using a VPN and also whether they live in Utah, which is like from. Obviously all of us with any technical knowledge are. Red flags are going up because it's fundamentally impossible. Challenging at best, fundamentally impossible at worst. Who pays for this? What'd you say?

[Ralph]

I'd say who pays for this?

[Corey]

Yeah, well, that. Okay. So exactly. There's a lot of. First of all, from a technical perspective, it's not really possible. How are you going to backwards trace a user from whatever visits your website all the way back to where they live? Like, it's basically impossible.

[Tim Medine]

But I think we might end up is we get 50,000 different prompts going forward. It's like, do you want to use cookies? Are you from Utah? Like,

[Ralph]

are you from this town or that town? What about this town?

[Corey]

Yeah, I mean, honestly, I don't basically. And if you're wondering how a website, one of these websites, you basically have two choices right now. One is take this risk, right? Like to actually, you know, basically taking the risk of just hoping that you don't get sued if someone comes and says, hey, a VPN user bought some knife or I don't know what, I don't really know what the use case is for these blocks.

[Ralph]

I think it's mostly proved it was a vpn.

[Corey]

Kids. Yeah, it saved the kids, right? It's for porn.

[Wade Wells]

The aliens are not going to be in Utah for sure.

[Corey]

So yeah, so basically, yeah, the aliens are. The aliens are like, nah, we went straight to California. But basically, as a website provider, you can either block all VPN IPs, which by the way is also extremely difficult. And that's kind of the. That's what everyone's assuming is going to happen. Everyone's assuming that this basically is trying to strong arm websites into banning VPN IPs, which technologically is kind of challenging to begin with. But let's say you could do it. Nothing's to stop someone like us from spinning up our own VPS and using it as a vpn. But regular old users will not be allowed or able to do that. Right? So basically puts, then the onus goes, it's like cat and mouse. Because then the onus goes on VPN providers to try to bypass that detection because otherwise their product is pointless.

[Ralph]

And I mean China, China's done this with the great firewall, right? But they still get out, right? And this is way more of a whole country technical limitation put into place. And you can still get through the great firewall and access that content. And there's ways, tons of different ways and in fact they've even developed better technology to do it because of it. It's like you essentially, you created this race where now there's even better ways to get through that are beyond a VPN that blend in with traffic and look more legitimate and all these other fun stuff. So yeah, you created a monster.

[Corey]

I just can't. I don't see where this ends up.

[Wade Wells]

Like, have you guys ever tried to log into something and it says you're on a VPN and you're not and then it blocks you? Right? Like I'm just imagining that happening.

[Corey]

I've never had that.

[Wade Wells]

Rest of my life I've never had that.

[Corey]

I have had my home IP get blocked from some websites because I'm a pen tester, right?

[Ralph]

Like I've had.

[Corey]

That makes sense. I've gotten rate Ltd. On GitHub because I forgot to, you know, do whatever and there's like a search, global search limit or you know, things like that have happened to me, but I've never had the opposite happen where I'm actually using my home ip and it, you know, it, it tells me that I'm on a vpn.

[Wade Wells]

There's. I forget which service it was. It's like you're on a vpn, please get off the vpn. And I'm like. And it was just like it was a login to something in particular and all I had to reset my modem to drop the IP I was on because it was a rotated IP, I'm guessing from some bad list that had VPNs on it, right? VPN services re. VPN services don't keep the IPs forever.

[Corey]

Yeah. So how are they going to prove this?

[Ralph]

How are they going to prove. So what's the scenario? Right, Someone from Utah uses a vpn.

[Wade Wells]

How.

[Ralph]

How do they prove that they use the VPN to get them arrested, to do whatever the, the punishment is for this.

[Wade Wells]

Well, what if I just. Just not, not host anything in the US Anymore and just do some type of legal loophole where everything's posted in bay.

[Tim Medine]

Exactly. But you don't.

[Corey]

But you don't.

[Tim Medine]

But you don't know that either. Oh, I was just saying you actually hosted.

[Corey]

Well, no. So, okay, so here's, here's the problem from the website. Like, from the website's perspective, there is no way to mitigate this risk. Like fundamentally all you can do is basically as a website, say we're blocking VPNs or we're trying to block VPNs. Hopefully that's good enough. Because I think the scenario here is you're, let's say you're, you know, Utah state prosecutor, some kid looked at big boobs online and now you're prosecuting him for it. Like you basically have the crime, then you backwards go through the website and say you violated this. Now you're shut down. Like.

[Ralph]

Yeah.

[Corey]

So from, from a legal standpoint, they

[Ralph]

would have to, they have to. A crime has to occur before they can go subpoena this information to find out if you were part of the crime. So you, like, like this becomes like a big thing where something bad has to happen first before you can then use this thing. But then the, the VPNs gonna be like, we have no logs and.

[Corey]

Yeah, yes, correct. And the website also, like the temporal element is so messed up if you think about it like, well, when. What, What IP did they use when? Like, I think it's like, I mean, if we're being honest, how it's actually going to go is the second that courts get their hands on this, they're going to be like, no. What? Like you can't.

[Tim Medine]

Would it be ironic if this actually had the opposite effect in actually making it easier in. In Utah? Because now if I come from Texas, it'd be like, well, wait, are you actually coming from Utah? You're trying to bypass this.

[Ralph]

What?

[Tim Medine]

Meanwhile you come from Utah and it's like, yeah, fair enough. You can do. You can definitely get in. Like, yeah, the porn here's like, you know, Utah pornhub. Like that one just works, right?

[Corey]

Yeah, like, maybe. I mean, that's a good point. I mean also this, we're not the first to do this. The UK is actually banning VPN use for anyone under the age of 18, which is hilarious. Like, how do you.

[Wade Wells]

They have ads for Mulvad in. In their subways up. Huge ones. On the wall.

[Corey]

Like, yeah, but literally, to be fair, there's ads for dispensaries where I live and you can't go, yeah, you know, you know, like there, there's so to get a BP.

[Wade Wells]

How many other ads for VPNs though do you see in like public spaces though? Like never.

[Corey]

True, true. And the reason they have the ads is because they know that everyone wants one because of their, all their bans on all the stuff. I don't know, I think it's inherently, I mean it's basically surveillance state and this is the save the kids angle that, that's like, I think the dystopian way to look at it is like this is just the thin end of the wedge for like, oh, we're allowed to pass this law because Save the kids.

[Ralph]

Yeah.

[Corey]

Oh, and then by the way, also we're banning looking at websites that say that, you know, Tiananmen Square massacre never happened or, you know what I mean? Like, yeah, where does the free speech

[Ralph]

start to get into it? Right. Yeah.

[Wade Wells]

It feels like we're going into the ender's game. We've said this before, the ender's game, like two Internet thing where you have like your government Internet where you log into it with your id and then there's like the secret Internet where nobody really no one, that's everyone, just for everyone.

[Corey]

Right.

[Wade Wells]

I, I still think that's going to happen, especially with all the laws based around social media nowadays, like in Australia and that's going on, eventually they're going to crack us down and it's not going to be what to really, to

[Corey]

actually like to actually implement this on a technical level. None of this math maths on the Internet, like the Internet isn't set up to handle any of this. We're migrating to IPv6, even IPv6, even deep packet inspection, like all the layers you can put on it. It doesn't fundamentally support these kinds of censorship and controls. And so like it basically comes into this. Where is there going to be a point where those sorts of controls are implemented on Internet protocols? Like, is there going to be like a censorship enabled Internet?

[Wade Wells]

IPv8 just came out, right? Does it have a censorship packet in it?

[Corey]

A censorship packet? Dude, is porn true or false? Like that's like a fly on the packet level.

[Ralph]

I just feel like China has already went down this road and at a much higher level and that's still not, you know, a full force. It's not, you know, doing what they think. And, and, and even more importantly, Though this is just the state and as it expands out into the federal government, which is, you know, whether there's an actual like general rule around this and it really, it really, really stems it with just age verification is what we're

[Corey]

really trying to get out here. More kyc age verification. Yeah, yeah.

[Ralph]

And then just like suddenly I feel like it kind of popped out of nowhere. Everyone was just like, you know what? The Internet needs more age verification. This is over, you know, I don't know.

[Corey]

Well, it's. I again, I think it really is the thin end of the wedge for surveillance and this is just a way to throw through all these policies and laws that can be abused.

[Wade Wells]

I think it is, I think you're right. But it's also, it is also like the negative effect that social media has played around with the entire world. Right. Like, you realize maybe access, access to an entire global media sphere of all knowledge probably isn't the best for human.

[Corey]

Well, what if they're not talking social media, by the way, which is harmful. Yeah. Like.

[Tim Medine]

Yeah, yeah, but what if we get to the point where they're like, there was a. And I'm sure there's a cryptographic way to do this. I just not smart enough to even lay it out but like to like I am over 18, I live in Texas and have in an anonymized way to authenticate to this thing. Right.

[Corey]

Talking about like a national identity system.

[Tim Medine]

Yeah, yeah, well, yeah, yeah, but, but, but a way to communicate on the Internet. But to prove I'm over 18 or.

[Corey]

Yeah, it's like a private key token

[Tim Medine]

of someone who's over 18.

[Ralph]

You could totally do this. The Internet's just not. We just didn't design that in the beginning. Right. Like we'd have to bolt it on, but you totally could. But you'd have to totally get essentially a federal law to build that system. Right. That's the way you bring it all the states. Because every state's going to be like, screw you, we're not doing that. And the other states, like, we're independent because we're technically all independent states in one, whatever, you know?

[Corey]

Well, there's also so many technical hurdles. Like as an example, like is it device bound? Okay, well, what if you hand your kid to your. Or your phone to your kid? Is it, is it IP bound? Because what if you have 50 computers at your house? Like there's no way to do it.

[Ralph]

Well, hold on. So I mean, one thought again, there could be holes in this thought maybe like just using your state Issued driver's license or other kind of, you know. Sure.

[Corey]

But the point is, how does that get checked on a technical level? Like, if it's device bound, there's all kinds of. I mean, honestly, like a common access

[Ralph]

card or whatever from the actual license that you put into a system and then that checks. And then all you're doing is sending the facts that you are from this state and at this age. And that gets authenticated. And all it does is essentially the way we do everything else. When I prove how that I own my house, they don't go ask me, they go ask the state if I actually own the house. Then we prove that system. Right. But how much information gets exchanged, I think is what Tim was bringing.

[Tim Medine]

Yeah. My point is like, you know, some of the places you definitely don't want to go with your real name. Right? Like, sure. What's the bare minimum? Why do you need to prove. So I can get access. But then at the same time.

[Ralph]

Right.

[Corey]

It's basically exactly what Wade's talking about, which is that Internet is like the government Internet. And then like everything else is like just the wild west.

[Tim Medine]

And everybody's like, guarantee and you get really nasty stuff with no laws and it's a free for all. Right.

[Wade Wells]

People would be nicer. Right. Like, it's. Once you get behind. I can't even say anonymity. There it goes. Everyone's an asshole. But like, it's.

[Corey]

Dude, people are willing. Have you ever seen. Like, I basically. Okay, so here's a. Here's like another way to think about this. And this actually kind of ties in with another article we have, which is. I don't really know how we ended up with this, but someone posted this. It's essentially like why you should refuse to let your doctor record you. And it's essentially a long sort of article about privacy and medicine and why you shouldn't let your doctor record and transcribe your, you know, your. Your chat with them. And honestly, I kind of take issue with the article because it's kind of, to me, just a fundamentally, like, I don't have that strong of a take on this, but reading the points, it's. It's just a. It's like, here's why technology is bad because it changes things. Like, that's basically the article. And I. I kind of was thinking, reading this medical recording article, I was thinking about body cams and police, and I was thinking about this is the same arguments that you could make for why body cams are bad. Like, it's like well, accountability is bad. It's like, no, it's not. Like, well, like, the doctors are going to act differently if they know they're being recorded. Like, isn't that a good thing? Like, don't. Don't we want the doctor to, like, know they're gonna have to be on record for what they're saying? Like, I don't know.

[Wade Wells]

After I watch the pit, I'm just like, yeah, record me. It's all cool, man. I don't care that much. Like, the government's already on my phone anyway. They know everything.

[Corey]

I mean, don't get me wrong. Sure. Make your own. Make your own decision about this. Like, that's why they're asking. But like, the fundamental articles, the. Or the fundamental reasons the person gives are all just like, technology is bad. Okay, that's fair. Like, yeah, it is. But also, like, there are benefits to technology. Like, they're like, oh, what if you're bilingual? It's like, well, also it can translate for you. Like, you know, like, they're all of the things that you are slanting as a negative. There's also positive effects of that. Right. Like, charting is part of care. Okay, but they can do more care if they don't have to chart. Like, I don't know. I don't have a strong take on it. I have some friends who are doctors, and I'll ask them what they think about it.

[Tim Medine]

Talk to some friends and. And they. They like it. Because there's sometimes, like, if you're gonna look back through someone's stuff, like, we've all done this. Looking just. Just in general looking at an article. You're like, there's like one sentence in here I'm trying to find, and I can't find it. You're like, find me this one quick thing, right? Or, hey, I'm trying to prescribe this. Is there anything that's gonna conflict with this medicine? And you're like, okay, cool. This will. So just some of those things. Like, it's just really easy for them to.

[Corey]

To.

[Tim Medine]

To do. I mean, yes, you're gonna have some extra hands on, but they freaking love it. They use it. He's like, I use it all day, all the time.

[Corey]

Like, I mean, of basically, like, okay, in a perfect world where everyone does their job perfectly, no one's time constrained. No, everyone can. Like, yes, okay, sure, they might be slightly. AI can get confused. The reality is no one is charting perfectly, and AI is going to improve on charting and make it better. And even if it makes mistakes, guess what? People make mistakes too. Like, I don't know it, I think.

[Wade Wells]

Yeah.

[Tim Medine]

And I don't know if it's like the WebMD thing. Like people talk about you put your symptoms at WebMD and you've got like this off the.

[Ralph]

You got cancer actually, right?

[Tim Medine]

No, not even that. Like this weird thing that three people in the world have, right? Yeah, and I'm hoping that. But you also read case after case after case and there's all sorts of biases with, with gender and race and stuff. But like people don't get the service that they need because no one actually looked at it deep enough. You're like, hey, you know what, it's actually this thing. But everyone's just giving you, you take your oxy and go home, you're going to be fine. Meanwhile, they got something that's really nasty and I'm hoping that kind of can help this.

[Corey]

Yeah, I mean privacy is one thing. Like the privacy thing is a whole separate beast though. Like that's again like that, that ship is sailed. And that, that's a technical compliance thing that relates to medicine and like you know, who can access your information. Hipaa, all that stuff is already like in play with all these recordings. Like there, there's, it's the same as if the doctor wrote it down.

[Ralph]

Right.

[Corey]

Maybe there's more risk with third party recordings or whatever being leaked. But you know, the same risk is there with Gen AI too.

[Wade Wells]

Right?

[Corey]

Like of, you know, prompts being leaked or whatever happens. But everyone make your own decision. I just think blanket saying don't do this, it feels a little bit biased, heavily biased. Because all of the things it's, all of the arguments they make are also just fundamentally arguments against any kind of accountability and technology of like yes, there's privacy implications when you're recording things. Correct. Like you could make the same argument for like, here's why no music should ever be recorded, it should always be performed live. Or privacy. Yeah, for privacy. Like what if they want to say something at their concert and not have it be recorded? Like, well that ship sailed because I can sit there with my phone in my pocket and record everything. Like anyway, it's interesting, interesting read. If you agree with it, go for it. But you know, make your own decision. Any other research, any other articles you got? Wade?

[Wade Wells]

The miter attack 1 is semi important for defenders to know where did that one go? I gotta find it.

[Corey]

Defensive Asian split.

[Wade Wells]

Yeah, so pretty much what defensive Asian was a tactic in Miter attack, which is like one of the top ones.

[Corey]

Right.

[Wade Wells]

And Techniques are the ones that go down. So defensive vision has split into. What was it? Stealth.

[Ralph]

And

[Wade Wells]

I was literally reading the article the whole time we were doing here. Now I forget. Stealth and defense impairment instead of defense invasion, which makes sense because, like, defense impairment, right, is like turning off security things, making sure logging doesn't do anything incorrectly, that type of stuff, where there used to be a single type of technique for that. So them splitting it up makes a lot of sense. Social engineering goes under stealth.

[Corey]

Right?

[Wade Wells]

What this means for all you defenders is you're gonna have to remap all your MITRE attack IDs and redo all your tagging. So that's great. There's an Excel spreadsheet on their website for it. And just point your. All your detections at Claude and that Excel spreadsheet and you should be good to go. Yeah, I'll probably write something Python later tomorrow for it.

[Ralph]

Bros. Python. You could do better than that.

[Wade Wells]

That's. That's my language.

[Corey]

I haven't.

[Wade Wells]

I haven't. I don't have to do anything else anymore. Like, I feel like, what am I gonna do?

[Ralph]

Yeah, write it in anything. Because you're not writing it anyways. You just told Claude that he was gonna do it.

[Corey]

I will say Python.

[Wade Wells]

I have to keep my. Dude, I'm already feeling my talent slightly slip away from me as.

[Ralph]

Oh, you just want to feel in control.

[Corey]

All right.

[Wade Wells]

I have to at least a little bit to show that I have the.

[Ralph]

Just run it in Golang and. And you'll be fine.

[Corey]

Yeah, Golang or Rust. Because the truth is. The truth is, from a programming perspective, there are actual benefits of Golang and Rust that you don't get with Python, like hard types and memory safety and things like that. I already.

[Wade Wells]

I already don't use Notepad plus plus anymore. All right, now you guys are going to take Python away from me too.

[Corey]

Hold on. We're not taking Python away. But what we are saying is if you're going to vibe code it, you might as well vibe code in a language that's built to last longer than 15 minutes.

[Ralph]

All those people, all the people who wrote all the Python stuff in the past, they wrote it because that's what they were comfortable in now. But now you don't have to necessarily be comfortable in that language to drive what you're trying to build. So build using the best language for the job.

[Corey]

There is one article.

[Ralph]

It could be C if I'm writing

[Corey]

it, or C. Okay, writing it for whatever. So, yeah, you're not wrong. But the one argument for writing, for still vibe coding in Python is you could make the argument that that is the language that it knows the, and can use the best and that would not be, that would not be wrong. Like the most information out there is the, is like AI is the best at Python.

[Ralph]

Yeah. But that would also argue it has

[Corey]

the most junk too.

[Ralph]

So it's like the junk, it's like the most like un, well written language.

[Wade Wells]

We just, we just talked about only having to do things that, you know, if I have that thing right in Rust and I can't read Rust, I, I can, I can Vibe.

[Corey]

You'll learn how to read Rust.

[Ralph]

All you're going to do is just

[Wade Wells]

don't want to learn how to read Rust.

[Tim Medine]

Are you, are you serious?

[Corey]

You're ask it. Yeah, seriously implying that you're gonna line by line go through a 10,000 line Python program.

[Wade Wells]

I'm not writing anything. I'm like 100, like 90% of my scripts are like a hundred lines at the most. I will run through them.

[Ralph]

I know, I know how to write and like a bash script. Right. And the scripts that I've gotten Claude to write, I, I, it's above me, it's gone. Like there's there. Like I couldn't have written that if I wanted to. Now do I understand kind of functionally how it works?

[Corey]

Sure.

[Ralph]

But could I have written that? No, not without like hours and hours. So like, you know, I'm okay with letting go of that as long as I understand functionally what it's going to do.

[Corey]

Okay.

[Wade Wells]

I will say I can't let go, I can't.

[Corey]

The other I will like an AI tip for those that are actually vibe coding, like something that might be important in the future is to, if you work for a company, have a spec for what, how you want your Claude to build things at your company and have it so they all work, so they all play nice together. Like if you're gonna write an API, use a RESTful API. If you're gonna write a, you know, if you're gonna write a freaking web server, don't write it in Python. If you're gonna write, if you're gonna use the database, don't use freaking Squirrel DB or whatever, something no one's ever heard of. Like use like come up with a list of five tools or whatever that you want to support and then put that in your Claude memories or your CLAUDE config and then company wide, you're going to have a way better time than it's like, hey guys, what's up? I finally got my Lisp program running and if you want to install it, all you have to do is install as 400 ports and you'd have to have an ARM64 CPU.

[Ralph]

So it's all going to be great.

[Corey]

It's going to be run super fast.

[Ralph]

It's super fast on my computer.

[Corey]

All right, the other articles. That's an interesting one. Ralph. Tim, you have anything on your radar right now? What's keeping you up at night? Mythos.

[Ralph]

Supply chain. Supply chain.

[Corey]

Supply chain. Yeah. Yeah, I know it seems weird because.

[Ralph]

But it's just like when you start coding a lot of software, software dependencies and then the supply chain stuff's been super hot right now. I know it's like such a high level thing, but it's. A lot of the coding frameworks are really getting hit up with that, so. And then seeing that kind of trickle down into whatever you've written, maybe it doesn't affect you, but it's just like, is this the time? Is it? What about next time? Right, so that's coming.

[Corey]

What was the one? Was there a supply chain attack this week? I thought there was one, but I.

[Wade Wells]

It was last week. There was one last week.

[Corey]

Yeah, I thought there was one this week too.

[Wade Wells]

I guess maybe, maybe I was Trellix. I was working. Oh, Trellix was a supply code. Was a supply chain. I saw they got pretty expensive source code repository leak.

[Corey]

I mean maybe they just unintentionally leaked it and it had their stuff.

[Wade Wells]

But it's Trellix. It's not going to really help anyone anyway.

[Patrick Gorman]

But

[Corey]

Trellix recently identified unauthorized access to a portion of our source code repository. I mean it doesn't really say how or who, but I feel like it had to be supply chain.

[Ralph]

How?

[Corey]

I mean, I don't know, I could be wrong. Could be leak Steelers.

[Tim Medine]

Yeah. Someone pushed to the wrong repo.

[Corey]

Yeah. I mean I will say for multiple customers we found employees who published copies of their entire production database and repo to their personal GitHubs. Yeah. Not unheard of.

[Wade Wells]

Yeah.

[Ralph]

The other thing too is I think GitHub.

[Corey]

Does that count as supply chain? Kind of, yeah. Yeah.

[Ralph]

I think GitHub and other repositories for. Or Git repositories, not just GitHub. Right. Are going to start implementing more kind of lockdowns in that. In that realm. Right. Especially with the CICD and how ubiquitous that is across enterprises and you know, development life cycles and how that's actually being the main Weaponized tool in that supply chain attached. Right.

[Patrick Gorman]

So.

[Corey]

So, okay, someone. There was an article in here that's like some. I don't know who this is, but. Mitchell Hashimoto. Does anyone know who that is? Hashi Corp. Founder.

[Wade Wells]

Oh, oh, yeah, yeah. Yes, yes.

[Ralph]

The.

[Corey]

Hashimore. Hashicorp co founder. Which. Hashicorp is a company that does what? Like, so they do.

[Ralph]

They do a lot of stuff. They. They have Terraform. They have the secret.

[Corey]

Oh, yeah. Terraform's bait. Okay. Yeah.

[Ralph]

They also have a bunch of other things around that. So.

[Corey]

So basically the founder of that company had a hot take and basically said, GitHub is no longer a place for serious work. So if you're making memes and jokes, it's great to put that on GitHub. Tim, you were laughing. What quote were you laughing at?

[Tim Medine]

That was actually it. I. I just pulled up the article that's like, no longer a place for serious work. And I was like, that's funny. Also, is that a recommendation for like. Like, I would be like, you know what? I don't want to do serious stuff. Maybe I'm gonna use GitHub.

[Corey]

Yeah, but the thing is he's complaining. The funniest thing is he's complaining about outages, right? Yeah, like, he's complaining about. Not about, like, privacy or this. Complaining about downtime.

[Wade Wells]

This was on Fireship. If you guys watch that at all. But pretty much their downtime is like 98. It's. It's low.

[Corey]

Like, that's not as bad as Claude. I mean.

[Wade Wells]

Yeah, it's very true, but. But Claude isn't like, there. There was a couple outages where people lost.

[Ralph]

What were you gonna say?

[Wade Wells]

I wouldn't say Claude is as critical.

[Corey]

Production. Yeah, as production.

[Wade Wells]

Right. It was fair.

[Corey]

Yeah, no, that's totally fair. If I can't. My. If my AI agent's down, that just means I'm not getting my database.

[Ralph]

It was critical for that one dude when he erased everything.

[Tim Medine]

I mean, not to get too technical on the get thing, but, like, there is no sort of central repository. There is no official cor. Forget. Like, if I have my repo, it technically has the same authority as the one on GitHub. Right. Like, if you revert some in GitHub, I can still. I still have local. I could push that. Like, what are they doing that they're losing stuff. I don't get there.

[Wade Wells]

There was. There was a big article about it that went all through it. I'm not a. I'm not a production. I'm Not a developer.

[Tim Medine]

I mean that said, I'm a guy I don't even know because I have no clue how to fix my get stuff.

[Corey]

But yeah, same dude, same Corey.

[Wade Wells]

Do you not watch Fireship?

[Corey]

I do. I don't watch it every day, but I watch it when something like this happens.

[Wade Wells]

Yeah, so they talked about that and then. Well, the other thing is this guy also. So the only thing he uses GitHub for that I could see right now is he has like a terminal spinoff that he has that is actually pretty cool. And that's what he was talking about is moving that off of GitHub onto.

[Corey]

Well so. Onto what? That's honestly the biggest question.

[Wade Wells]

Yeah, that's. That's a good question.

[Corey]

Okay, so this is a great example. Okay. We're talking about Fireship. Fireship is a great YouTube channel that talks about current events and development stuff. My question is, okay, YouTube's had issues for years. We've gotten creators banned for no reason. The advertising is sketchy, there's a bunch of AI generated videos, blah, blah, blah. Okay, where do I go next? Freaking nucle or whatever. Nuclear univers or whatever. Like I don't ven. Yeah, what Vimeo. Like there's no like let's be real. Okay, there's GitLab but that's like self hosted. Right?

[Ralph]

Like and GitHub. GitLab is not. They do have the.

[Corey]

Well there's GitLab but then there's like GitLab Cloud like whatever.

[Ralph]

So they have a regular GitLab just like GitHub they. Then you could self host it. There's a couple other again less. Less popular but fully self hosted. Yeah and then BitBucket was I think the last like are the. Not last but also big one. Yeah. If you're. Where's repo. If you have a public repo it should be on GitHub but you know I think for private repository there is probably a good reason to maybe host it somewhere else. That's all I have to say. Right. Like you don't.

[Corey]

I will say that's fair but I do think from an, from an actual like I'm not a developer but talking to our soc and our like Eric and Whitney who like our God tier developers, they're hard committed to GitHub because it has the most advanced CICD features.

[Ralph]

So yeah, the CICD features are there. I mean one of the other benefits of GitHub and what a lot of people do use it is the runners. So you can have a runner run in Any environment you want. So if you want a Mac machine, you could just ask for it. You'll get one. You want a Windows, you want a Windows, you want a Mac x86, you want a Mac arm, whatever. So that, that.

[Tim Medine]

Yeah.

[Corey]

Whereas on GitLab, you would have to deploy.

[Ralph]

You'd have to deploy every one of those other stuff like that. So, yeah, there is some, definitely some. It is mature, let's just put it that way. And I think that's what you're getting.

[Corey]

It's not reliable, but it has the most features. So it's like Windows.

[Ralph]

Yeah, that's why Microsoft bought it.

[Corey]

That makes perfect sense. All right, well, before we close, let's do some final plugs. First of all, I'm just going to go in sequential order here. So let's do some. Let's plug it up. So number one, May 6th this week, our man Wade Wells himself. This is two days from now.

[Wade Wells]

Yeah, yeah. Dude, I looked at the slides today. I did. I did something really bad. I did. I did the slides really early. I looked at them today and realized I don't remember doing them. So now I have to like redo them.

[Corey]

Oh, you got to do it the night before, dude. You still have a whole day.

[Wade Wells]

You're absolutely right. That's like the worst part.

[Corey]

So, yeah, so Wednesday we got Wade coming on to talk about how to turn cybersecurity headlines into action. There's so many things I, I mean, I'll, I'll probably show up to pre show banter for this because I have so many feelings about this of like, how I mean, we do this. I'm talking right now with my team about how we're gonna freaking use chatbots to send in encrypted zip files and get support teams to compromise their machines. Like, I'm gonna do this right now. Obviously yours is probably more defensive based, not offensive based, but it's a great idea.

[Wade Wells]

And it's more psychological, to tell you the truth. Like I even go, yeah, yeah, it, it should be good, but I mean,

[Corey]

you don't have a choice. You have to do this fundamentally. Like you need, this is a skill everyone needs. Speaking of skills everyone needs, we've got John's information security core skills training on May 11th. That's next week. And then, Wade, you have another workshop next week.

[Wade Wells]

Yeah, on the 15th.

[Corey]

Tim's course coming up on May 20th. And then he also also has a workshop on May 22nd. Or not. Sorry, not Tim's course. Corey's webcast is coming up and then Tim has a workshop and then. Patrick, when's your thing? For some reason, it's not listed here.

[Patrick Gorman]

As far as what. When is that course.

[Corey]

Yeah. Yeah. What's your. Oh, here it is. Yeah. What are you. I'm sorry. No, just. Just list all the things you have coming up.

[Tim Medine]

Thanks for coming, Patrick.

[Ralph]

You were really good. Thank you.

[Corey]

But also just list all the stuff you have coming up and when it's happening. Megan probably has links. I don't know why it isn't in the show notes, but.

[Patrick Gorman]

No, no, it's all. It's all good. So it's probably going to be in about a month and a half. Still working on some stuff, actually, I had a few little family events happen recently, so I had to put some pauses on stuff, but hopefully definitely before defcon, so.

[Corey]

Okay, cool. Yeah, looking forward to it. All right, well, thanks all for coming and to our audience. Thanks for being in the Discord. We'll. We'll see you next week. Bye. All right, Andrew, guys, you.

[Tim Medine]

Bye.