[00:00.000 --> 00:00.400]  Hello, everybody.
[00:00.720 --> 00:01.020]  Hi.
[00:02.420 --> 00:05.380]  My name is Geoff, and I'm a Club-Mate addict.
[00:05.920 --> 00:06.520]  Oh, wait.
[00:06.920 --> 00:08.340]  I don't know if this is the right meeting.
[00:09.940 --> 00:11.660]  All right, so welcome.
[00:12.080 --> 00:18.600]  And I'd like to thank you all, first of all, for choosing us over the bar, especially our panelists.
[00:22.080 --> 00:25.700]  And so we're here tonight to talk about something not very new.
[00:25.800 --> 00:27.180]  Actually, it's kind of getting very old.
[00:28.460 --> 00:35.800]  It's been 20 years since the first HOPE, where people addressed and talked about, discussed technology security challenges.
[00:36.500 --> 00:42.620]  Ten years ago, I stood on a soapbox in front of the media and other people and said, What the f*ck?
[00:42.820 --> 00:43.760]  Rallied for change.
[00:44.080 --> 00:44.800]  Similar problems.
[00:46.440 --> 00:49.240]  Now, we are ten years past that.
[00:50.200 --> 00:52.020]  We see a lot of the same problems.
[00:52.260 --> 00:57.380]  If you would have asked me ten years ago if I would have thought these problems would be fixed, at least somewhat, I would have said yes, a hundred percent.
[00:58.180 --> 00:58.900]  They have not.
[00:58.980 --> 01:00.840]  In fact, they are arguably getting worse.
[01:03.360 --> 01:04.200]  Like the lights.
[01:05.400 --> 01:11.140]  I don't know if it's the trip glasses or what, but may cause seizures.
[01:11.560 --> 01:12.540]  This is changing, right?
[01:12.740 --> 01:12.880]  Okay.
[01:15.180 --> 01:22.700]  So, how do we prevent going another ten and being in the same position, standing up here in front of these lights, asking the same question?
[01:23.000 --> 01:28.800]  So, tonight we have with us, all too sober, three great minds from three very different backgrounds.
[01:30.180 --> 01:30.620]  Thank you.
[01:30.620 --> 01:31.760]  Thank you.
[01:34.240 --> 01:34.680]  Pause.
[01:35.040 --> 01:35.650]  This is better.
[01:35.930 --> 01:36.520]  Okay, cool.
[01:36.710 --> 01:37.290]  Thank you, thank you.
[01:39.580 --> 01:52.430]  And they will share their three very different and strong views on what the f*ck is the problem, how the f*ck can we fix it, and what the f*ck y'all can do to fix it.
[01:53.250 --> 01:56.400]  So, that was the SoCal, yeah.
[01:57.020 --> 02:01.180]  So, I'm going to start off introductions of who you are and why you are here.
[02:02.210 --> 02:02.260]  Okay.
[02:03.940 --> 02:07.300]  Can you guys hear me in the back, or do we need to try and bring this mic?
[02:07.300 --> 02:07.620]  You have to use the mic.
[02:09.760 --> 02:10.560]  All right.
[02:10.740 --> 02:12.080]  Do we have a mic we can use?
[02:12.640 --> 02:14.380]  No, we have to run that one way.
[02:14.580 --> 02:15.000]  All right.
[02:15.600 --> 02:16.080]  We'll be there.
[02:16.380 --> 02:16.800]  Thank you.
[02:19.580 --> 02:20.000]  Thank you.
[02:20.940 --> 02:21.660]  So, hello.
[02:21.920 --> 02:22.960]  My name is Beau Woods.
[02:22.960 --> 02:27.240]  I've been around the security and technology industry for a while.
[02:28.400 --> 02:37.560]  About a year ago, I saw a couple of folks out of DEFCON and besides Las Vegas give a talk called, you know, the cavalry isn't coming, we have to save ourselves.
[02:38.260 --> 02:40.500]  And that idea really resonated with me.
[02:40.580 --> 02:47.420]  The idea that, right now, our dependence on technology is growing faster than our ability to secure that technology.
[02:47.420 --> 03:00.360]  When you start talking about putting computers into medical devices, into cars, into airplanes, public transportation systems, lights, as we've seen tonight, there are some that have computers in them, right?
[03:00.360 --> 03:12.920]  So, as we move a new technology into an old product, we should probably not make the same mistakes we've made that make our desktops crash all day long.
[03:13.460 --> 03:16.520]  It's one thing if, you know, windows goes down once a week.
[03:16.720 --> 03:23.040]  It's another thing entirely if your car suddenly turns off or loses power going down the highway once a week.
[03:23.240 --> 03:25.500]  It's a whole different set of impacts.
[03:26.240 --> 03:37.320]  And I think that this new technology that we're putting into those old technologies can have tremendous potential for safety.
[03:37.640 --> 03:59.680]  Talking about medical devices, using computers and connectivity can bring a whole new world of safety abilities to doctors who can save more lives, improve more lives, You know, replace limbs with actuators that are controlled by computers that really restore a person to being themselves.
[04:00.440 --> 04:11.220]  But as we're making these great leaps forward in safety, we should not make leaps backwards in security that cause an attrition of that safety.
[04:13.020 --> 04:15.820]  So that's the position of I am the cavalry.
[04:16.120 --> 04:19.940]  And that's what I've been working on for about the last year, as I said.
[04:20.360 --> 04:22.580]  And we've done various different things.
[04:22.860 --> 04:25.420]  We called this session Fuzzing the Chain of Influence.
[04:25.620 --> 04:33.640]  The idea being there are many different ways, many different value levers that you can use to affect the change that you need to see.
[04:33.640 --> 04:42.940]  So that we are safeguarding ourselves, that we are protecting the technologies, and doing so in a way that preserves safety and doesn't erode safety.
[04:43.760 --> 04:59.080]  So tonight, we'll have some Q&A on how we've done that, as the cavalry as well as the two panelists to my left and right, who have been doing different things, but still in the idea of let's fix the technology problems that we have.
[05:00.960 --> 05:01.680]  Andrew?
[05:03.900 --> 05:04.900]  No, really, off to you.
[05:06.380 --> 05:07.500]  I'm Jen Ellis.
[05:07.780 --> 05:15.340]  I am the head of community and public affairs at a security software and services company, Rapid7.
[05:15.880 --> 05:22.240]  I work very closely with security researchers who find a lot of bad shit.
[05:22.240 --> 05:45.780]  And during the course of doing that, I have seen firsthand how much the deck is kind of stacked against the research community and in favor of vendors who don't face liability and in most instances are not necessarily particularly keen to jump on the security bandwagon when it comes to what they're selling.
[05:47.300 --> 05:52.680]  And so, more recently, I've been working with the cavalry.
[05:53.500 --> 06:15.600]  And I've also been working on trying to help educate those in Washington on, you know, why security matters and why this is a really big problem that's only going to get worse and why we need to change the way we're doing things and how we can change them.
[06:20.750 --> 06:21.930]  Hi, I'm Andrea Matwyshyn.
[06:22.010 --> 06:23.430]  I'm sort of the outsider on the panel.
[06:23.590 --> 06:25.370]  I'm a law professor and a developmental psychologist.
[06:25.810 --> 06:31.550]  And apart from that, I'm currently serving as the Federal Trade Commission Senior Policy Advisor on Privacy and Security.
[06:31.550 --> 06:45.530]  So, the first thing that I will announce in that capacity is that the Federal Trade Commission will be at DEFCON running a contest that is focused on building the next generation honeypot dealing with robocallers.
[06:45.650 --> 06:51.610]  And so, I encourage all of you to please participate in that contest and join us at DEFCON.
[06:51.810 --> 06:56.030]  And the official rules are now available on the Federal Trade Commission website.
[06:56.030 --> 07:21.910]  And it is one way that this community can truly, fruitfully engage with the other relevant constituencies, such as the Federal Trade Commission and government agencies that are interested in this stuff, by participating in this kind of a venture to build bridges where people meet and cooperate and we build a more secure environment for all of us.
[07:21.910 --> 07:29.290]  So, that said, that is the end of my piece as a Federal Trade Commission employee.
[07:29.530 --> 07:38.530]  And now, everything that I say from this point forward constitutes solely my opinions as an academic and should not be attributable in any way, shape, or form to the Federal Trade Commission.
[07:38.710 --> 07:40.730]  So, these are my ideas and mine alone.
[07:40.930 --> 07:42.790]  So, it's a strong disclaimer for everything else that follows.
[07:43.550 --> 07:57.690]  So, to that vein, I've been observing this community and the workings of government around the issues of information security for over a decade now and being a fly on the wall at DEFCON and Black Cat and conferences like this.
[07:58.410 --> 08:12.670]  And so, the evolution of both this business community and the informal hacker community, it's been fascinating to watch as an academic for me, but also the way that the public has engaged with these issues.
[08:12.670 --> 08:26.090]  And so, there definitely is a groundswell around these issues and helping to bridge the conversations, the very high-end conversations that happen in spaces like this with the conversations happening in the mainstream and the media and the press.
[08:26.250 --> 08:31.270]  It's a formidable challenge, but it's something that you guys really can do and help to build those bridges.
[08:31.270 --> 08:47.150]  In particular, one of the themes that I see recurring in the media, in government circles, and in our circles here, is the question of what it means to be innovative.
[08:47.150 --> 08:48.150]  What are we building?
[08:48.290 --> 08:57.810]  What is this society that we're building for the next generation of the technologies that are going to engage with us, our bodies, our devices, our social systems?
[08:57.810 --> 09:13.610]  And one of the fundamental questions that I see pervading all of these circles relates to the question of whether more innovation is better just for the sake of more innovation or whether responsible innovation should be the hallmark of the next generation of innovation policy.
[09:13.830 --> 09:17.430]  And so, I'm definitely squarely in the responsible innovation camp.
[09:17.570 --> 09:20.730]  Just because we can build something doesn't necessarily mean that we should.
[09:20.910 --> 09:28.150]  There are some systems that are better, for example, not connected to the Internet because there are negative externalities that can happen to our society as a consequence, right?
[09:28.290 --> 09:34.630]  So, we need to make this calculus in a reasoned way and not simply build for the sake of building.
[09:34.890 --> 09:44.370]  And that's the main contribution that communities such as this and the public discourse that we trigger here can value add to this conversation.
[09:44.370 --> 09:54.750]  And every person that you educate in these questions is one more person that can engage intelligently and teach other people.
[09:54.990 --> 10:08.990]  And so, it's the responsibility of each of us as informed citizens to try to fix the challenges that we face as a society in building the next generation of technology engagement in our social systems.
[10:11.710 --> 10:13.830]  Thank you very much for those wonderful introductions.
[10:15.890 --> 10:21.910]  So, I mean, I think it was you, Jen, last night who said, well, we were brainstorming and bitching about the problem.
[10:22.070 --> 10:24.490]  So, if we all know the problem, so what is the problem?
[10:25.390 --> 10:32.970]  What are some of the challenges, the top challenges, you would say, that you see facing our world as it relates to security?
[10:34.350 --> 10:34.990]  Go first?
[10:35.230 --> 10:35.610]  Nope, you.
[10:35.850 --> 10:36.930]  All right, I'll go first.
[10:39.070 --> 10:43.750]  I'll say one of the biggest challenges is leadership and going first.
[10:46.190 --> 11:09.670]  We didn't plan that, but I think that one of the things that we recognized with the I Am The Cavalry movement is when we look around and ask, you know, who is taking it up on themselves to make sure that security and safety issues and the next generation of technology products and the next generation of life-critical systems is safe,
[11:10.410 --> 11:12.210]  you kind of draw a blank.
[11:12.430 --> 11:15.690]  There's some vague hand-waving, oh, it's over there.
[11:15.810 --> 11:17.170]  Those people are taking care of it.
[11:17.170 --> 11:17.970]  Well, how do you know?
[11:18.210 --> 11:19.770]  Well, I'm sure they are, right?
[11:20.210 --> 11:26.350]  And that's not really good enough when you're dealing with impacts as severe as this.
[11:26.510 --> 11:38.630]  We have to know, not just believe, that somebody is addressing the issues, that somebody is considering them, that somebody is thinking about it, and making informed, technically literate decisions.
[11:40.010 --> 11:48.690]  You know, whatever your feelings are, I think we all can agree that making an informed decision is better than making an uninformed decision.
[11:48.990 --> 12:07.430]  And no matter what the, you know, the cards may fall out on privacy and security and the Internet of Things, if the decision is made in a way that's informed, that has input from all the stakeholders in the system, and there are many, many stakeholders in these systems,
[12:07.710 --> 12:11.230]  that it's going to be a better decision with more people in agreement.
[12:11.430 --> 12:13.290]  Otherwise, you just kind of have to get lucky.
[12:14.190 --> 12:32.470]  So taking some kind of a leadership role, standing up and going and taking on those issues, and tackling those kinds, initiating those kinds of debates, those kinds of thoughts, and doing so in a way that is inclusive, rather than just a bunch of people sitting at a conference yelling.
[12:37.270 --> 12:40.450]  So I think one of the biggest challenges is the complexity.
[12:41.250 --> 13:02.210]  I think that the people who really, really understand what's at stake here, are typically people who either work in security or have like a deep passion for it in some regard, and have the sort of technical mouse to kind of get it, or have invested enough time to really get it.
[13:02.210 --> 13:04.850]  And that's great that those people have.
[13:05.310 --> 13:28.670]  The challenge is that the security industry is still relatively young, and in the past sort of 30 years or so that it's developed, we haven't, and I say we as in like I'm part of the security industry, we haven't really done a great job of making this simple for other people in two ways.
[13:28.670 --> 13:39.330]  One, on a technical level, like we haven't solved a lot of the sort of complexities that befuddle people like my mum on a technical level, like encryption and passwords and that kind of stuff.
[13:39.770 --> 13:46.350]  But the other side is, we haven't dealt with the communication issue.
[13:46.790 --> 13:52.090]  We haven't found ways of talking about this problem in really, really simple, meaningful ways.
[13:52.710 --> 13:58.290]  And now we're at a point where like we're starting to a little bit more because it's a little bit more tangible to people.
[13:59.270 --> 14:07.030]  But we haven't really got to a point where we can tell the story in a way that is super compelling and stops people from walking out.
[14:10.310 --> 14:11.050]  I'll go now.
[14:12.050 --> 14:13.930]  And so I think that's one of the big challenges.
[14:14.170 --> 14:25.030]  And definitely like that was something I encountered the first time that I went to DC is I was kind of there saying like, oh, we really need security research, it's really important.
[14:25.590 --> 14:28.810]  And the CFAA is bad and it stops people from being able to research.
[14:29.190 --> 14:31.810]  And people were kind of looking at me blankly going, well, Obamacare blew up.
[14:31.890 --> 14:32.490]  What are you talking about?
[14:33.670 --> 14:37.270]  And I was basically telling them that we need to build a rocket ship and go to the moon.
[14:37.270 --> 14:39.070]  And they didn't know what the moon was.
[14:39.310 --> 14:42.190]  And we haven't told them yet what the moon is.
[14:45.510 --> 14:56.070]  So following up on that point, I think the education gap that Jen just highlighted is definitely one of the formidable obstacles that exists in this space.
[14:56.370 --> 15:06.470]  So on one level, we have uneven knowledge among government actors, be they policymakers in Congress, regulatory agencies or judges.
[15:06.470 --> 15:24.470]  On the next level, we have corporate decision makers who have dramatically different understandings of what good information security is and what duties of care are owed to customers and business partners.
[15:24.470 --> 15:34.150]  And then consumers are yet another level of an educational challenge and knowledge deficit that needs to be remedied.
[15:34.230 --> 15:43.490]  And so with these three different levels of individuals, different strategies will best work in terms of educating them, but each is a formidable obstacle.
[15:44.170 --> 15:56.670]  The second point of deficiency that currently exists, we're at a point where, and this is a very legalistic nerdy point for those of you who are law interested in the audience.
[15:56.850 --> 16:10.030]  There's a fundamental conflict between the traditional paradigms of responsibility and liability for products, physical space products, and the liability regime, or really lack thereof, that has traditionally applied to software products.
[16:10.030 --> 16:29.090]  So these EULAs that we all click on that essentially disclaim all liability for the creators of the code, once that code starts being embedded in things like cars that can kill people, there will inevitably, and we're already seeing the first harbingers of these cases,
[16:29.510 --> 16:38.870]  inevitably be cases dealing with code malfunctioning in potentially deadly items, such as a car.
[16:38.870 --> 16:44.670]  And public interest will immediately be sparked, and legislative interest will then consequently be sparked.
[16:45.210 --> 16:56.890]  And so trying to come up with the optimal way to reconcile the liability regimes with a bigger picture plan for innovating.
[16:57.070 --> 17:01.130]  Well, it's a tension that we haven't quite figured out yet.
[17:01.130 --> 17:07.910]  And it's important that we do that, because on the one hand, we need to have responsible code in the system.
[17:07.910 --> 17:19.690]  But on the other hand, we also need to be conscious of the space that creative people need to build new products, to innovate, and to offer us the next generation of technology.
[17:20.010 --> 17:24.670]  And so it's that fundamental tension that we have not figured out yet in society that is an obstacle.
[17:27.710 --> 17:33.790]  So to highlight this, so there's a huge amount of innovation that's coming out with the Internet of Things.
[17:33.990 --> 17:38.110]  There's lots of Kickstarters, and some really, really cool startups.
[17:38.410 --> 17:44.410]  And I was at an Internet of Things event recently, and I was chatting to one of the panelists after the event.
[17:44.410 --> 17:48.230]  His company, they make a post-operative care bracelet.
[17:48.830 --> 17:49.950]  It's a pretty neat idea.
[17:50.090 --> 17:58.170]  The idea is that by wearing this bracelet, you can be discharged faster, but you can also find issues faster and get the care you need, which is great.
[17:58.290 --> 18:00.510]  It makes sense to me, probably most people in the room.
[18:01.590 --> 18:08.830]  So I was chatting with him, and I was saying, like, you know, how do you go about building security into your software development?
[18:09.510 --> 18:12.090]  And he said, oh, no, no, no, we don't, we don't develop any software.
[18:12.630 --> 18:15.610]  And I was like, oh, how does the bracelet work?
[18:15.730 --> 18:17.150]  I mean, how do people access the information?
[18:17.630 --> 18:18.930]  And he said, oh, there's an app.
[18:20.010 --> 18:21.530]  And I did a kind of Stewie Griffin.
[18:22.830 --> 18:27.830]  I was like, you know, right, that the app is software.
[18:29.450 --> 18:36.030]  And he kind of looked at me and was like, and then he kind of shrugged and went, okay, and walked off.
[18:36.030 --> 18:39.350]  And I was like, oh, oh, God, he's, he's not the exception.
[18:39.350 --> 18:40.270]  He's the norm.
[18:40.810 --> 18:42.270]  And that's the problem right there.
[18:42.370 --> 18:43.570]  You don't want to curb that innovation.
[18:43.690 --> 18:45.110]  That innovation is really, really important.
[18:45.450 --> 18:50.150]  But, and, and organizations like his, they don't know how to build security.
[18:50.150 --> 18:51.990]  And they don't even think of themselves as developers.
[18:53.590 --> 19:03.110]  Yeah, I think that's, that's a, that like, shrug it off is kind of goes hand in hand as well with the, the issue in American culture specifically, where you show someone vulnerabilities.
[19:03.110 --> 19:04.570]  And I'm sure everyone knows this all too well.
[19:04.690 --> 19:07.230]  And you won't, you might not get hired again.
[19:07.370 --> 19:08.750]  And they might hire someone else.
[19:08.850 --> 19:10.390]  And it's just, oh, well, okay, that's there.
[19:10.490 --> 19:11.610]  And we'll do something the next time.
[19:12.030 --> 19:12.910]  Kind of let it go.
[19:13.090 --> 19:14.890]  Oh, not an app, not software.
[19:15.750 --> 19:16.110]  Okay.
[19:16.230 --> 19:21.990]  So what, what, what do you think that, or before that, why do you think it hasn't changed?
[19:22.170 --> 19:30.810]  What, if you could cite a specific reason why it, this hasn't changed throughout on top of what you've already kind of discussed is what the problem is, what would you say?
[19:32.970 --> 19:33.570]  Anyone?
[19:33.790 --> 19:33.870]  Anyone?
[19:38.610 --> 20:00.450]  So one of the functional reasons is the lack of software liability, because at present, the way that these kinds of problems evolve, in a space where the law is just beginning to demand conduct of, for example, companies that experience data breaches,
[20:00.830 --> 20:26.130]  or that act unreasonably in their security processes, when the liability is just starting to evolve around those things, it's easy for companies to choose to simply build that cost into their business models, or to ignore the important broader economy stability concerns and shareholder interests.
[20:27.130 --> 20:52.810]  And until a robust liability regime exists, at the point that something like that would exist, until such time, it is easy to ignore the impact in terms of data loss for some companies who look very short-sightedly, quarter to quarter, at their business modeling,
[20:52.810 --> 21:03.430]  rather than the long-term, real impact on customer loyalty, the economy at large, business partners who are subsequently harmed because of lost shared data, et cetera.
[21:03.430 --> 21:23.890]  So that ability to look only short-term, rather than big picture in terms of protection of data, that's one of the reasons that, to date, we haven't necessarily, in my mind, seen as aggressive an evolution in internal standards of care of data maintenance,
[21:23.890 --> 21:25.250]  at least in the private sector.
[21:26.690 --> 21:29.510]  Yeah, and I agree with that.
[21:29.690 --> 21:33.530]  I also think that, you know, this is a big problem space.
[21:33.770 --> 21:35.630]  There are a lot of problems to potentially solve.
[21:37.730 --> 21:39.630]  I don't know how to solve all of them.
[21:40.490 --> 21:41.470]  Maybe nobody does.
[21:41.870 --> 21:47.110]  But one of the things that I've come to recognize is that it's not my job to solve all the problems, right?
[21:47.850 --> 21:48.810]  I'm standing here.
[21:48.910 --> 21:50.370]  I'm seeing the problems out there.
[21:50.650 --> 21:56.270]  I'm seeing that somebody else is directly in line, in the line of those problems.
[21:56.630 --> 22:00.510]  Essentially, they have the incentives to solve them.
[22:00.590 --> 22:02.170]  They have the capabilities to solve them.
[22:02.170 --> 22:12.010]  If I try and go, you know, walking over there and point at the problem and say, I'm going to solve this problem, I'm always going to fail, because I'm going to be running into somebody else.
[22:13.430 --> 22:23.710]  But I think part of the way that we go about fixing that, the problems over there, is we have to understand that the people over there are our friends.
[22:23.930 --> 22:27.030]  They, in general, want the same things that we do.
[22:28.770 --> 22:36.610]  Sometimes it's literally just as simple as getting three or four stakeholders in a room, people from representing different groups, and talking to them.
[22:37.690 --> 22:40.410]  They may not realize that they're doing application development.
[22:40.930 --> 22:44.990]  And so maybe they think, oh, I didn't know I was doing application development.
[22:45.130 --> 22:47.170]  All right, now help me, right?
[22:47.370 --> 22:59.850]  So instead of trying to shout at them or preach to them or, you know, the worst case is tell them they're stupid and ignorant and that they aren't possibly as smart as we are, you get them to invite you into that conversation.
[23:00.350 --> 23:03.030]  And I think that it has to start with education.
[23:03.210 --> 23:05.450]  It has to start with outreach.
[23:06.390 --> 23:11.290]  And it has to start with a fundamental understanding of their perspective, their point of view.
[23:12.150 --> 23:15.470]  Otherwise, you're always just going to be butting heads with each other.
[23:15.770 --> 23:17.930]  And that clearly isn't effective.
[23:20.150 --> 23:23.810]  I think this is frighteningly simple, why we are where we are.
[23:23.810 --> 23:26.930]  Why did GM not recall the cars with the ignition issue?
[23:27.710 --> 23:33.570]  They didn't do it because really, really simply, the cost of a recall is higher than the cost of life.
[23:33.770 --> 23:34.350]  Simple as that.
[23:36.090 --> 23:45.150]  And that's the same calculation that's being made, but to Andrea's point, with less information and understanding on what the real costs are on either side of the equation at the moment.
[23:46.390 --> 23:51.290]  And the bottom line is going back to that piece about how complex this stuff is.
[23:51.950 --> 23:59.050]  We aren't at a point at the moment where the majority of consumers are voting with their feet based on security choices.
[23:59.290 --> 24:06.390]  And so it doesn't apply pressure to vendors at this point for them to build security in.
[24:06.390 --> 24:13.270]  There are relatively few vendors that are really selling on the USP of security at the moment.
[24:20.030 --> 24:22.510]  Okay, so good reflection.
[24:23.050 --> 24:24.370]  I agree with that.
[24:24.710 --> 24:28.070]  And I think we've talked a lot about the problem.
[24:28.330 --> 24:30.190]  Now let's talk about how we can fix it.
[24:30.670 --> 24:32.910]  And things didn't get this way overnight.
[24:33.170 --> 24:34.510]  They got this way slowly.
[24:34.510 --> 24:46.530]  And I think one of the other things that people experience in this industry, there's been some studies recently about this, is obviously getting burnt out and going really hard and trying to solve all the problems really fast, or even just one or two of the problems.
[24:47.490 --> 24:49.830]  I think there's a lot to speak about around that.
[24:49.950 --> 24:53.930]  But, you know, do you think there is, you know, some small quick fixes we can do?
[24:54.030 --> 25:01.890]  Or do you think that, you know, to set our expectations properly for a, you know, a slower recovery back to a place where we want to be?
[25:01.890 --> 25:03.270]  Or to a place where we want to be?
[25:03.370 --> 25:04.050]  I don't know if we're ever there.
[25:05.330 --> 25:13.510]  And, you know, what specifically, what are some things we can recommend that people do, or people together can do to kind of alleviate these problems?
[25:15.470 --> 25:18.630]  So I'm taking this first so that I can make the joke, I have hope.
[25:20.730 --> 25:21.090]  Thanks.
[25:21.410 --> 25:22.250]  I'll be here all week.
[25:25.170 --> 25:28.410]  I think that we may be slightly different on our outlooks on this.
[25:28.530 --> 25:29.770]  I am the hopeful one.
[25:29.770 --> 25:39.170]  I think that we're in a situation right now where technology development is moving faster than society is able to keep up with it.
[25:39.290 --> 25:41.730]  And certainly faster than legislators are able to keep up with it.
[25:42.710 --> 25:46.790]  But the good news is that I think people are becoming more aware of that.
[25:46.930 --> 25:47.870]  They're waking up to that.
[25:48.390 --> 25:52.430]  And there is lots of conversation going on around how we respond to that.
[25:52.430 --> 25:58.010]  Now, granted, the conversation may not be going in exactly the right direction all the time.
[25:58.330 --> 26:02.910]  And there is definitely work for us to do in influencing that conversation.
[26:02.910 --> 26:05.030]  But here's the good news.
[26:05.550 --> 26:06.870]  You guys are the good news.
[26:07.110 --> 26:12.490]  Because there's a room full of people sitting here at 1030 at night when you should be in the bar.
[26:12.910 --> 26:15.230]  And you're all powerful.
[26:15.430 --> 26:16.690]  Every single one of you is powerful.
[26:17.290 --> 26:18.170]  We're powerful.
[26:19.290 --> 26:21.650]  And Andrea's particularly very powerful.
[26:26.270 --> 26:28.870]  And we actually can influence.
[26:29.630 --> 26:31.250]  You know, we can have influence.
[26:31.450 --> 26:32.610]  We can help educate.
[26:32.930 --> 26:35.090]  We can make the people around us care more.
[26:35.310 --> 26:38.770]  We can make it something that they can attach to and understand.
[26:39.770 --> 26:46.850]  You probably all have played, you know, being the tech admin for all of your friends.
[26:46.850 --> 26:48.930]  You've been help desk at some point for your family.
[26:49.990 --> 26:51.670]  And it's really annoying to do it.
[26:51.910 --> 26:58.750]  But, like, you can help save the world by, you know, actually not just doing the role of that.
[26:58.930 --> 27:04.390]  But, like, actually educating people on, you know, what good security looks like and why it's important.
[27:04.550 --> 27:10.550]  Helping people understand that, like, physical and virtual, there isn't really a good line between those things anymore.
[27:10.990 --> 27:15.030]  And, like, actually, you know, security equals safety now.
[27:15.270 --> 27:16.650]  And it does matter.
[27:16.910 --> 27:18.470]  And you can all help with that.
[27:18.470 --> 27:26.050]  You can help to show that you care about this and the choices you make with your vendors.
[27:26.470 --> 27:29.130]  And you can do it in your online profiles.
[27:29.590 --> 27:31.990]  And, you know, you can go onto Amazon and write reviews.
[27:32.290 --> 27:35.470]  And you can write to your local, I was going to say, Member of Parliament.
[27:35.790 --> 27:36.770]  That is not the right expression.
[27:37.470 --> 27:39.790]  I spend time on Capitol Hill, don't you know?
[27:41.430 --> 27:42.390]  Congress critter.
[27:42.870 --> 27:45.770]  You can, you can, you can do all of that stuff.
[27:46.030 --> 27:57.030]  And, and as somebody who is in DC on a regular basis, having conversations about the problem, there are actually a lot of people who really care and who really want to do something about this.
[27:57.030 --> 27:59.550]  It's not a simple problem to fix.
[27:59.850 --> 28:06.390]  But the fact that they care and that they want to have the conversation and that they want to learn more is a really good starting point.
[28:08.010 --> 28:09.890]  Yeah, I absolutely agree.
[28:10.230 --> 28:14.130]  You know, we were talking last night and we said, it's the adopt a derp, right?
[28:14.370 --> 28:17.950]  Find somebody who's a derp and turn them into not a derp.
[28:18.050 --> 28:19.290]  It's a tractable problem.
[28:19.410 --> 28:19.930]  It's solvable.
[28:20.170 --> 28:22.210]  All it takes is just go to talk to somebody, right?
[28:22.430 --> 28:33.050]  So maybe in your own organization, you find someone who's, they're interested or they're in a role where they can influence a change for the better.
[28:33.050 --> 28:34.310]  And just go talk to them.
[28:34.410 --> 28:34.690]  Sit down.
[28:34.790 --> 28:35.710]  Hey, what are your concerns?
[28:35.870 --> 28:36.450]  What do you care about?
[28:36.770 --> 28:38.990]  What are the things in security that you want to know?
[28:39.150 --> 28:45.210]  And how can I answer the questions that you've asked, not throw a bunch of answers at you and you haven't even asked a question, right?
[28:46.930 --> 28:50.710]  I also think that we have to keep in mind that this is a long game, right?
[28:51.570 --> 28:58.630]  Like Jen said, car manufacturers might not recall a car tomorrow because of a security problem that we found that affects safety.
[28:59.510 --> 29:00.790]  But you know what they can do?
[29:00.790 --> 29:03.730]  They can build the fix into the car that's coming out in five years.
[29:04.470 --> 29:06.830]  That's something that they can very definitely do.
[29:07.090 --> 29:07.550]  You know why?
[29:07.670 --> 29:11.710]  Because that prevents the recall discussion from even coming up in five years.
[29:11.950 --> 29:14.670]  That's a great long-term cost-saving measure.
[29:15.970 --> 29:25.470]  Understanding that there are more ways than one to win, I think is something that we have in our day jobs when we're out, you know, trying to hack firewalls, right?
[29:25.470 --> 29:29.290]  Oh, I hit that port and it wasn't open, I guess I just quit and go home.
[29:29.430 --> 29:30.270]  No, we don't say that.
[29:31.250 --> 29:34.550]  We hit something that's closed, we hit a wall, and we work around it.
[29:34.690 --> 29:39.510]  We figure out a way to succeed in the face of every opportunity to give up.
[29:39.510 --> 29:43.030]  I think we have to do that in this game too, right?
[29:43.170 --> 29:50.270]  We have to do that when we're pushing for things that are good, is not give up at the first or the second or the third hurdle that we hit.
[29:50.430 --> 29:53.490]  Just change our technique, change our tactic, and be persistent.
[29:56.640 --> 29:59.720]  I recently had the pleasure of keynoting at Source Boston.
[29:59.900 --> 30:04.900]  And the advice that I gave there, many of you don't work in security consultancies.
[30:04.940 --> 30:09.880]  Many of you work in traditional industry as the expert in your domain.
[30:10.080 --> 30:15.880]  And in those organizations, someone who is intuitively aligned with you is the general counsel.
[30:16.240 --> 30:20.380]  Go befriend a lawyer in the general counsel's office.
[30:20.380 --> 30:36.220]  Have conversations with that lawyer about these issues and about what it means for society to have vulnerabilities in key social systems and products that we are all using on a regular basis.
[30:36.920 --> 30:39.840]  Have a human-to-human conversation with that lawyer.
[30:40.180 --> 30:41.440]  And that lawyer will become an ally.
[30:41.640 --> 30:48.360]  And lawyers are used to thinking about risks in a not yet fully actuated way.
[30:48.360 --> 30:55.100]  To anticipate risk and to avoid the risks rather than mitigate exclusively.
[30:55.860 --> 31:10.860]  So the kind of training that a lawyer has is intuitively allied with the type of enterprise that you all as security professionals or security and privacy interested individuals have.
[31:10.860 --> 31:20.620]  And having a powerful ally in the general counsel's office in a company, you basically have those people fight the battle for you.
[31:20.780 --> 31:22.800]  And you become a resource to them.
[31:23.060 --> 31:28.860]  And then you have a stronger unified front inside your organizations.
[31:28.860 --> 31:31.940]  Because security isn't just about technology companies, right?
[31:32.060 --> 31:45.660]  It's about traditional industries also getting up to speed with their incorporation of technology into their less technology-driven enterprises, right?
[31:48.320 --> 31:55.780]  And I think you just said something that made me think of something, which is talking to people like a human.
[31:56.040 --> 32:01.760]  And actually sitting there instead of making people feel dumb, which not intentionally most of the time.
[32:02.800 --> 32:08.980]  Sometimes I think security can be really intimidating to people and obviously for good reason.
[32:08.980 --> 32:12.720]  And a lot of people over the last 10 years have used fear as a motivator.
[32:12.880 --> 32:14.920]  Digital Pearl Harbor, oh my God, everything's going down.
[32:15.020 --> 32:21.620]  And while there is good reason to have the fear or to know that, I don't think fear is a good long-term motivator.
[32:21.840 --> 32:29.820]  And when connecting with people on a one-on-one basis and helping them understand why their password shouldn't be their street name across all of their 20 accounts.
[32:31.660 --> 32:35.560]  Doesn't have to make them feel dumb, though they may once they notice how silly it is.
[32:36.800 --> 32:38.620]  Connecting with them on a one-on-one level helps a lot.
[32:38.620 --> 32:45.500]  So, are there any more... do you guys want to open up for questions now?
[32:45.980 --> 32:46.660]  All right, yeah.
[32:47.060 --> 32:49.760]  And anyone want to ask a question, come on up.
[32:49.820 --> 32:51.540]  I'll hand you this wonderful microphone.
[32:51.780 --> 32:54.080]  If you have sunglasses, I suggest you wear them.
[32:54.160 --> 32:54.960]  The lights are still kind of bright.
[32:56.500 --> 32:57.580]  We have candy.
[33:00.180 --> 33:01.160]  Come on down.
[33:05.480 --> 33:07.380]  You had me at espresso bean.
[33:08.660 --> 33:09.420]  No, really.
[33:12.570 --> 33:14.230]  I've taken the candy.
[33:15.210 --> 33:15.830]  It's that easy.
[33:16.450 --> 33:18.130]  So, yeah.
[33:18.510 --> 33:27.890]  Vulnerabilities, bugs, fixing things, GM, valuation of how long it's... you know, monetary loss.
[33:28.090 --> 33:29.650]  Just, I totally get that.
[33:29.650 --> 33:50.730]  The one thing that concerns me now is, like, within... in light of the, you know, revelations about NSA practicing tradecraft, leaning in VP's ears, leaning over standards bodies and going, hey, it would really help us out to, you know, if you would just,
[33:50.730 --> 33:54.990]  like, choose that spec instead of that spec.
[33:56.250 --> 34:01.670]  How much should you... I mean, I get the feeling... it's... yeah, okay, it costs money.
[34:01.890 --> 34:13.470]  But I also think that now we have to think about this possibly more pernicious thing about... of, like, you know, it would really help us if you just, like, didn't fix that.
[34:13.470 --> 34:20.950]  Or it would really help the company, because we've got this other product coming out that's going to address that.
[34:21.170 --> 34:23.610]  If you just, like, wouldn't fix that.
[34:23.610 --> 34:30.290]  Or if you just kind of maybe kick that down, like, you know, two versions down on the roadmap.
[34:30.810 --> 34:32.550]  What do you say to something like that?
[34:33.310 --> 34:34.570]  How do we fight that?
[34:41.000 --> 34:44.460]  This is a new form of yoga we're doing with the microphone over here.
[34:44.700 --> 34:46.080]  So, Geoff's pioneering tonight.
[34:46.420 --> 34:48.440]  You're in the presence of genius.
[34:49.700 --> 34:50.720]  Thanks for the question.
[34:50.880 --> 34:53.260]  I think that's something that...
[34:54.100 --> 35:00.960]  I tend to be really focused on safety rather than the privacy issues, though those certainly exist.
[35:00.960 --> 35:09.500]  From a safety angle, I'm not as worried about someone leaving defective code or inserting defective code.
[35:09.760 --> 35:11.900]  I think it's certainly a possibility.
[35:12.700 --> 35:18.640]  But, you know, the first hurdle that we have to get over is just not doing the things that we know are dumb, right?
[35:18.860 --> 35:27.280]  So, if we can just do those things that are fairly easy, fairly straightforward, I think that's the first priority.
[35:27.860 --> 35:32.660]  Right now, I'm more afraid of accidents than adversaries, to be honest.
[35:35.340 --> 35:35.860]  Wow.
[35:35.860 --> 35:36.820]  I don't know if you want to answer it.
[35:39.160 --> 35:39.680]  Bean?
[35:40.440 --> 35:40.960]  Sweet.
[35:41.260 --> 35:41.520]  Right.
[35:42.000 --> 35:43.180]  This is working well.
[35:48.610 --> 35:52.430]  So, I love that you said that fear is not a good long-term motivator.
[35:53.150 --> 36:03.850]  So, what I wonder, or what are some sort of positive visions of what better secure software can give us?
[36:03.970 --> 36:08.210]  Other than all these scary things, they won't happen to you.
[36:08.330 --> 36:09.410]  Or they'll be less likely.
[36:09.950 --> 36:19.850]  Because it seems like perhaps the reason that fear is not a good long-term motivator is people are very good at just pushing fears out of their mind.
[36:22.370 --> 36:29.570]  Or making quick knee-jerk reactions to something, temporary fixing, but not something that will actually fix it long-term.
[36:30.370 --> 36:31.970]  What do you guys want to...
[36:34.650 --> 36:48.970]  So, some of the conversations that I have on a regular basis are with people who are sophisticated consumers, but yet not necessarily technologically as sophisticated as you guys are.
[36:48.970 --> 36:56.810]  And I find that perspective very informative to me to understand kind of the reality of the upper end of the consumer knowledge base.
[36:56.970 --> 37:03.530]  So, when Heartbleed happened, I started having conversations with some of my law professor friends, who are not technology focused.
[37:03.530 --> 37:05.730]  Because I wanted to kind of see the world through their eyes.
[37:06.590 --> 37:12.390]  And what came through to me is that they all knew that Heartbleed happened.
[37:13.150 --> 37:18.430]  And they knew that they needed to take action, because that's what a responsible person would do.
[37:18.930 --> 37:21.290]  And they understood that that meant changing their passwords.
[37:21.610 --> 37:28.330]  And they understood the dynamic of, I may need to wait a while so that companies have a chance to patch things update.
[37:29.650 --> 37:39.570]  But the minutia of the tech, of how exactly Heartbleed was a risk or how it functioned, that wasn't of interest to them necessarily.
[37:40.330 --> 37:45.570]  They knew that something bad happened, question mark in the middle.
[37:46.330 --> 37:49.430]  They needed to take an action, because that's what is responsible.
[37:49.430 --> 38:02.010]  And so this idea of being responsible in your technology conduct, the same way that you're responsible with your finances, the same way you're responsible with your work product.
[38:02.610 --> 38:08.710]  There's an innate competency interest that people have.
[38:08.710 --> 38:22.130]  And if we can appeal to that broader sense by not making them feel stupid, but just this is one other dimension of this generalized responsible conduct that we all engage in.
[38:24.110 --> 38:28.550]  These people that I spoke with, they were all on top of it to the extent they could be.
[38:28.750 --> 38:30.730]  But none of them really understood the middle piece.
[38:30.930 --> 38:37.490]  It's like with my students, I sometimes use the South Park underpants gnomes example.
[38:37.490 --> 38:39.010]  Some of you are familiar with that episode.
[38:39.330 --> 38:43.790]  So these creatures hoard all the underwear and they have a meeting.
[38:44.230 --> 38:47.210]  And there's a business plan that says, step one, hoard all the underwear.
[38:47.730 --> 38:50.250]  Step two, question mark, question mark, question mark.
[38:50.370 --> 38:51.150]  Step three, profit.
[38:51.370 --> 38:51.690]  Okay?
[38:52.010 --> 38:57.130]  So it's okay with some of this stuff for there to be a big set of question marks for consumers.
[38:57.650 --> 39:00.170]  But step one and step three need to be clear.
[39:00.170 --> 39:11.790]  And the reason that Heartbleed was a fascinating case study for me of a security communication is that step one and step three were clear to many consumers.
[39:12.030 --> 39:13.270]  And that's a win.
[39:13.490 --> 39:18.590]  And it's probably okay if we have that step two, question mark, question mark, question mark in there.
[39:19.290 --> 39:22.990]  So that's something for us to ponder as a community.
[39:25.390 --> 39:26.690]  Yeah, I think that's a great question.
[39:26.850 --> 39:34.690]  And a good answer as well is that I think saying that we don't have all the answers and we don't know versus saying, this is what we need to do and let's drive for them.
[39:35.530 --> 39:37.290]  Kind of leaving it open to figure it out.
[39:37.690 --> 39:38.230]  Coffee Bean?
[39:40.090 --> 39:40.810]  Question first.
[39:41.610 --> 39:44.590]  At risk of sounding simple, I know something that's dumb.
[39:45.230 --> 39:47.950]  Signing away all of my liability every time I click a EULA.
[39:48.170 --> 39:51.450]  I mean like what if we put some of that responsibility back on the developers?
[39:51.730 --> 39:52.630]  Hey, you develop an app.
[39:52.750 --> 39:53.230]  That's software.
[39:53.390 --> 39:55.990]  You're responsible in a little bit more capacity than you are now.
[39:56.670 --> 39:57.210]  That sounds great.
[39:57.310 --> 39:57.710]  Write a letter.
[39:58.410 --> 39:58.850]  What's that?
[39:58.990 --> 39:59.610]  Write a letter.
[39:59.850 --> 40:00.310]  Do it.
[40:00.530 --> 40:02.050]  Do you want to answer that?
[40:02.210 --> 40:02.610]  Simple stuff.
[40:02.770 --> 40:03.690]  No, I agree.
[40:04.650 --> 40:09.390]  I think we all think that there is a woeful lack of liability.
[40:09.810 --> 40:20.550]  It's interesting to me that software engineering is the, and I'm not an expert on engineering, but I think it's the only area of engineering where you can build shit and there's no safety code you have to be.
[40:21.610 --> 40:30.030]  And that was fine when there was this like big gap between physical and virtual, but when it's the brakes in my car, it's not okay.
[40:31.950 --> 40:36.870]  So I think like we're getting to a point now where there needs to be some liability on vendors.
[40:37.930 --> 40:40.290]  And, and, and yeah, I definitely agree.
[40:40.390 --> 40:43.190]  I think there's too much power in the EULA.
[40:44.050 --> 40:47.230]  So you guys should, should make that heard.
[40:49.630 --> 40:59.930]  Um, I think it was the, the USENIX magazine a month or two ago did a really good write up on like basically liability for hackers, right?
[41:00.110 --> 41:02.850]  Like what you need to know about the legal liability system.
[41:03.070 --> 41:05.430]  So if you're really interested in that, go read the paper.
[41:05.430 --> 41:06.650]  Where it's like three pages.
[41:06.830 --> 41:08.310]  It's really short and it gives you a great primer.
[41:10.470 --> 41:10.870]  Cool.
[41:11.130 --> 41:11.330]  Yes.
[41:16.670 --> 41:24.210]  Um, sorry, this is going to seem like a simple question, but could you just give us a quick overview of what I am the cavalry is as an organization?
[41:24.530 --> 41:24.830]  Yes.
[41:25.070 --> 41:25.170]  Cool.
[41:26.570 --> 41:26.870]  Beau?
[41:28.370 --> 41:29.290]  Uh, thank you.
[41:29.290 --> 41:29.490]  Yeah.
[41:29.670 --> 41:31.490]  So, um, I am the cavalry.
[41:31.710 --> 41:44.310]  Our mission is, uh, to, um, to ensure that the devices that have the ability to, uh, affect and impact human life and public safety are worthy of the trust we place in them.
[41:44.530 --> 41:44.790]  Right?
[41:45.010 --> 41:53.070]  So the basic idea behind that and kind of an unofficial slogan is like security of consequence, saving lives through security research.
[41:53.070 --> 41:59.030]  So what we try and do is do education, outreach, and promote research.
[41:59.410 --> 42:07.890]  Um, the idea being education is the people who don't already know about the security and safety link, they should know that there is a link there.
[42:08.030 --> 42:10.230]  And we should invite them to the conversation.
[42:10.750 --> 42:16.510]  Outreach is going and finding them, not just staying in our echo chamber and throwing rocks at them from back here.
[42:16.910 --> 42:24.650]  Uh, and then promoting security research is we want to take people who are doing good things, and make sure that they have the support that they can have, right?
[42:24.830 --> 42:35.230]  Whether it's media support, whether it's, uh, knowing how public policy functions, whether it's knowing the other researchers in their field that are doing similar things, so that they don't have to repeat the wheel.
[42:35.450 --> 42:42.730]  The idea is that we want to amplify and magnify the impact and the ability that we have in this community.
[42:43.250 --> 42:45.150]  We already have a lot of great motivation.
[42:45.910 --> 42:53.230]  We need to turn that motivation up a notch, um, with other things in terms of its effectiveness.
[42:53.670 --> 43:07.330]  Uh, and I think getting the word out, making those connections, uh, collecting past work and current researchers, um, and catalyzing good works, uh, faster maybe than they would have had happened before.
[43:07.670 --> 43:08.730]  Uh, that's our goal.
[43:09.010 --> 43:10.850]  Um, that said, we don't have it all figured out.
[43:10.850 --> 43:14.630]  Uh, there's plenty of room for other people to do things if you want to.
[43:14.870 --> 43:18.430]  One of the most important things, uh, I'll go back to it again, is, is leadership.
[43:18.690 --> 43:20.390]  Just take whatever you're passionate about.
[43:20.750 --> 43:21.710]  Take it and go do it.
[43:21.930 --> 43:22.790]  Let us know you're doing it.
[43:22.910 --> 43:23.790]  We'll help you any way we can.
[43:25.470 --> 43:28.690]  I, I have a, uh, very literal answer.
[43:29.190 --> 43:40.350]  So, uh, I am the cavalry is a grassroots initiative that originally started with security researchers saying, Oh shit, scary stuff's happening and we should try and do something about that.
[43:41.110 --> 43:51.850]  Um, but I kind of have this arsehole view of what I am the cavalry is in that whenever someone asks me, I say, it's you.
[43:52.870 --> 43:55.090]  Uh, well, it's like the game.
[43:55.250 --> 43:57.890]  You're already in the game, whether you want to be in the game or not.
[43:58.030 --> 43:59.330]  And by the way, we all just lost the game.
[43:59.850 --> 44:02.670]  Um, so that's what I am the cavalry is.
[44:02.670 --> 44:04.970]  Every single one of you has the potential to make a difference.
[44:05.350 --> 44:07.350]  It's a question of whether or not you will.
[44:09.090 --> 44:09.490]  Yeah.
[44:09.630 --> 44:27.230]  And I, we talked a little bit about that last night when, uh, we were bitching and brainstorming about, um, a lot of people that were talking about wanting to fix the problems and, uh, long-term 20 years ago, 10 years ago, got caught up making ungodly amounts of money in the security industry and forgot about fixing the problem.
[44:27.770 --> 44:32.490]  Um, so I think I would hope that now some of those people are set financially.
[44:32.670 --> 44:34.270]  We'd like to come back and spend some time with the problems.
[44:34.530 --> 44:50.870]  Um, but I think, uh, I think for me, what I like most about the cavalry is the, the piece about getting people together, like you were saying before in the beginning, Beau, getting different groups together in a room and playing facilitator and communicator between whether it be a government organization,
[44:51.190 --> 44:57.190]  a vendor, a, you know, trade organization, different people that aren't normally speaking the same language.
[44:57.190 --> 45:03.350]  And when they do try to speak together in the same language, it ends up, they repel each other and it doesn't create good things.
[45:03.350 --> 45:06.090]  So, um, I think that is a really cool piece.
[45:06.290 --> 45:06.910]  Next question?
[45:07.330 --> 45:07.710]  Sir?
[45:09.430 --> 45:10.870]  We've got two beans now if you want.
[45:11.010 --> 45:11.730]  You can have two whole ones.
[45:12.070 --> 45:12.370]  Yep.
[45:14.030 --> 45:14.550]  All right.
[45:14.750 --> 45:15.150]  Thanks.
[45:16.930 --> 45:18.030]  Oh, right here?
[45:18.350 --> 45:18.450]  Yeah.
[45:18.550 --> 45:18.630]  Okay.
[45:19.370 --> 45:25.270]  Um, so I, I have a, I have like a kind of multi-part question, but not really, that's all kind of working together.
[45:25.270 --> 45:28.310]  Um, sure, sure.
[45:28.490 --> 45:28.930]  Let's do that.
[45:29.530 --> 45:36.470]  Um, so how do you think the, um, interaction that, uh, power and political economy have in this?
[45:36.590 --> 45:50.250]  Because there, there was a lot of touching on, on like profit and the costs of things, but how, I'd suggest that the power manifests generally in the inability to move from any platforms that make choices as people were mentioning.
[45:50.250 --> 45:57.130]  Like there's a lot of it lock in and I mean, if your car is one thing, you, you can't just swap out the car's operating system.
[45:57.530 --> 46:09.210]  And just how those intersects, how, how those intersections can actually be used going forward instead of maybe relying on the existing power dynamics that already exist.
[46:09.430 --> 46:10.890]  It's just my question.
[46:11.030 --> 46:14.130]  How, how does that affect your analysis?
[46:16.030 --> 46:16.810]  You have two.
[46:17.110 --> 46:17.810]  Oh, thank you.
[46:19.670 --> 46:20.150]  Yeah.
[46:20.270 --> 46:25.150]  I think you definitely deserve multiple coffee beans for that is it's a really, really hard question.
[46:25.310 --> 46:29.450]  I think you could ask it about anything that you're trying to achieve.
[46:29.670 --> 46:35.110]  That is a, a complex problem, um, where you have multiple stakeholders involved.
[46:35.590 --> 46:41.530]  Uh, but I think that's also kind of the power is you have multiple opportunities to get in there, right?
[46:41.650 --> 46:47.410]  You don't just have to worry about, well, this power broker over here is talking to this policy maker here.
[46:48.070 --> 46:50.710]  And that's the only way anything moves.
[46:50.910 --> 46:54.710]  You also have, uh, standards bodies, love them or hate them.
[46:54.810 --> 46:55.470]  They have some power.
[46:55.610 --> 47:11.270]  You have the purchasing public, whether that's, uh, you know, a healthcare, uh, organization that's buying medical devices, whether that's, um, your parents who are buying cars, whether that's, uh, the people who are flying in planes, right?
[47:12.010 --> 47:17.890]  We have different power levers, each of us who are stakeholders in this dynamic.
[47:17.890 --> 47:30.170]  So, um, it's not quite as simple as, uh, you might think it is in your mind with, you know, the fat cats cuddling up to the, you know, whoever else like in these backroom deals.
[47:30.770 --> 47:32.350]  It's, it's a wide open system.
[47:32.570 --> 47:34.330]  I think that's, that's part of the power of it.
[47:34.470 --> 47:36.610]  It's just a matter of trying different things, right?
[47:36.850 --> 47:42.130]  Fuzzing the chain of influence, seeing what works, what doesn't, repeat the things that work and drop the things that don't.
[47:42.950 --> 47:49.910]  So that's, um, maybe not a perfect answer and it's not a prescription, but I think it's the best one we've got so far.
[47:52.370 --> 47:57.350]  I think one of the important points that your question raises, and I don't know where you went.
[47:57.790 --> 47:58.270]  You went somewhere.
[47:58.990 --> 47:59.050]  Yeah.
[47:59.050 --> 47:59.230]  Hi.
[47:59.810 --> 48:16.210]  Um, is that as consumers start to purchase progressively more expensive items that are inherently reliant on code, it's not just about building the product correctly, safely, in the first instance, but it's also very important to think about the updating of that product,
[48:16.610 --> 48:27.890]  the constant maintenance of that product, particularly in a world where deployment of new code is not a once in a blue moon thing, but we have constant deployment of new updates to things.
[48:28.130 --> 48:48.230]  Um, not only building in the first instance in a reasonably secure way, but figuring out a way to have that update chain demonstrate a similarly, um, uh, solid, uh, process demonstrating integrity and reasonable security.
[48:48.890 --> 49:08.030]  Um, so the, the inability of consumers to move away from some of these products that are big ticket items where there's lock-in, as you pointed out, highlights even more fiercely the need for resolving some of these deficits in building and update chain,
[49:08.310 --> 49:11.150]  uh, security challenges.
[49:13.890 --> 49:14.330]  Yeah.
[49:14.670 --> 49:18.370]  Um, so basically to your point right now, the situation's bad and you get locked in.
[49:18.550 --> 49:22.010]  Um, the, the option is kind of binary right now.
[49:22.230 --> 49:25.510]  You can choose to opt in, um, and get locked in.
[49:25.670 --> 49:26.170]  Oh, sorry.
[49:26.670 --> 49:39.250]  Um, it's cause I'm short, uh, or you can just completely opt out and there's no kind of middle ground, but the good thing is, uh, to, to Beau's point, you know, we can create a, a kind of ground swell.
[49:39.830 --> 49:50.110]  Um, and, and we can do that by like, you know, like everybody in this room, like posting like negative reviews on, on something, um, that's not, not secure.
[49:50.170 --> 49:56.150]  And then like, you know, I, I'm talking to people in DC and there's a bunch of other people talking to people in DC.
[49:56.150 --> 50:02.990]  And then, um, you guys are doing what Andrea said and you're, uh, influencing the people who manage risk in your organization.
[50:03.370 --> 50:13.910]  Um, be that the lawyers, the CFO is whatever, uh, basically like as much noise as we make, as much noise as we can make in every different realm, you know, as Beau said, there's not just one avenue.
[50:14.190 --> 50:15.510]  We create a ground swell.
[50:15.910 --> 50:17.490]  And so it won't be tomorrow.
[50:17.630 --> 50:20.390]  You won't get up suddenly in the morning and be like, Oh my, hallelujah.
[50:20.930 --> 50:24.250]  Suddenly there's another option, but eventually we'll get there.
[50:24.370 --> 50:24.770]  Eventually.
[50:25.150 --> 50:33.470]  Like if we vote with our feet and we make enough noise, then the vendors will pay attention because you know, bottom line, they got mouths to feed that they need to make money.
[50:34.830 --> 50:35.230]  Yeah.
[50:35.350 --> 50:38.450]  I think that those are all really good and practical things.
[50:38.690 --> 50:40.830]  If, uh, you know, and again, it's not going to happen overnight.
[50:40.990 --> 50:42.450]  It is going to take time.
[50:42.790 --> 50:54.250]  Um, this didn't happen overnight and little things, I mean, it may seem silly right now, but you know, a lot of little Amazon reviews on some really shitty router, printer, whatever it may be.
[50:54.650 --> 50:56.450]  Um, those things do affect change.
[50:56.450 --> 51:00.670]  Uh, if you want to, you know, try to restructure EULA agreements, that's a piece.
[51:00.910 --> 51:06.390]  Um, you know, there's tons of other people talking about other solutions in different ways, and there are solutions happening.
[51:06.510 --> 51:08.850]  It isn't all, you know, problem, problem, problem.
[51:09.150 --> 51:13.430]  Uh, the fact that what you guys are doing with the cavalry is the beginning of that groundswell.
[51:13.550 --> 51:13.930]  It's exciting.
[51:14.070 --> 51:25.650]  It's, you know, personally what got me excited about, okay, then, you know, yeah, there still is a problem, which was kind of a big bummer to see going forward, but really, really inspiring to see that, you know, that groundswell starting.
[51:25.650 --> 51:39.250]  So, um, I'm really hopeful, and I think that if everyone sticks together, and, uh, you know, it doesn't just mean one giant group of everyone doing everything, but many small groups doing projects over the next 10 years, hopefully we will not be in this situation,
[51:39.270 --> 51:43.910]  and we'll be up here talking about how it worked, and, you know, how we can make it even better.
[51:44.090 --> 51:45.410]  So, thank you all for coming.
[51:45.590 --> 51:46.130]  I appreciate it.
[51:46.190 --> 51:46.710]  Go to the bar.
[51:49.940 --> 51:50.600]  Thank you, guys.
[51:51.360 --> 51:52.520]  More talks after this.
[51:52.720 --> 51:53.700]  Oh, yeah, and there's more talks.
[51:53.820 --> 51:54.600]  Don't go to the bar, sorry.
[51:54.920 --> 51:56.400]  You can go to the bar after the other talks.
[51:56.400 --> 51:56.500]  Thanks.