Fixing pentesting, Meta is destroying its engineering org, the weekly news - ESW #465
Ayman discusses how AI is changing the role of engineers, noting that while it can make tasks easier, it also increases the volume of work, such as code reviews. He highlights concerns about AI training methods, including the use of human feedback and the potential for poor quality outputs. Ayman also mentions security practices, such as using internal repositories for software packages to improve supply chain safety.
Transcript
Only Ayman's parts of this conversation are included, with the question before each answer for context.
Well, and there's I think one of the myths there is that programmers, that software engineers write code, right? Like it's a lot have told me that it's maybe 10% of the job, right? Like there's a lot of other work going on there that you can't necessarily offload to an AI at this point. So I think we got Ayman back and I think he's stable. So I'll turn it over to you.
Welcome back, Ayman. Yeah, thanks. Yeah, there's a lot to unpack here. I mean, if you take a look at the article and the supporting articles, I think there's a lot of threads here. We should probably talk about the security issues, like the vulns that I've introduced from this, which is an observation I've noticed is that people are pushing code and people are reviewing code, but it's the agents that are doing the pushing and the reviewing, and nobody's actually looking at the code. 42:38 You know one guy on some slack was like if you have if you're if you're not even looking at the code and approving it you should be fired you know it was a very snarky a response but there could be some truth to it The other side is thinking that AI is going to replace engineers. And I love what Jensen Huang says. He goes, it's not. In fact, it's going to make engineers busier than ever, which could lead to an interesting observation of Jevons Paradox. 43:14 If we have something that's going to make our lives easier, but in actuality, it's making our lives busier.
Right, it's what I was commenting earlier, Ayman, is that writing code is not the full job, right?
Yeah, and you know, people have been talking about like how product managers, now the job of the product manager is changing. Where that they can actually ship proof of concepts for code and things like that right without even talking to engineering and say hey engineering i this is what i want help me build this in reality make this production and that's also going to force engineers to have more of a product manager mindset as well i gotta tell you almost every day somebody asks me how has ai changed your job and i'm like man that's a big question like 44:03 You know, I think what they're hoping to hear or wanting to hear is like, are you going to be jobless with AI? And the reality is, one, it's made my personal job easier where I can actually do, I could push proof of concepts, I could fix code issues, right? I could review code. But also, I have way more PRs to review as well now. So it's making my job even harder. You know, I'm busier than ever.
Yeah, I'm not saying it's a fun job, but...
Yeah. Are we referring to like the reinforcement learning from human feedback? RLH? Yeah. Yeah. I mean, it's similar to, I think Adrian, was it you that posted this? Where like companies are, they have cameras on people's heads, where they're like in sewing machines and capturing their movements so that they can train models. I mean i think it's it's a long tail i don't know when done is done that's that's going to be an interesting i don't know so they came around the head that's all meta employees and they cannot opt out of that's everyone
This is you are no longer doing any real work that contributes to anything that will be released. Like this is you're just coming up with sample problems. You're making workbooks to train the AI to get better at doing what you used to do.
Yeah i mean you know the whole token maxing i don't know if it's like really tracking the right metrics right because it's not you know people could be you know wasting tokens on a whole lot of things but the output is not really that great the quality cannot be that great so yeah i mean that's a skill within itself
Now for the Enterprise Security Weekly news. You can check out securityweekly.com forward slash ESW465 if you want to follow along as we go through the news or for links to any of the articles that we're covering. All right. Ayman, I never introduced you, but Ayman Elsawah joined us in the last segment and I'm an asshole and I forgot to introduce him.
You're good. You're good. How you doing? I kind of just snuck in there.
Fourth round, apparently.
Wow.
Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe,
Yeah, you know, being laid off is not easy or can be tough. But I think what people need to understand, and I've said this a little bit before, but the employment in the future is not going to be the same, right? You're going to have to have multiple sources of income, right? Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. 58:05 Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria.
And so 50% of people said that they're staying put. With without mythos or fable, they're just going to drop down to Opus 4.8 or whatever the latest Opus is. And so 50% said they're staying put. 25% a quarter said they're building the exit and 25% said they're already moving. So I thought that was interesting. Basically talking about when your model of choice gets rug pulled, what do you do?
I mean, there's so many models these days. So, you know, it's...
Where they even encrypt data in memory, only you have the key, not confidential computing. I forget the term for it, but yeah, like confidential computing. So basically like you're running in the cloud, but the cloud provider can't see your workload, you know, so like Proton. Yeah, I'm blanking on the term for it. It's been a long week.
It's anti-encryption, like, so there's no, like, there's no insight into it. Yeah. I don't remember the technical term, but yeah.
That's a commoditized market where cost is all that matters, right? And I think at some point we will see that the models will commoditize down. It may not happen in 2026. Maybe it's 2028. You know, I don't know when, but just like cloud computing, cloud computing has come down too. What's that, Ayman?
You don't think the prices are going to go up? Because they're all subsidized right now.
It's just a matter of when. And so for me, you know, I think could make a ton of money. And I know there's some companies out there doing it. It's just a routing company. Where your whole job is to be the middleman that routes between all of the different... So you don't have to change anything in your... Yeah, that exists. It's open router. Yeah, and that company is going to crush it because people are just going to be like, you know what, I'll solve this problem by being an open router. So if Fable gets rug pulled, I'll flip to some other one that's relatively close in value.
And you know what happens? The good thing, I mean, you know, it's a bad event, but it's the good thing that at least it happened quickly because, you know, it didn't, it's not like Fable was out for six months and then it got pulled. That would have been way more catastrophic. Yeah, because, I mean, it takes time for providers, for companies to, they do a lot of testing before they release a model or integrate it into their tooling. So, you know, like typically a model comes out Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria
So interesting new tool here. One of the engineers at Thinkst introduced a tool called Package Proxy. Ayman, I don't know if you got a chance to look at this, but I thought it was pretty interesting. Supply chain safety checks without client-side software. Cool.
I did not get to look at this. No, no. But it is something I'm interested in.
You know, require the package to be a certain age, check whether the package was uploaded to the repo incorrectly, look at email domains, you know, et cetera, et cetera. So it's like a freeware proxy, Ayman.
Yeah, yeah. Yeah.
Go ahead, Ayman.
No, I mean, my approach towards this now is kind of really have your own repos internally and just have engineers pull from there and not allow anyone to pull directly from the internet. So that applies to VS Code, that applies to NPM, all the packages and extensions. So... I would you know if i didn't have that i would probably yeah but i that's that's kind of like my path is like hey you're not allowed to go out to the public pull it from our repo it's vetted maybe i would run this obviously on my own repo like on the internal repo yeah
So, Ayman, let's jump to one of yours. Let's skip away from some of mine.
Mine? I had some? Oh, okay. Here we go.
Yeah, so you've got two, AMD stripping memory crypto, which I didn't even realize was happening from its consumer CPUs without any press release or anything like that. And then the other one, we may be living through the most consequential 100 days in cyber history, and almost nobody has noticed because we are just being hit over the head with everything so often. Yeah, I feel like I just...
Yeah the second one was actually from i think the same person that published the dvd article so when i yeah that's how i found it yeah the long read so that was that was pretty interesting And, you know, the author takes a take that like, you know, there's all these like big cybersecurity events that happen and we're like not really paying attention to them. So it's worth a read.
I mean, it's not that we're not, we just don't have any time to talk about it before the next one happens.
Yeah, I think that's the, I mean, you know, I think we're all experiencing squirrel, right? Like, you know, attention just being led in different directions.
You know, I think that's one of the reasons why this isn't a big deal. Like Jaguar Land Rover was a big deal. Like they couldn't produce cars for like a month and a half, 4,000 other companies were impacted. But like the rest of these, a lot of companies are just shrugging these attacks off.
What's interesting about some of these attacks is that it's kind of like a lot of IP all over the place. So it's maybe it's like a quiet, how do I say this, skirmish, you know, that's happening on the internet between different, you know, private companies and governments that are just, everybody's trying to grab everybody else's IP and just, you know, go around. I don't know, maybe it's a little too esoteric or fringe, but... 1:22:53 Yeah.
Sorry to interrupt there. I mean, go ahead and finish.
No, no, no. Yeah, go for it.
Yeah, Honda. I didn't hear about the Honda breach. Honda?
He says... Yeah, Honda, he also claims that China NS breached maybe the largest single exfiltration event. And he goes, he's not sure if it's true.
Oh, is that the supercomputer one?
Yeah.
Yeah, we're not sure if that's true. That is, yeah, I did hear about that when I looked into it.
Okay.
Yeah. I don't know, man. It's just a noise thing. You know, it's a, it's a, it's, I think personally, it's a situation of, you know, you cry wolf enough. It's not really a cry wolf analogy in the sense of they're lying, but if they're just so much noise, you just get desensitized to the volume of it. And to the point where like you, Adrian, I'm supposed to be keeping up on this stuff. And I see another breach news report. I take a quick glance and I'm like, yeah, okay. So what? It's just another one.
Yeah, we have been really desensitized. And then these are all the ones that we hear about, right? There's so many ones that don't happen. We all know that. I mean, sorry, that we don't know about that happen. And I try to tell folks, you know, a lot of companies feel like, oh, if they get breached, yes, that's not a good thing. But, you know, historically, we know that the public just forgets about it. Right. Now, if it happens more than once, like I see LastPass again in here, like, why are we people using LastPass? 1:26:23 Like, come on, you know, please learn your lesson.
Yeah, that's the Clue, Clue, what was it called? Yeah, Clue.
Yeah, the Clue breach. Yeah, I didn't even know who Clue was, so.
I didn't either. Sales, it's a Salesforce plugin or something, I think.
I don't have a clue.
You get all the breaks you want, buddy, all the breaks you want.
I love the $60 laptop story, though, I have to say.
Yeah. So Ayman, let's go to digital estate management. What'd you think of that article?
It was, it was fun. It was a fun read. Like, kudos to the, so the summary of the story is like someone bought a laptop from an estate sale for $60. And, you know, they're hoping to get some sort of friction, but they turn on the computer and it goes straight to the desktop, Windows computer. And go straight to the desktop login. And the author goes and explores the computer and finds a very meticulously well-maintained computer. 1:30:03 So much so that the original owner who has passed away put a registry key to prevent it from updating to Windows 11, right? So just like kind of like really knew what they wanted. But, you know, it does have the security of the 1990s where all the original owners' information, I mean like social security numbers, client account passwords, right? 1:30:35 Medicare login, everything were just in like several text files. Well organized. Well organized text files. But, yeah, it's pretty scary. So, and... It might be related but like you know i am seeing a large there's a lot of people reaching out to me like parent friends right people my parents age that are being hit with scams right now so it's a little related but like you know they don't know like about good password hygiene and MFA and all that kind of stuff but this was a an amazing treasure trove of information
But one password does have a and it's literally something that you just print out onto physical paper where you put your credentials on there so somebody can get in there if they need to. So I've done that for mine, but I am not the typical person. Like most of these people from my parents' generation and maybe the age of this guy here, they do store their passwords and text files.
Yeah.
So it's going to take even longer for just the ordinary folks to become familiar with this attack type. And forget your antivirus. This was the solution for endpoint security. Just have you execute the command on purpose. And it bypasses all your security tools for now.
That's crazy.
If they're tiny, it's better.
Adrian, have you not had a good experience with dolphins or something?
No, I've just read a lot about them and I'm not going to ruin dolphins and other cute animals for anybody listening to this podcast. But if you wanted to, you could do just a tiny bit of research on dolphins and you'll be like, oh my God, they are assholes. Wow.
Huh? Are they like bullies or something? Okay, I got to look this up.
We're going to have to Google it. We're going to have to look it up, Ayman.
Yeah.
I'll tell you after we stop recording.
Yeah, it sounds like Adrian had a bad experience with the dolphin, though.
No, not personally. I've just read. I think he's just prejudiced against dolphins.
I think he's just prejudiced against dolphins. Went to SeaWorld or something and just had not a good experience.
So yeah, somebody had some fun vibe coding.
Yeah. Yeah. That's cool.
So that's a lot of fun. And with that, that's all the time we have for this episode of Enterprise Security Weekly. Thank you so much, Ayman and Tyler, for joining me today. It's been a blast.
All right.