[00:00.000 --> 00:01.400]  This is the Javaman.
[00:01.500 --> 00:04.380]  He'll be talking about network security through diversity of operating systems.
[00:04.940 --> 00:07.180]  Before we begin, I wanted to make two announcements.
[00:07.440 --> 00:12.660]  First of all, the lock picking session is going on right now in area 8 on the second floor.
[00:12.860 --> 00:15.840]  There will be a beginner section and an advanced section.
[00:15.980 --> 00:17.500]  You're encouraged to bring your own locks.
[00:18.320 --> 00:22.060]  The other announcement is we're looking for help with the AV system.
[00:22.240 --> 00:28.900]  So if you have AV experience, if you don't know what AV is, you probably don't qualify, especially camera people.
[00:28.900 --> 00:33.940]  So if you have any of that experience and you'd like to help out, you can just talk to anyone at an AV stand.
[00:35.100 --> 00:36.360]  Preferably when they're most busy.
[00:37.260 --> 00:39.160]  Without further ado, we have Javaman.
[00:39.760 --> 00:40.280]  How's it going?
[00:40.640 --> 00:41.360]  Can we bring up the...
[00:41.360 --> 00:41.580]  Yeah!
[00:41.920 --> 00:42.460]  Javaman!
[00:46.620 --> 00:47.420]  Javaman!
[00:47.720 --> 00:49.660]  Can we bring up the line audio?
[00:52.540 --> 00:52.980]  Word.
[00:55.440 --> 00:59.000]  Alright, so my name is Adam or Javaman.
[00:59.000 --> 01:04.300]  And I am going to be talking about the topic of pure security through diversity of systems.
[01:05.080 --> 01:05.560]  Yeah!
[01:07.760 --> 01:10.580]  So what generally inspired this work?
[01:11.700 --> 01:12.980]  You don't have to bring it that far down.
[01:13.020 --> 01:13.520]  Bring it back up.
[01:13.700 --> 01:14.080]  A little bit more.
[01:15.360 --> 01:15.840]  Good.
[01:17.100 --> 01:18.060]  Alright, so...
[01:18.060 --> 01:19.820]  So what inspired this work?
[01:19.940 --> 01:23.300]  What inspired this work is that I eventually want to graduate from school.
[01:23.300 --> 01:27.760]  And I'm in research, so...
[01:28.300 --> 01:29.780]  And also I'm in computer security.
[01:29.960 --> 01:32.180]  So I like to kind of research computer security problems.
[01:32.300 --> 01:33.340]  Which is a good idea.
[01:33.840 --> 01:34.520]  And so...
[01:35.260 --> 01:42.260]  I became interested in the idea of what can we learn from biology that we can apply to computer security to make our systems more secure.
[01:42.260 --> 01:52.440]  And so, if we look at biological systems in general, biological systems survive not as individuals but as populations.
[01:52.820 --> 01:56.520]  It doesn't matter if any one of us dies in a car wreck, the human race will continue.
[01:57.320 --> 02:07.680]  But on a whole, we need to have large numbers of people who, you know, survive and breed and make new copies of us so that our race, you know, will move on.
[02:07.680 --> 02:13.920]  And from a genetic standpoint, individuals are incredibly variable from one person to another.
[02:14.980 --> 02:27.060]  But we are similar enough that we can actually share the same languages and be able to procreate and mostly live together as a society without too many dramatic wars or things along these lines.
[02:29.580 --> 02:40.000]  So, it's kind of interesting that very minor changes in our genome, very small differences for one person to another, give rise to these incredibly devastating illnesses.
[02:40.420 --> 02:46.780]  And if Darwinism says anything, it would be that people who have genetic illnesses should have been removed from the human population a long time ago.
[02:46.780 --> 02:50.740]  Because these things are our faults and not things that help us.
[02:51.240 --> 02:59.060]  But there has to be some logical reason for why these things actually exist in our genetic code or really our programming.
[02:59.220 --> 03:03.120]  And why these things have been passed down from generation to generation of humanity.
[03:04.400 --> 03:08.760]  So, a very basic example is single gene deletion.
[03:08.760 --> 03:16.320]  So, on chromosome 7, there's this gene called CFTR, which comprises of three base pairs, right?
[03:16.440 --> 03:20.700]  And all genes are comprised of three base pairs, which give rise to 64 different amino acids.
[03:21.240 --> 03:29.980]  And so, people have this single gene deleted, okay, on one of their chromosomes, or on both of their chromosomes, because we have two pairs of chromosomes, one from mommy and one from daddy.
[03:30.800 --> 03:34.840]  It suffers a very devastating disease called cystic fibrosis.
[03:35.740 --> 03:36.880]  And I think we have a...
[03:38.640 --> 03:40.640]  I think we have a live demonstration of...
[03:40.640 --> 03:42.700]  We were having a side conversation about...
[03:42.700 --> 03:44.820]  Would you like to share something with the class, young man?
[03:44.940 --> 03:46.000]  Those three base pairs.
[03:47.560 --> 03:48.880]  They're talking about free basing.
[03:49.040 --> 03:49.640]  That's wonderful.
[03:50.240 --> 03:50.680]  So...
[03:54.440 --> 03:56.160]  Okay, so, anyway, there's this...
[03:56.160 --> 04:06.300]  If you lose this gene or these three base pairs on two chromosomes, you can get this horrible disease called cystic fibrosis, which, you know, is pretty devastating and tragic.
[04:06.660 --> 04:14.240]  And you'd think that, you know, that in the human population, this would have disappeared a long time ago, because people usually who have this disease don't make it to the age of being able to reproduce.
[04:17.100 --> 04:27.980]  And again, if we take a look at what ends up happening, is that people who have cystic fibrosis, though, who only carry one of these gene codons, there's got to be some kind of advantage.
[04:27.980 --> 04:40.080]  And in a very similar fashion, there's another genetic disease, where only one base pair is flipped, where a T changes to an A inside the DNA sequence on that one chain.
[04:40.280 --> 04:46.500]  And what happens is when it's coded off into RNA, there's a single code error.
[04:46.640 --> 05:00.720]  And what ends up happening is that the human hemoglobin changes from a very nicely well-shaped molecule that maintains its structure at all times under various conditions, from something that looks like this, hemoglobin version A, to something a lot more misshapen,
[05:00.820 --> 05:02.700]  hemoglobin version B.
[05:04.080 --> 05:16.300]  And the people who have this are people who suffer from what's called sickle cell anemia, where we have these red blood cells, and as they absorb oxygen, they become very regularly formed and are able to pass through capillaries very well.
[05:16.360 --> 05:25.880]  But as these cells give up their oxygen, they become misshapen and start to clog the arteries.
[05:26.540 --> 05:29.360]  So this is a, no, it's capillaries.
[05:29.480 --> 05:34.500]  So this is, you know, pretty, pretty shitty, you know, a lot, a genetic lot.
[05:34.680 --> 05:35.980]  But it happens to people.
[05:36.200 --> 05:37.580]  And we have to ask ourselves why?
[05:37.740 --> 05:48.380]  Why these single, these very minor changes in our genome, which you'd think have no survivability advantage, why they continue to exist?
[05:48.380 --> 05:56.980]  And basically, people with the CFTR mutation on one chromosome are incredibly tolerant against cholera.
[05:57.220 --> 06:01.540]  And the reason why is because we have these calcium channels, which line the lung, right, and also our bowels.
[06:01.760 --> 06:10.380]  And so these calcium channels permit, you know, correct balancing of salts, I believe, in our fluids.
[06:11.560 --> 06:17.580]  And people who, if they have the single gene mutation, they have far less of these things.
[06:17.760 --> 06:22.680]  And their lungs are able to survive and operate kind of in a normal fashion.
[06:25.780 --> 06:32.420]  But if they have two of these mutations, they develop cystic fibrosis.
[06:32.560 --> 06:45.240]  But in the bowels, if they only have one of these mutations, they're incredibly resistant against cholera, which is a disease where, you know, huge amounts of water will flow from the body across the bowel and then pass out of the body.
[06:45.440 --> 06:49.640]  And so people, when they have cholera, they die of dehydration more than they die of anything else.
[06:50.720 --> 06:55.100]  So, in Northern Europe, where it looks like most of this audience is from.
[06:56.660 --> 06:58.360]  I don't understand why everyone here is white.
[07:00.900 --> 07:03.240]  I think so, too, Kevin.
[07:04.600 --> 07:04.920]  So?
[07:09.800 --> 07:10.600]  Go, Rhett.
[07:12.560 --> 07:23.660]  So, the single gene mutation, which gives a rise of survivability amongst people from Northern Europe who have only this one problem.
[07:23.680 --> 07:26.280]  But if they're children, if they have both these genes, they end up dying.
[07:26.860 --> 07:27.720]  So, this is...
[07:30.540 --> 07:33.800]  So, again, it's a disorder, but there's an advantage to it.
[07:33.860 --> 07:38.660]  This minor change gives rise of advantage and gives rise of tolerance against some kind of infectious agent.
[07:38.980 --> 07:49.900]  And in a similar fashion, individuals with sickle cell anemia are incredibly resistant against malaria, which is a scourge of people from Sub-Saharan Africa.
[07:50.880 --> 07:59.480]  Now, in the human population, there seems to be similar evidence for resistance against SARS and HIV.
[07:59.800 --> 08:02.260]  So, even if HIV became a serious...
[08:02.780 --> 08:07.660]  I mean, much more serious pandemic than it is now, about one to two percent of the human population would survive.
[08:09.360 --> 08:17.220]  And in the same way SARS, which, you know, got a huge amount of media attention as being this horrible disease, there are certain people that are incredibly resistant against SARS.
[08:17.420 --> 08:18.660]  And to them, it's just a light cold.
[08:19.200 --> 08:22.140]  So, and it's because of human tolerance to disease that...
[08:22.780 --> 08:25.320]  or human variation that we become incredibly tolerant to these diseases.
[08:28.940 --> 08:36.080]  So, these genetic variations, which give rise of hereditary disease, also give us a lot of resistance to different forms of plagues.
[08:37.600 --> 08:41.540]  And pathogens, which would take one person and wipe them out...
[08:41.540 --> 08:41.780]  Thank you.
[08:42.060 --> 08:45.760]  Wipe them out in a week, may cause no sickness whatsoever in someone else.
[08:47.660 --> 08:49.000]  Again, this is true of HIV.
[08:49.440 --> 08:53.400]  There are prostitutes in Africa who cannot contract HIV.
[08:53.600 --> 08:54.180]  And they don't know why.
[08:54.340 --> 08:56.400]  And again, it's one to two percent of the human population.
[08:58.660 --> 09:01.820]  So, our own differences will save our race, basically.
[09:03.060 --> 09:12.600]  So, really, the thing to stress here from the human perspective is that this diversity that we have inherent to our genetic code of the population leads to resistance in some individuals, but not to others.
[09:12.860 --> 09:15.800]  So, in general, the system survives, but the individual does not.
[09:19.080 --> 09:27.500]  So, if we want to generalize this even further, the survivability of all biological systems, including humanity, in response to a huge number of kinds of genetic...
[09:27.500 --> 09:33.800]  a huge number of different kinds of influences, be it environmental or pathological or microbial...
[09:34.880 --> 09:35.400]  uh...
[09:43.020 --> 09:43.120]  Okay.
[09:43.440 --> 09:44.440]  I have depended upon...
[09:44.440 --> 09:46.540]  I have depended upon our genetic variations.
[09:48.400 --> 09:48.920]  Uh...
[09:48.920 --> 09:56.160]  So, when genetic diversity decreases, however, our resistance to these diseases dramatically increases, which is kind of logical.
[09:56.420 --> 10:05.040]  And so, we haven't seen that, really, in any kind of natural system, like a biological system, you know, such as the human population, except for a small number.
[10:05.040 --> 10:08.760]  There are a number of them, such as European jews with tight sacks and things like that.
[10:08.920 --> 10:09.420]  We have...
[10:09.420 --> 10:10.480]  And, uh...
[10:10.480 --> 10:12.460]  Pennsylvania Dutch, the Amish.
[10:13.800 --> 10:14.240]  Um...
[10:15.260 --> 10:15.700]  Where...
[10:17.940 --> 10:18.820]  Is it really?
[10:18.920 --> 10:20.380]  I thought it was a triangle in the back of the buggy.
[10:20.560 --> 10:20.980]  Uh...
[10:20.980 --> 10:22.180]  So, uh...
[10:22.180 --> 10:24.180]  So, these disorders, uh...
[10:24.180 --> 10:24.900]  which...
[10:24.900 --> 10:27.520]  when you have this limited population set of...
[10:27.520 --> 10:29.940]  of genetic diversity, uh...
[10:29.940 --> 10:30.640]  give rise to people.
[10:30.740 --> 10:32.880]  And it's actually very easy to see in agricultural practices.
[10:34.000 --> 10:34.440]  Um...
[10:34.940 --> 10:35.380]  So...
[10:35.380 --> 10:35.980]  Uh...
[10:35.980 --> 10:36.960]  How many people here are Irish?
[10:37.820 --> 10:38.220]  All right.
[10:38.620 --> 10:39.040]  Okay.
[10:39.200 --> 10:40.000]  So, uh...
[10:40.500 --> 10:41.000]  So, uh...
[10:41.000 --> 10:41.880]  So, the reason why, uh...
[10:41.880 --> 10:44.160]  we are in this country is, uh...
[10:44.160 --> 10:44.480]  uh...
[10:44.480 --> 10:46.240]  mostly because of, uh...
[10:46.240 --> 10:46.740]  I know...
[10:46.740 --> 10:50.740]  I mean, everyone could argue this, that the British were kind of, you know, starving us of, uh...
[10:50.740 --> 10:52.060]  wheat, and, um...
[10:52.060 --> 10:53.940]  absentee landlordism, and, uh...
[10:53.940 --> 10:54.800]  uh...
[10:54.800 --> 10:55.940]  the whole, uh...
[10:57.140 --> 10:57.760]  uh...
[10:57.760 --> 10:58.040]  uh...
[10:58.040 --> 11:02.060]  associated social causes that came with the great potato famine, uh...
[11:02.060 --> 11:03.160]  were the real reason.
[11:03.260 --> 11:04.780]  But, in reality, the, uh...
[11:04.780 --> 11:05.320]  the, uh...
[11:05.320 --> 11:09.380]  the poor frying practices of the Irish, uh... gave rise to, uh...
[11:09.380 --> 11:10.190]  a major, uh...
[11:10.740 --> 11:10.800]  uh...
[11:10.800 --> 11:12.180]  pandemic across their food staple.
[11:13.040 --> 11:13.660]  And...
[11:13.660 --> 11:14.080]  What?
[11:19.880 --> 11:20.560]  Let's take it outside!
[11:20.820 --> 11:20.980]  Yeah!
[11:22.220 --> 11:23.580]  So, anyways, uh...
[11:23.580 --> 11:25.340]  so, this pathogen, uh...
[11:25.340 --> 11:27.040]  fungus went through and, and...
[11:27.040 --> 11:28.040]  and demolished the entire, uh...
[11:28.040 --> 11:28.720]  Irish food crop.
[11:28.800 --> 11:29.060]  And why?
[11:29.280 --> 11:30.580]  Because they only planted one kind of potato.
[11:32.140 --> 11:32.500]  And...
[11:32.500 --> 11:33.060]  Which...
[11:33.060 --> 11:37.960]  And you laugh, I mean, they only planted, oh, look, they only planted one kind of potato, those damn potato eaters, and... f*cking mix.
[11:40.380 --> 11:40.880]  So, uh...
[11:43.780 --> 11:44.140]  Uh...
[11:46.300 --> 11:47.140]  Oh, no, no.
[11:47.240 --> 11:50.100]  My last name's O'Donnell, I'm allowed to say these things, that we're all drunks.
[11:50.380 --> 11:50.800]  Uh, so...
[11:51.700 --> 11:52.100]  uh...
[11:52.100 --> 11:52.800]  this...
[11:52.800 --> 11:54.760]  we only planted one form of potato, right?
[11:54.900 --> 11:57.560]  And so, when this pathogen came through, it wiped out the entire food supply.
[11:57.640 --> 12:05.860]  People would be pulling these potatoes out of the ground, and put them in storage, and within a few weeks, they'd turn black and then rot in their storage cell, whereas, uh...
[12:05.860 --> 12:07.660]  customarily, they'd stay okay for months.
[12:08.540 --> 12:08.940]  Um...
[12:08.940 --> 12:10.820]  This pathogen originally came from South America.
[12:11.140 --> 12:15.360]  And South America didn't have a dramatic genetic...
[12:15.360 --> 12:18.740]  or dramatic genetic failure, or crop failure, like the Irish did.
[12:18.740 --> 12:18.960]  Why?
[12:19.080 --> 12:21.820]  Because the South Americans planted 18 different varieties of potatoes.
[12:22.340 --> 12:22.780]  Uh...
[12:22.780 --> 12:26.000]  separate, distinct, genetically diverse kinds of potatoes.
[12:26.140 --> 12:30.660]  So, if one of them was wiped out, they still have 17, 18, so their food supply, uh...
[12:30.660 --> 12:32.200]  which is a major fraction.
[12:32.320 --> 12:34.220]  It's not something that will completely destroy the population.
[12:36.120 --> 12:37.400]  So, uh...
[12:37.400 --> 12:41.800]  Historians studying the Great Potato Famine Institute of Global Laws, which prevented, uh...
[12:41.800 --> 12:45.460]  anything like this from ever happening again across the history of humanity, uh...
[12:45.460 --> 12:46.620]  for all, uh...
[12:46.620 --> 12:47.360]  farm practices.
[12:48.020 --> 12:48.460]  Uh...
[12:48.460 --> 12:52.820]  Which is a load of horseshit, because in the 1970s, uh...
[12:52.820 --> 12:56.060]  the American farmer planted this, uh...
[12:56.060 --> 12:58.680]  this strain of high-yield corn, and, uh...
[12:58.680 --> 13:01.280]  the southern corn blade went through and ripped through the entire, uh...
[13:01.280 --> 13:01.440]  uh...
[13:01.440 --> 13:01.760]  set of it.
[13:02.600 --> 13:03.000]  Uh...
[13:03.500 --> 13:03.900]  So...
[13:03.900 --> 13:04.460]  So...
[13:04.460 --> 13:07.240]  We were really big on, you know, on growing corn for...
[13:07.240 --> 13:07.600]  for...
[13:07.600 --> 13:08.400]  for cattle feed.
[13:08.800 --> 13:09.160]  Uh...
[13:09.160 --> 13:11.180]  But there's only one or two strains of all of, uh...
[13:11.180 --> 13:12.140]  American corn at the time.
[13:12.560 --> 13:15.920]  And so, when a pathogen hit, it would go from one...
[13:15.920 --> 13:16.800]  one, uh...
[13:16.800 --> 13:19.860]  farm to the next one to the next one, and just keep spreading across all Jason farms.
[13:19.860 --> 13:21.820]  And this was incredibly tragic.
[13:22.040 --> 13:22.940]  I mean, uh...
[13:22.940 --> 13:28.140]  you're talking about people whose profit margins are $20,000, $30,000 a year, and whose lives are owed to the bank.
[13:28.360 --> 13:33.080]  If 15% of their crop is wiped out, and some locations 100% of their crop is wiped out, that's it.
[13:33.140 --> 13:33.800]  They lost the farm.
[13:34.200 --> 13:36.200]  And so, uh...
[13:36.200 --> 13:36.400]  uh...
[13:36.400 --> 13:37.840]  about 15%, or, uh...
[13:37.840 --> 13:40.180]  for those of you who do not know scientific notation, it's a billion.
[13:40.700 --> 13:40.880]  Uh...
[13:40.880 --> 13:43.040]  so a billion dollars of the crop was, uh, lost that year.
[13:44.860 --> 13:46.700]  So, the question is, uh...
[13:46.700 --> 13:49.400]  are humans and computers really that much different from a...
[13:49.400 --> 13:50.800]  from a systems standpoint.
[13:52.000 --> 13:52.500]  Uh...
[13:53.100 --> 13:53.660]  and...
[13:53.660 --> 13:55.580]  I really don't think they are individuals.
[13:56.020 --> 13:57.240]  Both, uh...
[13:57.240 --> 13:59.180]  silicon and carbon-based are complex systems.
[14:00.700 --> 14:00.980]  Uh...
[14:01.500 --> 14:02.060]  It's...
[14:02.060 --> 14:02.700]  for...
[14:02.700 --> 14:03.280]  for...
[14:03.280 --> 14:05.240]  humans, it's been millions of years of evolution.
[14:05.500 --> 14:08.520]  For computers, it's been millions of man-hours of forced evolution.
[14:09.640 --> 14:10.200]  And...
[14:10.780 --> 14:11.340]  each...
[14:11.340 --> 14:13.020]  humans composed of...
[14:13.020 --> 14:13.420]  of, uh...
[14:13.420 --> 14:17.260]  each individual is here composed of millions of lines of code or millions of, uh...
[14:17.260 --> 14:18.200]  of, uh...
[14:18.200 --> 14:19.760]  lines of amino acid-based pairs.
[14:20.160 --> 14:21.520]  There really is not much different.
[14:22.440 --> 14:23.000]  Um...
[14:23.000 --> 14:25.220]  And populations of, uh...
[14:25.220 --> 14:26.840]  human beings interact, uh...
[14:26.840 --> 14:28.120]  in these complex networks.
[14:28.200 --> 14:30.880]  And populations of computers interact in these complex networks.
[14:31.100 --> 14:35.260]  In a very similar and very much, uh...
[14:35.260 --> 14:36.940]  indistinguishable, uh...
[14:38.080 --> 14:38.600]  statistical fashion.
[14:38.760 --> 14:40.080]  It's just the way they interact.
[14:42.180 --> 14:42.900]  And, uh...
[14:42.900 --> 14:42.980]  Uh...
[14:42.980 --> 14:46.780]  So a lot of them has been made of the general science of- of network study recently.
[14:47.020 --> 14:51.580]  And if I presented this graph to a sociologist, I'd say, oh, this is the rate at which, um...
[14:51.580 --> 14:53.060]  people interact with each other.
[14:53.260 --> 14:55.940]  You know, this is- this is like a- a friend of a friend network.
[14:56.880 --> 14:57.240]  Uh...
[14:57.240 --> 14:59.800]  Or if I presented it to a- uh...
[14:59.800 --> 15:03.540]  to a civil engineer, I'd say, oh, this is distribution of, uh, city- uh...
[15:03.540 --> 15:04.100]  of, uh...
[15:07.500 --> 15:08.680]  across, uh...
[15:08.680 --> 15:09.160]  the continent.
[15:09.500 --> 15:13.260]  Or if I presented it to, you know, a hydrologist, it would say something similar about, uh...
[15:13.260 --> 15:14.140]  water table distributions.
[15:14.420 --> 15:15.900]  And this is actually, uh...
[15:15.900 --> 15:16.820]  extracted from a, uh...
[15:16.820 --> 15:18.080]  graph about, uh...
[15:18.080 --> 15:19.180]  uh... interactions of, uh...
[15:19.180 --> 15:19.960]  people over email.
[15:20.740 --> 15:21.120]  Uh...
[15:21.120 --> 15:21.900]  And this is real data.
[15:22.080 --> 15:25.080]  And what happens if it follows this- this- this scale-free distribution.
[15:25.260 --> 15:27.260]  I'm not going to get into scale-free distributions, really, in general.
[15:27.720 --> 15:28.480]  But, uh...
[15:28.480 --> 15:31.660]  the thing that's much more interesting about it is that, uh...
[15:31.660 --> 15:36.320]  that- that the same statistical patterns and the same interaction patterns that happen amongst biological systems
[15:42.940 --> 15:47.000]  So, individuals from both groups get sick because of flaws in their construction.
[15:47.420 --> 15:48.460]  Human beings get viruses.
[15:49.100 --> 15:51.340]  Computers get viruses because of flawed people.
[15:56.160 --> 15:58.280]  So, these problems erupt.
[15:59.560 --> 16:03.980]  And when these problems erupt, fixing them is kind of difficult.
[16:04.460 --> 16:08.740]  It's nearly impossible right now to go through someone's genetic code and make a single base pair change.
[16:09.080 --> 16:14.880]  And at the same time, it's nearly impossible to actually go in and find an error in a piece of code, write a patch, and get everyone to apply it.
[16:16.360 --> 16:17.460]  It hasn't happened yet.
[16:17.520 --> 16:18.680]  It's not going to happen anytime soon.
[16:19.060 --> 16:25.000]  So, we kind of have to get to the point where we truly accept that there is no way of fixing computer systems.
[16:25.100 --> 16:26.580]  The computer systems will always be insecure.
[16:26.800 --> 16:28.720]  And human beings will always have viruses.
[16:28.900 --> 16:31.820]  And human beings will always be vulnerable from this standpoint.
[16:35.720 --> 16:47.900]  So, the basic principle of computer security through diversity is that computer systems should emulate biological systems to become much more survivable in the face of attack and adversity.
[16:48.140 --> 16:54.980]  Either environmental adversity or something that's man-made or something along those lines.
[16:55.260 --> 16:56.680]  Is there any questions up to this point?
[16:59.520 --> 17:00.840]  Everyone following me so far?
[17:00.840 --> 17:01.920]  It's the dance.
[17:01.940 --> 17:02.580]  It's the dance.
[17:02.680 --> 17:03.280]  Does the dance help?
[17:03.860 --> 17:04.940]  Who thinks the dance helps?
[17:12.360 --> 17:14.140]  Yes, no heavy coinage.
[17:18.530 --> 17:20.710]  Okay, so what do I mean by emulate?
[17:21.730 --> 17:25.070]  Basically, it's kind of an acceptance that when we build these systems...
[17:25.590 --> 17:27.110]  We can bring up the music a little bit more, too.
[17:27.550 --> 17:28.070]  Just a little bit.
[17:28.650 --> 17:29.010]  Thanks.
[17:30.350 --> 17:33.850]  So, when we build these systems, what are we really trying to do?
[17:34.910 --> 17:39.130]  We must stop focusing on trying to make the individual ultimately secure.
[17:39.250 --> 17:41.010]  Because that's near f*cking impossible.
[17:41.590 --> 17:41.710]  Okay?
[17:41.710 --> 18:00.490]  But what can we do amongst our computer computing infrastructure to say that if we're going to lose a single system or if something is singly vulnerable, how can we prevent this attack from spreading all over the place to the point where it becomes an academic?
[18:03.490 --> 18:09.790]  And there's been a lot of research where people say that they should emulate biological systems for computing systems.
[18:09.950 --> 18:23.330]  A lot of the research is centered upon organic immune system research and self-non-self-recognition and all this other good fields of work, right?
[18:23.730 --> 18:26.210]  But are these true biological system emulators?
[18:26.390 --> 18:33.510]  I mean, part of the problem is that from a self-non-self-recognition standpoint, you have to go and recognize a change in a file.
[18:33.630 --> 18:35.510]  You have to have a large population of files change.
[18:35.730 --> 18:42.430]  At the same time, be able to stop the attack in midpoint.
[18:42.930 --> 18:44.830]  Anyway, that problem is kind of difficult.
[18:48.790 --> 18:55.930]  So, from an epidemic standpoint, humans and computers get epidemics.
[18:56.270 --> 19:04.270]  I mean, we have the slammer worm as a form of epidemic or any of the other major Internet-enabled viruses.
[19:04.490 --> 19:05.610]  I mean, I can't think of what else.
[19:05.770 --> 19:07.050]  Well, whatever you should call them.
[19:07.250 --> 19:09.050]  Yeah, SAS or whatever the hell else is out there.
[19:09.350 --> 19:10.450]  The stoned virus.
[19:10.610 --> 19:11.590]  That was the last one I got.
[19:11.830 --> 19:12.390]  The stoned.
[19:13.210 --> 19:14.810]  Not that I got stoned, but I got the stoned virus.
[19:14.810 --> 19:15.970]  And that was a boot-sector virus.
[19:16.490 --> 19:16.810]  You're straight edge.
[19:16.910 --> 19:17.790]  Because I'm straight edge.
[19:17.950 --> 19:20.390]  I'm like that.
[19:21.230 --> 19:21.490]  So...
[19:23.670 --> 19:26.930]  And for those of you who do not remember what stoned virus was, a boot-sector virus.
[19:27.090 --> 19:30.510]  So, the way it was spread was that people would put the floppy disk in their boot drive.
[19:30.690 --> 19:32.030]  This was before everyone had hard drives.
[19:32.290 --> 19:37.090]  And they would turn on a computer and spread the other disk in the other floppy drive.
[19:38.730 --> 19:40.950]  And so, I mean, these things were a pain in the ass to get rid of.
[19:40.950 --> 19:47.310]  But these biological systems evolve in the same rate as viruses evolve.
[19:47.530 --> 19:51.490]  We evolve these diversity techniques to defeat viruses.
[19:51.670 --> 19:56.430]  And viruses evolve to kind of take advantage of our weaknesses.
[19:56.490 --> 20:01.470]  And at the same time, we have populations that have been completely wiped out by a lack of variation.
[20:02.230 --> 20:06.110]  Again, such as the potato crop and other problems like that.
[20:06.290 --> 20:07.330]  And Jamie, I see you leaving!
[20:10.210 --> 20:18.730]  So, populations in competing systems, which should have been wiped out a long time ago, are kept in place by flawed market economics.
[20:18.730 --> 20:23.330]  Which, many of you would, you know, kind of say, oh, oh, oh, oh, oh.
[20:23.450 --> 20:25.310]  But basically, oh, oh, oh, oh.
[20:25.610 --> 20:29.130]  If security was an economic concern, which it truly is.
[20:29.410 --> 20:35.450]  And when there's a security problem, people have to spend money hand over fist to kind of eliminate the issue.
[20:35.450 --> 20:38.070]  Either manpower or downtime or along those lines.
[20:40.370 --> 20:46.050]  These economic pushes would have said, hey, maybe we should run something that's all this secure.
[20:46.230 --> 20:49.610]  But because there's no other name in the game, it's kind of tough.
[20:49.770 --> 20:58.930]  So, what can we do to diversify systems where economics does not allow us to actually run something that's completely unique or different?
[20:59.970 --> 21:03.190]  So, this general principle is described in several position papers.
[21:05.030 --> 21:12.330]  I think the Zhang paper is, you know, it was entitled, Herogenius Networking, A New Paradigm in Security or something like that.
[21:13.170 --> 21:19.290]  It was Dan Geer who wrote a paper for a security conference.
[21:19.290 --> 21:23.270]  And he got, well, here?
[21:24.410 --> 21:24.970]  Okay.
[21:25.210 --> 21:26.410]  So he got fired from Matt Stakefort.
[21:30.770 --> 21:31.570]  And then...
[21:34.490 --> 21:43.650]  There was a paper that came up in, like, the last article section of ACM Communications not too long ago, by a stamp, about the idea of the risks of monoculture in computer systems.
[21:44.150 --> 21:49.990]  And basically, the very statement of it is saying that the act of having a monopoly makes the Internet insecure.
[21:49.990 --> 21:56.830]  And that is kind of, if you can prove that statement, there's a lot of bad that comes with that.
[21:56.930 --> 22:02.750]  That basically says that it's an ultimate argument against Microsoft, in a way.
[22:03.010 --> 22:12.230]  I mean, if we want homeland security, then we need to eliminate these monocultures.
[22:12.230 --> 22:13.190]  We got to diversify.
[22:13.570 --> 22:14.630]  We got to spread things in.
[22:15.810 --> 22:16.530]  And so...
[22:17.510 --> 22:19.390]  And so, it's a hard...
[22:19.390 --> 22:22.010]  Again, it's proven that it's a hard thing to actually go and fight in the courts.
[22:22.230 --> 22:26.290]  Basically, it says that our military would be insecure if it only runs something from one vendor.
[22:27.490 --> 22:28.670]  So, again, there's...
[22:28.670 --> 22:33.290]  If you guys want to jot these down, I can throw this slide up again at the end.
[22:33.530 --> 22:38.510]  But these are all papers that are available via the Google and the Interweb.
[22:39.250 --> 22:42.150]  You don't need an IEEE or an ACM login to get these things.
[22:42.170 --> 22:44.030]  They're kind of widely accessible.
[22:46.570 --> 22:49.030]  So, what is my message to you guys here today?
[22:49.190 --> 22:52.950]  Is to go forth and bring changes to the computer world.
[22:53.050 --> 23:00.850]  And to go forth and diversify your software through both library standpoints, and from system standpoints, and from hardware standpoints.
[23:00.850 --> 23:02.170]  Is to run different things.
[23:02.370 --> 23:05.290]  And to do different things, and to think differently about computer systems.
[23:05.290 --> 23:10.610]  And so, it should be the job of the security community to encourage and enforce diversity.
[23:11.230 --> 23:12.770]  Really, by any means necessary.
[23:13.010 --> 23:19.330]  Because it is something that is making our systems insecure, and making our networks insecure from a global standpoint.
[23:20.710 --> 23:22.390]  But, I mean, let's be honest.
[23:22.470 --> 23:24.570]  There's only so many names in the router business.
[23:24.890 --> 23:26.750]  There's only so many things you can run besides iOS.
[23:28.010 --> 23:29.450]  Really, the only thing you can run is iOS.
[23:29.790 --> 23:30.710]  I mean...
[23:31.810 --> 23:32.170]  And...
[23:32.170 --> 23:33.030]  Yeah, Foundry.
[23:33.570 --> 23:33.930]  But...
[23:33.930 --> 23:36.310]  In a couple of years, those will get bought up.
[23:36.410 --> 23:36.890]  Let's be honest.
[23:37.330 --> 23:37.970]  I mean, that's...
[23:38.670 --> 23:39.030]  Juniper.
[23:40.170 --> 23:42.010]  How many people here run Juniper, Nick?
[23:42.870 --> 23:43.690]  It's a grand Foundry.
[23:43.890 --> 23:44.190]  Yeah.
[23:47.510 --> 23:50.670]  So, really implementing any kind of diversity on large scale is...
[23:50.670 --> 23:51.350]  It remains a challenge.
[23:51.530 --> 23:52.130]  I mean, if you're...
[23:52.570 --> 23:55.990]  If you're a large knock, and you're going to be running iOS, then...
[23:55.990 --> 23:58.350]  Go and get your people cross-trained on...
[23:58.350 --> 23:58.690]  On...
[23:58.690 --> 23:59.190]  On...
[23:59.770 --> 24:00.450]  Foundry or...
[24:00.930 --> 24:01.970]  Juniper is a pain in the ass.
[24:02.110 --> 24:02.590]  It's expensive.
[24:02.830 --> 24:08.190]  And if something goes and breaks, you may not have the person on staff, at that moment in time, to actually go through and repair that system.
[24:08.970 --> 24:09.350]  So...
[24:09.350 --> 24:14.250]  We kind of need to keep these interfaces much the same, but at the same time, make these...
[24:14.250 --> 24:15.750]  These systems dramatically different.
[24:16.550 --> 24:17.390]  So as to...
[24:17.390 --> 24:18.530]  To prevent...
[24:18.530 --> 24:19.150]  Uh...
[24:19.150 --> 24:19.770]  Security break-ins.
[24:20.390 --> 24:20.770]  So...
[24:20.770 --> 24:24.050]  There are a couple of different ways we can go about diversifying systems.
[24:24.050 --> 24:26.410]  They can either be done through manual and automatic...
[24:26.410 --> 24:26.650]  Or...
[24:26.650 --> 24:27.750]  Or automatic systems.
[24:28.370 --> 24:28.770]  Uh...
[24:28.770 --> 24:31.490]  Whereas manual systems is something that someone goes and sits down and does on their own.
[24:32.010 --> 24:33.450]  And automatic system would be a piece of...
[24:33.450 --> 24:35.590]  An algorithm or some kind of code or some kind of...
[24:35.590 --> 24:38.590]  Architecture would be able to take in some piece of software and then go...
[24:38.590 --> 24:41.610]  And then chop it up and do something to it that makes it completely different.
[24:42.350 --> 24:43.350]  Any questions so far?
[24:44.270 --> 24:45.010]  Am I going...
[24:45.010 --> 24:45.330]  Yes!
[24:45.850 --> 24:46.290]  That's...
[24:58.720 --> 24:59.980]  You're exactly correct.
[25:00.540 --> 25:00.980]  No.
[25:01.160 --> 25:01.980]  You're exactly correct.
[25:02.800 --> 25:03.240]  And...
[25:03.240 --> 25:03.940]  Uh...
[25:03.940 --> 25:04.480]  But...
[25:04.480 --> 25:06.820]  But we've reverse engineered standards before.
[25:07.180 --> 25:07.820]  Look at Samba.
[25:08.300 --> 25:09.960]  I mean, Samba wasn't anything that was...
[25:09.960 --> 25:10.880]  That was really published.
[25:11.040 --> 25:14.140]  That was something that someone sat down and reverse engineered to spec and it made something that was different.
[25:14.500 --> 25:16.600]  And so now there's two ways of doing Windows file sharing.
[25:17.280 --> 25:18.940]  I mean, so...
[25:19.680 --> 25:20.120]  Uh...
[25:20.120 --> 25:20.500]  Uh...
[25:20.500 --> 25:20.600]  Uh...
[25:20.600 --> 25:20.960]  I mean, there's...
[25:20.960 --> 25:22.580]  There's legions of people out there.
[25:22.780 --> 25:23.540]  Legions of...
[25:23.540 --> 25:23.840]  Of...
[25:23.840 --> 25:24.060]  Doom!
[25:24.640 --> 25:26.340]  But legions of people that would go out to...
[25:26.340 --> 25:26.520]  Doom!
[25:27.240 --> 25:32.960]  But legions of people out there who are more than happy to sit down and reverse engineer a protocol because they've got nothing else f*cking better to do.
[25:36.060 --> 25:36.500]  Uh...
[25:36.500 --> 25:40.800]  Not that I'm criticizing the very concept of people reverse engineering stuff, but I think that'd be somewhat entertaining.
[25:43.440 --> 25:44.040]  Thank you.
[25:55.280 --> 25:56.560]  Well, for my...
[25:58.880 --> 26:00.520]  For your homies, you've been busted.
[26:00.740 --> 26:01.840]  Yeah, for our homies, you've been busted.
[26:05.020 --> 26:05.820]  Jesus Christ.
[26:06.000 --> 26:06.560]  Thank you, Mackie.
[26:06.860 --> 26:07.480]  Uh, so...
[26:08.180 --> 26:09.240]  Oh, my God.
[26:10.620 --> 26:11.080]  Um...
[26:11.080 --> 26:12.000]  So, what's...
[26:12.000 --> 26:17.360]  The general idea of manual diversity is manual replication of functionality in an uncommon way.
[26:17.860 --> 26:18.020]  Yeah.
[26:18.140 --> 26:19.160]  This thing's f*cking heavy.
[26:19.660 --> 26:20.020]  So, uh...
[26:20.020 --> 26:20.520]  40 ounces.
[26:20.820 --> 26:21.460]  Yeah, I know.
[26:22.020 --> 26:24.060]  I'm only used to 12-ounce curls nowadays.
[26:25.040 --> 26:26.460]  I don't even drink pounders anymore.
[26:26.520 --> 26:28.340]  I'm glad I didn't bring you the old English 64.
[26:29.700 --> 26:30.800]  I think it's cute.
[26:33.260 --> 26:35.000]  I'm gonna put some meat on the Mackie that way.
[26:36.260 --> 26:37.100]  Ugh, beer.
[26:37.400 --> 26:39.520]  I had your brunch at 29th, but it's really hard.
[26:40.120 --> 26:40.940]  Oh, man.
[26:41.880 --> 26:42.040]  All right.
[26:42.320 --> 26:48.040]  So, again, manual diversity is basically the idea of manual replication of functionality in an uncommon way.
[26:48.420 --> 26:49.680]  And so, what are some examples?
[26:50.080 --> 26:54.440]  Uh, the truly obvious example is web browsers, where, um...
[26:54.440 --> 26:59.800]  There are plenty of, uh, uh, third-party browsers out there, but they all kind of use the standard plug-ins.
[26:59.900 --> 27:00.940]  But that's a different topic.
[27:01.580 --> 27:02.540]  I mean, um...
[27:02.540 --> 27:04.460]  What, Cirque came out and said you shouldn't use an IE anymore?
[27:04.920 --> 27:05.960]  It's not because...
[27:05.960 --> 27:07.440]  It's my fiance calling.
[27:07.860 --> 27:09.780]  Uh, so, uh...
[27:09.780 --> 27:09.900]  Uh...
[27:12.220 --> 27:12.700]  I'll call her back.
[27:12.940 --> 27:13.460]  Uh, so...
[27:14.560 --> 27:14.920]  Uh...
[27:14.920 --> 27:15.440]  She won't mind.
[27:15.620 --> 27:17.780]  Uh, so anyway, uh...
[27:17.780 --> 27:20.860]  There was a big alert that came out from CERT recently saying they should stop using IE.
[27:21.020 --> 27:24.540]  And the reason why they should stop using IE is not because IE is less secure than anything else.
[27:24.640 --> 27:25.520]  I mean, I'm sure that...
[27:26.120 --> 27:26.820]  Oh, excuse me.
[27:26.900 --> 27:28.400]  I'm sure that, um...
[27:28.400 --> 27:28.940]  Uh, that...
[27:28.940 --> 27:34.240]  That Mozilla and all the other programs out there have as many security problems in there as IE does.
[27:34.540 --> 27:37.840]  The problem is because it's 95% of the computers out there use it.
[27:37.840 --> 27:45.720]  If you're gonna invest time into developing an exploit, if you're gonna invest a hundred hours into developing an exploit for IE versus one for Mozilla, which one's gonna give you a bigger bang for your buck?
[27:46.020 --> 27:46.980]  Uh, IE.
[27:47.100 --> 27:49.760]  You know, you're gonna sit down and develop for the one thing that's standard.
[27:50.840 --> 27:58.340]  Uh, and so, uh, uh, this is a very simple, very easy to demonstrate the example of why you should, you know, avoid doing diversification.
[27:59.120 --> 28:00.860]  Uh, also using non-standard plug-ins.
[28:01.100 --> 28:08.060]  Uh, as much as we go and try to use flat, uh, use, uh, Mozilla or we use, uh, Safari or Firefox or whatever the hell you wanna use.
[28:08.720 --> 28:11.420]  Uh, if you're using Flash, then you're using Flash.
[28:11.620 --> 28:17.000]  And if someone comes up with an exploit against Flash or something like that, it doesn't matter what browser you're using, it's still that single point of failure exists.
[28:17.640 --> 28:27.780]  So, uh, while you may think that this is just a cautionary tale, while you may think that you're, you're diversifying your system, in a way you're still kinda not because there's these single libraries which everyone depends upon.
[28:29.520 --> 28:32.060]  So, uh, so the other part of this...
[28:32.060 --> 28:32.800]  What was that?
[28:33.500 --> 28:34.280]  I'm not drinking enough.
[28:34.560 --> 28:42.560]  Alright, so the other part of this is that we really should replicate libraries that have already been written in a totally new and more secure way.
[28:42.920 --> 28:45.040]  Using totally new and more secure programming languages.
[28:45.380 --> 28:48.920]  Um, and a side note of that is, uh, for the love of all that is holy, place OpenSSL.
[28:49.920 --> 28:53.000]  Because, I don't know, how many of us have programmed using OpenSSL?
[28:53.000 --> 28:54.880]  Okay, how many of us like it?
[28:55.980 --> 28:56.420]  Okay.
[28:58.140 --> 28:58.840]  Yeah, exactly.
[28:59.120 --> 29:01.440]  Uh, but it isn't just the API that's a problem.
[29:01.560 --> 29:03.620]  There's a lot of bugs in OpenSSL.
[29:03.720 --> 29:07.280]  You feed it the wrong input, and stuff starts core dumping very oddly.
[29:07.580 --> 29:13.120]  And when things core dump, that usually means, you know, or you see a segmentation violation, there's something bad there.
[29:13.960 --> 29:16.430]  Core dumping!
[29:16.710 --> 29:17.530]  It's core dumping.
[29:29.100 --> 29:30.960]  I wanted to get paper proof from the monkey.
[29:31.220 --> 29:32.080]  But, uh, let me finish this point.
[29:32.440 --> 29:38.440]  So, um, so it'd be very good if we could actually go and, um, um, replace OpenSSL.
[29:38.580 --> 29:46.600]  Because for all the people out there who say, Oh, well I'm running Linux, I'm running OpenSSH, and since it's not the commercial OpenSSH, it's not the commercial SSH, it's gotta be more secure, blah, blah, blah, blah, blah.
[29:47.880 --> 29:48.600]  That's horseshit.
[29:48.920 --> 29:58.620]  And the reason why is because, because Apache OpenSSL, uh, Apache SSH, um, uh, all these encrypted AIM clients, everything else relies upon this one single library.
[29:59.060 --> 30:08.760]  And whenever there's a problem found in this one single library, it wouldn't be too much of a difficult concept to, to go manipulate this attack to actually start attacking other, other applications that use the same library.
[30:09.500 --> 30:15.860]  Um, and again, uh, I know some people, uh, uh, I mean, we all know him.
[30:15.980 --> 30:22.040]  So anyway, uh, he, he said, he sat down and said, Oh, I'm gonna, for shits and grins, I'm gonna go and audit OpenSSL.
[30:22.040 --> 30:23.900]  And he found eight major problems.
[30:24.120 --> 30:27.640]  And of course he didn't release them, because he sat down and wrote the exploit for him, and just keeps it in his own back pocket.
[30:28.120 --> 30:30.940]  But, you know, OpenSSL has so many problems in that.
[30:31.160 --> 30:34.820]  When a skilled professional sits down to go and look at it, you know, pick it apart like crazy.
[30:35.180 --> 30:35.780]  Your question.
[30:44.050 --> 30:44.850]  Yeah, that...
[30:46.690 --> 30:49.330]  Oh yeah, so you said you wanted to mention the Akamai DDoS attacks.
[30:49.670 --> 30:51.910]  Uh, so I was gonna get to that actually later, but next.
[30:52.390 --> 30:52.810]  What was the other one?
[30:53.010 --> 30:55.670]  That's what I wanted to mention was that self-reactive.
[30:56.970 --> 31:00.850]  So, well, self-reactive APs aren't, uh, diverse itself.
[31:01.070 --> 31:09.370]  I mean, if there's a problem with the, the, the, I mean, that's what, uh, Mike's working on this weekend, is, is keeping this network up of, uh, of reactive access points.
[31:09.370 --> 31:11.370]  Even having a reactionary algorithm is bad.
[31:11.510 --> 31:17.790]  Because every single system implements the same reactionary algorithm, you find a problem in that reactionary algorithm, then every single system goes down.
[31:19.430 --> 31:27.850]  So, uh, so implement, so another big problem is, uh, writing a part, a secure parser is really freaking hard.
[31:28.430 --> 31:30.910]  Uh, I mean, I'm not f*cking around.
[31:31.270 --> 31:38.090]  Writing a, writing a, uh, how many people sat down and try writing a, a full parser for, uh, parser in somewhere for a TCP/IP?
[31:38.670 --> 31:39.270]  And see.
[31:39.710 --> 31:40.990]  How many people think they did it right?
[31:42.250 --> 31:45.010]  I mean, it is incredibly difficult.
[31:45.290 --> 31:51.390]  And this is why there's all those attacks that came out a couple years ago, like Teardrop and, uh, the hell else were the other ones?
[31:52.150 --> 31:52.870]  Teardrop, Bonk.
[31:55.090 --> 32:01.870]  Yeah, I mean, you know, these things that, and it wasn't because, because, you know, the systems were so terrible that they, you know, they're so easily attacked.
[32:01.870 --> 32:04.210]  No, it's, it's really, really, really hard to do.
[32:04.470 --> 32:14.330]  And if we only have, like, a couple code bases out there, if the code bases that exist to, to do TCP/IP stack parsing is Windows and Linux, this is bad.
[32:14.490 --> 32:22.170]  Because what happens is that once someone goes and finds a problem, it won't take very long for them to go and code up a massive denial of service attack that could, you know, pop, bring these things down.
[32:22.410 --> 32:23.630]  We saw this with iOS.
[32:24.090 --> 32:28.170]  Every time there's an iOS problem, people go and they, you know, they crap their pants.
[32:28.170 --> 32:42.530]  And the reason why is because, because if there's a major problem with, with, with the TCP/IP parser for, for BGP or something like that, or, or something along those lines, it circumvents all these little mechanisms that they have in iOS to do authentication on,
[32:42.590 --> 32:44.570]  on, uh, BGP packets.
[32:44.830 --> 32:47.090]  And you can go bring down the link that sits at the core of the Internet.
[32:48.170 --> 32:59.190]  So, so for many of you who are in, uh, uh, school or something like that, a really good idea for senior project is to sit down and rewrite an ASN 1, ASN 1 parser and some crazy-ass language.
[32:59.910 --> 33:02.150]  And, uh, you can go and graduate that way.
[33:03.390 --> 33:14.070]  So, um, so in general, uh, I think that another goal for people would be to make it very, very easy to run different operating systems on all different kinds of hardware with only a few basic, basic requirements.
[33:14.210 --> 33:16.050]  Because not everyone wants to sit down and learn Linux.
[33:16.790 --> 33:22.430]  Uh, not everyone is the same, uh, in that they don't use computers for the sake of using computers.
[33:22.550 --> 33:23.870]  They use computers to get work done.
[33:24.130 --> 33:25.190]  This is very specific.
[33:25.190 --> 33:33.310]  They have projects that aren't, that aren't, you know, self, uh, uh, you know, uh, uh, uh, they don't look back on themselves.
[33:33.430 --> 33:34.290]  They're not recursive projects.
[33:34.430 --> 33:34.670]  You know what I mean?
[33:34.730 --> 33:39.690]  It's, uh, they want to use computers to communicate with people via email to, to mild scientific problems.
[33:39.930 --> 33:46.490]  And they don't want to spend all their days learning how to install OpenBSD 3.4 on a, uh, M60AK machine.
[33:47.370 --> 33:51.950]  It's just, uh, I mean, my immediate friends excluded.
[33:52.550 --> 33:59.570]  But, uh, uh, I mean, these are, so, so, a lot of these operating systems, and the reason why I came up with saying that, you know, Knoppix is a perfect example.
[33:59.990 --> 34:02.250]  I think Knoppix is the coolest f*cking thing ever.
[34:02.490 --> 34:10.970]  The fact that someone took this, this, this piece of software that, that, I don't know if anyone remembers Linux back in 94, it was a pain and he has to get anything to work.
[34:11.510 --> 34:18.690]  And they actually went and they, they were resolved everything down to a single CD that, that went and detected a huge number of feature sets on one platform, granted.
[34:18.970 --> 34:21.510]  But, you just drop it in and it pretty much always works.
[34:21.670 --> 34:22.810]  And it's very rare for it not to work.
[34:24.730 --> 34:25.590]  We need to take a break.
[34:25.930 --> 34:26.350]  All right.
[34:26.530 --> 34:26.850]  All right.
[34:30.890 --> 34:33.230]  So you're probably, you're putting the cat back on and slowed it down.
[34:33.370 --> 34:33.790]  Yeah, yeah, yeah.
[34:34.730 --> 34:36.590]  You really should be up prominently on the head.
[34:40.500 --> 34:40.980]  Yeah.
[34:43.260 --> 34:43.940]  More interpretive energy.
[34:44.160 --> 34:44.620]  More 40.
[34:45.380 --> 34:45.860]  More energy.
[34:46.220 --> 34:46.700]  Faster.
[34:47.360 --> 34:48.940]  Your motivation here is...
[34:48.940 --> 34:49.180]  Yeah.
[34:51.280 --> 34:52.940]  You're drinking a 40 and you're giving a talk.
[34:53.040 --> 34:53.700]  That's your motivation.
[34:54.980 --> 34:56.140]  You're on fire, baby.
[34:56.380 --> 34:56.740]  You're on fire.
[34:57.640 --> 34:57.840]  Yeah!
[34:58.080 --> 34:58.920]  Java badge!
[34:59.280 --> 34:59.460]  Woo!
[35:00.020 --> 35:01.620]  So, uh, again...
[35:01.620 --> 35:02.520]  Java is not at all 40!
[35:02.780 --> 35:03.100]  Yay!
[35:04.620 --> 35:04.860]  Yay!
[35:04.860 --> 35:07.300]  So, you want to make systems that are easy to use for the beginner.
[35:07.300 --> 35:09.960]  So everyone can go adopt these things rather than just the nerd set.
[35:10.540 --> 35:12.840]  Uh, so don't stop at reinventing the wheel.
[35:12.920 --> 35:14.340]  Do things that are completely new.
[35:14.500 --> 35:15.840]  And so here's some of the craziest ideas.
[35:16.660 --> 35:17.020]  Like...
[35:17.020 --> 35:18.460]  What the hell just happened to my screen?
[35:19.160 --> 35:19.660]  Oh, okay.
[35:22.780 --> 35:23.140]  Uh...
[35:23.140 --> 35:24.400]  Don't stop at reinventing the wheel.
[35:24.740 --> 35:26.560]  Uh, run crypto streams to the GPU.
[35:26.560 --> 35:28.000]  I mean, you've got this vector processor.
[35:28.220 --> 35:35.640]  You go and start, you know, jamming like, you know, 64 RC5 streams through your, uh, uh, through your video board and your, you know, your video will cut out.
[35:35.960 --> 35:41.040]  But, uh, the cool thing about it is that you'd be able to, you know, you know, fling open SSL very quickly.
[35:41.240 --> 35:44.920]  Uh, and when you start doing things in hardware, it's a lot more...
[35:45.780 --> 35:51.540]  The design methodology you use when you start using hardware systems is a lot more, um, I want to say precise.
[35:52.440 --> 35:54.420]  Uh, I mean, it's, it's very much more formalized.
[35:54.520 --> 35:58.360]  And so a lot, and so security problems that erupt are so much different from, from software.
[35:58.500 --> 35:58.800]  It's different.
[35:58.980 --> 36:00.800]  And it, it makes it harder for people to attack.
[36:01.440 --> 36:04.340]  Uh, design reconfigurable competing back ends that handle parts of state machines.
[36:04.600 --> 36:09.960]  Build all your state machines in the hardware and you're going to have a hell of a lot more difficulty in, um, and having someone attack it.
[36:10.060 --> 36:13.000]  And it's a lot easier to analyze from the, from the hardware design perspective.
[36:13.000 --> 36:16.920]  Because you just have to close all the state transitions, uh, from, uh, state to state.
[36:17.640 --> 36:26.880]  Uh, or you can do all our computations by passing out computations, uh, over MPI to terminals, uh, and cubicle staff by, uh, Romanians brought over, uh, and a slave ship.
[36:27.580 --> 36:28.640]  Uh, yay!
[36:29.540 --> 36:33.020]  Uh, because those Eastern Bloc Europeans really can do math.
[36:33.480 --> 36:36.160]  Uh, yeah.
[36:36.840 --> 36:46.000]  Um, so the caveat, uh, as much as I want everyone to, to do something that's completely different, uh, don't build different APIs to a certain extent.
[36:46.140 --> 36:50.180]  If you go and you make these, say, oh, we're gonna make GNU, uh, uh, SSL.
[36:50.420 --> 36:52.400]  And it's gonna have this brand new API.
[36:53.220 --> 36:55.220]  You're gonna have a very slow adoption rate.
[36:55.500 --> 36:58.880]  Because everyone has this open SSL code out there.
[36:59.000 --> 37:05.240]  And what would be really, really cool is they had a full open SSL, you know, interface layer that's completely compatible.
[37:05.240 --> 37:08.080]  So all you need to do is change a link flag in the compiler settings.
[37:08.440 --> 37:09.540]  And that would be nifty.
[37:09.940 --> 37:14.980]  So that way, you have all these people, instead of just running Apache, they're able to run, you know, uh, Apache with open SSL.
[37:15.060 --> 37:21.160]  They're able to run, uh, uh, Apache with, you know, I don't know, uh, f*cking veggie SSL or something like that.
[37:22.360 --> 37:25.560]  And, um, and have something that'll be a little bit more attack.
[37:25.720 --> 37:29.440]  And you would be able to sleep a little bit better at night every single time an open SSL vulnerability comes out.
[37:29.840 --> 37:35.840]  Um, and also, uh, in general, people like to have the same interface over and over and over again.
[37:36.180 --> 37:43.100]  Uh, one of the reasons why PalmPilot programming got so big is because it uses the same general APIs as Mac 68K programming did.
[37:43.260 --> 37:46.360]  Like old System 6, uh, I mean, it looked similar.
[37:46.560 --> 37:47.480]  It wasn't too different.
[37:47.620 --> 37:54.300]  And so you're able to have a lot of people who came from that one environment to come over to the, uh, the, the, the PalmPilot, uh, environment and start working on those.
[37:55.220 --> 37:58.840]  Mostly that's due to Code Warrior and, and the entire attitudes around that, but still.
[37:59.780 --> 38:02.920]  Uh, so where can you actually find some, uh, uh, work on this?
[38:03.080 --> 38:05.800]  Uh, a lot of this came out from the fault tolerance community.
[38:06.180 --> 38:12.400]  Um, and they kind of advocate using these techniques for fault tolerance, uh, uh, for, for, uh, computer security.
[38:13.060 --> 38:15.760]  Now, how can we, uh, do it in an automatic fashion?
[38:15.940 --> 38:17.480]  This is where you do, this is where you do the robot.
[38:18.360 --> 38:18.720]  Yeah.
[38:22.790 --> 38:24.310]  That's the worst robot I've ever seen.
[38:29.670 --> 38:34.810]  So, algorithms exist which can, uh, automatically introduce variability into multiple levels of system behavior.
[38:36.830 --> 38:39.370]  And, some basic examples.
[38:39.910 --> 38:40.510]  I'm trying to remember.
[38:40.770 --> 38:41.070]  Okay, yeah.
[38:41.350 --> 38:42.970]  So, let's go right to the slide.
[38:43.570 --> 38:58.030]  Uh, so, uh, what, uh, Linger proposed in this paper, uh, which again, you can go look it up on the Google, uh, uh, is that they could, which actually is kind of interesting because it comes into a discussion I had at lunch.
[38:58.210 --> 39:06.590]  Uh, basically they talked about an architecture which would go and derive code structure from, uh, from source code and generate a directed graph that describes code structure.
[39:07.510 --> 39:08.410]  Oh, my God.
[39:10.270 --> 39:10.670]  Um.
[39:11.530 --> 39:12.050]  Let it out.
[39:12.070 --> 39:12.470]  What?
[39:12.670 --> 39:13.070]  Let it out.
[39:13.150 --> 39:13.790]  I'm letting it out.
[39:13.790 --> 39:14.010]  It's out.
[39:14.290 --> 39:14.490]  It's out.
[39:14.770 --> 39:22.430]  Uh, so, so, uh, they generate code structure from, from, uh, generate a graph structure from the source code.
[39:22.610 --> 39:34.210]  And, um, they would, uh, go and do random manipulations to the ordered binary decision tree but still maintain a general structure of the code, uh, so as to introduce randomization.
[39:34.210 --> 39:44.370]  And so, because the, the, the, they made some graph theoretic statements, because these two things were equivalent, that the code was equivalent, but still it introduced a great amount of randomization, so it made it much more difficult to actually, you know,
[39:44.430 --> 39:44.910]  go and attack.
[39:45.610 --> 39:46.450]  Go and attack.
[39:47.150 --> 39:47.950]  Mm-hmm.
[39:48.210 --> 39:49.250]  Uh, piece of code.
[39:49.690 --> 40:01.930]  Uh, so it works at the source level, but you probably do the same thing by doing, uh, reverse engineering of a binary into a, uh, uh, directed graph and then doing analysis and then reconstructing a binary after you do manipulations.
[40:01.930 --> 40:04.830]  Who would have thought that would be possible before this morning?
[40:05.350 --> 40:08.410]  Um, who would have thought?
[40:08.970 --> 40:16.190]  Uh, so, uh, another way of doing it is, uh, uh, Carry on.
[40:16.470 --> 40:16.790]  Okay.
[40:17.910 --> 40:19.570]  What's the light jazz sound right now?
[40:19.930 --> 40:23.890]  Oh, this is actually from, uh, uh, Dr. Nick's roommate, Mad Ripper.
[40:25.010 --> 40:25.450]  Yeah.
[40:25.950 --> 40:27.230]  So, yeah.
[40:27.890 --> 40:30.150]  Uh, so, uh, randomized stack protections.
[40:30.150 --> 40:34.390]  Uh, one method involves, uh, insertion of randomized variables between the targeted buffer and the old frame.
[40:34.830 --> 40:36.590]  This is just generally the idea of stack guard.
[40:36.750 --> 40:38.050]  You're gonna break your head open.
[40:38.530 --> 40:39.330]  Jesus Christ.
[40:41.630 --> 40:47.630]  Uh, and, and, uh, and in, in this case, an attacker must, I mean, see.
[40:47.770 --> 40:50.090]  Watch the, watch the 40.
[40:50.090 --> 40:50.830]  It's both.
[40:53.150 --> 40:54.110]  Why am I here?
[40:54.270 --> 40:54.830]  It's all right.
[40:57.050 --> 40:57.370]  So, so...
[40:57.370 --> 40:57.410]  Yeah.
[41:00.570 --> 41:02.770]  So, how many people have written a buffer overflow here before?
[41:03.010 --> 41:03.990]  Then you ain't got already.
[41:04.170 --> 41:05.070]  That's pathetic.
[41:05.390 --> 41:05.810]  All right.
[41:06.050 --> 41:06.490]  So...
[41:07.610 --> 41:12.090]  So, uh, so, allow your time when you're sitting there writing a buffer overflow.
[41:12.790 --> 41:14.770]  When you're writing a buffer overflow, please, class.
[41:15.030 --> 41:15.090]  Okay.
[41:15.270 --> 41:16.330]  So, anyway, uh...
[41:16.330 --> 41:17.110]  Are you still talking?
[41:17.290 --> 41:17.510]  Yes!
[41:18.430 --> 41:19.590]  I have an hour to kill.
[41:20.070 --> 41:22.670]  So, uh, uh, so when people write a buffer overflow...
[41:22.670 --> 41:23.670]  Oh my god, is it five minutes?
[41:23.850 --> 41:24.090]  All right.
[41:24.470 --> 41:30.270]  Uh, so when people write a buffer overflow, um, uh, they have to guess this thing called, you know, the stack offset.
[41:30.430 --> 41:34.610]  And you have to basically, you know, jam some data into this thing and, and you have to make a bunch of guesses.
[41:34.750 --> 41:38.870]  And if you randomize this, it makes it a lot harder for someone to go and guess and use the same attack over and over again.
[41:39.570 --> 41:48.750]  Uh, you do the same thing for stack and heap protection, uh, which will help, uh, uh, work to, to solve some of the problems with, uh, uh, heap overflow attacks.
[41:49.950 --> 41:57.710]  And you can do it for, uh, randomized, uh, address space so you can help prevent return to libc attacks, which have become more and more popular ever since people have started going to non-executable stacks.
[41:58.530 --> 42:06.470]  Uh, instruct, you can randomize the entire instruction set by putting in an xorg and say standard, very, uh, standard, uh, uh, uh, password and a register.
[42:06.470 --> 42:10.010]  And so basically it completely randomizes, uh, every instruction that comes through.
[42:10.230 --> 42:17.390]  And yes, it is xorg, but at the same time you're adding, you know, whatever that, uh, uh, to the end, uh, bits wide, ever wide your register is.
[42:17.510 --> 42:19.350]  That's how many instructions that you're generating in a random.
[42:20.350 --> 42:25.230]  Uh, so this can be done, uh, easily in, uh, runtime emulation using box.
[42:25.370 --> 42:27.190]  You could do it in, uh, a hardware system.
[42:27.370 --> 42:32.690]  And, uh, although people say, oh, you're adding, you know, additional stages of the processors, it really isn't that complex because you're pipelining it.
[42:32.690 --> 42:38.870]  And already the, uh, instruction fetch, instruction, fetch, instruction to code stage of a processor is pretty heavily pipelined.
[42:39.570 --> 42:41.950]  Uh, so there's some papers that discuss that.
[42:42.090 --> 42:44.910]  I can give you the, uh, uh, listing afterwards.
[42:45.070 --> 42:46.890]  So frequently asked criticisms.
[42:47.290 --> 42:48.770]  Uh, this is just security through obscurity.
[42:48.930 --> 42:49.610]  That's horseshit.
[42:49.870 --> 42:53.510]  The reason why is the difference between diversity and obscurity is so most significant.
[42:53.510 --> 43:01.310]  Um, and obscurity relies, obscurity really is a concept barred from the cryptosystem people where they hide their crypto algorithms.
[43:01.410 --> 43:04.090]  And it kind of applies to us, but not completely.
[43:04.610 --> 43:08.910]  Because, uh, they believe that keeping the entire cryptosystem hidden, they'll be more secure.
[43:09.270 --> 43:13.010]  This statement says that there's nothing we're going to be able to do to make things secure.
[43:13.250 --> 43:17.450]  So we just try to make things as diverse as possible and to slow down the attacker.
[43:18.710 --> 43:22.630]  Uh, another criticism that this is f*cking impractical and I can't manage as much software.
[43:23.650 --> 43:30.690]  Uh, ideally you could do this in a completely transparent fashion where you have an automatic tool which would go and randomize your software and introduce all this diversity.
[43:31.050 --> 43:32.650]  And, uh, do the same thing with libraries.
[43:32.870 --> 43:35.350]  And then you handle patch management for all the libraries at the same time.
[43:36.430 --> 43:40.730]  Insert2b is, um, uh, a lot of things that we do are completely impractical.
[43:40.890 --> 43:42.750]  Patch management is incredibly impractical.
[43:43.070 --> 43:47.310]  I mean, we see time and time again that people don't go and patch every single one of their systems.
[43:47.630 --> 43:50.450]  Uh, also how practical is having an Internet-wide virus attack?
[43:51.230 --> 43:51.930]  Any questions?
[43:55.030 --> 43:55.050]  Okay.
[43:55.350 --> 43:57.390]  First, applause for, uh, our dancers.
[44:02.510 --> 44:03.030]  Okay.
[44:03.430 --> 44:03.770]  Question.
[44:04.250 --> 44:05.710]  I have a two-part question.
[44:05.750 --> 44:05.910]  Go.
[44:06.190 --> 44:06.490]  One.
[44:06.710 --> 44:09.310]  What is...
[44:09.310 --> 44:11.030]  He's not smoking anything.
[44:11.030 --> 44:12.630]  This all comes from up here.
[44:13.330 --> 44:14.030]  High on life.
[44:14.030 --> 44:14.390]  And him.
[44:14.550 --> 44:15.410]  He's high on life.
[44:15.710 --> 44:16.810]  He's high on the Jesus.
[44:17.150 --> 44:17.750]  Next question.
[44:20.890 --> 44:21.890]  Right over there, behind you.
[44:21.950 --> 44:23.810]  I don't give a shit.
[44:24.010 --> 44:24.330]  Pick someone.
[44:32.200 --> 44:32.540]  Loud.
[44:32.800 --> 44:33.100]  Scream it!
[44:33.100 --> 44:33.500]  Good job!
[44:33.980 --> 44:34.660]  Yeah, anyway.
[44:35.180 --> 44:39.760]  Uh, I've never heard of, like, uh, using the, uh, graphics processor.
[44:40.180 --> 44:43.060]  Or is there any kind of information that exists?
[44:43.700 --> 44:44.140]  Oh.
[44:46.320 --> 44:46.960]  Good answer.
[44:47.020 --> 44:47.600]  Next question.
[44:49.440 --> 44:50.480]  Then do it.
[44:50.980 --> 44:53.200]  I mean, it's a vector processor.
[44:53.400 --> 44:55.040]  It's designed to do vector manipulations.
[44:55.100 --> 44:56.920]  And a lot of crypto stuff is vector manipulations.
[45:05.420 --> 45:08.280]  You know, replace open SSL, not SSL.
[45:08.420 --> 45:09.240]  There's a difference.
[45:09.940 --> 45:10.020]  Okay.
[45:10.400 --> 45:11.880]  Open SSL is an architecture.
[45:12.400 --> 45:13.060]  Or, no.
[45:13.060 --> 45:13.960]  SSL is an architecture.
[45:14.140 --> 45:15.040]  Open SSL is an implementation.
[45:15.240 --> 45:15.980]  Replace the implementation.
[45:16.320 --> 45:16.420]  Yeah.
[45:18.380 --> 45:21.700]  But, it being around so long, there are all patches that have been applied.
[45:22.120 --> 45:23.220]  These are all minor things.
[45:23.660 --> 45:24.660]  At this point...
[45:24.660 --> 45:25.540]  What do you mean, minor?
[45:26.320 --> 45:26.660]  I mean...
[45:26.660 --> 45:28.120]  I mean, a code flaw is a code flaw.
[45:28.380 --> 45:30.520]  And if someone's able to exploit it, they're able to exploit it.
[45:30.760 --> 45:32.520]  And then people don't go and patch their systems.
[45:33.720 --> 45:34.960]  I mean, the idea is that...
[45:34.960 --> 45:38.960]  The idea is that not that open SSL is ever going to converge to the point of becoming a perfect security tool.
[45:39.100 --> 45:43.720]  Because as soon as they do, they're going to come up with some kind of new technology, or some kind of new, uh, exploit technique.
[45:43.860 --> 45:47.660]  Once we got all the buffer overflow things started, all the format string attacks started happening.
[45:47.960 --> 45:49.000]  So we got all the soft...
[45:49.000 --> 45:51.460]  All the heap overflow attacks started happening.
[45:51.720 --> 45:55.060]  And so, who the hell knows what's going to be next, but, you know, we're never going to solve all the problems.
[45:56.280 --> 46:00.780]  You're advocating diversity by encouraging... Oh, it does work now.
[46:01.100 --> 46:01.420]  Okay.
[46:01.940 --> 46:09.740]  You said that you're encouraging diversity in libraries by having an API-compatible layer, the example being OpenSSL.
[46:10.140 --> 46:25.040]  But doesn't having a set-standard protocol and a set-standard API make design restrictions that, for instance, the prior ASN.1 parsing vulnerabilities that seem to have affected a lot of things?
[46:25.040 --> 46:25.820]  Different parsers?
[46:26.240 --> 46:29.420]  Well, I see your point, but at the same time, you have to have standards for something.
[46:30.080 --> 46:30.160]  Okay.
[46:30.440 --> 46:32.140]  You have to have some form of standardization.
[46:32.360 --> 46:36.540]  We all have to have the same four base pairs of genetic code, otherwise we won't be able to reproduce.
[46:36.700 --> 46:38.180]  We all have to have the same number of chromosomes.
[46:40.480 --> 46:40.840]  Back.
[46:41.180 --> 46:41.660]  Over there.
[46:42.140 --> 46:42.560]  Gray shirt.
[46:43.580 --> 46:44.420]  Yes, you, sir.
[46:44.940 --> 46:45.940]  Yeah, I was curious.
[46:46.220 --> 46:49.560]  I met the guys from CACERT and was doing pre-SSL certs.
[46:49.680 --> 46:49.880]  Yeah.
[46:50.240 --> 46:51.200]  You know about that project?
[46:51.320 --> 46:51.440]  No.
[46:51.800 --> 46:53.360]  There might be some people who want to look into it.
[46:53.680 --> 46:54.500]  CACERT.org.
[46:54.780 --> 46:55.020]  Okay.
[46:55.040 --> 47:06.660]  I mean, the main point of what I'm saying is, obviously, look at what they're doing, but also, I mean, the problems with authentication and assurances and so on, from VeriSign and so on, with the SSL certs.
[47:06.820 --> 47:07.380]  It's just a joke.
[47:07.980 --> 47:19.120]  One of the discussions we had last week regarding, you know, VeriSign and using your Dun & Bradstreet number, and if you have the wrong Dun & Bradstreet number, you have, you know, a five...
[47:19.120 --> 47:21.120]  What does that have to do with diversity?
[47:23.580 --> 47:25.120]  You were bringing up SSL before.
[47:25.560 --> 47:25.840]  Oh.
[47:26.180 --> 47:26.340]  No.
[47:26.420 --> 47:27.220]  I mean, it's a different issue.
[47:27.360 --> 47:28.860]  I mean, that's really an organizational issue.
[47:28.980 --> 47:34.700]  And I agree with you that we should have more CERP vendors, but at the same time, it's not as much a code diversity problem.
[47:35.840 --> 47:36.120]  Yes?
[47:37.100 --> 47:37.380]  Is
[47:40.680 --> 47:42.280]  there an everything that you can read for?
[47:44.200 --> 47:44.760]  500 or...
[47:45.480 --> 47:48.420]  That's part of my PhD research, and until I publish it, I don't want to talk about it too much.
[47:51.640 --> 47:52.000]  So...
[47:52.000 --> 47:53.260]  Or until you drink enough of that for you.
[47:53.360 --> 47:54.420]  Yeah, until I drink enough of that for you.
[47:54.480 --> 47:55.620]  I'll be like...
[47:55.620 --> 47:57.060]  And then we'll be set.
[47:58.460 --> 47:58.820]  28.
[47:59.840 --> 48:00.340]  Over here.
[48:00.540 --> 48:00.780]  Andrew.
[48:05.740 --> 48:06.820]  Oh, good point.
[48:07.660 --> 48:08.020]  Uh...
[48:08.020 --> 48:10.660]  Is the commercial nature of licensing completely against the stuff?
[48:11.280 --> 48:11.640]  Probably.
[48:11.940 --> 48:13.060]  But do we have a choice?
[48:14.320 --> 48:16.680]  I mean, that's really what the issue comes down to.
[48:16.680 --> 48:18.000]  And if you're able to say...
[48:18.000 --> 48:19.660]  Let's say from a business standpoint.
[48:19.900 --> 48:32.040]  If someone's able to come out with a system that says, we have a license which says you're allowed to randomize and diversify our software, and by its very nature make it more secure, they become more commercially appreciable or more valuable commercially.
[48:32.960 --> 48:35.400]  So I can see it as a value add for an organization.
[48:37.980 --> 48:38.340]  Next.
[48:39.720 --> 48:41.760]  I came in late, so this is something to discuss.
[48:43.820 --> 48:44.800]  How much time do I have left?
[48:46.420 --> 48:46.740]  Okay.
[48:46.920 --> 48:47.860]  So maybe this is the last question.
[48:47.900 --> 48:49.820]  I see a lot of, you know, contention about this.
[48:49.940 --> 48:52.940]  That paper, Dan Geer and Bruce Neier, that he lost his job.
[48:53.180 --> 48:53.460]  Yeah.
[48:54.120 --> 48:54.780]  So if you can
[49:03.760 --> 49:07.400]  patch your systems now, and they're all with those jobs, would you be able to...
[49:07.400 --> 49:08.060]  Oh, yeah.
[49:08.160 --> 49:08.840]  But I see what you're saying.
[49:08.980 --> 49:10.140]  It doesn't have to be at the system level.
[49:10.240 --> 49:11.200]  It could be at the library level.
[49:11.340 --> 49:13.520]  And all these libraries could be managed by Microsoft.
[49:13.820 --> 49:14.300]  You know what I mean?
[49:14.320 --> 49:16.840]  They could be included in the Microsoft patch cluster, right?
[49:17.260 --> 49:19.700]  And yes, it would make their patch chunk larger.
[49:19.900 --> 49:22.920]  But at the same time, it doesn't have to be something that's completely unique.
[49:23.040 --> 49:26.160]  It doesn't have to be that, you know, you have to implement all these different systems.
[49:26.280 --> 49:29.220]  It could be done at the library level, or at the parser level, or something along those lines.
[49:30.760 --> 49:32.480]  I think I'll have to take the rest offline.
[49:32.480 --> 49:33.560]  So, alright.
[49:33.900 --> 49:34.140]  Thank you.
[49:43.690 --> 49:44.010]  What?
[49:45.870 --> 49:48.010]  I've got to get the hell out of here, because the next speaker is coming up.
[49:48.710 --> 49:52.150]  There was an implementation of the OpenGLV in the initial computation.
[49:52.330 --> 49:53.230]  For what?
[49:54.430 --> 49:54.690]  For what?