Alright, hey everybody!
So Brave has released a minimal,
but a paid version of their browser.
That's very interesting, we're gonna talk about that.
Meta has started keylogging their employees.
And we're finally gonna talk about Anthropic Smithos tool.
And all this and more coming in this
week in Privacy Number 50, so stay tuned.
(Music)
Welcome back to This Week in Privacy, our weekly series where we
discuss the latest updates with what we're working on within the
Privacy Guides community and this week's
top stories in data privacy and cybersecurity.
I am Nate, and joining me this week is a very special guest, Kerry
Parker, the host of Firewall's Don't Stop Dragons.
So thank you for joining us this week.
Kerry, how are you?
Hey man, I'm really glad to be here.
We just did this recently when you guys were on my show, so it
seems like only natural for me to come on yours.
I'm really looking forward to this.
This is great.
So thanks for inviting me.
This is gonna be a good time.
Yeah, I'm super excited.
I've definitely been wanting to collaborate with you on something
for quite a while, and I'm glad we're able to make this happen now.
Yeah, me too, for sure.
Alright, with that, we'll go ahead and jump straight into the news.
And we're gonna start off with a pretty hot story that has gotten a
lot of discussion this week, which is Brave Origin.
So for those of you who have not heard, which is weird, because
Brave didn't make a blog post, I don't think.
I don't know what their official method of
distributing this news was, but Brave Origin.
So the Brave browser,
as many of you may know, is a little
bit controversial for a lot of reasons.
And one of the reasons is that it just comes with a lot of stuff
that some people don't necessarily want.
I think it comes with a ton of crypto integration.
It comes with an AI assistant called Leo.
I think those are kind of the two most
controversial ones, but you know, stuff like that.
And some people, you can disable it, you can ignore it, but some
people still argue like you shouldn't be there in the first place.
And so now Brave has announced this new
browser that they're calling Brave Origin.
And it strips all of that stuff out.
I looked at the original press release, and they had everything at
a bullet point, oh, here we go, here it is in this article.
So it strips out rewards, Brave ads, the built-in crypto wallet,
Leo AI, their news feature, their VPN, the Tor integration, and it
turns off all the analytics by default.
So yeah, it's a minimalist stripped down version of Brave.
The catch here is that it costs $60, and that's a one-time fee.
So I mean, there's pros and cons, right?
Like, it's a one-time fee, and it's actually free on Linux.
So if you're a Linux user, you can just
go download this right now, no biggie.
Actually, for the record, I think it might be in beta.
I'd also explain why they haven't made a blog post about it.
But when it comes to Linux, whenever you're
ready, if you want it, you can go get it for free.
The $60 fee does come with 10 activations,
meaning you can use it on up to 10 devices.
We'll get into that in just a minute.
Actually, I mean, I guess we could get into that now, because I
think that's kind of the meat of the story there.
But why don't I...
I'll start by throwing it over to you, Kerry.
Do you have any particular thoughts on the story first?
Or I can start it.
Well, this doesn't...
No, we can go together.
But I think it's weird, right?
I mean, basically, they're saying, "Here's all
these really cool features we've been releasing."
They've been touting these
features as they release them, certainly.
You know, these are things why you might want to use their product.
And now they're saying, "Or for $60, we could take a lot away."
So, it kind of gives a really mixed
message about what they're doing, right?
I mean, if these things are bloatware that people don't like enough
that paying for them makes them go
away, why are they there in the first place?
I don't know.
Brave is...
We were talking before the show.
Brave is basically my second browser.
I use Firefox, as I think a lot of my listeners know.
And Brave is certainly the easy button option.
If I think somebody doesn't, you know, want
to do anything to get privacy, I'll just...
Easy button is brave.
I mean, it's a great browser.
I like a lot of things about it.
But, you know, the attention token thing and the Leo stuff,
everyone's shoving AI at everything.
I would like this.
The other thing that I think that was in the article, and you could
tell me, but it was $60 lifetime, right?
So, even as a method for making money for Brave,
I mean, we all hate subscriptions, but I mean, if this is going to
be an ongoing thing, I can't imagine a
$60 lifetime is really going to cover it.
I mean, those are just some of my initial thoughts.
Yeah, for sure.
Yeah, it's a one time $60 fee.
We've already got quite a few people in the chat, actually.
Yeah, somebody said it's not out of beta yet, as far as we know.
Lucas kind of has my thoughts, which is why would you pay for it
when you can just turn it all off?
To be fair,
if you get the paid version, you can download...
So, there's two ways to go about this.
And let me recap this real quick for those who don't know.
You can pay for it and you can download it fresh.
And all that stuff is gone.
Like, it is not there at all.
It's not even like an option you can turn on or off.
It's just completely gone.
Alternately, you can upgrade, quote unquote, your existing browser.
And then basically, it turns all that stuff off and then you can
turn it back on, which I will say personally,
if I was going to pay for this, I would do that.
Because there are a few things like, I
think like Speed Reader gets removed.
We were, like you said, we were talking about this before we went
live, but I do use Leo a little bit, mostly for like research.
It's a real good time saver for research.
I can type it in.
Yeah, there was this story about AT&T
had a data breach and here's the details.
And it's like, oh, you're talking about
this 2019, blah, blah, blah, blah, blah.
And it spits out all the links.
And I always double check it for the record.
I do it sometimes.
So, I mean, I like the idea of being able to turn things back on.
But yeah, I mean, this has been a really polarizing story.
And I don't know if I have a...
I don't know if I really have a strong one way
or the other, because I do see both arguments.
Like you said, like some of the people here are saying is like, you
have to like pay developers somehow.
You know, but you also made a really good point about like, why
would you pay for something that
people didn't want in the first place?
Like that's kind of silly.
I don't know.
It's certainly a mixed marketing message, right?
I mean, obviously, as again, as these features
came out, I know they were touting these things.
Oh, we got this really cool thing.
What'd you get this in the next version of Brave?
And now to suddenly say, or you could take all out of the way if
you pay us money, just seems really...
I mean, just as a pure marketing
thing seems like a really bizarre message.
I mean, and yes, all this stuff costs money.
We should absolutely be supporting these folks.
You know, I try to donate where I can.
A lot of people don't.
I don't know if that's a sustainable
model for a lot of these companies.
I wish it were.
I get that part of it.
Just the marketing aspect of this just
is what I guess confuses me the most.
And it also is really interesting.
All right, so let me ask if you see if you know.
So is there a way to get a better idea of what you're doing? Let me see if you know.
So if you pay the 60 bucks to get the second version of this where
all these things are disabled, can you, if you re-enabled
everything, would it be right back where you started?
Or is there still some difference?
No, as far as I know, it would basically be like as if you just
downloaded the free version fresh.
Huh.
Strange.
So, yeah, I don't know.
I mean, my other concern is, you know, this Charles said here, the
whole thing about like, you have to be able to pay developers.
I don't want to shoot myself in the foot or anything, but $60 one
time isn't really sustainable in my opinion.
Right.
I feel the need to point that out.
But also like, I don't know.
It's, I do want to, I do want to point out, I actually kind of
sympathize with Brave a little bit here because a lot of people, I
know I just mentioned it a minute ago, but like, you're paying to
get rid of features you don't want.
Yes, but that means they have to make a
completely separate version of the browser every time.
They have to make a completely separate
version that has all this stuff taken out.
And then they have to like put it out there to the public.
It's completely different upload.
And so
that is actually true.
And from a software development standpoint, that is, that's
actually incurred cost because that basically doubles the amount of
testing you need to do against that browser.
You'd have to test the features that are removed, but you still got
to run it through everything else that doesn't work and make sure
you didn't break anything by removing those features.
So it actually does incur them some overhead to support two
different versions of their browser.
So yeah.
Yeah.
I actually, uh, I'm glad Jonah reminded me here.
I wanted to go ahead and run a little poll and
see who, who would be willing to pay for this?
Yes, no, or maybe.
Um, for those of you who don't know how the polls work, you leave
one, two or three in the comments,
but, um, yeah, I'm, uh, I'm curious.
I haven't, I keep waffling.
Cause on the one hand, one thing I hear
people defending it is this is really good.
If you've got like, um, if you've got friends or family who are
maybe not a little bit more tech savvy.
I mean, brave has really good built in
out of the box privacy protection features.
I don't think that's really arguable
regardless of how you feel about them.
I think it would be really cool to have, you know, to get your
friends and family on brave and to, to be able to give them this
like minimalist version where you can just be like, you know,
install this origin, but like I bought it, but I'll activate it for
you and install it and it's good.
And there's no chance they're going to accidentally wander onto the
Leo page or the crypto page or any of that kind of crazy stuff.
So that's an interesting point actually.
And I want to support these guys too.
So I may just pay for this just to support them, but as a gift for
people, like you're saying that, that I don't want to take the time
or it's too tedious because we all know this, you know, the tyranny
of the default is Steve Gibson likes to call it, right?
Whatever, whatever comes out of the box
is what almost everyone's going to use.
And if you have to start tweaking that to get to the point where
you want to people often won't do it.
Certainly a lot of the, you know, my,
again, like my mom is often my avatar.
She's not going to do it.
Then, then most of my audience is not going to do it either.
So yeah, if it could pay to give it to pay to give somebody else a
version of this that is already ready to go.
That might be actually more interesting as a gift thing.
Yeah, for sure.
And I mean, I forget what I was listening to lately.
I think it was about ad blockers, but that was a point that came up
is like, I mean, even I've had times where, you know, my ad
blockers stop things from working or my
wife's, you know, she also uses brave and yeah.
No, Jonah, I don't think polls are broken.
I think I forgot to hit resume on that one.
But yeah, I don't know.
It's it's it's interesting.
It's a tall order.
I think it's really cool.
I think I don't know if he was being tongue in cheek, but I did see
somebody asked the CEO of brave why it's free on Linux.
And he's like, try to push people towards links.
So I don't know if he was joking
around or not, but that was pretty cool.
So yeah, that's weird too.
I mean, did they, did they say why they're, I mean, why are they,
is this just a matter of we want, this is another way for you to
support us basically going this way or.
Because I'll give it away for free on the phone.
Get it for anyway.
I don't know.
No, I think that's I don't know.
I mean, that's I'm not much of a business person, but I feel like
that's the only explanation that makes sense to me is like we
wanted to try and support the Linux community.
I think it's also I know I think you you
mentioned this a little bit, but I think it's.
Kind of like trying to find that middle ground of, you know, like
people complain about the bloat and it's like, OK, here's a bloat
free version, which of course now
they're going to complain that it's paid.
But yeah.
Right there, we want Linux to win.
So.
But yeah, you think it'd be the way around, right?
Like the basic one to be free and then all the stuff with all these
features we've spent all this time putting
into there, that would be the for pay for.
Yeah, that's what's getting me.
Not to be cynical, but one thing I've
noticed is the average person doesn't care.
Like I love my wife.
I mentioned she uses Brave.
She still has the sponsored backgrounds
turned on, which I don't know how she does.
I just hate ads personally.
I'm like, oh, I do too.
With a passion.
Yeah, so I don't understand.
Like every time I have to use her computer for something and I pull
up Brave or I see her pull up Brave and I'm
like looking over her shoulder for whatever reason.
And it's just like I see a little sponsored thing.
I'm like, how would you not turn those off?
But it doesn't seem to bother her.
So I don't know.
I just have the tyranny of the
defaults if there's good defaults there.
So I guess that could be another argument going back to my whole
like not playing tech support for the parents is, you know, you get
this, you install it on their computer and guess what?
They have good defaults right there.
Like all the analytics are turned off.
So.
I do imagine that people that watch ads, this is the same
experience I have is want to look at anybody like on Chrome.
And it doesn't have you block or something installed and there's
ads and stuff all over the place.
And I can all I can guess is that they've
already looked their brains tune that out.
Like they they're so used to it.
They're so numb to it that they don't see it.
Whereas you and I who don't see ads all the time, it's just it's
glaring to us because they're trying to get their attention.
They've already ruled them out.
And for us who are not used to it, you know, it's like anyway, we
haven't built up the resistance to it like they have.
I I've stopped saying it because I
feel like I'm a party pooper every time.
But on that note, every time I see certain like TikTok videos or
something, I'm like, why were they filming this moment?
And that's to me, that's a good way to tell if it's an ad.
But real quick, I didn't want to call out.
Jonah said he's going to keep using
Zen browser on the topic of competitors.
I know we're going to get ahead of it because a lot of people have
asked about this is the helium browser
has been a really popular subject lately.
It's popped up on the forums a few times.
I know there's some videos have been made about it.
So Jonah asked me earlier this week if I
could test it out and kind of take a look at it.
And actually, I guess you guys can't see the whole window here, but
I'm actually using helium browser today.
And it's you know, I will go on record and say I was I was really a
hater when Jonah was like, hey, can you test this out?
And I was like, why?
But you know, I got to say it's been pretty pleasant.
Like some people have been promoting it as a let's see if I can
pull up their website here real quick.
It's coming up because you know, we're talking about things like
Zen or like helium, like why pay for this when you can just do this
or you can just manually debloat it.
I've definitely found little things here and there like every once
in a while my my well on this computer, I have a solo key.
But every once in a while my solo key
won't work with it quite right for some reason.
But I mean, I got to admit it was it was it.
Ironically, it was a little bit longer of an install, I feel like
than most browsers because you know, most browsers like they just
want to get out of your way and get going real quick.
But this one's this one had like a whole page
of like what settings do you want to enable?
What search engine do you want to use?
So it felt like it took a little bit longer to get started.
Not not by much longer, just a few seconds, but it definitely felt
like it was a little more involved.
But I mean, once I got up and running, it's it's it's been treating
me well, pretty, pretty well so far.
I'm always a fan of anything that
comes included with you block origin.
I don't I just realized I didn't pull the page up.
I'm sorry.
I'm talking about it.
But yeah, I don't know.
I mean, I just I know people are going to ask us about it.
So this is kind of an unofficial review.
I don't know if there's enough there for us
to do an entire review of it specifically.
But I thought it was okay.
I thought it was pretty cool.
You could check it out if you want.
I don't think I'm going to switch from brave to be totally honest.
Like this has been an okay experiment.
I think after this, I'm going back to brave.
But yeah, I mean, doesn't seem to be
anything wrong with it in my expertise, at least.
So it's actually amazing how many browsers we have.
And even even how many different privacy oriented browsers we have.
That's I mean, it's a good problem to have, I guess.
Yeah, for sure.
I mean, we've got, I mean, for the record, I think they've all got
most of them, you have to do some various
tweaking to like really get the most out of it.
But we got brave, we got Firefox, we got mobile,
we got Leberwolf, we got even things like Vivaldi.
And comparing them to like mainstream like Chrome, for example,
like even Vivaldi comes with like a built
in ad blocker and all that kind of stuff.
So I mean, have you used Zen browser at all?
I haven't used it.
But I know Jonah speaks very highly of it.
And I think Jordan's used it too.
So I know Zen's a really popular one.
But so like you said, it's a good problem to have for sure.
Yeah.
All right.
I don't think I have anything else to add to that story.
Did you have anything you wanted to?
Oh, here we go.
We got a question for you.
What browser are you using?
I thought you said it a minute ago.
I use Firefox and I've been using Firefox for a long time.
And sadly, I saw the numbers on Firefox.
It's down to like single digit percent usage.
It's really, really sad.
I mean, I guess maybe some of that is the fact
that we've got so many browsers to choose from.
But I don't know.
I've been a longtime Firefox user.
One of the reasons I like Firefox, though, and I like to support
Firefox is I really want something besides chromium.
I'm honestly surprised that Google I know that Google is the
browser and we're or was the search
engine on Firefox for a long time.
And that was kind of how they indirectly supported.
But there were times in history with Apple, for example, where
Microsoft gave a bunch of money to Apple because they didn't want
Apple to die because they needed a competitor.
Otherwise they'd be a monopoly.
And so for that reason alone, maybe Google
should kick in some money to the Mozilla Foundation.
Anyway, I like to support these.
I want something besides chromium.
And so for me, it's Firefox and you block origin.
That's my go to.
Yeah, I am.
I'm not gonna lie, I kind of want to go back to Firefox for the
same reason you said like just to
support the the wide range of browser choices.
But I'll admit I use Leo quite like most of the time, okay, most of
the time, I'm either going to like the things that I would log in
with a with a YubiKey like my next cloud instance, my mastodon
instance, or I'm doing research for a video at which point, like I
said, I kind of come to rely on Leo pretty heavily for that, just
because it speeds up the research process so dramatically.
So I don't know, but I'm trying to use Tor a lot more as well.
And I know there's that like ask mode in Brave, I think I need to
play play around with that a little bit more.
Well, of course, Tor is Tor is based on Firefox too.
So what happens to Tor if Firefox goes away?
I don't know.
Yeah, that's true.
That is that is very, very true.
Normally we save questions till the end,
but the chat is really popping tonight.
So I don't want to lose questions.
Somebody said, do you use Arken Fox with Firefox?
Do you have an opinion on the Arken Fox project?
I've looked at it.
I've basically gotten Firefox to the point where I've tweaked it.
And so I don't know.
I've not gone through.
I've looked at some of the things that Arken Fox has done.
I've kind of looked through their bullet list of of modifications.
Some of them are a little further than I would that I go.
I've got other things going on, too.
I use Next DNS and some other things, too.
So some of them kind of overlap, perhaps.
I'm not, you know, I'm not super, super hardcore.
Plus my audience is not.
So I also kind of try to do what I
recommend so that I'm more familiar with it.
So you know, so there's some of that going on there, too.
Yeah.
And I mean, my personal opinion is like I feel like the Mulvad
browser has closed the gap so much.
I actually thought I heard that Arken Fox was going to stop
developing because the Mulvad browser was so good.
I mean, I use it sometimes, too.
Yeah, I was going to say, I don't like it again, like we were
saying earlier, it's great that there's so many choices out there.
So I'm not like mad about it.
If they want to keep developing, that's that's cool for them.
But yeah, I have I literally I have four browsers on my computer.
I brave Firefox, Tor and Mulvad.
And I've
got all those bus safari.
Well, OK, OK, yes.
We want to talk about the Mac.
I only use this when I'm traveling, to be honest.
Otherwise, I'm either on Linux or Windows.
But the keys just the keys.
I don't know.
I might I might I feel like I should buy origin now just in case it
does turn into like a subscription or like prices go up later.
Like price now.
Had your bets.
These are pretty straightforward.
Don't they just work like keyboards?
Like how do they fail?
I'm sorry, we're getting off
topic, but you're talking about the Mac.
No.
Well, you said some of these keys don't work with some of the
browsers or something that some of your hardware.
Oh, no, I don't.
Oh, yeah.
Yeah.
On Helium.
I don't know.
Just the other day I went to log
into what was I trying to log into?
It might have been it might have been massed on.
I don't know.
I went to log into something and I
hit my my solo key and the key was fine.
But like it gave me some kind of error
about like could not parse something or other.
And I like I made a note of him in my head.
But then by that point, I was like, whatever, I'm going to bed.
But it's been a long I went to New York this week.
I went to upstate New York.
So I had to travel and everything.
And yeah, that's that was fun.
Yeah.
But yeah, I think before we move on, I do want to point out this
new Keith person here, I think is
actually a member of the brave team.
So thank you so much for stopping by and answering.
Oh, hey, we really appreciate it.
But with that, I think I will turn it over to
you to talk about this new law from Maryland.
Yeah, yeah.
OK, so Maryland has passed the first and first
in the US law for banning surveillance pricing.
They called it the Protection from Predatory Pricing Act.
Actually, I think New York actually has
a law, but it's only about transparency.
New York, I believe, has a lot that says if you
do it, you have to tell people you're doing it.
But this sounds going to outright ban.
It was Westmore is going to sign it.
Apparently surveillance pricing, if you if you don't know, is this
notion of the collects all this information about all these data
brokers, all these things that we've been talking about on shows
like this in mind, where all this data, personal data has been
collected about you often without your
knowledge, supposedly with your consent.
But we all know how that goes.
And then when the time comes to show you a price based on all that
information, if they think you're
desperate, they might charge you more.
If they think you're rich, they might charge you more.
Or if they haven't seen you in a while when
to get you back, they might charge you less.
There's all sorts of things baked into these algorithms.
But the point being is that people get different prices.
And there's been all sorts of studies that
people have and they've asked questions to people.
Do you like this idea?
And everyone says no, like nobody likes this idea.
And yet there are still other things like
loyalty programs or whatever your croaker card.
But the thing with those is everyone gets the same deal.
Like if you've got the card, then you get the price.
So anyway, this is a situation where potentially you like your
particular person might get a
different price than someone next to you.
And so I guess food retailers as in grocery
stores are a big place where this happened.
Obviously a lot of this would be online so that two people not
sitting next to each other are
noticing that the prices are different.
Though Walmart and some other stores
are going to those electronic tags now.
And some people are envisioning this like I
walk up to a tag and then the price changes for me.
I don't think that's going to be happening anytime soon.
But anyway, so Maryland has come up with this law saying that this
is bad and we're going to treat it as
a fair and deceptive trade practice,
which is great.
We need more things like this.
I think this is a good idea.
I've got some questions about how this is really going to work out.
And the devil's always in the details like,
you know, how are they going to enforce this?
How do you catch this, for example,
how do you prove that this is happening?
And then how do you then even if I get a different price, how do I
prove that it was because I'm different than somebody else that I
got this price, that it was some algorithm behind the scenes and
not just, well, we just changed the prices five minutes ago.
Also, what is not clear, I looked at the I
tried to look at the law before we came on.
It doesn't appear to have a private right of action built into it.
Now, sometimes in different states, there are other laws that would
come into play that might give you this.
So it doesn't have to be directly in the law.
But a private right of action basically says if I figure out and
can show I'm pretty sure I can show that I was just discriminated
for some reason and I was given a
way worse price than somebody else.
Let's say through surveillance, they figure out that I just had a
death in my family and I went to go shop for a flight at Delta dot
com and Delta dot com gets information to
the back door carries hard up right now.
You really need to fight.
Let's charge you more.
Now, maybe it's a bad example because I know some airlines actually
have bereaved net fares and whatnot that
are usually cheaper for a last bit of flights.
But anyway, let's just say that that's what happened.
I can show and prove that that happened.
I if I had a private right of action could personally sue.
Whereas if you don't have a private right of action, which is what
I think is going on here, you actually have to get the state
attorney general to sue on your behalf.
So probably have to have a lot of people complain about it or they
have to be a really egregious case because
they've got other things they're doing, too.
Right.
So without a private right of action, some of these things sound
good on paper, but in reality, don't have a lot of teeth to them.
Also remains to be seen if someone gets brought up on this with the
you know what the remedy is going to be.
Is it going to be the margin of a lot of money or is it like a lot
of things with meta and all those companies?
It's going to be the cost of doing business.
Right.
Like, oh, it's a fine.
It's a small fine.
We'll pay that whenever you can make that happen.
We'll pay that because we're still going to make money.
So I don't know about that.
I will also say that I just did an interview with Justin Brookman
from Consumer Reports and Eric Gardner from More Perfect Union.
They did a real interesting study about this actually, where they
got a whole bunch of people into a room together at the same time
on the same phone on the same IP, the same websites and said, OK,
everybody find this item and buy it right now.
And they found that there were differing prices for a lot of these
things and they kept track of this and looked into it.
So if you're interested, you should definitely check that out.
But there are things that we kind of do this for already today to
the kind of muddies the waters like if you think about it like
airline tickets, like no one gets the
same damn price for an airline ticket.
It depends on when you buy it.
Depends on what not just what fare you want,
but like what things are going on right now.
And it could be fuel prices, but
airline tickets are weird this way.
There's surge pricing for Uber.
Does that fall under this category?
You know, I don't know.
So those are just some of my initial
thoughts on this after I read this article.
I think it's good that we're calling it out.
I think I don't think a lot of people understand this.
I think that surveillance pricing is one of these issues that is
finally going to make a lot of people sit up and notice all this
data gathering is a real problem.
And this is why we care.
Some of the other things are just kind
of nebulous and like, yeah, I don't care.
I get targeted ads.
Fine.
I want to look at an ad that I don't want to see.
Show me those ads that are targeted.
That's good.
I like that.
This is where this is going to hit home.
I think this is actually an issue that's going to get traction.
What do you think?
No, I totally agree.
And it's funny on that note.
I am so backlogged on podcasts today.
I finally listened to your freely episode with McNeroll.
Oh, you mentioned that like, okay, coming up, we're going to be
talking about, you know, consumer
reports and how they put everybody in the room.
So while you were talking, I'm like, was
that his podcast or was that somebody else?
Where did I hear that?
But, um, yeah, no, I, it's another podcast I listened to.
Um, they talked about this and that was his take.
He's like, he's like, no, I think like, um, I mean, he didn't come
right out and say like, I think this would be
awesome, but he, he's just such an optimistic person.
He's just like, I wouldn't mind if they use my
data to like, give me a discount or something.
I'm like, yeah, but the difference is they're going to give you a
10% discount and somebody else a 20% discount or like, they're
going to charge you a little bit more and then give you a discount.
So it's the same price, which Amazon already does that anyways, but
yeah, that's actually the point that came up with the thing is
that, is that what often what they do is they
changed it's all psychological games, right?
So it's, they show you a list price that wasn't the real, the MSRP
or whatever, and they show you seven bucks
for you, but you know, five bucks for me.
And then they sell it for three bucks.
One of us thinks they're getting a $4 discount.
One of us thinks they're getting a $2 discount.
You're both paying the same price.
So it works in other ways too.
This whole surveillance thing.
Yeah, for sure.
Um, but no, I, I agree with you.
Like I feel like this is where this is unfortunately one of those
moments where like privacy, a lot of the time the hypotheticals
have to become real before people start to notice it.
Like we've, we've already seen with cars now, you know, that that
stuff is used to influence your insurance rate, which I, I think I
told this story on a previous episode of like, I just moved to a
new area and I decided I would take the hit and get like the
little, um, the little tracker thing you plug into your car.
It's not on my phone.
It's on the car.
Well, because it was like, it would
cut my insurance rate in half, but it
kept being the ODB two dongle.
Yeah.
But it kept dinging me.
When I asked them, I'm like, I need to return this thing because my
insurance is going to be more than
if I hadn't bought the damn thing.
And you know, they were like, it was so funny because they were
like, okay, well, um, I mean, some of it is like, you're, you know,
you're driving, which I explained.
I'm like, yeah, I'm in an area with really aggressive drivers.
Like there's nothing I can do about that.
And then also some of it was like, you take a lot of short,
inconsistent trips and I'm like, cause I work from home and I just,
I just run to the store when I need to,
like I don't commute to an office every day.
What do you want from me?
But yeah, it's, you know, anyway, sorry, that was a, you know,
we're, we're at the point now where like our car
data is being used to determine insurance rates.
And now like this stuff could be
used to determine individual pricing.
And this is different.
Um, I know I've said this before, but for anybody who doesn't know,
this is different from surge pricing or dynamic pricing, right?
Cause that affects everybody.
You know, if you, the example I use is if you're at a concert and
the concert's over and you call an Uber, it's going to be more
expensive because it's a concert.
It's crowding.
Everybody's trying to get home, but it's
going to be more expensive for everybody.
The surveillance part comes in where it's more expensive for you
because your phone's at 10% and they know that
you can't afford to wait for traffic to die down.
So you say that, but that was a thing.
Uber was one of the things, if you give it permissions, the Uber
app was looking at the charge on your phone.
And if you were charged was low on your phone, they figured you
were desperate and they would give you a different price.
Also, as Cory doctor was very common to point out or very, um, the
drivers themselves are subject to kind
of surveillance pricing as well, as well.
Like what they are offered for a ride before they accept it varies
depending on factors on their end too.
And it's just, it's this whole algorithmic game that is all, you
know, it's very untransparent to the people that affects, but the
companies are using it to make a lot of money.
There was, when I was talking to these guys, uh, one of the things
I thought was interesting was the whole, the whole point of this is
they don't want to leave money on the table.
Right?
So all these companies want to charge you as much as possible and
still get you to buy you personally.
Like what, how much can I charge Carrie and get him to buy without
charging him too much so he walks away?
It's same thing with Nate.
That could be a different price.
And so, and it's called a customer surplus.
Whatever they, whatever they left on the table of Carrie, if I
charge Carrie seven bucks for
something turns out Carrie would have paid 10.
And so that that's three bucks.
I didn't make that's the way they look at that.
And that's what they're trying to
solve with this surveillance pricing.
Yeah, for sure.
Um, for the record real quick on the Uber one, I don't know if they
were ever like convicted of that, but yeah, I do remember that was
like a, um, somebody alleges that was, that was the thing.
But yeah, it's a Vonnegate here says Wendy's had plans to introduce
surge pricing that they pulled back because of backlash.
I vaguely remember that.
What was the brand?
Oh, surge price.
Okay, sure.
Yeah.
I don't, I don't know.
Uh, that's weird.
Everybody's trying to get in on, which I know like for the record,
I understand like welcome to capitalism.
Everybody's trying to make as much money
as possible, but like it's still just crazy.
Like is nothing sacred, man?
I don't know.
There's still some basic fairness that needs to be in there.
And this is something I bring up all the time when people talk
about capitalism, unfettered capitalism is still not good.
I mean, the way I usually put it is that any game worth playing
has, has rules and any game with enough
consequences needs a referee to enforce those rules.
Do you need fairness or it's capitalism has to
be fair at its basic level or it's predatory.
Yeah, for sure.
Um, yeah, I don't think I have much
to add to that one, um, personally.
So I guess, uh, let's move on to our next section.
Um, in a little bit here, we're going to talk about meta and a meta
is basically key logging their employees, um, to train AI.
But before we talk about that, which
should be fun because I love making fun of meta.
Um, first we're going to give some quick updates.
Um, we're going to talk a little about a little
bit about what's been going on at privacy guides.
So for anybody who is not subscribed to our newsletter or our
YouTube channel or any of our socials or anything, uh, you really
should be because we have a new interview out with Carissa Bailey's
and, um, she talked about AI and actually just this thing we were
just talking about now about how, um, AI and predictive algorithms
are making things less fair and not more fair and really taking
away a lot of opportunity from people.
Um, amazing video.
I don't have it on me.
It's in the coffee table.
Um, but I, uh, I preordered her book and it
got to me like the day before it came out.
So that was super cool.
I got to read a little bit of it on the plane.
It is so far.
It is amazing as always.
Um, she's an amazing author.
Uh, in other news, Jonah put up a video about the parents decide
act that we covered a little bit last week.
Um, we covered that last week before the text of the bill was out.
So we were kind of going off of PR statement that the
representative put out, but Jonah actually
read the text of the bill and kind of had
some, it's actually pretty short.
Oh, okay.
I, I didn't have time to read it,
but, um, yeah, Jonah had some hot takes.
Uh, he kind of disagreed with everybody.
And um, you know, I mean, it shows there's so
many comments on that video, which that's great.
I mean, you know, we're, we're having discussion, which I think is
awesome, but, um, you don't have to agree with him obviously.
But I think if you want to hear a different perspective on it, I
would say definitely go check that out.
And like I said, you may not agree
with him, but it's, it's another opinion.
Well, for what it's worth, I agree with him.
Um, and I, and I don't like the age gating
stuff and I don't like the ID verification stuff.
That is not what this bill is.
So that's the, that's the thing.
It's not that long.
It's like almost a one pager.
So it's, it is worth listening.
It definitely, I watched Jonah's video and it's what it watched
that before you make your decision because I, I, I have knee jerk
reaction to whenever I see these kinds
of bills because so many of them are bad.
This is one you need to take a look at because it's none of this is
good, but I think this has an interesting approach.
So I think it's worth at least considering.
Yeah, for the record, I don't really know how I feel about it
because I think Jonah really did make a lot of good points, but I
think a lot of it is also like, at least the, the what I heard from
it was like, assuming this doesn't get
abused and I'm very cynical of government.
So I don't know, but I also full, full
honesty, I think Jonah's a lot smarter than me.
So even if I don't fully believe him, I'm still going to listen.
Oh yeah.
I mean, there's still problems with it.
I mean, it's, it's definitely not perfect.
And there's always a slippery slope
article, uh, argument against a lot of that's true.
That's what it starts out being good and then ends up going wrong.
And so as soon as you enable it once it
might start out being good and then go to crap.
That is most definitely possible.
But it's worth the debating by looking at this bill.
Yeah, for sure.
And that's, that's a really good point.
Like we can make the slippery slope argument about anything doesn't
always mean it's going to happen.
So that's true.
And we do have another video is already in the editing phase.
And all I will say is that it is a tutorial
that some people have been asking for for a while.
I'm really excited about it.
Like I just, I've told you all, I do like the initial cuts.
Like I'll record something.
I'll do like a rough cut to get rid of
all the pauses and the starting over.
And, um, even that initial cut, I was like, damn, I don't, I'm not
normally one of those like, I'm so good at this kind of people.
But even I was sitting there, I was like, I
think this is going to turn out really good.
So I'm excited to share that with y'all.
But, uh, and then we wrote a bunch of articles this week.
It was a really busy week.
Um, Apple has fixed the, uh, the issue that was causing signal
notifications to be stored on phones.
Uh, Madison Square Garden, I think it was wired, did like a real
deep dive into their facial recognition software.
I got to walk by MSG this week, so I'm pretty sure I'm on there.
Um, fingerprint.com, fingerprint.com discovered a vulnerability
that can link your tour browsing together.
Definitely go check those out.
Cause unfortunately we're not covering any of those stories on the
podcast this week, but they're good,
important stories that are worth knowing about.
And on that note, I'm going to turn it over to Carrie and you can
tell us a little bit about what's
coming up over on Firewall's no stop dragons.
Right.
Well, you beat me to all the interviews.
So, uh,
my interview with Chris of Lee's is going to come out Monday and I
have had a chance to read the book.
It is amazing.
Privacy is power, which you've got behind you on the wall.
There is still my go-to.
Like if I recommend one book to
anybody about privacy, it's that one.
If you have not read it, you need to read it and buy it for your
friends and family because it's, it's just that good.
Um, she's a philosophy professor and she approaches this from a,
from a very human angle and a very, very interesting and
provocative angle and says a lot of things.
I've been doing this stuff for a while when I read that book.
And there were still points of view in that book.
They're like, wow, I really liked it.
That it really, that I really took home.
So anyway, so that's really good.
Uh, Chris is amazing and I got a chance
to talk to her as well about her new book.
So she and I have an interview coming out Monday.
I also talked with Cindy Cohen.
You've already talked with her.
Uh, and so I did talk to her as well.
Another amazing woman and another great book.
She's got out privacy's defender.
That's well worth a read.
Uh, so both of those interviews are
coming out, uh, for me, the next two.
Uh, then this is something I've
been wanting to talk about for a while.
Uh, we talk about surveillance all the time and mass surveillance
all the time, but I wanted specifically to talk about employee
surveillance and which is a great, it's going to
be a great segue when we get to the meta article.
Um, and so I found a couple of people to
talk to me about the technology behind it.
Like the, the, the MDM profiles and things of what really happens
when you use your own device at work and what you should expect for
privacy when you're using company resources or on
company property, which spoiler alert is nothing.
You have no privacy.
Um, so we talk a lot about that.
So I get, those are kind of the interviews I got coming up.
Um, and also maybe I could say this for the end when we wrap up,
but I've got some big news to talk about
with the, uh, the book and the podcast.
I'll say that for the end when we wrap up.
All right.
I'm excited.
And I'll definitely be listening to those interviews.
Yeah.
Karisa writes in plain English, um, but like so articulate.
I love it.
So, um, yeah, so all this is made possible
by all our supporters for privacy guides.
You can sign up for a membership or donate at privacy guides.org.
You can pick up some swag at shop.privacyguides.org.
Like this awesome water bottle that I take everywhere.
When I travel for firewalls, don't stop dragons, you can head over
to firewalls, don't stop dragons.com, or I
will fully admit your little, uh, FDSD.me.
I use that like crazy.
So just type that in.
If you're, if you're like me and that's a
lot to type and you make a lot of typos.
Oh,
I make so many typos and I'm a writer for a living.
Can you tell?
But, um, but yeah, that'll take you to his website.
You can get a copy of his book and learn more about the podcast.
But for now, um, I'm going to leave it with Carrie and we're going
to talk about Mozilla and anthropics mythos
that you guys may have heard so much about.
Yeah.
So I guess, uh, you guys haven't talked a lot about this show, so I
want to start by giving a little bit of background.
Cause I think that's going to be important.
I honestly, the, the takeaway from the art that we have a couple
articles, the tip takeaway from the articles is pretty short.
So, but I do want to talk about what mythos is and just general,
general generative AI and coding.
So I'm a retired and recovering software engineer.
I did it for, I mean, I've been writing code for 40 years.
I've been doing it professionally for 30.
Um, and I'm here to tell you this stuff is for real.
I, you, there's a lot of problems with AI. I
say this whenever I do it, my show, I've got these disclaimers,
like, like, yes, there are a lot of
environmental problems with the AI.
We didn't have to do it that way, but we did.
There's a lot of copyright problems and content things with AI.
We didn't have to do it that way, but we did.
But all that aside, if just from a strictly, from a coding
perspective, gen AI, LLMs, large language model, chat bots, you
know, your Clods, your Gemini's, your chat GPTs.
Um, turns out code is, is just
ideal for working in these situations.
LLMs training on code is, is almost perfect.
Um, there's always bugs in code.
I would have would have said that for my entire career.
We maybe get to the point where that's not true anymore, but in,
but before we get there, we're going to be finding a lot of bugs
and that's kind of what we're going to be talking about today.
So mythosis, the latest version of Claude, which is from anthropic.
And so they did this big song and dance release recently where they
said, we've got this new version of Claude.
It is so amazingly powerful.
It is so unbelievably powerful in coding and finding bugs and
exploiting vulnerabilities in software.
It is so good.
We can't give it to you yet.
So, so they created this thing called project glass wing and
project glass wing is this, I don't know, pseudo charity thing
where they said, okay, we're going to let
the quote unquote good guys have it first.
And so I think there's like 40 different companies that they're
giving it access to before they release it to the public.
They're running it on a lot of open source projects, which
especially a lot of the big ones, which is great.
Uh, we're going to find out in this next article when I finally get
to it, that Mozilla has used it to good effect.
But I'm, I'm here to tell you that this, these tools are the real
deal and there's a lot of hype behind this.
A lot of people are saying, oh, they're going to IPO this year.
They're just trying to get a lot of interest.
They are getting a lot of interest.
Uh, they're making such a big deal out of this.
It's all hyperbolic.
It's just, you know, it can't be this good.
It can't be this dangerous as a software engineer, in my opinion.
And that actually, it's just, it's not just my opinion.
There's actually a lot of
cybersecurity researchers who share this opinion.
And I can, if you're interested, I can maybe try to give you some
links, but, um, this is the real deal.
They are finding a lot of bugs.
Uh, one of the things that they point to, and then I'll get to the
story and I'll have more to say, but I'll finally get to the story
is somebody's keeping track of the meantime to exploit how long it
takes before a patch is released.
Like somebody's fixed a bug and then the bad guys find people who
have not updated their software yet and then
exploit it in the wild, like eight years ago.
It was like two years.
It took two years on average.
And I don't know what the, um, standard deviation on that is.
But anyway, the point is over the last
few years, it's come down very, very fast.
It's to the point where so far, I think this year, the meantime to
exploit between publishing a patch and somebody exploiting that
patch in the wild for somebody who has
not fixed their software yet is 10 hours.
That's that's nuts.
That's basically instantaneous.
I just need to chime in real quick.
I remember when I was on
surveillance report, it was like three days.
So it's going down constantly.
That's insane.
It's basically immediate.
So that is what these tools are doing.
So that is why anthropic basically said, okay, we can't, we can't
just release this to everybody yet.
We're going to let the, we're going to let the good guys have it
first and try to fix all their stuff.
And so that leads to this article.
And that is that Mozilla used this tool
and in the latest version, uh, well, okay.
So it's, it's a little fuzzy.
They said they found 271 bugs in Firefox.
I don't think they're all fixed in here
and I don't think they're all critical bugs.
Um, they fixed a lot of them in
Firefox one 50, which just came out.
So it does exactly what they said they wanted to do.
They wanted to give it to the two, you know, in this case, Mozilla
say, find all your bugs before the bad
guys do fix them now and then release.
And, you know, at some point soon, I don't think they've said when
they will eventually release this, but now this brings me to
another point is I want to say that.
Even if this particular version of Claude is not as good as they
say it is, the next one will be, but if
it's not them, it's going to be chat GPTs.
They're next.
They've got a cyber version out
now that they think is about as good.
And by the way, uh, opening, I released their chat GPT cyber and
said, we're also going to, they took a lot of pot shots at
anthropic without saying it by name and their press release.
But basically they're doing the same thing.
They're good.
They're not releasing it broadly yet either.
But even if these guys don't do it, someone's
going to do it and it's going to be out there.
That's going to happen.
So all I want to say, well, some of the things I want to say about
this, that to you guys, the audience and anybody, you know, that
has a business or works for a
company that might, well, that's everybody.
This is real and we need to be taking advantage of it now.
Uh, Steve Gibson on security now liking this to the Y2K thing.
It's like, this is coming.
It's going to happen.
We need to fix our software.
And it turns out back then, it ended up being a nothing burger
because we get, we had enough notice and we, we, we worked ahead
enough that when that actually happened, it was nothing really
happened because all the software had been fixed and we're all good
when the clock rolled over on January 1st of 20, 2000.
I don't think this is going to be like that at all.
There's a lot of existing software
out there that's not being updated.
Uh, on devices that are no longer supported,
people are not going to be on top of this stuff.
And so for all of that software that is already out there and
vulnerable, even if all these companies do get privileged access to
this tool ahead of time and fix these things at a time and release
their updates to this, those updates are
not going to be put on everywhere right away.
So for, I think companies and there's this white paper that, gosh,
I wish I could remember the name of it.
I'll maybe while you're talking or whatever, I'll look it up and
say, but these guys basically said you, you need to prepare now.
They're talking to like the, the CEOs and the CISOs of companies,
the chief information security offers and saying, this is real.
This is coming.
You guys need to prepare, like hire people, get ready for a big
wave of bugs to be found either before
you release, because you're using this tool.
You're privileged enough to get access to this at a time or the bad
guys are going to find them for you after the fact.
You're going to need to be ready to fix these things and quickly.
And for just regular everyday people that the company is going to
be able to fix, they're going to be able to fix this.
And so I think that's the kind of advice I'm giving is the advice
that we've always been giving, but it's more urgent.
You know, get your old, unsupported devices off the internet.
Make sure that you're not have internet holes in your firewall.
You can use tools like shields up and
show Dan to find those kind of things.
If you've got software that needs to be updated, get it updated.
You know, get your data offline as much as
you can, you know, because that if you got old
there, reduce that as much as you can now while, you know, until
because these things are going to be exploited.
I've been talking a lot.
I'm sure you've got some things to say.
So let me take a breath.
Nate, tell me what you think about
all this stuff I just put out there.
No, you're good.
Yeah, I mean, honestly, I agree with you like I.
It you said it really well, like AI has
so many problems and I'm not an AI Maxi.
You know, earlier I said that I do use
Leo quite a bit, but I'm fully aware.
Of, you know, the copyright issues, the
privacy issues, I try to use it sparingly.
I try to use it specifically for
like, hey, find this article or something.
I generally don't use it for creative stuff, but it is I've heard.
I feel like we covered this on an older episode.
There was a one of the top Linux maintainers was talking to the
register and he said that, you know, historically companies, open
source projects have had issues with AI bug reports.
Because there's just too many of
them and they can't keep up with them.
And but now he's in and this was like a month ago.
So now he's talking about two months ago or so.
But at the time of the interview, he's like, yeah.
And then like a month ago, all of a sudden it
was like a switch flipped and something changed.
And now, like a lot of these bug reports are
really good and they're actually really helpful.
And we're we're finding a lot of things and fixing them.
And so I think AI, like one of the valid use cases and again, like
we should have done it differently.
I'm not going to argue that.
But now that it's here, one thing it's
actually really good for is technical stuff.
And like I use it all the time to help me troubleshoot server.
Like you can ask Jonah, he used to be my go to person even before I
started working at Privacy Guides.
He was like my go to person where
I'm like, hey, I'm having a tech issue.
Can I pick your brain?
And now I think ever since I've started using AI for that, I think
I've only had to hit him up like once or twice like and I've had
one other issue that the AI was giving me bad information.
But I thankfully I able to imagine that you
read the logs and I might tell you what's wrong.
But you know, it's like it's really good.
Like 99 percent of the time it maybe not 99, but
for coding stuff specifically, it's really good.
And I think it's very I'm with you.
Like even if it does turn out that it's hype and it probably is
some hype like I mean, it's a company.
Yeah, they're trying to make money.
They're trying to get more investors.
Like there's always a little bit of B.S. marketing.
But even still, like I'm willing to bet
there's quite a bit of good substance under there.
And so it's it's good.
I guess what I'm getting at is it's good to see it being used for
something useful for once instead of like,
oh, let's make fake news and let's make a.
Oh, my God.
I've been raging the last couple of days
because I just uploaded a short video for the new oil.
I just uploaded one to like TikTok and stuff.
And every time I go to TikTok, I do it
on the computer and I'm not signed in.
So I get like the generic home page and
I swear to God, it's at least 50 percent.
AI slop like obviously a.i. slop.
And I'm just like, why are people using this website?
But, you know, it's so much like this is such a better use case for
that instead of, you know, I don't know.
Yeah, it's crazy.
All right.
So a few other points that I'll bring up is that coding in
particular, again, I'm a software engineer.
I've done this for a long time.
And one of the things that I think makes LLM supremely.
Good at doing code is code.
Software code has a very strict syntax and a very strict format.
And it's either right or it's wrong.
It'll either run or it won't.
Now, you can write code different ways to do the same thing.
But if you want code to work, it's got to
follow rules and they're pretty limited.
Unlike the English language, which has all
sorts of ambiguities, every language does right.
Coding language is very strict.
And so not only can you because it's so strict and the syntax is so
fixed, it makes it, I think, perfect for something like an LLM to
study lots of existing code that's already out there and then be
able to write new code from that.
You can also have it write tests and prove that
it works, which you can also do automatically.
So this entropic, these entropic tools and some of this is from
tools that are even before mythos.
But for mythos, what they told him was
literally this is the instructions to mythos.
Here's some code.
Read the code.
Find me a vulnerability.
And they walked away.
That's it.
And it found them.
It's that good.
And it's not some of these bugs.
If you're into cybersecurity and you'll know
that today, a lot of our software has gotten better.
It's gotten more secure.
We've put in lots of sorts of safeguards on software to prevent,
you know, it's a cat and mouse game.
You know, the cyber hackers figure out, you
know, oh, code is vulnerable in these ways.
And so we've actually rearchitected entire operating systems to not
let that be a vulnerability and where a
whole class of vulnerabilities have gone away.
So oftentimes today, when you're finding a vulnerability in
software and you find an exploit that allows you to take over a
system, for example, it's what it really is under the covers.
It's usually three, four, five, six chained exploits.
It's not any one bug that gets them in.
It's a set of bugs.
This bug gets me this far.
This bug lets me raise my permissions.
This bug lets me access this other software.
And by the time you're done, all of these things
together in order will get you this vulnerability.
This tool in this case found an exploit
chain that I think that was six links long.
It's it is that it is that good.
I'm here to tell you if this is the
real deal and we should be worried.
The next 12 months is going to be bumpy.
I mean, I don't want to.
I am not hyperbolic.
If you follow me at all, you know this is I am
not a chicken little skies falling kind of guy.
And I think there's also a lot of upside to like I think this
project glasswing for all the hype and everything.
I think it's still a good idea that we're doing it.
Once we build these tools into our software development process, we
are going to be shipping much, much cleaner
code with a lot fewer security vulnerabilities.
That day when it comes will be good.
Until then, we have a lot of software that exists already out there
that is not going to get patched that is at least not quickly.
And it's going to be vulnerable to these things.
So it's I'm not a prepper.
No, I'm not.
You know, but I'm telling you and I usually avoid hyperbole.
This is a case where I think the hype I think both things are true.
I think there is a lot of hype.
I also think these things really are that good.
And we need to I'm glad they're giving it access.
We're actually going to talk about the next story.
They screwed that up, too.
But I'm glad they give them access to ahead of time.
I think that's a good call.
Yeah, I think you kind of summed up what what there's there's a lot
of hype, but I think there's also a lot of substance, too.
So well, I guess real quick before we jump into that next story,
I'll give the audience a chance to disagree.
We'll try these polls out again.
Do you think I will change cybersecurity will be useful?
Let us know in the comments one, two or three.
But in the meantime, I'll let you
keep rolling and tell us more about this.
What what's the latest development in the mythos saga?
Well, OK, so this is this is one of
the downsides to doing what they did.
And so the one thing I think that they got wrong with this whole
project glass ring thing where they came out again, anthropic came
out and said, we have this tool that is so amazing and so good
called mythos that we can't just give it out to everybody yet.
We're going to we're going to let the the good
guys, the blue teams have access to this first.
And that was great.
But if I was in retrospect, I wouldn't
have told anybody that I was doing that.
I just would have done it and then
announced it when you could release it.
You know, you don't have to tell everybody you're going to do this.
And they went so far, by the way, just just to show you how the
hype works in this and the marketing work.
Somebody figured this out.
What they did was in the press release is they basically said, we
found we've already found all these bugs.
We can't tell you what they are yet because we don't want the bad
guys to exploit them yet because the people that the software that
has the bugs hasn't fixed them yet haven't released the patches.
So we're not going to tell you.
But we want we so badly want to prove to
you that we know that these are real bugs.
And what we did was we wrote the report with all the details that
explains and proves that we know what we're talking about.
And this was a real bug.
And then we took that report and we hashed it.
Now, if you don't know what a hash is, it's a cryptographic
function that basically takes any amount of input data and distills
it down into a fixed link number, essentially.
It's a big number to the point where if you took an entire book and
hashed it all the text from a book and hashed it, you get a number.
If you change a period in that book and hashed
it again, you would get a totally different hash.
It's like a fingerprint for the book.
So basically what they did, because they wanted to be able to prove
so badly that when this thing came out
like, see, we told you we knew this was here.
They took their bug reports and hashed them and released the hashes
so that when those bug reports eventually do come out, you can hash
them, get the same value and say,
oh, yeah, they really did have that.
They knew about that weeks ago.
So anyway, what what happened here is, of course, because they came
out and said this thing is super valuable.
Everyone's going to want this, but you can't have it yet.
Somebody figured out how to get it.
And the weak spot is always people.
So this article in TechCrunch, the summary basically is some some
group of people, I think they had like a
discord group where they they evaluate stuff.
They figured out by looking at the pattern of various clawed
releases, they kind of guessed where
the service was going to live on the Web.
Got it.
And then somehow through a third party, because there's always a
third party, there's always your partners.
Always what kills you.
They partnered with some people, some
partner had a had a vulnerability or something.
I don't know.
So I don't know if it was social engineering or what.
It's a little bit vague.
But somehow through a they've compromised a third party and got
access to the mythos tool ahead of time.
Now, we could only hope that they're not using it for for evil.
I don't know.
But but whatever you come out and say that these things are so
amazing, you're just paying a target on your back.
They should have.
They should have just waited.
I think that's all I got to say about that.
Nate, what do you think?
Any comments on that?
Sorry, I was having some slight technical difficulties.
Sorry.
All right.
Yeah, no, I I thought that was funny, too, that.
Yeah, it does seem kind of inevitable.
I feel like when I read this headline, I
was kind of like 50 50 on the one hand.
I was like, whoa, that's crazy.
And on the other hand, I'm like, yeah,
I guess that was kind of inevitable was.
But I don't know.
My my only real thought, to be honest, is that I'm surprised we
haven't seen any further developments yet,
because this was you see, this was on the 21st.
So that was like, what, Monday or Tuesday?
And I mean, it's a good thing.
It's a good thing, I guess.
And, you know,
the week is young.
Like we could still see stuff come out of this.
But it's like, OK, they say that they've got
access now, but what are they doing with it?
And so I guess I'm curious.
Because, yeah, we really don't know much, or at least publicly they
haven't said much about who's behind this.
So yeah, this this this smacks to me of somebody like almost like,
hacker interest group that just wanted to see if they could.
And they and they poked around and figured out they could.
And they did it.
A lot of, you know, a lot of hackers is just for the laws, as we
say, you know, it's just to say that we
could do it, maybe get a little street cred.
But if they can do it, what that really
means is someone else could do it, too.
And if I were North Korea or Russia or China or Iran or any one of
the other state sponsored actors, I'd be trying this, too.
And if they could, if these guys
could be in, the chances are pretty good.
Someone else can, too.
I if again, I know we talk about security through security.
And it's not a great thing, but it's also not a bad thing.
I entropic should have just sat on this.
They should they shouldn't have gone for all the marketing hype
with the we're sitting on something we can't tell you about.
And it's it's like I've got a secret, but I can't tell you.
Right.
I mean, we all know as human beings that never works out.
That's funny.
That's a really good comparison.
Yeah, that's yeah.
I mean, that reminds me of the the 80s and 90s hackers, like what
it was all about, just because you could.
And there was no real incentive behind it.
But yeah, yeah, I certainly hope that's it.
And I certainly hope we're not about to see a string of like all
these companies were hacked in a way where clearly they must have
been abusing me, those because there's nowhere
else that you could have done it or something.
But yeah, interesting stuff.
I think that's all I got.
And I feel like we've covered that pretty well.
Yeah,
Jonah's, I think, trying to give you a real
quick plug again, if you guys are enjoying Carrie,
which somebody said that in the signal trap, by the way, they said
they're really enjoying you on the show.
So fireballs, don't stop dragons.
FDSD dot me.
Definitely check them out.
And we'll talk about that a little bit more in just a moment.
But first, we're going to get into a fun story about Meta.
We all love to jump on.
Oh, yes, that is one of my favorite companies to pick on.
So Meta has started keylogging their
employees, allegedly to train A.I. data.
I'll be honest, the story is pretty
straightforward, but there's still some good takeaways here.
So let's start with the facts of the story.
Meta is installing new tracking software on employers' computers
that will measure mouse movements, clicks and keystrokes for
training its artificial intelligence models.
This is called the Model Capability Initiative, and it will run on
work related apps and websites and will also take occasional
screenshots of the employee screens.
And they say that the goal is they're trying
to improve areas where agentic A.I. struggles.
Well, they said the company's A.I. models.
I'm assuming this is an across the board thing or maybe their A.I.
really just sucks that much compared to everybody else.
I don't know.
I haven't used any A.I. agents.
I wouldn't know.
I don't trust them enough.
I don't mind telling me click.
I just it's a control freak thing.
I don't mind telling me like, hey, click on this article because
that's got the news you're looking for.
I do mind when it's like, let me go buy your plane tickets.
Like, no, don't.
But anyways, they say that they're specifically looking to improve
things like like when you have to choose from
a dropdown menu or you use keyboard shortcuts.
Apparently, that's something where A.I. still struggles.
They also said that.
Where did it go here?
Oh, yeah, here it is.
They said that the MCI would not be used for performance
assessments or any other purpose besides model training and the
safeguards were in place to protect, quote unquote, sensitive
content without elaborating on
which types of data would be excluded.
So.
I mean, me again, I hate meta.
I love to take shots at them.
So my first question is, it's not going
to be used for performance stuff for now.
And like, how are they going to if it's taking screenshots like,
OK, first of all, and I think this is probably where we're going to
start getting into the analysis portion, but like you shouldn't be
doing anything personal or work computer.
But hypothetically, let's say someone's opened like an email or
something like something that they need to do real quick.
I mean, we've all had those moments,
right, where it's like, I need to do this thing.
It'll take five minutes.
I'm at work.
Let me step outside and make this phone call or whatever.
So what happens when they open their email and that's the moment
that it decides to take a screenshot,
there is not a world in which you can
convince me that that is going to throw that away.
Like, yeah, I'm sure they'll say they will.
I don't believe it for a second.
Yeah,
Lucas says I want them to train their replacement.
They may.
Maybe you're not wrong.
Yeah.
So it's one.
So, OK, so one of the things I got from the article was that it
seemed like what they were really trying to do is, again, toward
this agentic I was talking about, they want to understand how
humans interact with this stuff so they can better implement their
agentic guy, which will take over and do these things for you.
So that's one of the one of the reasons
supposedly why they're why they're doing this.
And so let me just take a quick
segue to say you're absolutely right.
In my opinion, you're absolutely right.
Do not use anything agentic at this point.
I think it's really cool.
I love sci fi.
I can't wait for the day when this stuff is
trustworthy and I can tell my computer do the stuff.
It can do great stuff like my my doctor,
of all people, was telling me, oh, yeah.
So I started I installed called Kowork
and just told it to clean up my Mac for me.
And it went and found all these files and get rid of stuff for me
and tweaked all my settings and it's so much better now.
I'm like, oh, my God, like I can't trust
these things yet to do those things on my behalf.
I someday maybe I'd love that.
But no, we are not there.
We are already.
I bet you that story was so close to ending
with like and then it deleted all my my kids photo.
Right.
Yeah.
And so we're building some of the things we need to do.
And we're already starting to do them.
There's this thing called MCP, which I
think is what is model control protocol.
We're starting to build in frameworks into
our operating systems that allow these things.
So
you will they're already building in hooks, basically, software
hooks into our applications that
are operating systems for agentic AI.
So it'll be easier for these guys to
basically script and automate things on your computer.
So and that's good in the sense of it's coming from the operating
system vendor, Apple, Google, Microsoft.
Hopefully they're going to build in some guardrails.
And hopefully they're going to set up
types of permissions that you could give.
It's going to be like apps all over again, where you have to go
through and say, yes, you can have access to my microphone.
No, you can't look at my this folder that has my taxes in it.
You know, you're going to have to go.
You're going to have to go through that.
But right now it's the total Wild West,
you know, Claude, was it Claude Baut or Molt?
Originally, what was the what was originally called?
Open Claw.
It's Open Claw now.
I think originally it was Claude
Baut and then it became like Molt Baut.
And now it's Open Claw.
I can't remember exactly either.
And so so when I read that, first of all,
like that is that again, I'm an engineer.
I love to automate things like that's totally cool.
But I would never do that.
I would never trust this thing.
So I was like, OK, how do I do this?
So I'm actually building my own server to do this on, because I
first of all, I've got to sandbox this.
And so I've got to keep this totally separate from I would never
run these things directly on my
machine because then they run as me.
They could do anything I can do.
And in most cases, that means
you're admin, so they could do anything.
No way am I going to do that on any computer I care about.
But so I bought a dedicated computer for
this and I'm running local models only.
It's using Olama, if anybody's familiar with that.
So it's all local.
There's nothing cloud based on there.
And I want to try to get this thing to do this kind of things.
But it's going to be more like an assistant,
like it's going to have their own personality.
Like I've already got this box set up.
It's OK, this is going to sound horrible.
I totally understand that AI is not real.
Do not worry about me.
But I called it Sam and I called it Sam because that's the name of
the AI and her, which is a movie.
If you've not seen, you need to watch.
It's very relevant now.
That's been on my list for like a year.
Oh, yeah.
Go watch it.
It's in fact, I need to watch it again.
It's a weird love story with AI.
I'm not spoiling too much.
But it's it's really talk.
It speaks a lot to what we're
doing now with those agentic AI stuff.
So I called it Sam.
Anyway, Sam's going to have a memory.
Sam's going to have a eye, but it's all going to be local.
And Sam is different from me.
Sam is not me.
Sam is not sharing my accounts.
This is the kind of thing where Sam's got her own proton account.
Sam's got her own signal account.
Sam's got her own phone number.
And I and we will communicate my signal.
She will only ever respond to me
and she will do automated stuff, but
she's going to do it as her, not me.
And with whatever sharing kind of
permissions, I'm able to set up in like
proton or wherever we're going to share stuff.
So that that's that's how I'm attacking this.
But eventually we will get to the point, I
think, where these things will be trustworthy.
We are not there yet.
Yeah, for sure.
I don't know.
For me, I think it's just a control freak thing.
I don't you like.
I don't know.
I've never been in a job where I've had an assistant.
I've never.
You know, I've always been.
My mom raised me to be self-reliant and not
have to rely on like anyone to take care of me.
So for me, I think I'm just too much of a control freak to like.
And also, like I honestly, I do ask myself a lot.
I'm like, is there anything where I can offload this to AI and I'll
be, you know, like I'm being stubborn, I'm being a lot, even though
I know that phrase gets used wrong,
but, you know, I ask myself that a lot.
And I just I never seem to run into anything.
It's like I've tried having and I know this isn't a genteck AI, but
I've tried having like AI write blog posts before.
And I won't lie, it's really good.
Like I'm not going to lie.
I did this with with my interview or my
review of Cindy Cohen's book just for fun.
I'm like, OK, here's a link to my blog post, like my entire old
blog that I've been writing since like 2018 on write as.
I'm like, here's a link to that for tone.
I want a review of this book.
Here were my thoughts about it.
And it was really good.
I'm not going to lie.
But at the same time, I looked at it and I'm like.
But I just I'm not comfortable
publishing that like I didn't write that.
And there were definitely like a couple sentences that I was like,
OK, actually, I really like the way it put that
and so I'm going to use that specific sentence.
But there were like two sentences out of the whole thing.
I just I don't know.
I'm the same way.
I think it's I think it's a pick and choose kind of thing.
So think of it like I'm the same way I would love.
This is something I'm working on as well.
It's called RAG and I forget what RAG stands for.
It's it's an acronym.
But basically you feed it a whole bunch
of stuff and I basically want to give it.
Here's here's my book.
Here's my all my blog posts.
Here's the transcripts from my podcast.
But I want to know things like have I talked about this before?
When was the last time I talked about it?
Who did I talk about?
Did I have a guest where they talked about this?
What were the points that we brought up then?
Go back and look at my podcast that I
ever say something like, you know what?
If this if this changes, I'll get back to you.
And I don't want to forget that.
So go back and help me find to do lists
from things where I said, oh, that's good.
I told my audience I'd get back to you
on this and I want to make sure I do that.
But yeah, I've done the same thing.
I I would I don't think I would ever let it write an article for
me, but I have had it's like, OK, give me some bullet points.
Give me some ideas.
Here's what I'm looking for.
And I've done some brainstorming with it.
And I did for fun, kind of like you.
Like I would I'm too OCD about it.
I would never let them.
I've got to write in my own voice.
It's me.
And I like my tone and the way I do things
that I wouldn't trust something else to mimic me.
But I did, you know, I did say, OK, give it a shot.
Take this and just write this article as if you were me and see it.
It wasn't me.
It was a good death.
It probably will be Sunday, but it's not there yet.
I probably still wouldn't do it.
I'm with you.
When it comes to things like that, content creation, things that
I'm creating, it's got to be for me.
But there are so many things that I got on me.
Here's here's another one for you that I'm looking at doing.
And I've already kind of started putting some groundwork.
I hate most news aggregators.
I have an RSS feed where I can actually just, you know, I can get
the raw articles into a nice set of folders or whatever.
But what I really want is I want to write my own news aggregator
that goes and finds these things for me and then highlights the
ones based on my criteria that are interesting and then maybe even
notifies me like, hey, this is hot.
This is happening right now.
You might want to go check this out.
I want to and I want it to be tailored to me and I don't want ads
and I don't want tracking and I don't want data mining.
But in summarize, give me give me three bullets and they can be a
slightly executive summary version.
And then if I want to go on, I'll read the whole thing.
I would love to have something like that because most all OK, every
news thing I've used lately just sucks.
It's full of ads.
It's full of autoplay videos.
And I just can't stand it.
I'm going to build my own.
And so let me make another point.
That's where we are.
Another thing I'll make another prediction for you.
And Chris Belize would not like it because
and that is that we are in the age now of custom apps.
We're already there.
I'm already doing it.
And the rest of us are going to be doing it very soon.
This is going to put some software people out of business, certain
a lot of these subscription based ones where you're going to say
that I just read this article recently and I think I might talk
about this on my next podcast where this
guy, no, I actually did my last podcast.
He wrote his own word processor
because he was so sick of all the other ones.
He needs a certain set of features.
I don't need 100 features.
I need five.
And then I need of the five that
Microsoft Word has that I really do use.
I need two more that it doesn't have.
Like he likes Pomodoro time.
Pomodoro timers.
He's into that getting things done
system, which I've heard of never used.
He built that into his own word processor.
He just had, he just vibe coded the whole thing.
And so now he has a custom word processor that lets him, it has
folders where you can bring in source material.
Like here's a PDF I want to reference.
Here's a link I want to reference.
And now I want to write an article about this.
Help synthesize that for me.
He wrote a custom word processor.
This is what we're all going to be doing soon.
We're just going to be writing our own apps.
It's amazing.
I've heard other people make those predictions too.
Yeah, I don't know.
And I mean, I guess as far as vibe coding goes, I know for the
simple stuff, it's probably fine.
Like maybe a note taking app that does this and looks like this.
It's I think right now, once they, the
complexity is where it's going to go wrong, right?
Like somebody's going to be like,
"Oh, but I wanted to do 500 things."
And then it's like the next thing you know, your social security
numbers on the front page of Google.
But you know, yeah.
I will say not to like keep getting on the topic, but I will say
the, the Cindy Cohen, the article that I had
it write, the AI write was actually pretty good.
And I'll be honest, if I published it, I think most people probably
would have not noticed maybe, but it's
still just, it just doesn't feel right.
Like it's, like you said, it's not me.
So, and then real quick, I, I was just going to say, I'd feel bad
if we didn't touch on this, the whole like the bossware aspect of
this meta story is, you know, just to kind of remind, I don't know
about other countries, but here in America, like I don't think, I
mean, it does specifically say that
this probably would not fly in Europe.
The Reuters article here did say that.
But I know in America, like they can't make
you download anything on a personal device.
I think on company computers, they technically can, which is also
why again, you know, we made a point of like, if you can try not to
do anything on company computers.
I know everybody's in a different situation.
Some people are, they're in a situation
where like, that's the only computer they have.
And that's really unfortunate.
But if you can try to, to keep
your stuff compartmentalized for sure.
We get into all that stuff in this interview
area coming up, I think it's going to be late May.
So it's good.
It's going to be, I think three, three interviews out, which is six
weeks, because I alternate between
news stories and interviews for my show.
But we talk about that.
We get into those details a lot about what
they can and can't do and what they are doing.
And the fact of the matter is it's their equipment.
And you're right.
So if you're using their equipment, you should assume that they
can, they know everything you're doing on there and they can
legally, you don't, you don't have the right and
expect expectation of privacy on a company device.
So from that perspective, I don't think just because it's right
doesn't mean it's not creepy and are legal.
Let me say it's not right.
Just cause it's legal doesn't mean it's not creepy.
And that's what Facebook is doing here.
It's going to be super creepy.
And, you know, the Microsoft recall
was, was another thing like that, right?
Where Microsoft had this built-in AI agent that's going to keep
track, take pictures every of your screen every few, every few
seconds, I think is what they were doing.
Yeah, I think it was like every three seconds or something.
Yeah, read all your texts so that you could ask it later.
I mean, what was that website I was looking at before?
Or Hey, what was that email I started and then deleted?
I want to do that again, you know, but, but that
also means that we're going to mind that stuff.
And their security, of course, when
they first released, it was horrible.
But anyway, yeah.
So these devices you should assume, even if it's your own devices,
if it's a mobile device, we call it BYOD, bring your own device.
If you're, cause it used to be
issued a company phone back in the day.
And that's a lot less common now you bring your own phone because
nobody wants to carry two phones.
And so they put an MDM profile on your
device, which allows them to do certain things.
Usually it's pretty sandbox is my understanding actually.
Again, we talked about this in the
interview, but that is actually pretty clean.
And like they don't cross the streams.
Like they get access to Outlook or
whatever the company wants you to install.
It might force you to have a pin or a pin of a certain strength on
your device, things like that security, things
like that's cause they want to protect their IP.
And by that, I mean intellectual property.
But yeah, when it comes to the corporate laptop or the corporate
desktop, if you've got one of those, you should just completely
assume that even off hours, if you've taken it home,
they can, they can, they're probably
not doing it maliciously right now.
Like there's not somebody sitting in a security room somewhere to
like flipping through channels and look at
what employees are doing, but it's being recorded.
So they could go back at any point and look at logs and look at
those kinds of things and, you know, find some reason to fire you.
Yeah, I used to at my last job where they gave us
a company laptop, I, it was on the guest network.
So it was behind a VPN.
It was isolated from everything else.
And I would like, I would come home, I would log my hours, I'd send
my daily report and I'd turn it off and
put it in my backpack and put it away.
But, and I really tried to get in the habit of doing that before I
even left the job site, just because that way it's like, I don't
know, it just felt like it saved up
so much more time when I got home.
Like I get home and I just go straight
into shower, eat, whatever, but yeah.
Yeah, setting boundaries.
And that was a good way to do it, probably.
Yeah.
All righty.
So I think we're at the point in the show
where we will start taking listener questions.
Right on.
So if anybody, bring it on.
All right.
Yeah, if anybody has any questions, I know the chat's been pretty
busy, but if you have any more you've been holding onto, go ahead
and start leaving them in the comments or in the forum thread,
we're gonna check that in a minute.
But first on the topic of the forum, we're
gonna check in on, well, the community forum.
So there's always a lot of activity.
This week has been really busy, a lot of chatter.
I mean, we've posted a lot of articles and videos.
So a lot of chatter this week.
But this week I wanted to highlight specifically
a couple of very closely related forum messages.
So one of them is,
somebody said, "How much privacy can I really
have "when I'm being ratted out by my friends?"
And interesting choice of words there.
But basically they mentioned that they
have a friend that they play sports with.
And that friend recently said they
chose their team lineup using chat GPT.
So basically they told chat GPT all their friends, like playing
styles, strengths and weaknesses.
And they said, "Although the information "was probably subjective
and not highly sensitive, "I'm still uncomfortable with it."
And kind of just went on to talk about,
how do we interact with people who may be a little bit less privacy
focused than us and may not necessarily
see the issues with that kind of stuff.
And similarly, there was somebody
else who asked about messaging apps.
They said they made a friend who uses Line,
which is a really popular messenger in Asia.
I think it is technically end-to-end
encrypted, but don't quote me on that.
It's definitely proprietary either way.
So basically like the Asian version of WhatsApp.
And they said, "Why don't we use Signal?"
But the person declined.
They said, "I don't know why they declined to use Signal."
Apparently they said Asian mainstream media sometimes intimidates
people away from secure messaging apps because it associates them
with criminal activities, which is really unfortunate.
But they were kind of asking in that
specific scenario, like, "What are my options here?
Like I could sign up for a line
using this, I could use it this way."
But again, the overarching theme here that I really wanna discuss,
cause I know you and me, Carrie, both kind of come from a
background, like me at the New Oil and you at Firewells, and I
stopped Dragons, we come from a background of like kind of trying
to meet people where they are and trying to like nudge them towards
better security, but also accepting that unfortunately, a lot of
people are just gonna do the basics.
And sometimes we'll just be lucky if they even do the basics.
But so yeah, what are, I know this is a very nebulous way to word
this question, but I mean, what are your
thoughts on that, finding that balance between like
accepting that you can't always force people to be as into privacy
as you are, but also like still wanting
to preserve your privacy and respect that?
No, I think that's a really good point.
And it's something I think a lot of
people lose sight of and it takes two to tango.
And so you've got to trust the other people in your group.
And that is another actually a great feature, a signal where you
can set your messages to be disappearing, which is nice, right?
So at least you don't even have to count on the person at the other
end to make sure they're wiping the device every so often if you
could set that, which is another great use for signal.
In this case, this person was using this other tool, which I don't
know if it has such a feature, but even so you've got to, I mean,
as far as if you're threat modeling, what's going on, you've got to
just take into the account that everybody that you're talking to,
end-to-end encryption only goes to the ends.
And so any of those ends could be compromised, right?
And like, what was it?
We're good on ops sec, right?
When the guy- We're clean on ops sec, I think it was, but yeah.
We're clean on ops sec.
So clean.
Yeah, right.
So, yeah, it's something you gotta take into account.
And as far as how do you,
this is a perennial problem with this, with security and privacy
tools in general, is that you've got to,
and I struggle with this.
I mean, you want to communicate to your friends.
I'm on several group chats that are just, the ones that drive me
the most nuts are Android slash iPhone group chats, where you're
getting green bubble messages everywhere.
And some people have older iPhones,
so they're like duplicating messages.
And when someone puts a highlight on a message, instead of
highlighting it says, there's a text
message saying, so-and-so it said, "Haha."
You know, so you know, technically that's
all, you're already screwed, plus it's SMS.
So, you know, there's no security.
And I would love to say, "Hey guys,
let's all go to Signal and do this there."
And I just don't, I just shut up and roll with it.
So there's only so much you could do.
I've convinced certain sets of my
friends to use Signal for when it matters.
And I keep trying to get more, but that, well,
this is why it needs to be the default everywhere.
So, you know, so there's, there is no choice.
You don't have to worry about it.
Everyone's just, we should all just have it by default.
It's not a criminal thing.
It should not be, should not raise
eyebrows when someone is using end-end encryption.
It just should be the default.
Yeah, for sure.
And thankfully, like now RCS is starting to come with encryption,
but I know that's still in the early days.
I don't even think it's out of beta on iOS yet, but, but even then,
you know, RCS comes with metadata concerns, but it's certainly a
step up from, like you said, SMS, which is, I always tell people,
I'm like, SMS is basically a postcard at this point.
Yeah.
But yeah, it is really frustrating.
Cause like my, my brother, I'm very close with my
brother, but he's pretty much all in on Discord.
Like you might maybe call me on like a cell phone if there's an
emergency, but he's not going to switch
to Signal or anything, but it does suck.
But yeah, I think kind of one thing you said toward the beginning,
if I heard you correctly, you kind of mentioned threat modeling,
and I think that's a really important thing that,
you know, I'm a firm believer that like
privacy should not negatively impact you.
And it's definitely great to try and like encourage people to use
these messengers and try to nudge people
towards that and offer to help them out.
You know, like it's such a fine line to, between like being pushy
and being helpful of like, hey, what if I install it for you?
Like, would that make you more likely to use it?
Cause I've run into those kinds of people.
Like I've mentioned on previous episodes, I have my stepdad on
Signal and we have like a family group chat.
We're probably the only people he uses Signal with, but like I put
it on his phone and he uses it, no problem.
And I guarantee you, it probably would have been crazy to talk him,
I think he's almost in his seventies.
It, he might be in his seventies now.
And he's just, he's one of those, you know, obviously there's a lot
of like tech savvy older people, but he's not one of them.
And I'm sure trying to walk him through it over the phone or
something would have been a nightmare, but we just got together one
time and I was like, hey, if I put
this on your phone, will you use it?
And he's like, yeah, absolutely.
And so it's super awesome having all of
us in there now, but yeah, it's, excuse me.
But where I was going with the threat modeling is, you know, just
remembering that it's, how important is it?
It's, it's finding that trade off of like,
this person is important to me.
I'm willing to, you know, have, have this SMS conversation, but
also recognizing that maybe there's some things I'll wait to say
until we're in person or, you know, some things, I don't know.
So it's a, it's a top line for sure.
Like, well, so when it comes to things like family, like one thing
I did for my family is I just went ahead and
sucked it up and paid for proton family for everybody.
And that, you know, so once I'm paying for it, it's, it's, it was
easier to talk them into doing it a
little bit of, little bit of a guilt.
Cause that was my first thought.
If I did that for my family, I'd have to guilt them into it.
Guys, I spent like $600 on this.
Come on.
Right.
I wasn't, I wasn't above doing that for my, for my family.
So yeah, I totally agree though.
Helping other people do it could be a big, can be a big way to go.
Back to threat modeling.
I wish we could come up with a more,
less scary term for that.
Threat modeling sounds really technical.
It sounds really scary and people
like that immediately turns people off.
I wish we could come up with a better
marketing term for evaluating your situation, right?
Yeah, that's why I did give a talk recently
and I basically had to like recap all the basics.
And I started with threat modeling and I always tell people, I'm
like, it's just a fancy way of saying, what are you protecting?
Who are you protecting it from?
Like it's, it sounds scary.
I think we use it cause it makes us feel like spies and that's fun,
but it's a, it definitely sounds intimidating.
But yeah.
The privacy dad said I put graphene on my
partner's phone and I don't even think she realized.
Honestly, yeah.
I kind of want to ask my wife that because she also has a pixel,
but she's at the point where she settled in.
She's got all her apps on there and everything.
And I've asked her before, I'm like, hey, can I flash your phone?
Like put something on there.
And she's like, yeah, but I mean,
at first she was like, yeah, sure.
And then when I told her, I'm like,
you're gonna have to reinstall everything.
She's like, oh God, that sounds awful.
So I think next time we buy phones, I'm gonna be like, okay, before
you sign in, can I flash this phone?
And then it's all yours.
So.
I think browsers are a thing that really fit in that category too.
I mean, surfing the web, there are
some nice features here and there.
Most people probably don't use them.
If you replace somebody's browser, I think the chances are pretty
low they're even gonna notice because
they basically function the same way.
I have seen multiple stories on Reddit of more tech savvy people
who were like, oh, I went to my mom's house and found out she was
still using like Windows Explorer
or Microsoft, whatever it's called.
Internet Explorer.
Internet Explorer, yeah.
Yeah, and so it's like, I replaced it
with Chrome, but I changed the logo.
So it still says Internet Explorer and she
hasn't even noticed that it's been like six months.
Oh, that's funny.
I mean, some people for sure could definitely do that, but I feel
like Chrome is different enough that I think most of the people in
my life would notice like, wait, something's different, but yeah.
So, all righty.
I think on that note, we'll dive into questions and we'll start
with the questions on the forums, specifically if we have any
paying members or if we have any questions, I
don't think anybody did, but I'll take a look.
And if you want to become a paying member, you can go to
privacyguides.org and there's a little red
heart icon in the top right corner of the page.
So I told you all this brave story was extremely controversial and
I'm not kidding because if you go look at the forum post for this
episode, it's mostly people discussing amongst themselves.
So the first question came from Nisromo who said, "I'm sure you'll
talk about it, "but please be sure to
make a case "both before and against."
I hope we did that because I personally feel very split on it.
So I apologize if I came off as very
like either way because I don't know.
I see both sides of the argument personally, but.
Yeah, yeah, me too.
And yeah, again, to me, there's a difference between the marketing
aspect and the financial aspect of this.
I think the marketing was kind of weird,
but that doesn't mean you still can't do it.
And if you want to support them, that is a way to do it.
And if it gets you a better version of the browser or automatically
turns off all those things that drive you nuts, sure, I guess.
I can see either way.
So we did have Cs listed a couple of questions here.
Let's see, "I'd be interested to hear your thoughts "on the
following topics and stories if you have time.
"I know some of these stories."
So we can go through them pretty quick.
Did you hear about the Bitwarden CLI?
I did.
Was it compromised in the supply chain attack?
Yeah, I did.
Do you have any thoughts on that one?
Not on that one specifically, but supply chain attacks are a
serious, serious problem that needs to be fixed.
We need to lock, that is, we found
another soft spot in our processes.
And as a software engineer, I can tell you that that is,
for example, one of the things that's often done in software is
that you say, "Here's a list of software libraries I depend on."
Because software today is not, no one
writes their own software top to bottom anymore.
We're all using, it's a Frankenstein.
You're taking a piece of this, a piece of
that, because someone's already done it.
So why reinvent the wheel?
And so you bring in all these various parts and
libraries, some are open source, some are not.
And if you don't specify,
by default, what usually happens is it's
like, "Okay, here are the 10 things I depend on."
They'll get you the latest version every time.
When you do a new version of software, it will go and fetch the
latest version, because it figures you want that.
That's where the supply chain attacks bite.
So one of the things we could be doing and should be doing for all
these things is what we call pinning, where you say, "Okay, here's
the 10 things I depend on, and I want these
specific versions unless I tell you otherwise."
So at least if you get to the point where you can trust the
versions that are there, you're not gonna get bit because one of
those got taken over by somebody and the next version has got
built-in malware, because you're not
gonna go get that version automatically.
There are things like that.
There's processes that we need to, the new best practices that we
need to adopt, but that is a definite
soft spot today with software engineering.
So I don't hold it against the Bitwarden-Steel Eye folks.
It's probably one of those kinds of things that bit them.
Supply chain stuff is a serious problem.
Yeah, and I do wanna say for the record, for those who aren't
familiar with the story, because it is pretty new.
It just happened like the other day, I think.
So this was a,
like Kerry said, supply chain attack.
So it wasn't Bitwarden itself.
It was one of the libraries they used.
The library itself was actually only
compromised for about two hours, not even.
I think it's like an hour and a
half, 557 PM to 730 PM on April 22nd.
Bitwarden confirmed the incident.
They said that the breach affected its NPM distribution channel,
and only those who downloaded the malicious version.
So hopefully nobody downloaded it in the hour and a half window.
They said there's no evidence at this time that any end user vault
data was accessed or at risk, but they've already fixed it up.
So yeah, I mean, I'm with you.
You talk about the supply chain.
What do you call it?
The bill of materials?
Or a manifest.
It has different names, but yeah.
You mentioned that a few times on the podcast, and that's
definitely, I think, I was real hopeful for a minute there.
We were seeing a whole bunch of supply chain attacks.
Oh, S-BOM, software bill of materials.
Yes, I have talked about that several times.
Keep going.
Yeah, and I remember thinking, I'm like, we might finally start
making some progress on this, but I
haven't really heard anything, so I don't know.
That is something that as a software
engineer, I would say we should all have.
And it sounds maybe easier than it is, but basically what that is
is that ingredients list for your
software, and you publish that with the software.
So you can say, these are all the
things that my software depends on.
Now, some companies are gonna say lots of proprietary secret, even
if I'm using a public library of some sort, OpenSSL, let's say.
Even if I'm using that, I don't wanna tell people I'm using that,
because maybe, again, security through obscurity, maybe it's gonna
expose me to people who's gonna find an exploit in the version I'm
using, and then try to exploit me.
Okay.
But the flip side of that is it also tells people, if we had
software bill of materials, if every piece of software you
downloaded came with a machine readable list of ingredients that
went into that software, then your operating system could keep
track of all that and find like, oh, OpenSSL version this, which
you have in this app, in this app, in this app right now, is been
compromised, which means those apps are then compromised, you
should stop using them, or update those apps right away.
It would give us that transparency and that visibility that will
allow us to react to those things.
So I think, yeah, you could look at it,
it's just kind of like open source software.
A lot of people say, well, if I show you, if I open Kemono this
whole thing, you're gonna know how to exploit me.
Okay, but the upshot, when you look at net net, it's better for
everybody, if people have had a chance to review that stuff, and
now we've got tools that'll do it, like Mythos, that will find bugs
in it, hopefully so you can fix them, as
opposed to just hoping that nobody finds these bugs.
So yeah, that was software bill of materials or S-bomb, which I
think is a fantastic idea, but yeah, it has
not really, unfortunately has not caught on.
Yeah.
Yeah, it's, oh, I was gonna say,
if you haven't, last week's episode, I think we talked about this,
because cal.com went closed source.
Yeah, no, I heard that, yes, I did listen to that.
Yeah, I was gonna say Discourse, which is our forum software that
we use, their maker kind of issued a very, very aggressive rebuttal
where they pointed out, kind of like you're saying like, yeah,
okay, security through obscurity might slow them
down a little bit, but probably not that much, but
yeah, it's- Well, they also got into the lighting.
Okay, good.
I was gonna say, like, you mentioned earlier that like security
through obscurity isn't necessarily bad, and I agree with you on
that, because to me, it's like, it
should be part of a defense in depth.
Like if you're only relying on security through obscurity, that's
probably bad, but if you're layering
it with other things, like- Correct.
Like password logging, password logins, right?
That's a really good example.
If your credentials, if you're not using the same password, and
you're not using the same username on every single website, that's
a little bit of security through obscurity,
but then you layer it with like two factors.
So probably not the best example.
(Laughs)
Yeah, so yeah, you definitely don't wanna rely on security through
obscurity, but it's also another
layer that doesn't hurt you either.
I mean, you know, but where I take
exception to that is with open source software.
I think it does help to have other eyes on software, and now other
tools that can look at that software.
And I know you've mentioned this fact, I think you mentioned it
maybe last week, where you said, you said that just because it's
open source doesn't mean it's gotta be more secure, but it gives
you the opportunity for other people to look at it and perhaps find
bugs and get them fixed, which is a good thing.
Yeah, that's my take at least.
(Laughs)
So this person did have a couple
other things they wanted us to look at.
Did you hear about how Firefox is
actually gonna start adding built-in ad blocking?
No, I hadn't heard that one yet, huh.
Oh man, I'll have to go find you an actual article because this
one, they just linked the Mozilla Bugzilla,
like their little in-house GitHub kind of thing.
I've seen at least one article write up
about it, but I'm not sure how good it is.
But yeah, they're basically going to,
they're gonna be using Brave's ad block
implementation, which I believe is written in Rust.
And again, I was traveling this week, so I didn't really read it
that closely, but I think it is,
let me see if I can go find it here.
Yeah, they're gonna be using Brave's ad block Rust engine.
And it's basically gonna be like a little bit of a built-in ad
blocker, which I think is really cool.
How my YouTube reaction-- Because Brave's built-in ad blockers,
because it's my secondary browser,
so I don't surf everywhere with it.
Is the built-in Brave stuff pretty good for blocking ads?
I mean, I think it's pretty good.
Is it comparable to UBlock Origin?
I was gonna say, I think it's
honestly just like a copy of UBlock Origin.
I think they make some changes to it, but I
think it's largely based on UBlock Origin,
or at least it uses a lot of the
same lists that UBlock Origin does.
So I don't know why they didn't just go with that personally, but
yeah, it looks like this is a pretty...
Jonah says here that Brave's is a little bit lighter weight.
So, okay, let's see.
Oh, this is a pretty short article.
Mozilla's bundling, pretty excited to see them finally.
It landed in 149.
Oh, okay.
It's an experiment.
It's disabled by default, no UI, no filter lists,
but looks like Waterfox rolls it on, and then he
talks about how to enable it in your about config.
So I might, if I remember, I will try to add that to the show
notes, which means I might do it tomorrow
while I'm making clips of these, but yeah, no.
I mean, I'm really excited about that
because I think personally that's been...
I have a lot of little nitpicky complaints with Firefox,
and then I have a few that I think are kind of bigger, I think this
is kind of somewhere in the middle is...
Okay, so actually, let me premise this, or preface this.
So when I make shorts over at the new oil,
I'll make shorts about ad blocking, right?
And I'll tell people, I'm like, download Brave.
And people get mad at me because they're mad at the company behind
Brave, they're mad at the guy at the
top of Brave, which is fair, that's fine.
And they're like, well, you should use Firefox.
And it's like, okay, but I'm making a TikTok video.
And what are people more likely to do?
Download Brave versus download Firefox and then install UBlock
Origin and then make these dozen
changes to bring it up to Brave's level.
Like Brave is just so set and forget,
and we have to make it easy for people.
And so I really appreciate that Firefox is like doing that and
getting up to that level where it's like,
now it's becoming easier to recommend that people just like go
download Brave or go download Firefox, they're both equally good.
And I'm excited to see them getting up to that level personally.
Okay, so I'll be flipping that back at you.
So one of the reasons that I didn't go to Brave and sometimes the
reason I don't tell people to use Brave, as I recall back in the
day, and this may have changed, having to like disable their bat
token thing and having to disable their AI now and have it, which
by the way, Firefox, their new CEO is
like, we're all in on AI, I'm like, no.
Anyway,
so for me, it was like, okay, yeah, Brave out of the box was
private, but then I'd also have to tell people
to disable this, disable this, turn this off.
So to me, it was kind of a wash.
And I mean, don't get me wrong, like if you go to like privacy
guides, for example, if you go to our website, we do have like a
recommendation, like you should still tweak these things.
But I think, I kind of think for some
reason, most people just don't care.
Like again, when I look at my wife's computer, she's got the bat
stuff turned on, she's got the sponsored images turned on.
Like I think,
and for the record, I'm not saying this
in praise of them because I'm with you.
I kind of wish that stuff wasn't there or at least I wish it was
off by default because I'm pretty sure the crypto people are smart
enough to go looking through the
settings and know how to turn things on.
Which by the way, Joni just said,
that's the point of the new Brave Origin.
Yeah, true, good point.
And actually on that note, Cass here said, maybe Firefox should
sell a $60 alternative for the app in default.
You know what, I'd pay for that.
I'm not even gonna lie, I would pay for that.
And it would be a sustainable business model, unlike just buying
random extensions nobody's ever heard of.
And then killing the ones that people actually liked.
You mentioned Pocket before we started recording.
That was like the one time Mozilla killed something and everybody
on my Mastodon timeline was like, dude, what the heck?
Yeah.
Anyways.
But no, I think it's, for better or worse, I think Brave has
designed those features in a way where
they're not really intrusive to the average person.
So I don't know, it's, at least I've never
heard anybody complain about it, but I agree.
It would be nice if they turned it off, but I think it's still just
an easier sell to tell people like, go use Brave, that's one step,
versus go use Firefox, but also you need to make some changes, so.
I will give Brave some credit in trying to
find a different way to monetize the internet.
Because it seems like, you know, micro
payments was gonna save us at one point.
Like, okay, we're gonna do micro payments.
And then there was this push for a little while of, let us mine
Bitcoin while you're on our page.
And it's all running in the browser, it's all contained, but you
know, hey, while you're on our site, there's this little thing
running in the background that's trying to mine Bitcoin.
I thought those were at least interesting.
Because ads, ad-based internet is what's
causing all of these problems in the first place.
We've got to find some other way to monetize
the internet that's kind of free-ish, right?
That people don't have to necessarily, I don't know.
So I give them credit for trying
to come up with some way to do that.
I just don't like what they chose.
No, and I agree with you.
And I find myself doing that too.
Like lately I've really been thinking a lot about,
I'll be honest, I just think a lot
about diet and finances and stuff.
And I'm like, man, why am I willing to buy,
especially with inflation and everything, like a soda is like $3
now, and it's gone in like an hour, but I'm not willing to pay like
five bucks a month for some kind of membership or something.
And it's just, it's so weird.
Like marketing's got us all messed up, man.
(Laughing)
I don't know what the solution is.
Because then on the other hand, there's certain things where I'll
admit, like there's certain YouTube channels I watch where I'm
like, I like this channel, but quite
frankly, I don't get enough value to pay for it.
If it went paid tomorrow, I would just stop watching.
But then, there's other things that it's like,
yeah, but I do get a lot of value out of this.
Like why am I not paying for it?
I don't know, it's weird.
It's weird what's happened to us.
But sustainability is an issue for everybody, I think.
The last one we had here is they were asking if we had any thoughts
on the way that Signal handles edited messages.
So I don't know if you've noticed, but basically when you edit a
message on Signal, I guess people
can see the changes that you made.
Oh, I actually had not noticed that.
I don't know if I've noticed that before or not.
I personally think that's perfect.
In fact, I've argued for that on social media, especially the damn
sites that don't let you edit your messages.
Oh my God, that drives me nuts.
Let me edit it and fine, keep the original.
I'm actually okay with that.
So that people can see if you've altered something.
I think that, especially on social media, perhaps, you could say
maybe for public figures, but whatever, everybody fine.
I think that solves the problem with the editing thing.
Edit it and just let people see your past edits.
And I think that preserves the, what's the
something trail, the audit trail or the log trail.
I'm okay with that.
Do you have an opinion?
Do you do not think that's cool to be able to go back and see,
because when I edit something, usually it's a typo or I want to
expand on something or realize that something I said was ambiguous.
So I want to add a little notes like this.
Here's the context that is missing from this
that so you can understand what I'm saying.
That's usually why I would edit a message on Signal.
Do you have a problem, what do you think, with showing that it's?
No, I mean, me personally, no, because I'm
kind of in the same boat as you, where I feel bad.
I try to reread my, especially longer messages, because like I
said, I am pro at typos or just forgetting a whole word.
Usually it's a small word, like the, or something like that.
But yeah, so a lot of the time I'll send a message.
And then if it's a long one, I'm like rereading it and I'm
constantly like, oh, go edit, I miss that word.
Oh, go edit, I type of that.
Oh, shit, go edit again.
And I try to group them because otherwise I feel like I'm just
gonna keep pinging the person every
time I edit it, which is annoying.
But I don't know, I think somebody pointed out, like I hate to do
whataboutism, but somebody pointed out that like, I feel like the
bigger concern here is, because basically they were saying like,
what if basically you said something
you didn't want the other person to see?
Like maybe you sent the wrong message to somebody or you like,
maybe you're having an argument, you said something hurtful,
which-- Could you just delete that though?
I mean, delete, just delete.
Well, so for the record, that's my bigger
concern is because I've, I struggle with depression.
I'm pretty open about that.
And every once in a while when I'm depressed,
I'll say something to somebody, like not
anything hurtful, but like I struggle to reach out.
I'm trying to figure out how to word this.
But then sometimes I'll doubt myself.
Like I'll send somebody a message and then my brain is just like,
man, just like, don't bother them with your crap.
And so I'll delete it.
And I've actually had times where people were
like, like, hold on, I saw you deleted that.
I saw the message preview, like, let's talk about this.
And I'm just like, oh my God, dude.
And you know, like that one's kind of relevant.
And that one's a good one, right?
Like people are trying to like help me out and be there.
But like, that's the bigger concern to me.
And I know this is again, this is kind of like what about is, but
like most people have notifications
turned on and the previews are turned on.
So what happens when you delete the message,
the preview doesn't go away, it's still there.
So I don't know, to me, that would be the bigger concern is like,
they're still probably gonna see
that preview even if you delete it.
Cause otherwise, yeah, I'm with you.
Like that would be the easy workaround is
just delete it and redraft it completely.
So yeah, I don't know if this is, I guess that's what I'm trying to
say is, I don't know if this is the bigger concern.
I think the bigger concern would be the message
previews that most people likely have enabled, but.
I thought it was interesting that we talked a little bit about the
signal thing where they figured out how to, I mean, this was as far
as I was in a bug in iOS, which by the way, they just fixed,
where they got into the signal messages to somebody because the
notifications, there was a whole database for the notifications.
And if you have those set to show in
your lock screen or certain situations,
they will get put in this database.
Even if you delete the app, which was the big thing.
So I think what Apple finally fixes, if you delete the app, it goes
to this database and also deletes the history of notifications.
But, you know, I don't know.
I guess delete should be delete.
I think that's, to me, that would be the solution.
So delete is delete.
So if I delete, it deletes it from all
this memory that should not show up anywhere.
If they happen to see it, I can't stop them.
But if they hadn't seen it yet, I delete it.
I think it should just be gone from their phone.
I think that's the delete angle and
hopefully that would cover most cases.
But I think otherwise edits, sure, I'm
fine retaining the edit history, I think.
And I wish that, like I said, I wish that that's how they would
solve edits on social media as well, because I
hate the fact that I will do this all the time.
I'll put a notice on Twitter.
I don't wanna get an eight-mail.
I don't like, but I gotta be there
because that's where a lot of people are.
So anyway, otherwise I don't like Twitter.
We have a Twitter too.
Yeah, it's the curse of being a public figure, I guess.
So I post on Twitter, and you can't change it.
And so I have to delete it.
And it very, by the time I'm posting on the third, I'm copy and
pasting to the third thing, I've done Mastodon and Blue Sky, and
I'm like, "Oh crap, there's a typo."
And I go back and fix Mastodon.
I can't fix Blue Sky, I can't fix
Twitter, and I gotta delete and re-add.
And of course, by then, someone's already liked
it, and I've just lost, anyway, drives me nuts.
How long has Twitter been around now?
And I swear to God, back when I used to use Twitter, back in like
2012, people were asking for that.
And why, is there a reason why they don't have it?
I don't get it.
Like, what's the reasoning?
I honestly don't know, I couldn't tell you.
I don't know if there's some kind of technical.
Well, I know, okay, so I know on Reddit, when you make a post, you
can edit it within the first, I think like five minutes, because
Reddit has a huge problem, or at least had, I don't know if they
still do, but they used to have a huge problem with like people
would go in, and they would make a comment, and it would get like a
lot of upvotes or whatever, it would get visibility.
And then they would go in and like edit the comment and make it say
something completely different, like sometimes something borderline
offensive or crazy, or like they would like make it seem like the
person responding to them was saying something crazy.
And I don't think Reddit lets you see the post history, but there
is a little star, and that means it's
been edited after that little five minutes.
So they give you like a little window where like, if you're like me
and you're like, oops, I forgot a word,
like you can go edit it and star is not there.
Yeah, that's not a bad compromise.
But yeah, if you come back an hour later.
But I do think if you edit it, it should wipe all likes.
I mean, it should start over, because for that exact problem,
because yeah, I don't want to put up something like, I love
puppies, and everyone says, yeah, thumbs
up, and it's like, and also I'm Hitler.
And you said that later, right?
Yeah, that's the kind of thing people were doing, I think.
Yeah, I mean, Anonymous here is a good point.
Like they should make it, if you disable edit history for yourself,
you can't see others edit history, which I mean, Signal already
does that for like Red Receipt stories.
Like I do have stories enabled, but I don't have view history.
So I can't see who sees my stories, and they can't see when I like
there, it's, you know, it goes both ways.
So I mean, that seems like a good compromise, but I don't know.
Yeah, interesting stuff.
Interesting fun things to talk about, but.
Totally agree.
I think that was actually all our questions.
It looks like all the other posts
were people discussing the brave thing.
And man, this was such a very contentious topic.
People have, which I mean, I'm not saying that's a bad thing.
Did they cover anything that we didn't cover?
Are there any angles to this?
I don't think so.
They're just kind of explaining, I think, let's see here.
They're talking about what counts as a license.
Like if you install, if you reinstall your operating system, does
that count as one of the 10 activations?
How do you get activations back?
So if I go through 10 devices when I buy that
11th device, how can I get my 10 activations back?
So yeah, I don't know.
Oh, can I throw out one more story?
I've got one more story.
Sure, I love stories.
This goes back to the AI coding stuff.
If you can't tell, I'm kind of fixated on this lately.
So do you remember, did you ever watch "Halt and Catch Fire"?
No, but it's, I've heard of it, or I've heard the phrase at least.
The first season satirized a thing that actually happened.
And that was back in the day in the, I guess in the 80s when IBM
had a proprietary BIOS for their PCs.
And of course, and they wouldn't, you
have to license or sell it or whatever.
Somebody figured out, hey, I got to take a group of engineers and I
got to say, go dig through this BIOS and figure out what it does.
I want you to look deep into it.
If you can find the code, find the code, but give me a spec.
Tell me what this BIOS does and describe it.
And then, okay, give that to me.
And then what they did is they hired a whole separate set of
engineers and said, here's your spec, make this.
So what they called, that's called a clean room.
And basically what they did to get around the copyright and the
licensing was they reverse engineered it.
And they had one group reverse, they had one group actually pick it
all apart as a black box and come up with all the specs for it and
hand that to another group of engineers who'd never seen the code,
never worked with it to create a
complete copy that works just like it.
And so that's how they got around
this thing, they reverse engineered.
Somebody has come up with, and they said
this was supposed to be satire, but it works.
They've come up with an AI tool that
will take a code, you give it any code.
I think it mostly works on open source code,
but you could, by the way, you could decompile binaries from
regular code and still get the code.
So even a side open source, you can still kind of get to it.
He created a tool that takes one set of AI agents and picks apart
the software, learns it, writes a spec, figures out what it does
and comes up with a spec for what that tool does.
And then takes the spec to a different set of AI agents.
So this is all automated, this is a single click.
Takes another set of agents.
I think I know where you're going with this.
Writes the software based on that.
And then, and the reason, one of the reasons this guy did is like
we didn't like the LG LPL license that came with the original code,
which means I had a back contributor or whatever.
I want to rewrite this with an MIT
license, which is much more permissive.
So I, they basically had AI, two sets of AI agents
rewrite it so they could come, so they could basically say, we
didn't look at the code when we did this.
That's the point of my mind.
I think I saw the headlines about
that one, but I haven't read the story.
Yeah, that's funny.
They're making like copyright free AI or
whatever because of that, that's so funny.
People, I love the ingenuity of it.
I love it.
I'm tired of it.
Yeah.
All right.
I think we're gonna call it here for this week though.
Thank you everybody who joined us.
All the updates from this episode
will be shared on the blog every week.
So if you are a regular listener, sign up for the newsletter or
subscribe with your favorite RSS reader if you want to stay tuned.
I'm still letting people know.
If you didn't know, we send the newsletter out as soon as the show
starts at five, well, five Eastern time.
And if you are subscribed, you'll get that.
And that'll be kind of your
reminder that, hey, the show is starting.
For people who prefer audio, we have a
podcast available on all podcast platforms.
And again, on RSS and this video will be synced to PeerTube.
We want to thank Kerry again for
coming on and being a guest this week.
And I'm gonna let him tell you guys a
little bit more about his show and his book.
Yeah, just a couple more things.
So this has been a, this is gonna be a big year for me.
It already has kind of been a big year.
So this is the ninth year I've been doing my podcast.
I'm on episode, I don't know, what am I on?
477.
I've done a podcast every week for 400 seven times.
The book is actually about a year or two older than that.
And both of those things are got big things this year.
So as you could tell by the numbering, I'm
gonna be hitting 500 in September, episode 500.
That's gonna be a really big deal.
And so in years past, so the funny story, in years past I tried to
get, you know, when I was in my tens of episodes, I kept reaching
out to Bruce Schneier, who's a
cryptographer and well-known security guy.
And I kept reaching out to Bruce and he was nice
enough to respond, but he always said he was busy.
I like, I want you to get on my show.
I want you to interview.
And finally, I was like, okay, the 100th episode was coming up and
I said, Bruce, look, I'm gonna ask you one more time.
I promise I will stop bugging you, but this is the 100th episode.
I'd really like to make it special.
I'd like to have you do, I guess I'm on the 100th episode.
He's like, you know what?
I'll do it.
So I got Bruce Schneier for the 100th.
I was super proud of that.
And then I think at the end of that episode, I
jokingly said, well, I'll see you at the 200.
Like, all right, I'll see you then.
I'm like, okay.
So I got him for the 200.
I got him for the 300.
So he's been my pod centennial guy.
So naturally I'm gonna be talking to Bruce to come back, but I
really want to try to get some big names.
I'm gonna do multiple big episodes.
So anyway, we'll see if I can pull that off, but I'm gonna try to
do big things to separate and not just for the podcast.
I'm gonna do some fun things for that.
So be on look up for that.
Also, I just am about, I'm this close
to, I've got the contract in my hand.
I haven't signed it yet for the sixth edition of my book.
So I wrote my book 10 years ago and I've done multiple editions
because my book has got a bunch of screenshots.
And so those get stale.
Like, I think two years later, I need to
unfortunately do the whole book and it's getting big.
And the screenshots are like 40% of the content.
So anyway, I'm due for a sixth edition.
And I think what I'm gonna do this
time around is a little bit different.
I'll make it smaller.
I'll make it cheaper.
Yeah, there you go.
Sucker is 600 pages, no lie.
It is, it's big.
It's honestly, it's gotten too big.
So what I'm gonna do is I'm going to split out the really volatile
parts and make that a free downloadable PDF.
So that I can update whenever I want as
needed and not have to redo the book every time.
So I'm gonna try to write a sixth edition of this book.
And I'm about to sign the contract to do that.
So it should be out hopefully by this fall.
It's gonna be thinner, it's gonna be cheaper.
And then all the PDF, all the
downloadable PDF for all the really volatile stuff.
So anyway, the book could just hopefully
stand on its own for a while after that.
So I'm also hoping to do that around September.
So they're all gonna, all this stuff is gonna
kind of hopefully come together in September.
Awesome, can't wait.
All righty.
As for privacy guides, we are an impartial nonprofit organization
that is focused on building a strong privacy advocacy community and
delivering the best digital privacy and
consumer technology rights advice on the internet.
If you want to support our mission, then you can make a donation on
our website, privacyguides.org slash donate.
You could also click the red heart icon
in the top right corner of the website.
I think it's visible on like any page.
You can contribute using standard fiat currency via debit or credit
card, or you can donate anonymously using
Monero or with your favorite cryptocurrency.
Becoming a paid member unlocks exclusive perks like early access to
videos, priority during the live stream Q&A.
You'll also get a cool badge on your profile in
the forum where Kerry is a regular participant.
I see your name pop up quite a lot.
And you'll get the warm fuzzy
feeling of supporting independent media.
So thank you all for watching and we'll be back next week.
(Upbeat Music)