WEBVTT 00:00.000 --> 00:10.840 All right, hello. Good morning. I'm extremely impressed that you have made it here. 00:10.840 --> 00:17.000 The talk just before me, if you did not watch that, go to the recording. It is also very 00:17.000 --> 00:22.840 good. If you care about these topics, that talk is right on the point. So today, I'm 00:23.080 --> 00:29.600 talking about this life of infrastructure. So in part, the reason why I think you are 00:29.600 --> 00:33.680 here is because you've discovered a love of open source or you live with an 00:33.680 --> 00:39.120 experiential knowledge of digital commons. And I don't need to convince this room 00:39.120 --> 00:44.600 necessarily that I perceive open source as a verb. I will participate in all other 00:44.600 --> 00:50.600 definitions, but unless you're doing something or building something, I'm not all 00:50.600 --> 00:57.160 that interested. But I might need to convince you that developing an individual 00:57.160 --> 01:04.040 awareness of your rights, your autonomy and your data exposure is a little 01:04.040 --> 01:13.920 existential. And this comes from the ideas of blending between law and actual 01:13.920 --> 01:20.320 technical work. The computational justice is about assuring fairness, accountability, 01:20.320 --> 01:29.520 and transparency in digital spaces. And I cannot personally take any more talks around 01:29.520 --> 01:39.640 computational justice unless they specifically include open source, cryptography, 01:40.480 --> 01:50.280 and verifiable compute. Otherwise, it will not be computational justice. So I'm 01:50.280 --> 01:54.840 giving this talk today because I want there to be a larger awareness around what are 01:54.840 --> 02:00.800 the things that we are actually at risk of losing. If we participate in open 02:00.800 --> 02:07.600 source as something that's nice, kind, and fun to do. But unless you protect the 02:07.640 --> 02:17.040 pillar of transparency, the entire thing will fall down. So I wrote this book. I just 02:17.040 --> 02:26.560 put the latest update out on it two weeks ago. It's code chips and control. There we 02:26.560 --> 02:35.280 go. And very specifically, here's how I want you to perceive this book. It is like 02:35.280 --> 02:42.400 a medical taxonomy. It's a narrative walkthrough of understanding how we built these things, 02:42.400 --> 02:48.880 why we built these things, and why we had to develop an immune system response in open 02:48.880 --> 02:54.880 source to the security threats that we were seeing. I am happy for you to pay for this book 02:54.880 --> 03:00.080 if you want to, but what would be much more valuable to me is that when you read this, 03:00.160 --> 03:05.360 I need you to understand that you can and you should participate. You can send me notes. 03:05.360 --> 03:11.280 You can tell me stories. If it's worth putting in the book, it will go into next year's version, 03:11.280 --> 03:22.080 and I am willing to maintain this for 10 years. So about me, I do have a very weird pathway here. 03:22.080 --> 03:32.160 I'm an education maximalist. So when I was doing my undergraduate education, 03:33.440 --> 03:44.400 I got a national institutes of health scholarship, and at the time I was also doing a public 03:44.400 --> 03:52.400 law like minor, which meant I got to go talk to a professor, and I had him read my NHS, 03:52.400 --> 04:00.000 and I aged contract, and he said, did you realize there's no upper bound on the amount of money 04:00.000 --> 04:07.760 they'll let you spend on your education? So I proceeded to get two majors and two minors, 04:08.560 --> 04:15.520 maximizing the literal amount of classes they would let me take. And that kind of energy, 04:15.520 --> 04:21.280 that kind of like go out and grab and do and build, maximalizing your education, 04:22.480 --> 04:26.240 is the kind of thing you can only do over a lifetime in something like open source. 04:28.480 --> 04:36.240 Another thing that really impacted me in the way that I perceived the world is I worked on Boeing 737 04:36.240 --> 04:44.080 cockpets, where we were doing cognitive design, and we would take pilots that work together all 04:44.080 --> 04:51.040 the time, a pilot and a co-pilot with hundreds of hours together, and we would put them in a 04:51.920 --> 04:59.760 four-dimensional simulator. So it's not just visual, it's also half-decks, and we would put them into 04:59.760 --> 05:07.760 failure conditions, and see how they behaved, and how they inserted information with language, 05:07.760 --> 05:14.640 or notes, or movements that wasn't available in the cockpit in order to get out of a failure 05:14.640 --> 05:21.200 condition. And uniquely in this case, those were considered real training hours. 05:21.760 --> 05:30.560 So if you crashed the simulator, that would go on your record permanently. So people took it really 05:30.560 --> 05:38.480 seriously. And to this day, I always think about that, because an open source, what you're effectively 05:38.480 --> 05:44.640 doing with your downstream consequences, is not realizing that you are the pilot of an airplane, 05:44.960 --> 05:54.800 and an airplane can maximally have a thousand people on it. How many people are 05:56.080 --> 06:04.000 consuming your system? How many people sit in a database that you protect? It could be 06:04.800 --> 06:11.520 hundreds, thousands, or millions, and that's how you should calculate the blast radius. 06:12.400 --> 06:22.720 I also did a very cool and fun PhD at NIH, where I asked the question, can brain computer interfaces, 06:24.080 --> 06:36.560 change people's brain networks, below conscious awareness? And the answer is yes. So if that's very 06:36.560 --> 06:44.160 interesting to you, go and read that paper and figure out how we were able to pull off that study. 06:45.440 --> 06:51.360 But while I was doing that, NIH, so I was going back and forth between National Institutes 06:51.360 --> 06:58.240 of Health and the Metacognition Lab at University College London, and Metacognition is specifically 06:58.240 --> 07:04.720 the ability to calculate how well a person knows that they're right before you provide them any 07:04.720 --> 07:10.160 of different evidence to validate it. There's a massive difference between being highly 07:10.160 --> 07:18.320 metacognitive and highly confident, and I'll just put it this way. Expert tennis player knows 07:19.520 --> 07:24.400 before they see, after they hit the ball, they can tell you where it's going to go before they see 07:24.400 --> 07:32.800 the outcome. That's metacognition. On the other side of the street, a gambler will tell you 07:33.760 --> 07:41.600 that they are certain next time that they're going to win, despite all previous or upcoming 07:41.600 --> 07:55.120 evidence that is low metacognition. And I'm skipping over this one quick part, but yeah, I ran this 07:55.200 --> 08:02.720 course called Online Brain Intensive, where I accidentally invited like a thousand contributors 08:02.720 --> 08:12.400 to a very specific neurodebian ecosystem, and I massively overwhelmed us, and to this damn a 08:12.400 --> 08:20.240 little bit sorry, but we had a lot of fun. Okay, also who is Sal? How does Sal exist? It's a moniker 08:20.320 --> 08:28.720 chose it by asking mechanical Turk? What three-letter word is authoritative and memorable? 08:28.720 --> 08:38.160 It does port onto a personal name that I use in my personal life, but when you look for Sal, 08:38.160 --> 08:46.800 it is always an exclusively open source. By design, and it's very hard to offend Sal, 08:46.800 --> 08:57.520 because Sal is an entity. I don't identify. And lastly, when I talk about all this, there's the 08:57.520 --> 09:03.760 secret part of my life, that people at Faustum don't always really love. It's the fact that 09:03.760 --> 09:08.880 I went and I worked for the Department of Defense, then there's a lot of defense agency, 09:08.880 --> 09:14.480 and for Castle Run. Castle Run was the briefest time I've ever spent at a 09:15.360 --> 09:23.360 institution, and that's only because I moved to the UK. But very specifically, I needed to understand 09:23.360 --> 09:32.080 that I was only in that space, because I was in a tribally owned cooperative, and it's very strange 09:32.080 --> 09:39.360 to tell you that I worked in and around open source for so long, but it was only in this specific 09:39.440 --> 09:47.520 context that my specific ethics were fully respected. I will never take a life, and I will never 09:47.520 --> 10:02.960 participate in the taking of life. Flat. So what is Godfly? So Godfly, yes, do we have a website? Have 10:02.960 --> 10:11.520 you looked at it? Do you not understand it? Yeah, we did that by design. It is one specific thing. 10:11.520 --> 10:17.200 I'm so interested in finding individual maintainers that maintain things for lifetimes, 10:18.080 --> 10:24.880 because they're coming out of it with a very, very different energy. And over time, over seven years 10:24.880 --> 10:30.000 now, I've changed these questions, and these are the questions that I think really matter. 10:30.960 --> 10:37.840 If you don't want to waste your time while writing code before you write that code, 10:39.040 --> 10:47.680 why don't you ask these questions? Number one, what is one problem that you want to see deeply 10:47.680 --> 10:52.880 solved in your lifetime? That's why we call it Godfly. Socrates called the things he was 10:52.880 --> 11:02.320 upset he couldn't get done in his life. Godfly's. Two, who are two or three, like what are two or three 11:02.320 --> 11:07.920 technical solutions that might separately or combined solve this problem? Like quite literally, 11:08.480 --> 11:16.160 is this problem technically tractable? The most important question is this one, and I wish everyone 11:16.160 --> 11:27.760 will ask themselves this, who are three people living or dead, who you would be proud to explain 11:27.760 --> 11:36.240 that you solved this problem for? Tell me what it would feel like when you told them that you 11:36.240 --> 11:43.760 fixed this problem forever. And if you don't have that motivation, there's probably no reason 11:43.760 --> 11:50.720 to maintain the code. Are there any examples of people or communities that have previously done this? 11:51.600 --> 11:59.760 And based on all answers above, do you still believe that technology is the best way to solve this 11:59.760 --> 12:07.600 problem? You can simultaneously say yes or no to that answer. That's a really good way to make sure 12:07.600 --> 12:13.200 you don't waste time with code. All right, so a couple of the guidelines that have come through. 12:13.200 --> 12:21.440 This is a Nova Howe. A Nova loves doing really interesting data science and visualizations as art. 12:24.400 --> 12:31.520 Oh no, okay, okay, and here's an example. So every year I get to send a Nova Howe all of the 12:31.520 --> 12:39.680 news software supply chain reports. They take them and they add additional information like 12:39.680 --> 12:53.440 very specifically for log4j log4 shell. They compare it to the instances of log4j and log4 shell 12:53.520 --> 13:05.280 being recorded on Twitter against the patches. And when you get another genius to come into the room, 13:05.280 --> 13:13.200 I never would have put those two data sets together. You can tell that for the downstream non-cordinated 13:13.200 --> 13:21.200 disclosure environment that I don't often think about, you learned about log4j log4 shell, 13:21.360 --> 13:33.520 statistically from Twitter. We have to fix that. There's also, here's the lane a couple years ago 13:33.520 --> 13:38.800 and I was working them on SRE stuff but I want to highlight this one because they asked me this 13:38.800 --> 13:44.720 terrible and great question like why don't we do chaos engineering over blockchain and it made 13:44.720 --> 13:50.720 me realize they're absolutely zero stupid questions. They're just really good blogs. They're really 13:50.720 --> 14:01.680 that blog. And then here's a like full absolute godfly. This one came in and we only worked together 14:01.680 --> 14:08.080 for like two and a half months and here's what happened. Their godfly was that specifically in the 14:08.160 --> 14:20.160 U.S. C4 hair products do not have the same federal regulation as all other products in that space. 14:21.120 --> 14:26.720 So they could have harmful chemicals in them. They told me the reason that they wanted to fix 14:26.720 --> 14:34.640 that problem was for their grandmothers and their aunts and every single person they know highly 14:34.720 --> 14:41.600 motivated to do this work. They built an app that goes and scrapes the information about the chemicals 14:41.600 --> 14:50.640 behind C4 hair products and puts it plainly visible and searchable and the reason why this is the 14:50.640 --> 14:57.760 shortest godfly I've ever had was because in less than three months they were acquired and that 14:57.840 --> 15:05.120 sits inside of the target app. I want you to think about solving really, really massive problems 15:05.120 --> 15:10.400 and not in like the past like I made something beautiful and people can consume it. I want you to think 15:10.400 --> 15:15.040 about how do we actually solve some really, really big problems with technology and I used to see 15:15.040 --> 15:24.080 that energy and open source so hard and I'm keeping it. So welcome to computer societies and the way 15:24.080 --> 15:32.240 that computer society I think has meaningfully changed because of security. Right, the book is 15:32.240 --> 15:38.880 dog food, read it, for free, give me feedback, tell me when there are updates that are meaningful 15:38.880 --> 15:44.240 and I've gotten too meaningful updates that fall so far. The review of that book looks like this 15:46.160 --> 15:53.360 and thank you. But I also want to say that was the first version of this book and because it's 15:53.360 --> 16:02.880 been edited, it's so much better now. But it is much closer to a medical taxonomy. With my background, 16:02.880 --> 16:10.320 I've got MDs and PhDs all around me. Read it like you're about to figure out how to understand 16:10.880 --> 16:21.760 like a human body system. Research mentions, four years of investigation, 37 conferences, 16:21.760 --> 16:29.600 12 countries, hardware security, software security, cybersecurity regulation, 112 formal interviews 16:29.600 --> 16:34.960 with kernel maintainers, hardware engineers, security engineers, policymakers, and literally anyone 16:34.960 --> 16:40.720 was sovereignty in their name if they were an engineer. If I could get them to talk to me. 16:42.240 --> 16:49.040 And then a bunch of fun field work, but also infrastructure side on this. So this is all on our 16:49.120 --> 16:56.240 personal server. Nothing was recorded. We used galene for our video conferencing. It's free 16:56.240 --> 17:04.080 and open source and it is quite literally my favorite installation from 2025. It's a good software. 17:04.640 --> 17:10.320 It's a very French software so it will always be available. No third-party surveillance 17:11.920 --> 17:15.760 and also just final note on galene. Like it's like better than jizzy y'all. 17:16.080 --> 17:21.440 Just switch to galene. It fits your principles and it solves the problem better. 17:23.280 --> 17:29.280 Research deficits all interviews were in English except for one where I attempted to speak Spanish 17:30.160 --> 17:36.320 but we both agreed that the two worst words in Spanish to speak are vulnerability that is 17:36.320 --> 17:43.760 E.C. Red or C. Goody that. So we switched to English and that really impacts my ability to 17:43.760 --> 17:50.240 give you the total surface area. And secondly, the first question I would always ask is like how 17:50.240 --> 17:57.680 do you define sovereignty and I literally never got the same answer once? Does anyone in this room 17:58.480 --> 18:02.720 except for the people that have read the book? No, what this is and there's two correct answers. 18:03.040 --> 18:18.160 Eth. Well that's a Pentium processor. It also happens to be a Navarro or Dina weave. This is from 18:18.160 --> 18:27.760 Merrillu Shults. She's about her entire career doing Navajo weave of computer chips, and I specifically 18:27.760 --> 18:33.680 reach out to her and I put her on the cover of my book so that you could see and understand 18:33.680 --> 18:40.960 this. There's real good historical reasons why specifically that nation would be very invested 18:40.960 --> 18:44.160 and understanding and holding their history of being involved in chips. 18:45.760 --> 18:52.160 Why my book? 30% will go to Lean Pub. It also exists on Amazon. Ignore that. 18:52.160 --> 18:55.360 The version controlled and always updated is going to be on Lean Pub. 18:56.160 --> 19:03.360 30% goes to Lean Pub. We pay the maintainers. Everything else will go to Asus. 19:03.360 --> 19:09.760 This is the American Indian Engineering and Sciences Society. And I specifically am 19:09.760 --> 19:13.840 reserving that money for cybersecurity scholarships in that space. 19:16.640 --> 19:20.560 Okay. Defining sovereignty. And I'm so sorry, y'all. 19:20.560 --> 19:27.760 I'm just going to move really, really fast. Okay. Five dimensions of sovereignty, authority, 19:27.760 --> 19:35.600 territory or domain, autonomy, recognition, or consent. And it's very, very good to understand 19:35.600 --> 19:42.800 that sovereignty regulation is very, very clear that revocation is also a right in this space. 19:42.800 --> 19:45.680 A right so strong that I think it represents a dimensionality. 19:46.000 --> 19:52.720 All right. So what is sovereignty traditionally? We've got Westphalian sovereignty. 19:52.720 --> 19:59.360 This is the idea that a state has an authority over its territory and its domestic affairs. 19:59.360 --> 20:07.520 A sovereign state that possesses a monopoly and legitimate monopoly within its borders. 20:08.320 --> 20:13.280 That really basically defines sovereignty by the edge between two sovereigns. 20:13.920 --> 20:20.560 Legal sovereignty. This is very habsian. sovereignty is the supreme, 20:20.560 --> 20:24.720 absolute and uncontrollable power by which an independent state is governed. 20:27.040 --> 20:32.560 Popular sovereign theme. This is a lot closer to what we have moved towards in many western 20:32.560 --> 20:36.880 countries. But it's the idea that sovereignty resides in the people and you cannot have a sovereign 20:36.960 --> 20:44.800 without the consent of the people. The federalist papers are what to find that for the U.S. 20:45.680 --> 20:54.800 And it is so cool to know that grab exists because they specifically wanted to know which of the 20:54.800 --> 21:00.960 founding fathers of the U.S. wrote which federalist papers. It was designed specifically to solve 21:01.040 --> 21:07.040 that problem. And there's a great, finally someone went and like communicated the story because I 21:07.040 --> 21:16.320 think it's great. Then there is relational sovereignty. Have you all ever heard of this? 21:17.280 --> 21:22.400 Surrelational sovereignty is the inherent right of indigenous nations to govern themselves based 21:22.400 --> 21:27.600 on their own laws, their own territories, their own knowledge systems recognize both internally 21:27.600 --> 21:33.440 and in relation to others. In digital sovereignty is not the mimicry of a nation state. 21:34.720 --> 21:40.240 It's about the continuance of indigenous life in relation to land, law, and kin. 21:42.800 --> 21:49.040 And cyber slash digital sovereignty. It's an emerging definition, but it's the right of a nation 21:49.040 --> 21:53.920 or community to control its digital infrastructure, data governance, all minor activities 21:53.920 --> 22:03.280 without external interference. This is not well enough to find 22:04.640 --> 22:12.480 to allow us to implement the CRA cleanly. You're trying to cut a cake which hasn't been baked yet. 22:13.200 --> 22:22.480 Sovereignty security postures. So I will we will have no more legal or political slides 22:22.480 --> 22:29.520 moving forward. Now we're just going into my brain. Sovereignty is a lot more interesting 22:29.520 --> 22:35.440 because you can actually define it. So sovereign security is data infrastructure, military 22:35.520 --> 22:42.480 defense and strategic autonomy. Sovereignty is the ability to put your policies and your actual 22:42.480 --> 22:48.000 practice in alignment with laws, values, and government structures. Typically for a nation state, 22:48.000 --> 22:56.000 but these are for all kinds of sovereign structures. Digital sovereignty makes sure that you 22:56.000 --> 23:03.600 control it. Information sovereignty makes sure you know that you know where your information is. 23:03.760 --> 23:10.960 Technical sovereignty know that you understand and own the infrastructure, including hardware, 23:10.960 --> 23:18.800 software, protocols, without a reliance and external suppliers and frameworks. Sovereignty 23:18.800 --> 23:29.200 is a security remet is extremely expensive and very hard. Sovereignty is a security. So 23:29.200 --> 23:36.880 like let's look at some examples of this. The China Russia model is a like full control over digital 23:36.880 --> 23:43.200 domain. Security sovereignty in the UN context is perceiving it as a fundamental right of nation 23:43.200 --> 23:50.560 states to define their own security interests. And in the same profile indigenous data sovereignty 23:50.560 --> 23:57.760 right now, I think is leading the way that we are thinking about and building out security 23:57.840 --> 24:09.520 protection right now. And specifically right are tribal nations just like, it's a legal thing. 24:10.080 --> 24:16.240 It often has a physical boundary, but the legal definition of a dependent nation is that tribal 24:16.240 --> 24:24.160 laws are considered domestic dependent nations. So we are in the most unique and interesting 24:24.240 --> 24:33.360 security position you could imagine. Because we have both all of the requirements of security 24:34.320 --> 24:42.160 of our tribal citizens and we have to somehow figure that out often while respecting all of the 24:42.240 --> 24:54.880 requirements of the United States. And last year the US government asked tribal nations if they 24:54.880 --> 25:02.960 wanted money in order to align their security to the federal government more closely. And that 25:04.160 --> 25:10.640 is like the most interesting case study I think you could ever look into. The unique relationship 25:10.720 --> 25:21.680 between tribal cyber security means that we have direct federal support and we also have 25:22.560 --> 25:33.840 a sovereign boundary. It's complex. And in the EU, I don't think it's any easier. 25:34.320 --> 25:42.560 But if you want to scrape away, if all the slides that I just showed you, you're like, oh wow, 25:42.560 --> 25:49.760 this is irritating and non-technical and awful, I agree. Every time I see the word sovereignty 25:49.760 --> 25:54.640 in a technical document, it worries me because that's not very clearly defined. 25:57.120 --> 26:02.880 So put it on a technical scale. From my research, what I can tell is if you have a fully sovereign 26:02.960 --> 26:08.960 stock, it's going to have these four principles. It is going to respect location, operator, 26:09.360 --> 26:19.520 cryptographic keys, and attestation. So I'm going to go as fast as I can through eight chapters 26:19.520 --> 26:25.040 of stuff. And I left a lot of it out. But I went really, really hard on chapter one. 26:25.040 --> 26:37.520 Here, let's go. I start this story with the transistor. And then we want to follow that up. 26:37.520 --> 26:44.160 Right? There's a couple of really interesting years of moving, I get us to, there we go. 26:46.160 --> 26:54.240 This pipeline from sand to wafer to chip. The semiconductor supply chain, 26:54.320 --> 27:01.360 the entire reason why chapter one of this book is on semiconductors is because no matter which 27:01.360 --> 27:08.560 kernel I talk to. And I got to be honest, I think now, spiritually, my favorite, 27:08.560 --> 27:18.400 kernel is free BSD. I get it, finally. Every kernel maintain or ask me to cover this semiconductor 27:18.400 --> 27:29.440 supply chain first. That's where they perceive the threats. Risk and says, if you don't know 27:29.440 --> 27:38.800 about this, great go for it, but this room does. I want to jump us to the fact that the 90s were great. 27:39.920 --> 27:47.200 It's when we broke Moore's law, and there's good reasons for that. It's a change in both physical 27:47.200 --> 27:57.360 production and also our ability to do planar. So that was our inflection point and regulation 27:57.360 --> 28:08.160 stopped keeping up at that point. In the mid-2010s, there was a rise in specialized chips 28:08.160 --> 28:13.600 and request for specialized chips in production. And right now, the entire industry is shifting 28:13.680 --> 28:21.920 us towards GAI. If you don't know what that is, go find out. You probably do. Okay, so this is the 28:21.920 --> 28:30.720 evolution. In the 1970s to the 2020s, there's like no other world in which I can tell you the entire 28:30.720 --> 28:36.160 history of a supply chain in 50 years. But in this case, we can. And it has some gaps and we should fix it. 28:37.040 --> 28:45.600 So the United States, how do they handle all of us? Any connector supply chain? They're a design 28:45.600 --> 28:51.680 powerhouse and they are strategically rebuilding right now. Their design dominance is still there, 28:51.680 --> 29:01.120 but they have lost their tractability on manufacturing. Japan, they lost the memory war in the 1990s, 29:01.280 --> 29:07.200 and they now own the materials that make everyone's chips possible. They're quiet, they work in the 29:07.200 --> 29:15.440 most upstream wall of the streams because that's physicalized production. European Union. 29:17.440 --> 29:26.480 In my view, I got it. ASMR is the crown jewel in semiconductor specific production. It's the 29:26.560 --> 29:34.160 only source of EV. It's a critical and artificially created bottleneck. And without it, no one 29:34.160 --> 29:44.640 can make advanced chips. Taiwan, it makes 90% of these advanced chips, and it is 130 kilometers 29:44.640 --> 29:51.120 from the Chinese mainland, and I wonder it did anyone see the news last week. South Korea, 29:51.120 --> 29:58.960 Samsung, and this is where memory dominance lives. And I think that's like a reasonably 29:58.960 --> 30:05.200 healthy fracturing, like you can own a pillar of a space, that's okay. But it is caught in a really 30:05.200 --> 30:12.160 interesting diplomatic situation of trying to still supply to both the US and Chinese markets. 30:13.280 --> 30:19.440 And China is the largest consumer of chips in the world, and they are building a sovereign stock 30:19.440 --> 30:28.800 because we have sanctioned them into doing that. Single points of failure in the semiconductor 30:28.800 --> 30:37.760 supply chain are these. These are the ways that building a system with extreme dependencies, 30:37.760 --> 30:49.040 as we have it built a world on chips. These are concerns, and I don't super know how to solve 30:49.040 --> 30:54.480 some of these problems, because it comes down all the way to where does the material physically 30:54.480 --> 31:02.400 come from, and I can't change that with words. So, transistor evolution, I'm going to skip. 31:02.400 --> 31:08.240 Remember on a chip? I'm going to skip because I will provide you these slides, and I assume 31:08.240 --> 31:17.280 half of you know this. Process our architectures, more interesting, risk, and then we find risk 31:18.240 --> 31:27.440 via the risk devroom yesterday is the thing that when I'm done with Phasem, I'm going to 31:28.240 --> 31:34.880 watch every single talk. And I recommend that you do too, because that line up looked great. 31:36.800 --> 31:42.080 Compute units, these are all just aspects of a chip. Integration paragraphs, you can have 31:42.080 --> 31:48.320 sock or chiplets, and I do think we are likely to be moving a lot more towards chiplets. 31:49.280 --> 31:56.320 They're a better yield cost mixed process nodes, and from a security perspective, 31:56.320 --> 32:01.040 Composibility is important to me. And then we got specialized chips. 32:02.480 --> 32:09.200 RF chips, opto, electronics, again, wrote a book on it, just follow those. We're down to chapter two, 32:09.200 --> 32:20.320 already, kernels. Here's the thing about kernels. They run with the highest level of access to 32:20.320 --> 32:27.040 the chip. They're the first thing that comes alive. It is literally the animus and the machine. 32:27.040 --> 32:37.040 It is the difference between having a chip and a brick. And we are at a really exciting point in a 32:37.040 --> 32:45.120 almost 130-year journey of actually being able to give a security guarantee, because in 1883, 32:45.120 --> 32:51.760 someone said, security should not depend on the secrecy of design, but on the secrecy of keys. 32:51.760 --> 33:00.800 And we all agreed, and then we couldn't do it until the 1970s and 1980s, the department of 33:00.800 --> 33:06.880 defense was focused on security kernels, formal verification, reference monitors, and it was the 33:06.880 --> 33:10.480 first line that we decided not to trust the kernel until it was mathematically bearable. 33:12.080 --> 33:19.040 2004, things start to get really interesting. We decide, and this is globally genuinely, 33:19.040 --> 33:24.560 that networks cannot be trusted. You have to assume their hostile. The assets have to protect themselves, 33:24.560 --> 33:31.440 and we shift it from data, from perimeter to data centric security. And it's like, I think that's 33:31.440 --> 33:40.640 the year where security starts to get interesting to me. And then in 2010, we started to come around 33:40.640 --> 33:47.360 and start really banging the drum of zero trust. To understand all of that, I'm going to give 33:47.360 --> 33:55.520 us these slides on how we can understand zero trust. Have to understand secure isolation, 33:55.520 --> 34:01.440 is the ability to keep data and workload separate from untrusted entities during computation. 34:02.560 --> 34:10.160 CIA triad. Secure isolation can take a lot of different forms. It can be process isolation, 34:10.240 --> 34:18.160 memory isolation, or workload, isolation. And as we get more agentic into our spaces, both 34:18.160 --> 34:28.640 as things that we like and our adversaries built to contact us with, I am so interested in 34:28.640 --> 34:35.440 understanding how to observe and limit non-human identities. And I'm going to go super fast because 34:35.440 --> 34:41.600 I have 15 minutes now. Trust boundaries. Care about them. If you were alive when an orange book 34:41.600 --> 34:46.560 would have been in your desk, then you understand this process. But the thing that really matters 34:46.560 --> 34:50.800 is that zero trust means I can throw the instructions on the ground. My adversary can pick it up. 34:50.800 --> 34:55.600 They can build their own, but they can't get into my system. There, we did it. All right, Kubernetes 34:55.600 --> 35:02.000 has this. It is everywhere. So if you think that you're like sitting at a layer, where zero trust 35:02.000 --> 35:06.480 doesn't impact you because you don't think about it, that's only because someone else did for you. 35:07.920 --> 35:14.320 So Thompson's trusting trust talk. Most of us know this. And I'm going to ignore it because 35:15.520 --> 35:25.760 I actually think this is fixed reproducibility. They are now doing like two compilers and checking 35:25.760 --> 35:31.120 them against each other. I can't tell you the details on that because I learned the details of it 35:31.200 --> 35:36.000 overbears two nights ago in a very foster way. But as soon as I get the details on that, 35:36.000 --> 35:40.480 that will go into the book because I think we've solved a problem that was 35:41.920 --> 35:48.800 previously insolvable. All right, let's skip all the kernels. But care about them. The secure 35:48.800 --> 35:54.560 kernel. I think is very cool because there is absolutely no nonsense. It just isn't mathematically 35:54.640 --> 36:03.680 provable or not. I'm not lovely. But okay, layer one. Harbor root of trust. Layer two, secure 36:03.680 --> 36:09.440 boot. Layer three, measured boot. Layer four, attestation. Y'all, I will send you these slides in the 36:09.440 --> 36:19.360 book it's free. Layer five, runtime hardening, layer six. I didn't fix, but this is really about 36:19.440 --> 36:26.880 syntactical security. So like the shift to rust is very much around that. 36:29.680 --> 36:35.360 If you want to consider the reasons why we are doing security at this level and putting controls 36:35.360 --> 36:41.520 more globally into place, then think about meltdown. And if you don't want to think about meltdown, 36:41.520 --> 36:50.480 think about specter. And specter has new variants that are still emerging. The legacy of that 36:50.480 --> 36:56.480 means that there's a massive hardware shift that hardware cannot be implicitly trusted. 36:56.480 --> 37:02.640 Dirty pipe sits in the space as well. None of my pictures are coming up. So y'all, I'm so sorry, 37:02.640 --> 37:10.800 we're just getting words today. Wanna cry? Also, a terrible disaster. But this is all sitting at 37:10.800 --> 37:19.360 this layer of the kernel. Also, this one, this story, think about this one. The best intentions 37:19.360 --> 37:24.960 of observability on the kernel can create security conditions. You really need to be careful and 37:24.960 --> 37:31.360 hygienic about that. Our defense is cryptographic, trust, chain, and software with materials, 37:31.360 --> 37:40.240 if they are valid, verifiable and attested only. Reproducible builds and transparency logs. 37:40.240 --> 37:46.480 Those four pillars are what we need. Chapter 3, oh no, we made some mistakes and now it's in 37:46.480 --> 37:55.840 our embedded devices. So, oh god, my picture is though here. Does anyone see the security concern in 37:55.840 --> 38:07.920 this picture? Okay, in 2017, there is a breach that I absolutely love because I find it very cool. 38:07.920 --> 38:12.240 I hate it. I got it. We can't like security breaches, but we can if they're really cool. 38:14.080 --> 38:20.160 So, there's what they did. We're targeting a casino to get access to their high-roller database 38:20.160 --> 38:26.400 and they used a Wi-Fi thermometer to get to it because it was trusted on the same network as the 38:26.400 --> 38:33.840 servers. That's interesting and concerning. How often do you think your personal security as an 38:33.920 --> 38:39.520 individual or an individual in a database has possibly even been compromised by that kind of thing? 38:41.680 --> 38:46.880 Garmin ran somewhere, same problem, but this is where we have to understand the difference between 38:46.880 --> 38:53.360 upstream and downstream security and how big the downstream can be. Garmin, not a big deal. 38:53.360 --> 39:01.680 If you can't access your like watch, but a very big deal, if it's also tied to the ability 39:01.760 --> 39:11.680 to get flight plans, we not just took down some like smart watches, we took down airplanes with 39:11.680 --> 39:17.600 this attack. Rowhammer, I'll skip it because you probably know about it and we'll come back to it. 39:20.640 --> 39:24.960 Well, probably in the book. All right, trust anchors fail. I'll ignore that. Four shadow, 39:24.960 --> 39:29.760 if you remember this one. Great, but what's interesting about it is that made us 39:29.760 --> 39:37.360 question our hardware route of trust. Chapter four. I got it. I'm going to do it. Yeah, I can do this. 39:37.360 --> 39:43.120 I can do this in 10 minutes. I got it. Okay, chapter four. The price of reliability is the pursuit 39:43.120 --> 39:51.120 of the utmost simplicity. It is a price which the rich find most hard to pay. That is a quote that 39:51.120 --> 39:58.000 I find extremely interesting from a turning award lecture. So once we get into embedded devices, 39:58.320 --> 40:05.280 we're talking about the thermometer issue, but also this one. This is my favorite. The Janet 40:05.280 --> 40:16.320 Jackson Rhythm Nation, specifically I've played on YouTube, will destroy circular drives, non-SSDs. 40:18.480 --> 40:25.440 And it's cool. Stocksnet. This is also sitting in a physicalized space. Their target was 40:25.440 --> 40:34.320 Iran nuclear center fuses and they succeeded by using a USB. Bad USB, cool issues. The researchers 40:34.320 --> 40:41.600 in this space are very cool. Go look up OMG cables. Chapter six, the Tower of Babel, where I get 40:41.600 --> 40:48.080 to regain my sanity because a language that does not affect the way that you think about programming 40:48.160 --> 40:54.960 is not worth knowing. So proofs and reality, proofs meet in the real world, and five familiar 40:54.960 --> 41:05.680 gaps happen. There's model mismatch, composition failure, opaque, trust, anchor, and our beloved 41:06.480 --> 41:12.560 side channel. And tool chain vulnerability, which I'm going to include in the space most people 41:12.560 --> 41:18.160 would separate them. I don't think you can. Then there's heart bleed, which I'm just going to speak 41:18.160 --> 41:25.440 to at a cultural level, because it started to make us really, really focus in on the syntax level 41:25.440 --> 41:32.800 of security. Grammar determines what kind of vulnerabilities are allowed, right? So like a great 41:32.800 --> 41:41.840 example is this is like rust gives you some hygienic properties to syntax, but it's not perfect. 41:41.920 --> 41:46.000 Just converting to rust doesn't make sense unless you really understand why you're doing it. 41:47.120 --> 41:52.880 So the idea of testing failed. Now we have to go against a specification, which again is a limited space. 41:53.760 --> 41:57.040 But that brings us to the five verbs of assurance. And if I can just give you these, 41:57.040 --> 42:02.720 we're probably in a good spot. So you have to start with measurement, which is observing a system 42:02.720 --> 42:11.040 state in order to understand the baseline. Attestation. We need to know that what was measured has 42:11.040 --> 42:18.320 not been altered at a specific time and that that attestation can be trusted around that information. 42:19.440 --> 42:27.040 Isolation easy to understand just don't let other people touch it. Mediation. The practice of 42:27.040 --> 42:36.560 regulating how isolated systems interact and update. Get update right. Those are the five 42:36.640 --> 42:42.960 verbs of assurance. And together, you have the CIA triad and a couple of other security profiles all 42:42.960 --> 42:48.480 represented by isolation, enforces confidentiality. Mediation, enforces authorization, 42:48.480 --> 42:56.240 attestation, should, prove, integrity. My communication of linguistics and cognition in the book is 42:56.240 --> 43:01.360 very good, but it's also incredibly limited due to specifically language I engage with, right? Like 43:02.320 --> 43:08.000 closure is the way that my mind thinks and I might think that people with other language experiences 43:08.000 --> 43:14.640 might be able to speak to something else. Chapter seven, hypervisors and the politics of virtualization. 43:15.520 --> 43:20.720 I kind of want to skip this slide because I don't think we figured this out and it's a very hot 43:20.720 --> 43:25.840 and active topic and that's why the book has to be updated because I want to say next year that we 43:25.840 --> 43:30.880 solved all these problems. Right now, here's all the different certification categories for 43:30.880 --> 43:36.960 security over cloud, just in the European Union, it's challenging. XE Utels, I'm also going to put 43:36.960 --> 43:43.600 into this category in space because it was particularly interesting and aware to cloud engineers. 43:43.600 --> 43:48.960 But the fact that a maintainer just has to get a bad feeling about something and notice that 43:48.960 --> 43:54.560 something is off before they can find these things means yes, these issues will always happen. 43:56.480 --> 44:02.160 But I hope we can get better over time with not doing detection as luck. 44:04.160 --> 44:10.400 Trust in hardware, that's got a lot more serious about that. If that's a discussion that you want to 44:10.400 --> 44:16.560 have, I'm happy to have that. Where are our trust anchors? How do you verify our trust anchor? 44:16.560 --> 44:19.600 And if you didn't build it with your own hands, how do you know that you can? 44:19.600 --> 44:28.000 The pain pattern, most sovereignty architectures optimize for external interception, 44:28.000 --> 44:32.880 but the highest impact threat is usually authorized malicious actors and I think that's what XE Utels 44:32.880 --> 44:39.200 showed us. The threat models around this space, I'm just going to jump through these slides 44:39.200 --> 44:44.400 extremely fast and I will send them to you. There's external threats inside or threats 44:45.360 --> 44:53.040 and that not yet solved. But no your threat model, don't deploy expensive controls for threats 44:53.040 --> 45:00.320 that you don't face and don't assume you've solved what you haven't. Location, operation, 45:01.040 --> 45:08.880 he control runtime integrity. If you're touching the cloud, you need to take all of those seriously. 45:09.520 --> 45:17.200 Enforcement, build, run, and export. Reject on the sign code, require attestation, policy 45:17.200 --> 45:27.360 grades, and egress, and enforce on it every stage. The patterns of cloud services are something 45:27.360 --> 45:34.000 that you can probably get from looking at someone's paid for platform requirements, or by looking 45:34.000 --> 45:40.400 at really interesting things like the shared confidential computing system between like France, 45:41.120 --> 45:50.080 Italy, and Switzerland. There's a lot of really cool sovereignty cloud stuff happening now. 45:51.200 --> 45:54.560 All right, I'm going to skip all of these because no, this is important. We're moving from 45:54.560 --> 45:59.840 static to dynamic trust. This means work led at any matters. All that's changed about doing 45:59.840 --> 46:05.280 like multi-tannet is like to do that. Well, you might not be able to avoid problems there, 46:05.280 --> 46:11.760 but you can at least include time in your threat model. So if you reduce the amount of time that 46:11.760 --> 46:16.640 something has access to a system, bound it to only the time that it's doing it's job. 46:17.920 --> 46:24.240 Putting time into your architectural decisions as a security decision is the thing that I find 46:24.240 --> 46:30.400 the most interesting about specifically this like hypervisor space. If I had more time, 46:30.400 --> 46:34.800 would say that this is the space where we really have to be hygienic about understanding 46:34.800 --> 46:39.760 our trust policies or trust tokens, but chapter 8 is where everything gets super cool. 46:40.560 --> 46:47.040 So the fact is, originally, I had a publisher reach out to me and they asked me to write a book 46:47.120 --> 46:54.480 about space technology and like I really tried, but I couldn't because you have to understand 46:54.480 --> 46:59.440 all of those seven chapters before we can even start with space. 47:04.000 --> 47:07.680 So Spatnik. The one thing you have to know about Spatnik is that everyone's like, 47:07.680 --> 47:16.160 oh, I see it in the sky. They didn't. They were probably seeing the R7, which was up there with Spatnik. 47:17.200 --> 47:26.000 Creating the first space located in the Continental Ballistic Monitoring System. 47:27.520 --> 47:30.720 Spatnik is very hard because you send it away and you can't get it back. 47:32.720 --> 47:39.280 And our treaties are old and don't understand that this is now a digital attack service. 47:39.280 --> 47:45.280 I'm going to, ooh, the via stat attack. I've had more time. I would go into it, but it's cool. 47:46.080 --> 47:48.800 I want us to think about radiation. 47:50.480 --> 47:59.040 So radiation is the primary adversary of space technology and the way that they do resilient design 47:59.040 --> 48:04.960 is something that I deeply respect and will probably one day write a book on once I eventually 48:04.960 --> 48:10.960 in 10 or 15 years of looking at it. Understand what they're doing. But to understand radiation 48:11.040 --> 48:20.960 just think about this. So we sent some cherry blossom seeds into space and then we brought them back. 48:21.920 --> 48:30.640 And one of those space seeds was planted right next to the ancient tree that it was specifically 48:30.640 --> 48:43.280 taken from. And that tree produces upside down flowers. It is bizarre. Something happened 48:44.160 --> 48:53.600 to that literal kernel in space that we didn't know or understand until six years later 48:53.680 --> 49:03.360 when it was a fully grown and developed tree. That feels so much to me like all of our like 49:03.360 --> 49:09.280 best security controls and then finding out problems and runtime, right? 49:13.520 --> 49:20.800 And basically, Rohammer radiation is just usually like a Rohammer attack. And if I had more time, 49:20.800 --> 49:25.040 I would have covered Rohammer more. But we're just going to get there today. So the one thing I want 49:25.040 --> 49:29.920 to talk about is that the thing that actually bothered me about space technology was not like how 49:29.920 --> 49:36.480 scary the satellite starts. The satellite hacks can be, but actually the fact that satellites 49:36.480 --> 49:43.280 all around the world run on different time signatures. And that's quite literally like a 49:43.280 --> 49:51.040 sovereign decision for them. It's a sovereignty claim to choose specifically what time signature you 49:51.040 --> 49:57.040 want. But the problem with that is it makes it much more likely that satellites will crash into 49:57.040 --> 50:01.600 each other. So we could create a signal that respects everyone's idea of time as long as we share 50:01.600 --> 50:07.200 that signal and we yield to distress to ensure that things don't fall out of the sky. So I'm going 50:07.200 --> 50:14.640 to skip all of these very good things that you should know except this. Someday, the last packet 50:14.640 --> 50:21.280 on this planet will route through the infrastructure that we leave behind. The real test of sovereignty 50:21.280 --> 50:30.400 is not who controls the switch, but whether the system keeps its promise when no one is left to watch. 50:31.360 --> 50:37.440 So sovereignty is a habit to build a sovereign technical stack is to build a world where the 50:37.440 --> 50:43.360 truth can survive distance, delay, and decay. And I want to remind everyone in this room that 50:43.360 --> 50:50.960 one day, the only proof that we were ever here will be the system that we designed to outlive us. 50:52.960 --> 50:59.760 So let's get that right. If now you're interested in reading this book, please do so for free. 51:00.400 --> 51:03.280 Thank you.