EU Wants Tech Independence, AI Costs Climb and Security Anxiety Grows

Hey, everybody. Welcome to the Techstrong gang. It's Thursday and well, the fun just never stops.

I got to admit, it's just like one thing after another. There's a whole other movie about that, but that's another story for another day. But I want to welcome our guests today.

We have John Schwartz joining us from California. John, how are you doing? I'm doing well.

It's good to see everybody. You sound like you got a little bit of a cold, allergies. What's going on?

It's an allergy. I've kind of got a scratchy throat, so it's the pollen in the air. It's that time of year.

Oh, God, yeah. It is. See, but you should move to Colorado where Mitch is, because it's still winter there, right?

You're on mute, Mitch. Yeah, I don't know what season it is. Had to mute it, it's so warm or so cold.

I don't know what it is. I've been traveling, so I'm just kind of happy the sun's shining. I'm here back in Colorado in my chair, in my office.

I'm all good. All right. And then finally, we have Gina Rosenthal, who's in a state where, I guess for 10 months a year, there's only one season, I think, but what do I know?

We have seasons. We have eight seasons. Right now, I think we're still in spring.

We're actually in spring right now, but my allergies are crazy because it's been raining so much. The mold is super, super high. I'm very allergic to mold, so it's not fun.

All right. Well, let's jump into it because, well, it is a season of rebellion. How about that?

Okay. And what we are seeing is our friends in the EU are up to something, and it's kind of ironic in my mind because it's occurring as we, in this country, are starting to gear up to celebrate our 250th anniversary, which is the founding of the US is based on certain truths being self-evident. And well, it turns out that the EU has read that same document and seems to hold those same truths now to be self-evident and is trying to tell the rest of the world where they can take their tech and shove it.

So John Sorry. No. That wasn't the cough drop.

That was your setup. Yes. Wow.

The European Commission is, in a sense, declaring its independence. You're right. So they're basically shifting their tech strategy from reactive regulator of foreign big tech, which means they used to find the, I'll say the word, they'd fine the s**t out of big tech companies, to now they're becoming an active promoter and defender of their own domestic industry.

So in a sense, they're introducing this new criteria for several things, cloud computing services in sectors like banking, energy, and healthcare. They're designing public tenders to favor homegrown alternatives over dominant market leaders, specifically the US and China, because according to an internal draft document from the EU, foreign providers supply over 80% of the EU's digital products, infrastructure, and intellectual property. Cloud sector is particularly lopsided.

Amazon, Microsoft, and Google command 70% of the markets. So the proposal is a core element. There's a lot of things going on.

There are a couple of laws. They're looking at something called the Cloud and AI Development Act, and one in particular, which is part of a sweeping package of these solutions to reduce their reliance on American technology and improve their domestic wellbeing. So that's where we stand.

It's going to be interesting to see where this goes. I would give this more credence than I would if something like this were to happen in the US, and we're going to talk about that, or we have been talking about that. But it seems like they're declaring their independence and trying not to be weaned on us and be overly reliant on us.

Right. Mitch, you and I were in Prague not too long ago. Mm-hmm.

And as part of this, one of the things that came through in that conference we were at, which it was calm, right? It wasn't this sense of angry rebellion, it was more just this calm, stoic, European, we're going to do this, but we don't expect to do it overnight. But it wasn't like there was this sense of we're going to burn down the house tomorrow, but we are going to do this.

Did you kind of get the same vibe or what? Well, there was no messy crying or bad breakup scene, nothing like that. I think you're right.

I think it's measured. Well, if we're going to do this, what does it mean to do it and take on this responsibility, and how much do we do? So I think that's pretty wide-eyed about that.

" Shed the old clothes and put on the new. We're all happy. " I don't know that they're going to do that yet, but it would be easy to be over-exuberant.

" Well, one thing, Mitch- Has to be unanimous, right? Yeah, one thing I didn't mention is all 27 members of the EU have to unanimously support this for this to happen. That's what I thought.

Yeah. Yeah. It's a good thing UK is not there, because then it would never happen.

They'd never agree with the French anyway. Right. But it's just the way it is, right?

So, I think they like regulation. They tend to be measured. Right.

And be thoughtful about it and not sort of drive off the cliff, and I don't think we're headed there Well, this is also a long time coming. This isn't something they decided to do overnight. So I think one of the big examples I hear talked about a lot was back in 2020, when the US sanctioned the International Criminal Court prosecutor.

Microsoft, because of US laws, shut her email down. It wasn't hacked. Microsoft shut it down because of a US sanction.

So that kind of led to a, "Wait a minute. If they can do this to an international court, what happens if it's our hospitals, or we're at war because we won't give up Greenland," or all of these other things. What happens to our tech?

Well, the tech company's based in the US. If one of our nations is sanctioned, then what happens if we're dependent on a company like Microsoft? So that was kind of the wake-up call that started leading them to talking about actually getting this done.

And I think we talk about they need a kill switch. What happens if the worst thing could possibly happen? How do we make sure that we can switch over to something that we can trust, and that we can still keep going with some sort of technology, even maybe if they're left behind a little bit?

We're supposed to have kill switches in this country, and it's not working. So I'm glad someone's doing it. I think Gina's spot on.

I think the core issue is the kill switch. I think everything else is kind of noise. The probability that you're going to have infrastructure anytime soon that doesn't have components from China in it is nearly zero.

I know that you're concerned that there might be some listening malware of some type in there, but things can be done about that. You can go and investigate that and clean it and do everything you can to remove it. It just takes effort and time.

And then- Well, just look at telco and Huawei, right? Yeah. There's a lot of Chinese technology in telecom.

Yeah, and most of that stuff, if it's not in China, it's in Europe somewhere. Or wherever, yeah. And then the other side of that coin, though, becomes so the US side, which is this CLOUD Act thing.

And how much of this is just the leverage point for that discussion? " And we have the export folks making that case. And then we have the EU saying, "Well, no.

" And that's a direct response to the US CLOUD Act. Let's be unreal here. It's all about the fact that, to what Gina was talking about, is that somebody can turn off somebody's email.

Well, here's a simple solution. Let's just go modify the stinking CLOUD Act so that we can all make some money again, and everybody can chill out. But I don't know.

Will cooler heads prevail, Mitch, or are we going to be crazy about this? I have much more faith in European governments and their legislation than I ever would have in the US because it's been proven. We go back to the GDPR, which was about a decade ago.

I think it was eight years, actually. But nonetheless, it was somewhat measured, and there wasn't a cataclysmic reaction or cause and effect because of it. But I also understand the Europeans had to do something a little bit more effective than their idea of fining tech companies because I think, as in a previous episode, we mentioned that just a scintilla, a small slice of that money is ever collected because these decisions are being appealed, or they're being fought off.

But I think they actually will come up with a reasonable solution versus here where we talk a lot and we don't really do anything. Yeah. But the CLOUD Act is overreach.

There's no two ways about it. Mm-hmm. And it's well-intentioned, right?

The idea- Mm-hmm ... is that there are criminals out there, and we want to be able to tap into their IT infrastructure so we can surveil them and arrest them. But when you start using that to turn off the services to government officials in other countries and typical end users, I think you are now beyond the pale.

Mm-hmm. And you have evidently overstepped. So- And I'm going to disagree with you about saying it was well-intentioned.

I don't believe that for one second. They made it as broad as they could so that they could do things like use this as a leverage against a country that's not doing what we want them to do, especially with this administration, or to be able to surveil us, their own citizens, just as they want to, without any kind of regard to the law that exists today. So we should be more afraid of what our government is doing.

I think it is wise for other countries to do the same. Yeah. No, I do think you're right.

There is a weaponization, politicization, whatever you want to call it, and one side will argue that the other side is doing it, and then they both do it, right? Yeah. Just in different ways or how aggressively.

And I think your point's spot on, Gina, is sort of good intentioned acts could even be used for ill gains. And you can go back to the FISA court, the whole process of 9/11 and- Yeah ... trying to really control monitoring US citizens when there's a potential foreign threat.

It's still dicey business to do it without stepping over the line. And it's really truthiness, right? That's when that whole word came to be- Yeah ...

is in that timeline as well. " That's just the lipstick they put on it. That's the story they tell, especially Americans, to make them buy it.

"Yeah, this is a good idea. " No, I don't think all of us do want that. Yeah.

Well, we talked earlier this week about the rise of the surveillance state in the US and how we're kind of backing into that whole process and not thinking through what it is we're allowing the government to do to its own citizens here in the US. John, do you think it's ironic that here it is on our 250th anniversary, and the European Union seems to have a higher regard for some of our self-evident truths than we do? Yeah, they do.

They respect privacy and data security and consumer rights much more so than we do. You're absolutely right. The irony is that I think when we talked about how London has more cameras and more surveillance than any city in the world, probably- Mm-hmm.

But I always think back to Germany, and there's a huge influence of their, given their history, given its history in supporting consumer rights. It's going to be interesting because, without betraying a future episode, tomorrow's show. Never mind.

I got to say. So, there's things developing in the US in terms of regulation of AI that seem just patently absurd compared to what the Europeans are doing. We're talking about, and we'll talk about it tomorrow, token taxes and AI taxes to save US jobs.

Then we have the Europeans are always much more reasonable and measured, especially given our current administration. I should have that caveat. So it's two approaches, one reasonable and one just reckless.

Sounds like the, what do they call that, John? The hard cheese for tomorrow? Oh, yeah.

Yeah. Sorry. Yeah.

But we'll talk about it more tomorrow. We know your ways. Sorry.

So, I'll throw this out to Gina. Do you think that at some point there's going to be something that feels like a treaty that gets established- Hmm ... " Trying to find a way to get the narrative and the story happy for everybody.

I think the problem right now is that there have been some egregious acts that have happened. If you look at the stuff that people are saying, even in England, about Palantir, it's a little bit... People are waking up, at least in Europe, and being very vocal about why should their government programs rely on software from the US that obviously has some ethical issues with it?

And we're just not as loud about that over here, and I don't understand why. Mm-hmm. So, I think that there will probably come a time, as long as these companies are making so much money, they're going to be influencing the lobbyists that go to the different countries to make the decision.

Hmm. And as long as we have the administration that we have that is not transparent, and it does not seem as if they are doing work for all of us, I'm not sure where things would go. So maybe after this administration, we'll get something a little bit more balanced that people on all sides can trust a little bit more, and those conversations can happen.

But I think the problem with this is money. There is so much money to be made, and the money has a way of driving, right now, the military, and the military escalations and the conflicts that we see. That's where a lot of the money is.

We see that a lot in Austin. There's a whole camp that's set up here to do it. Mm-hmm.

So there's money to be made, there's power to be grabbed, and I'm not sure how that's going to settle down. It's a little scary to me. Sorry.

Gina, I think you're pointing to the big elephant in the room and starting to describe it. If you take it a step further, Gina, we are in an AI arms race. Countries are not going to allow themselves, especially US and China, you can argue whether EU is that aggressive about it or others are, we're not going to let others win the AI race.

That's where we are. Whether you think of it as geopolitical, military, economic, financial, et cetera, that's really what's happening here. We just don't describe it that way.

And whether we'll get into a détente or a cold war about it or something somewhere down the road, I think all good intentions are good intentions until they're not. Mm-hmm. Until other interests prevail.

" And that's the attitude I think everybody is taking, and so that's why you see some of the moves weaponized, whether it's regulations and things can be used, whether it's shutting down your really nice email account you've got there, Gina. Be a real shame if something happened to it, right? I think that's the world we're in.

I'm not trying to be the negative Yahoo here, but I think that's real. Well, I think the thing about it is, besides the money, is the power. If you have the power to take the information and make everybody believe or take all the information and be able to tell the story that the rest of the world hears, that's almost more powerful than going and shooting everybody up in the country.

Mm-hmm. Because you can lead that way, and it's very scary. Can I just fundamentally say, unequivocally, this is stupid.

And here's the part that's stupid. So let's look at the arms race that we've already been in in the past, right? So we spend a fortune building missiles, and we build a missile, and the next one builds a missile, and then we kind of keep getting better missiles, and wow, isn't that awesome?

And we spend a fortune on this crap that basically we don't ever actually use most of it, and it just sits in a warehouse somewhere, or occasionally there's some conflict somewhere where we're firing million-dollar missiles to blow up three people on a rock somewhere. Again, stupid. Great.

We have an advantage in AI for a couple of weeks, then the Chinese will catch up, and then they'll have an advantage, and then we'll just play this game forever and ever to the point where we will spend trillions chasing this stuff. And meanwhile, I don't know, there's a few million people starving somewhere in Africa that maybe we could help, but no, we don't have money for that because we're spending trillions on this AI stuff, rockets, and all this other stupid things. So I can't help but say, on a common sense level, this is stupid.

I agree. Well said. Yeah.

A million percent. Yeah. Money talks, though.

Yeah, power. I get it. I get money talks.

Or like millennials. Yeah. But just because somebody has money doesn't mean they're not stupid.

That's all I'm going to say. You said it. They are, yeah.

All right. I'm going to leave this here and let everybody else figure out what they want to do next from here, but we're going to talk more about money and AI. So, it's the subject of the day, I believe.

There is a new foundation that's the Linux Foundation and those folks, I've lost track how many arms there are of the Linux Foundation now. There must be at least a dozen different foundations, but we have a new one for managing or optimizing token consumption, and we've gone from, "Well, we need everybody to use as many tokens as possible so they can show that we are using AI, and I'm running up the token leaderboard," to now we're discovering that, well, these tokens cost money, and people are running out of tokens in the middle of projects. People are racking up fake token consumption because it makes them look good on a token leaderboard for a project that probably didn't need any tokens in the first place.

But hey, the boss said use it, so here we are. That's called token maxing. And I guess, Gina, if we come full circle on this thing now, I guess token optimization is the next big thing here.

So is this kind of just the natural order of events, and it just seems to be happening faster than ever? Or, again, I don't know. Are we stupid?

Coming back to that. To the day. Well, everybody did get excited about AI, and people claimed that they were laying people off and using that money to build out their AI, and the thing about it is the tokens are expensive.

If you're relying on a model that you didn't build, you've got to pay the bill, and now they've decided the bill is really going to be kind of high. And they're seeing, these articles were really interesting, like mid-market companies losing a quarter of their AI spend just trying to make it work. That's part that we'll talk about in a second.

But you look at Uber spending their whole AI spend, their whole budget by April of this year, and they're out. What did they do? " So I think we're getting to a maturation stage.

This also happened with cloud. The cloud bills were out of control, and a whole new job category popped up where look at your AI spend. Who's doing the cloud-- I'm sorry, your cloud spend.

Look at your cloud economics. Is this working, or can you get this down, or does this make sense in a computer science looking at my system kind of way? And I think that's where we're getting with AI.

I think the problem with AI is the other article was the one that talked about how you turn on AI. You just don't turn on AI. It's expensive to stand up.

You have to decide, which model am I going to use? And now you have to figure out, okay, what portion of my budget needs to go to tokens, and what kind of actions can we do when we're querying the model so that we don't spend all of our tokens by April? What does that look like?

Does everybody get to play with AI now, or are we going to say you have to work on what you're trying to ask of AI in a different model that's cheaper and then really spend the good money on your good questions and your good prompts? So that's kind of where this is going. But if you look at the infrastructure part of it, from an AI workflow, you start with the data, which takes the longest to clean up.

And this is stuff that people should have done, but nobody ever does it. You got to get your data right. You've got to get it tagged.

You've got to do all sorts of things with that. You've got to figure out where it's going to live. Then you feed it into a model so that when you query it, your data's in there, too, then that you train the model with your data, so that's another whole standing up the infrastructure and whether it's on the cloud or on-prem, how does that work and what does it look like and which methodology do you use?

And then when you're doing inference, it's a whole new thing because then you're still going to have to pay for tokens, but then you also are having to figure out, do I use GPUs, or how do I make my GPUs work more than one per job for AI? How do I, all of this money that I've spent on infrastructure, how do I utilize it so it's 100% being used all the time? So everybody's all excited about AI, but now all of a sudden we're looking at, okay, it's a system.

We have to build these new systems to take advantage of the way we can query our data now, and we can use our data and make new data. And it's not just a matter of letting everybody have a license to clog and go for it, because it's ended up costing a lot of money. Yeah.

Mitch, how do we clean this up? Because ultimately, this is kind of a FinOps conversation on steroids, and it's ultimately these software engineers who are at the core of much of this consumption. So, are we going to put meters on everybody, and I'm going to count how much tokens I consumed, and heck, will I stop using, to Gina's point, AI for stupid prompts?

Well, it's kind of like getting a new credit card and maxing it out on the first trip, right? " It's gone. What you're pointing to, Mike, is the problem isn't pricing, the problem is structural.

The structural gap is I'm going to provide you a product of which there's no specifications of what it takes to use it. There's no minimum system requirements, recommended system requirements. I need a server this size.

I need to buy these set of things. It's open-ended. And at the same time, the people who are providing the AI capabilities are also the ones providing the AI software that consume those capabilities.

So guess what? Claude and ChatGPT, they don't choose the most economical model, they choose the best, the most recent, most expensive, et cetera. And so now you have things like token routers or agent routers and things like that being introduced, but it's bigger than that.

It's bigger than just the token consumption from what users are doing. We still have structural gaps in AI and how you use it. If you talk to the developers, every developer's had to solve the problem of how do I manage memory across AI sessions and with agents, and how do I share skills that I create in a project or for myself or for my team?

So there's all these, we're having to build this scaffolding around AI right now. And then we realize that, oh, well, the more we overload those things, you see lots of memes on whatever social media you follow. By the way, everything you put in at the beginning of the session gets reread every time a prompt gets injected.

So that's why you want to start new sessions. So there's all these structural things about how it works that the AI companies know. They know this.

But it's not in their self-interest to pull you back. So I'll just say one more thing. I think FinOps will go, it's not going to be immediate.

We're going to go through a re-imagining or transformation of what FinOps and that kind of approach means. The problem with FinOps is it's forensics. You've already spent that money.

That could've been last night, and that could've been a $250,000 AI bill because John's not supposed to be out there writing agents that do that kind of stuff, but he got access, or whoever, whatever happened. And you have to, whether it's token consumption, memory, observability, security, all of these things have to happen at the point of execution, not somewhere down the line, hours later, dashboards later, governors later. To really manage it, you have to do it at the point of origin.

And it sounds hard, but now I think with AI, you actually can build some of those harnesses in. But that's the structural work we have to do. All right.

Well, let's play with that a little bit. I agree that AI is going to get more efficient, and we'll probably lower the costs, and that'll take a little while, but we'll get there. But I also, being somewhat of a student of history, can remember reading about how when we had all these manufacturing plants back in the turn of the last century, they all had their own electrical power capability.

Mm-hmm. " And they decided that it was time to build a grid, and we could consume these services as something that we would pay for as we would do any utility. So, has the time now come to consider creating something that feels like an AI data center utility that we can all share and access, and we'll pay for some sort of consumption model around it the way we pay for electricity?

And maybe we don't all need to go build a data center to drive all this stuff because it just becomes some sort of national service. I'm not calling for the nationalization of things, but I am saying that there's a way to think about this differently. I don't know.

John, am I crazy? Yeah, you have to think about it differently because the one thing that jumped out at me, I did one of these stories about the mid-market companies, which I think have employees of up to 5,000, and they have much tighter budgets than massive corporations, and they're losing a quarter of their budget to overhead. Yet a vast majority of them still are going to be investing in AI.

When I think about this, I think about the money, the structure. Mm-hmm. And something has to be addressed because in a broader picture, I'm thinking of Anthropic and OpenAI going public, and there's going to be a lot of pressure on those companies to show that they are profitable and that they have a strong user base- Mm-hmm ...

that's also thriving. " He's kind of hedging. He's backtracking.

Mm-hmm. He's setting off all sorts of alarms, and I think we have to think about this fundamentally, otherwise the path we're going on, the math doesn't add up. It doesn't even come to break even.

Oh, John, let's just push that envelope. Let's go one more step further then. So what happens when OpenAI stands up and says, "Yeah, you know what?

We can't quite figure out how to make this thing profitable, and we need something called a bailout from the United States government to help us fund all this stuff," and then the United States government winds up being a big shareholder in these companies? So you might as well jump to the end thing that I described, which is just create a national utility. But, you know.

Yeah. He's laying the ground. I think he's laying the groundwork to a certain extent.

Mm-hmm. I mean, given some of the things he's saying recently. Well, the problem is we're in the Doritos phase of AI.

Oh. You eat Doritos, we'll make more, right? There's an endless supply of Doritos.

" What do we do to kind of rethink this picture? So remember- And there's such grift around- ... Doritos phase.

Doritos. Sorry. No.

There's such a grift around this, too, right? So I was kidding saying if there's a national AI grid, Texas is going to bounce out of that one too. But I'm kind of not kidding.

If you can see where they're building all of the massive AI data centers that supposedly they need, which I personally can't understand why they do need that many and that big of them. So you look at that, and it's just a grift to build their own power supplies, and they're helping out all of their buddies, and that's what it seems like, this endless circle of, you tie in with us as a partner, we're going to buy that from you, and you're going to build this from us. And it's all these promises that they're building all of this so-called ecosystem on top of.

And you got to get back to what Mitch was saying. This is rebuilding out the infrastructure for this all to happen. And once the infrastructure gets built out, the thing I see too is people don't understand how it works.

They don't understand the infrastructure. They don't understand what the workflow is for all of AI, and what piece of that do I need to build, and what piece of that do I need to pay for, like I did with SaaS? This is like early days cloud, early days SaaS, where people don't understand, what are you actually trying to build?

Mm. And let's be pragmatic about this, and let's make it happen, and let's build it. And you lease the pieces that you need to lease, like access to a model, a large model, so you can train your own model.

But then where do you put that, and what does that look like, and what's the energy requirements? It doesn't seem like anybody's thinking about it down to that level. It's not as easy as with this whole point, this whole section was about grabbing some tokens and talking to Claude or whoever you talk to, and- ...

and trying to see what I can build. Can I make a cooler picture for my LinkedIn post? I don't know.

But that's what we're wasting it on. Yeah, cool, it works like that because it's a generative AI, but what are you trying to build, and what type of AI do you need, and where is the infrastructure coming from, and what's the whole life cycle of that look like? Why aren't we doing this as systems people?

Mm-hmm. That's stupid, because we don't do that. I think eventually it all winds up going in that route anyway.

I'm just saying we should accelerate to the end outcome. And I'm all for people making money, but let's make money smart. All right.

I'm going to shift the gear here and talk about, well, application security because there's no shortage of intelligence in that whole sector. But we have the folks at Anthropic and Mythos are talking about how they're sharing their model now with more and more people. " And so now- ...

we are sharing this stuff with 150 organizations and the people that are in those organizations, and I'm thinking that the odds that any of this stuff is going to stay secret is zero. Mitch, what do you think? Where is this whole thing headed from here, and what is real and what's not real?

I'm just trying to figure out what kind of historian you are, whether it's US history or life is a box of chocolates. Where are we going, Mike? But anyway, I'll work on that one for a while.

It's very interesting. Yeah, security has come back, and now people think, what about the security of code? So there's a governor in all of this, and that is for AI to get into production, it has to be able to be governed, secure, controlled, et cetera.

Now, maybe not at your midsize company, certainly not at your small company until it deletes the database and something bad happens. But at large companies, they'll only let AI in to the degree that the blast radius is small enough they can contain it until we get the right governance and controls and process. Along the way, we have the way to solve security issues with AI is use AI to do better security or create better code.

And that's where we came along the way with the Mythos model, which got a lot of attention because all of a sudden securing AI meant code generated by AI also meant you could really find a lot of vulnerabilities with it, and that's what scared everybody. And yeah, they are sharing it. Mike, they've got sort of their however number of companies, 150 or something like that, 50 organizations or whatever it is.

" So OpenAI had to do their own thing with ChatGPT-55, Cyber, which is their model for this. I think it's a natural progression that AI is discovering ways of breaking and making things unsecure. The good part of it is we need it.

We need it to be out there now because it isn't just the big companies that can do this now. People can create open weight models and start to build their own models for code security and exploiting. They don't have to be able to exploit everything.

They just have to be able to exploit the right one that's going to get them access to all these systems. So it's like they only have to be right once, sort of that idea. So the fact that that's on the agenda and we're working on it, we're talking about it, that's great.

It's why our iPhones and our laptops and everything else update every night, because there's more patches coming out to it. Right. So is this the way we're going to handle this?

I get that we're probably going to have to automate patch management, and those things will be created faster because we'll have AI to help us create it, and that's great. The part that I'm a little unsure about, it's like, soWho knows about this vulnerability first and for how long, and is everything going to be a zero-day vulnerability going forward? " And, it was kind of like wink, wink.

There's your two secrets of two, three people and secrets, right? Yeah. There you go.

Exactly. And so, the question is, so a small number of people know about these vulnerabilities for how long, and then the bad guys don't know about this? The same bad guys that can steal our credentials and hack into anything.

I'm kind of like, what is the procedure going to be here? Mitch, that's a lot- Hey, can I ask a quick question? Oh, can I ask a quick question of...

Can I submit you a quick question or maybe two questions? Yeah. So tell me, this is way above my pay grade, but, is the era of releasing these raw, unrestricted frontier models to general public coming to an end for highly sensitive domains?

And would that be then replaced by some sort of walled garden strategy to let cybersecurity catch up or adapt? I don't think you can. Boy, I'll just say real quick, and then Gina, please jump in.

Okay. There is no such thing as keeping secrets, right? That's why you have spies, and that's why things always leak out.

It's why the Russian space shuttle sure looked like the US space shuttle, right? Or whatever, or vice versa. Yeah.

Secrets will get out no matter what systems you put in place and processes you put in place. So I think it's sort of like zero trust. You have to assume that that's going to happen eventually.

And so whatever systems you put in place, always assume that they will fail, and now how do you make it more resilient so when it does fail? That's the process. So, it happened with Mythos.

All of a sudden, now it's out of its bounds, out of its sandbox, and people are getting access to it, and people are calling each other and sharing secrets. I think it's just the world we're in. So I think you have to have measures, but countermeasures, and figure out how you make security more resilient.

Last thing I'll say is security has to happen at the point of origin. It has to happen when code is generated, when code is built, when code is assembled. At all parts of the life cycle.

And just like tokenomics and FinOps is all forensics, so is security is. If it happens at the end of the process, it's not security, it's forensics. All right.

Gina, let me ask you this question. Okay. Who at the bottom of this hill, of that thing that Mitch just described as running down that hill, are your favorite IT operations people?

Oh, boy. So what are they supposed to do? Because there's- Yeah.

vulnerabilities coming in batches that they're supposed to fix, and the bad guys are going to be pounding on that hard, and they may not even... I saw some data that said, from Google, that the bad guys are already pounding on vulnerabilities seven days before the patch exists. So that's probably going to be three weeks before the patch exists, even in the age of AI, as these things get faster.

What's the poor IT ops people to do? It's a really bad situation. I think if they don't have zero-day, they're incorrect protecting on that, they're probably at a disadvantage.

I know we talked last week to just talk about, to answer John's question, too. If somebody gets ahold of a model and all they have to do is strip the weights in it that we're protecting the model from all the bad stuff. So all the bad stuff is available once somebody gets a model and their intention is to be malicious.

And this is way different because now, people that don't speak English as their native language, things like that don't code, all of a sudden they have a tool to get to the bad, the things that do the bad, really bad things. And yeah, ops is at the bottom of it, so you have to... And I've seen things where people, the bad actors are no longer going after, like the hackers are no longer going after the good data.

The first thing they go after is all of the things that ops would use to restore the data. So all of the replicas, all of the data protection and backups, they go for that first and foremost. So there just has to be very, very good low-level security hygiene if something happens so that they can't access the things they want to manipulate, is what I guess would need to happen.

And, this is something I really do think that, if you look at the companies that were backup, that's what they were called, was backup and recovery companies. They all are security companies now because really, the ability to be able to keep your business up and running with the data that they need is tantamount. So you have to do the boring hygiene for every data center, whether it's cloud, on-prem, out in the middle of nowhere, that you were always supposed to be doing, but it's got to be done very strictly and you've got to have a way to recover.

And it sucks because I can't imagine having to be in that situation. It would just not be fun. Because back in the days we would just like, we'd set a tail on a log someplace and we'd watch people try to break in, and we could see what they were doing, and then we could just change a couple of things and they wouldn't bug us for a month or two.

I can't imagine the bad actors having the ability to deconstruct a large language model to get all the information they need to do really bad stuff. " So situation normal? Is that what you're saying?

F you. Yeah. Oh, wow.

Yes. Well, it's a good question. One of the things I'm struck by is even at the developer conferences, and I go to all of them, the Microsoft, Google, et cetera, all of them, and even there, security isn't the big theme.

It's not front and center. It is there. It's governance and some things, and here's guardrails and some controls, and some things like that are being talked about and introduced.

My thought is developers grab this stuff and run with it. This is your opportunity to really say, "You know what? We weren't doing it right before.

This is the right way to do it now. Let's get that in there. " Maybe I'm being too altruistic and with tilting at too many windmills at once, and it's happened before.

I've done that, but now's the time to be involved. And I would say the same thing, so here's the good part of the message is it isn't just a roll downhill message. With AI, it's happening everywhere, maybe at different speeds, velocities of the life cycle.

Maybe it's really high RPMs in the development side. But the Red Hats and the SUSEs and people that are in the software infrastructure side of this are talking about this, too, and they're coming out with technologies for managing security operations, et cetera. " That's the challenge.

All right. I'm going to leave this here, and I'm even going to avoid using that S word one more time, but there is a chronic shortage of common sense in the world. It is pretty clear.

Oh, say it. You want to say it. Go ahead, say it.

Go ahead. I'm not going to say it. One more time.

Dare you. Get in the Bronx. Tie it all together.

That S word is self-evident. So there you go. Anyway, I want to thank our guests for sharing their knowledge and insights.

As always, John, Mitch, Gina, we'll see you again soon. I want to thank you all for watching the latest episode of the Techstrong gang. Please stay tuned for the rest of the rerun of the Techstrong TV lineup.

It, too, is equally awesome as this conversation, and we'll see you all, as John pointed out earlier, tomorrow to talk about, well, taxes.