Who Patches While You Sleep?

0:00 Tim McAllister

I developed my own AI cybersecurity stack and it's been automated and in place. And when I did the review on Monday, I found most of it was not operational, which was Not a good feeling. Yeah. Oops.

0:26 Sam Rogers

Welcome to Signals and Subtractions. I'm your host, Sam Rogers. So every week, everyone at this table brings two things: one signal worth watching and one subtraction worth making. What to watch, what to drop. Today's question is a little uncomfortable. Who's allowed to change your systems while you sleep? As you may be aware, the last week. War II has not been boring. There have been many revealing vulnerabilities, hacks, announcements, lots of things like that that are a little uncomfortable for all of us. So we have someone here today on the other side of this table who has a lot of well-informed opinions about such things. Not just the panic, but actually. Some solutions, some ideas, some tools that hopefully you can use. Tim McAllister, welcome Tim works for DigiCert and maybe you could say a little bit about who you are and what you do.

1:28 Tim McAllister

Yeah, thanks so much for coming in to Santa Rosa here, I am a regional field CTO at DigiCert and I work closely with our customers explaining some of the biggest changes that are coming down the pike for both cybersecurity and specifically PKI, public key infrastructure, And there's never been more changes that are pending and coming through and already underway So in AI trust and AI in general, and some of the extreme circumstances that we've seen just in the last last year and and definitely over the last week have brought that to a head and there's tons of questions coming up. So it's an honor and a pleasure to be able to get to talk with you as well as our customers and the industry in general. To explain kind of what's ahead and maybe some ideas about what to do about it.

2:19 Sam Rogers

yeah, it's always great to to say a little bit about what we can do and also what we can drop, like things that used to make sense in the world that maybe don't make as much sense to keep doing. but before we get to that, so you've worked on everything from just researching your bio, I was impressed, like post-quantum solutions and and like how a An electric vehicle talks to the charger to make sure that there's nothing nefarious going on there, batteries won't blow up, all that good authentication stuff. Given all that's changed just in the last couple weeks, what's the kind of overall signal that you're watching?

2:54 Tim McAllister

what we see happening, If we're looking specifically at the impact of AI and agentic AI, is that we have this unprecedented capability to find vulnerabilities in software that's been in service for decades, right? So I mean on last Monday the vulnerabilities finally publicly disclosed about PHP. Yeah. PHP has been in place as a as an infrastructure and web services for over two decades at least. Yeah, three, I yeah. you look at some of the backstory, and they just thought, and this is part of the signal, this open source community specifically was looking at PHP and It just wasn't worth the effort because it was too hard to figure out like what the exploit would be, right? For them to get through it, they'd have to do so much work, right? So almost like Bitcoin, proof of work, not just proof of stake. Yeah. So it's it's these calculations that are based on what's the level of effort as far as what's your risk mitigation.

4:00 Sam Rogers

Yeah.

4:00 Tim McAllister

So the current signal is that. the that evaluation and those assessments are no longer valid, right? It's a huge problem. Yeah. Because we are not ready for it. it took, at least 30 days, probably a little bit longer than that, based on some of the review I've done of leading disclosure privately, following disclosure methodologies. That the PHP was vulnerable and needed to be addressed, and giving some of those folks an ability to work on the quote patch. and it still wasn't in time for pretty much most of the internet. Yeah. Right on Monday, yeah, when it was disclosed. And the other piece of it that's that's part of that signal is the scale, both the scale up and the scale out capability of agentic AI Is also unprecedented. I mean, we've seen you know DDOS attacks meeting kind of the highest levels, trillions of bits per second. And that same capability of scale up and scale out is now available for the agentic space as a you know a targeted focus on whatever resource they are trying to crack into. It's literally brute force. At your fingertips. So that is very different than a point and and posture and defense and risk mitigation than we've ever experienced. Yeah. Right.

5:21 Sam Rogers

Yeah, that's that all makes it sound very serious, very dire. This is just the infrastructure of the web we're talking about, you know, as well as the infrastructure of lots of other things that are connected to the web, which is most things at at this point.

5:34 Tim McAllister

Yeah.

5:35 Sam Rogers

And The ability to be able to tell a bad actor from a haphazard actor that may be doing something that's permitted, but may be doing something that's just like overkill for the situation. the signal that I've been watching is just that all of the things that are human written code, basically it's been predicted for a while that. There would be these vulnerabilities that we would find things like has been happening over the last couple weeks. Black Monday, as you called it. Not not the 1987 date, but like the new version of that for this generation. what is it that we can build for and design for that is taking The world that we've known that works at human speeds, human scales, more or less, and making it actually functional within a much faster, much larger scale which is like over half the internet traffic last I heard. Like that change just in May, as far as like how much traffic is human versus inhuman. And just the amount of from an agentic perspective, just even navigating a web that is built on protocols that are with those human kinds of design constraints of like it's too much work to do this, nobody would ever do this. Well, nobody would ever do it, but bot e probably would. and and they don't know when to back off, right? No, no graceful degradation You know, you didn't this? Well, how about this? How about this? How about this? How about this? How about this? How about this? Until like it looks a lot like a DDOS attack. And it's not an attack, but the right protocols haven't been in place to be able to, you know, do it the polite way, the right way. And I know Tim, you've have some ideas around this, built some tools around what we're talking about.

7:22 Tim McAllister

Yeah, so just what I've seen from the signal is going to require a different approach and kind of systemically. And what I've seen, and we've observed this not just on last Monday, with the resultant vulnerabilities, disclosures, and then attacks, where certain governmental bodies The focus is going to be on containment versus patching. Yeah. Because patching is always going to be a bit behind these new zero-day vulnerabilities. So I think the the new SOP is what's your containment strategy? And in that case, it was taking these services for these government bodies offline. Yeah. So and that isn't just going to be for the government bodies. That's going to be for Chunks of the internet. Yeah.

8:07 Sam Rogers

Anytime it counts, basically. Like a rolling blackout due to the vulnerabilities being breached, yeah.

8:13 Tim McAllister

Being executed upon with these agentic non-human identities or non-human agents, right? So that's a very different SOP, almost like get ready for rolling internet blackouts. Yeah. That's not what anybody else that I'm listening to is exactly saying, but patching is reactive. It's always going to be reactive. We have these disclosure procedures and policies that have worked pretty well up to this point. And with this kind of scale up and scale out capability of the agentic systems, that's not going to be sufficient. And then to answer your question as far as what we can do. So I reviewed my own AI stack and system stack on the day of these vulnerabilities, because I know I have PHP. In a lot of my web apps and web systems. Right? Yeah.

9:00 Sam Rogers

So like a two-thirds of the web runs on it. I was like, my gosh, this is not good.

9:05 Tim McAllister

Yeah. Right. And then some of these we're relying on our hosting provider to manage. So it's sort of out of our hands, which is good and bad as far as responsibility or capability and ownership. It wasn't me, but like it still doesn't work. Yeah. Yeah. Yeah. And did they take me offline, which would be good or You know, and what controls do I have. And then the other side of that is there are patches, there are updates that were eventually available for PHP. And and I was looking at my stack and I had, you know, I developed kind of my own AI cybersecurity stack and it's been automated and in place. And when I did the review on Monday, I found that it was basically most of it was not operational, which was Not a good feeling. Yeah. Oops. Right. Cause you know, 'cause you can, you know, have your agent do a full assessment, do a custom cybersecurity stack for for your AI stack using your model and your agents and your capability, very, very high functioning, except for it just all of a sudden wasn't working. And there was no notification, no transparency, no visibility into that state of my systems and solutions that are publicly available. Right. So that was the part that was a bit concerning. and then I had to do some work and that work is actually continued. And you know, that's some of what I provided and you kind of exposed on your your site, which Yeah, I I we should probably be careful about the word exposed.

10:32 Sam Rogers

I was trying to like support what you're no, no.

10:35 Tim McAllister

I'm you know I I tot tot totally appreciate it because more awareness in in that set of prompts. I mean, you know, I'm a follower of Nate B. Jones.

10:44 Sam Rogers

yes, we sh we should say like that's actually how we met I think I saw you originally commenting in Nate's forum.

10:51 Tim McAllister

I started commenting on Nate's forum in May of was it this year while I was on vacation in Maui.

10:58 Sam Rogers

because I had downtime and then I discovered Substack.

11:02 Tim McAllister

Yeah. And I was like, this is awesome. Yeah. And it was so that's how I started.

11:07 Sam Rogers

Yeah. So shout out to Nate B. Jones, big fans. Love your work. yeah, being able to look through your own stack and see what the implications are in your world, what are the kind of thoughts running through your mind on a day like Monday, last week, when you're seeing these things, drop one after the other, and you're seeing the impact in your own work, like what what's that like for you?

11:28 Tim McAllister

Yeah, no, it was I mean, along the lines of your your intro point. It's never been a less interesting time to be in cybersecurity or on the internet in general. Yeah. Right. Because of all these big changes that are that are happening in our lifetimes right in front of our eyes. number one, do an assessment evaluation and make sure like what is my exposure. That was kind of number one, like do a full assessment of what are all my systems. Yeah. What are their versions, So just kind of a software SBOM, software bill of materials of my systems and processes. So that was the first thing. I'm doing it on my own as a sole practitioner and I happen to work for a large company that happens to be one of the leading cybersecurity companies in the world, Digicert, and you know, those are the kinds of things that we're helping, you know, professionally support. know some the largest commercial enterprises in the world with their solutions. So but they have budgets, you know, large budgets.

12:23 Sam Rogers

Yeah. You know, soon to be larger with the what's what's going on here.

12:27 Tim McAllister

so it was just an assessment individually of what is my exposure, an awareness of what is in my stack, because that's not something that we're like tuned to pay attention to. Yeah. To have I mean on the commercial side For medical devices, there's a requirement to understand what your software bill of materials is. For other critical infrastructures, there's a requirement to understand what that is and track it and manage it and manage those vulnerabilities. But as an individual consumer or sole practitioner using AI solutions, that is not the requirement. Yeah. Per se, depending on your industry. So that was step one. And then step two was now what do I do about it? and that was part of the the challenge with my own automations that I set up because what is the authorization and authority and scope are you giving your agents? Right, because yeah, and are do I trust these agents? Yeah, right. Whether they be open source models that I've downloaded from somewhere through open router, or whether they're you know large. Commercially, you know, some of the largest models, providers, software providers in the world, right? There's trust issues no matter what side you're looking at. So if human is in the loop, how do I automate that process? how do I reduce the bottleneck that I am so that things are actually potentially getting updated overnight? Yeah. It's not an easy question to to answer.

13:49 Sam Rogers

Yeah, and it's usually one that We kind of sloppily assign I use the example always trying to bring it back to people of like, I I trust you. Like this is our first time meeting in person. I might say, Can you can you just watch my stuff while I go, you know, down to the market or something? But I wouldn't say like, here's all of my crypto keys and every bank account that I've ever had in my whole life, and I'm just gonna go away for an hour and come back. Like I might not trust you that much. And the fine-grained scoping, and permissioning that's needed for our agents really does need to be specific. Because if we haven't been specific about here's everything that I've ever done, all of conversations that we've had, but if you have like any external memory stores that you're sharing with agents, like if they they basically got the keys to the kingdom and you go get a sandwich, what happens with that time? we have always had this issue, but now it's just faster and louder and more dangerous than it's ever been, that we haven't specified it.

14:52 Tim McAllister

Yeah, because it has a incredible capability that has never exactly existed.

14:58 Sam Rogers

Yeah.

14:59 Tim McAllister

Right? So to to affect operations without oversight.

15:03 Sam Rogers

Right.

15:03 Tim McAllister

Right. no, it's a great question. And that's, I mean, it's a question for a sole practitioner. It's a question for the largest enterprises. Right. and the answers that that I'm seeing the other part of the signal is that everyone's talking about non-human identity. Now that existed before we really had kind of this burgeoning of agentic AI yeah capability back you know just with cloud compute so now that is kind of being added to this agentic you know agentic identity and and how do you scale up and scale out that capability but you need more than that you need that scoping you need that fine grained control over what exactly is the scope that a specific agent has To go and pull from a data source, and any external data source by default is probably going to be untrusted. And then what guardrails and what policies and controls are going to be implemented that you trust actually going to be enforced, right? And what is that enforcement point? There's a lot to those questions, right? And we're right at the beginning of understanding, you know, there's a lot of different cybersecurity solutions that are coming out that talk about identity. There's other ones talking about governance and control. There's other solutions that like the end of twenty twenty five, the go-to that everyone was talking about was visibility and observability. Like w can you see what your agents are doing?

16:28 Sam Rogers

Start there. It seems so basic. But yeah, that but that automatically puts us in a reactive position. Right. Yes.

16:34 Tim McAllister

Yeah. So so now we're on identity, but you need to Couple identity with policy, scope, yeah, authorization, and those have to be tightly bound together and hopefully cryptographically, right? And hopefully it scales up because the scale that you need to to operate at is cloud based, right? It's it's not billions, it's trillions as far as the numbers go. Yeah. Right. And hence, you know, some of the valuations of these companies that are Just being listed for another thing that just happened on Monday this week. Yes.

17:09 Sam Rogers

Referring, of course, to the anthropic S1 filing. So as we've said before on the show, when it comes to security, either it's architecture or it's broken. how it is that we express our permissions. Needs to be a function of an authenticated act, a scoped space in which these agents can operate, as opposed to saying, you can do anything, and now I'm going to ask you, who can do anything, to just focus here and play by these wishes that I've expressed. Like we know how well that works with humans, right? Not so great. What we want to have is some. permissioned availability that agents can work within a bounded set of capabilities, things that they can access. and doing that the right way so that we don't have rolling blackouts in the internet means expressing what that is in the first place.

18:01 Tim McAllister

and it's individually within an organization, an enterprise, but then we need cross border Federated agentic trust.

18:09 Sam Rogers

Yeah.

18:09 Tim McAllister

Right. how does one set of agents trust anything coming from another set of agents?

18:14 Sam Rogers

Yeah.

18:14 Tim McAllister

There's a lot of unanswered questions there. Yeah. But is it safer today? Probably.

18:19 Sam Rogers

Yes. And and there's been plenty of predictions out there of the next 18 months are gonna be pretty rough, probably, while we're figuring out how to answer all these questions. But on the other end of that, the world will be a more secure world because it'll have to be in order to operate. So, given that and all that context that we've just been talking about, to these subtractions, what what no longer makes sense that used to make sense, that we used to spend time doing, now we probably just don't need to do anymore, or we need to do it differently?

18:52 Tim McAllister

Yeah, something that that I've been working on, is Taking the human in the loop out of the the bottleneck. Like I am the bottleneck to affecting updating the software, making sure that I have the latest you know, I'm still working through what that process looks like.

19:09 Sam Rogers

I've even looked at implementing JEV.

19:11 Tim McAllister

yeah, as far as a decision approach to does this so here's a patch that's available. Does it make sense? given certain context to do the update or not. And just trying to remove myself out of the decision loop where things can be more automated. Yeah. At least to a point. Like is it going to make the decision to update my OS? No. It's not going to make the decision to update my computer or Mac mini's operating systems. But you know, if it's, you know, PHP, definitely. If it's, you know, some other package, you know, if I I was on railway, et cetera, et cetera, definitely right. So I want to implement those vulnerability patches as quickly as possible and not have the human and loop being the bottleneck. I mean, so that's one one of the subtractions that I'm actively working on. And that's part part of the prompt. I and it was a pretty basic prompt, but I just wanted to put something out there that was kind of my kind of version one point two. so now I'm getting a notification every day of that view. And if I don't get the email of that view of the stack of the possible patches that are made available, I'll know I didn't get that email.

20:22 Sam Rogers

Yeah. So that's your canary.

20:24 Tim McAllister

yeah. There is still that human in the loop. And that's just my own personal you know working on my own personal AI stack, but even if you work at a large company, everybody's working on their own projects, on their own systems. Right. Yep.

20:35 Sam Rogers

And just to name what Tim's talking about, this is the daily patch loop, which Tim's got a bunch of stuff that he shares on his website, Tim McAllister.io. We'll put a link in the show notes to that. this week has two takeaways from signals and subtractions that are kind of ones built directly off of that and the other is like more inspired by. I thought it was great approach. Yeah. And you know, you'd agreed to be on the show before all this stuff broke loose.

21:01 Tim McAllister

And now it's like perfect timing. Yay.

21:03 Sam Rogers

And and thanks again for hosting here in Santa Rosa. it's a pleasure to have our first in-person signals and subtractions. Hopefully we'll do more. Yeah. the subtraction on my end I am guilty of it as well. the whole idea of security through obscurity, we've always known it was bad. And it's just been easy enough. And the odds were kind of in our favor for like little projects, like you're talking about PHP kind of stuff. Like things that I did on the web 20 years ago that I just never really got back to or turned down, or nobody's gonna know be able to guess that this password. It's not like password one, two, three, but you know, it is just it is just a password. It's not like a secured authentication method that should be there. so that's what I am subtracting in my whole stack is anything that's that's basically a simple password, anything that doesn't have a real authentication method behind it, or you know, even saying a password. Like 20 years ago, was I making every password at least 20 characters with all the things that I've done now for last 10 years? No, I wasn't. Yeah. we've been able to kind of slide.

22:14 Tim McAllister

We knew that it was bad, but there weren't necessarily bad things happening all the time.

22:20 Sam Rogers

Now there's bad things happening all the time. And it's probably gonna get worse. Yep.

22:25 Tim McAllister

Based on, you know, everything that you're sharing.

22:28 Sam Rogers

Yep.

22:29 Tim McAllister

No, I would agree. There's another, I would say industry-wide subtraction that it needs some review, potentially. So in current agentic system to resource Cloudflare, Supabase Resend, any of your services that you're using to drive and build and operate your AI stack, GitHub. Yeah. There are these long-term API tokens. Yeah. That is a problem.

22:55 Sam Rogers

How do you manage that at scale? Yeah.

22:58 Tim McAllister

And there's and there's no authentication scope related to those. I mean, there's kind of broad coarse policy controls for API tokens, but it's not fine-grained control. And it's definitely not time limited. Yeah. And changing it is a pain in the butt. It is. And you can't use your agent to change them because then you're giving your token password secrets away. You know, you get thankfully you get notified, don't do that over and over in many possible places, which is great. You know, I was at the Superbase event about four weeks ago. one of the highlights was Steven Wozniak Awesome to see him talk about his early days and how he approached problems and how he he all he built the first computers reading the latest chip magazines amazing yeah but superbase even announced a authorization limitation and scope of those same API tokens that talk to their systems, right? So everyone's looking at how to address that. But I would say it needs to be even more finely Tuned and maybe you need to start looking at more cryptographic functions, maybe PKI even for these authentication tokens. So you have more of a non-human approach that's secure, yeah, that scales and is not just going to be one and done for years. Because that's currently what you have because it's such a pain in the butt to change them. Yeah. Because you have to do it yourself.

24:23 Sam Rogers

Yeah, I was watching some of the live stream for GitHub Universe. this morning and I'll be at some events at in San Francisco tonight and tomorrow. But I didn't hear anybody talking about PKI. And maybe there's some announcements coming. There's more tomorrow, but they were certainly talking about the problem. Yep. and and trying to make it easier. You know, it's always a balance and it always has been a balance between security and ease of use. Yep. you can talk about locksmithing. It's the same thing and has been for a hundred years, longer, between ease of use, and how secure it really is. as we're putting more and more into the hands of others on our behalf, it's hard to know exactly where that balance is until oops, it's out of balance and bad things happen. Not a good day. Not a good day. Well, to make a a better day for you next week, I would encourage you to pick one thing on Monday. Pick one AI tool and run a check on it. see if you want to leave it where it is. Definitely check out Tim's post, the takeaways that we have on signals and subtractions. Do you want to leave this in report only mode? Like he's describing, I get this report daily on my whole stack. I'm just gonna leave it there and and get that report every day? Or is this something where I need to actually be more aggressive in how I'm designing my whole stack? where are these vulnerabilities? Can I find them in advance? You'd shared some great resources about how to even use some agents to analyze your stack. You're not giving them anything that they wouldn't have access to already. You're just asking them to help tighten it up. Do I need to rotate these keys? Like You should probably just rotate all the keys anyway, Like just for practice. it's it's a good thing to do. It's it's not gonna hurt anything. No.

26:09 Tim McAllister

but it may very well hurt if you don't. yeah.

26:12 Sam Rogers

Yeah. And I'm sure you've never made this mistake, but earlier on, a younger me has made some mistakes with like sharing where there are some keys that could be accessed by an agent. made a mistake early on. I didn't think it could do that. Oops, it did that. now I gotta pay the stupid tax and rotate all the things out again. Make sure that that mistake can't happen again. But what about the next mistake? Because we all make them all of us humans anyway.

26:41 Tim McAllister

Yes.

26:42 Sam Rogers

So in closing, thank you so much for being here today. if people want to see more from you, where do we send them?

26:52 Tim McAllister

medium.com/@emergentcap and substack.com/@timmcallister my own personal website, TimMcAllister.io, and then on X, I'm emergentcap All right.

27:01 Sam Rogers

Well, thanks so much again. It's been great having you here.

27:04 Tim McAllister

It's a pleasure.

27:05 Sam Rogers

we do this live every Wednesday, and the episode will be out on all the podcasts and all the things on Friday. Sunday is the newsletter. We will have more fun coming on all of those. If you're listening on the podcast app right now, please click follow. if you're on YouTube, show us you know where the like and subscribe buttons are. How they work. The newsletter will be on Substack as well, issue 75 this week. Everything about the show lives at sigsub.show. One signal worth watching, one subtraction worth making. Go find yours.