Facial Recognition, Deepfakes & Open Source: What’s the Cost? | TSG Ep. 872

Hey, everyone wanna find out about the latest tool in the quiver of your favorite ice agent? Stay tuned. You're watching Text On Gang.

Hey. Hey, everyone. Happy Wednesday to you.

It's Alan Shimel here for Textron Gang. We have a great gang show to talk about. We've got some interesting things going on, as usual in the world with some interesting people to talk to them about following our kind of semi new, uh, uh, protocol.

I'm not going to do big do big intros to tell everybody where you're from, but joining us there, regular gang members, Mitch Ashley, Chris Blask, Guy Currier, the Dean, Mike Vizard, but we do have one new member, and so she gets to be the star today. Kate Scarcella. Kate, welcome to Textron Gang.

It's great to have you on here. Tell people a little bit about yourself. Yeah, so my name's Kate S I've been a cybersecurity architect before cybersecurity was even a thing before it was even popular.

So, uh, did my master's, um, thesis in information security. And I always tell people back in 2006, and there was only four people in my class, so definitely, and, you know, uh, yeah. So I've been doing this for a long time.

Absolutely. And I do remember before it was cyber and there was no, not even a bachelor's in cybersecurity or an error of concentration, or I remember Mitchell and I doing a survey, it's still secure maybe in 2003 or oh four about where, where did you come from that you're now working in InfoSec? And I think 66% of the people were network people, Network helped desk admins, network admins.

They were just too stupid to say no when someone asked them, you know, do you wanna handle security? Anyway, welcome to Textron Gang, and I'm sure you're gonna be a fine addition to our gang. Um, let's jump into it for today, guys.

So our friendly neighborhood ICE officers, officers, if that's not an oxymoron, have come out with something new to help them in their never ending quest to throw out people who may or may not belong here. Um, it's a new face facial immigration recognition tool. Mike, what's this about?

So, yeah, they're not commenting on it, but apparently they have revealed that ICE agents have this mobile fortify smartphone app, which is realtime facial recognition that they're using that help them identify potential illegal immigrants. And on one hand people are saying that it might help them maybe identify the right people, but other folks are saying facial recognition software is a little too shaky these days to be relied on. Guy.

I know you've been kind of following this space a little bit. What is the state of facial recognition and are we likely to see, you know, somebody get deported who shouldn't be deported? Well, I think the, Hmm, well, I think the state of facial recognition in general is pretty good and it's getting better, um, for two reasons.

One is, um, the ai which way predates all of this generative AI stuff. Uh, uh, computer vision is what it's called, um, is very well developed in getting better. The second reason is that there is more and more data for it to train on, but also for it to use in reference whether your typical, I don't know, uh, person of interest to ICE has any kind of extensive, uh, facial data, um, in a database somewhere that I have no idea, but I suspect it's less than those of us on this call who live in a privileged class that gets to fly around all the time.

So we've all been through TSA several times, if not dozens of times by now, and had our image taken and used for recognition purposes, I should say, pretty darned accurately. I don't know of any stories about like, inaccuracies in that for citizens and run of the mill travelers. Any, any problems with that?

Nonetheless, I find this one of the most concerning developments I have seen in this whole, um, I don't know what to call it. I hate to use the word immigration, or I hate to use the word deportation or the legally speaking. A lot of this doesn't have to do with any of that.

It just has to do with identifying, uh, persons of interest undesirable, singling them out, pulling them out and doing stuff with them, using ICE as the agency for that. And, uh, the idea that, um, as we all know, um, uh, an imperfect tool, um, will be relied on as if it's perfect. Uh, because no matter how good this AI is at facial recognition now, it remains imperfect, even if it's more accurate than the human brain, which is highly doubtful.

The human brain is evolved over a million years roughly to, uh, identify faces almost as one of its primary uses. Um, but even if it's more accurate than that, um, the, the real problem remains in ai, the human problem, that it looks so easy and so quick that people just think it's just doing what it's supposed to do every time, even when it's not. Now, I will add one last thing, which is there still remain in this country legal processes, um, or dealing with things like false identification, but by then the punishment has already even med out.

You even sent you Souths did pulled. Well, even if you're not Alan, you've just been pulled out, single out, you've gotta reach out to family members, a lawyer, somebody, maybe you're being an inata. The damage has already done.

So I think this is a pretty damn dumb idea on about a thousand levels. Chris, I gotta I gotta go first. I'm sorry.

All right, so I got a few things to say about this. So you're trying to tell me that they weren't doing racial stereotyping and just picking brown people all this time. Let's not.

Oh boy. Because that is one real black hole and facial recognition that still hasn't been patched, which It's funny, funny you say black hole because it's had a problem with black people. Mm-hmm.

That's your brown, you're right. I'm ashamed I Didn't mention That myself. So, yeah.

Okay. Mm-hmm. And there isn't much of a jump from having a problem with black people to having a problem with brown people.

And I think that's, that's not where our problem is. Our problem is with the people using it. Right.

A tool is as good as the people who use it. That's all. I'm, well, actually the Go ahead.

The, the, that technical issue remains, it's horrible. It's based on a thousand, you know, mistakes by the thousands of programmers putting this together over the last decade or so, and it remains so, so that makes it just even worse. Yep.

Chris, I know you have some thoughts. Yeah. This is just a Twilight Zone episode, right?

The technology's fine. Technology does what it's supposed to do, right? You know, this is mi minority report without the precogs, right?

We're running facial matches on the street, feeding into a central intelligence grid and calling it AI and, and to the point you, I think both of you are making, there's no audit trail and no public accountability and no verified accuracy. But other than that, it'll work fine. So I I, we find ourselves in these situations with advanced technologies where we're, we're, we're mirroring flaws in ourselves, right?

And you, you touched on this with racial profiling. You know, we all know this as security people, right? When you're crossing a border or you're, you're, you're as a human sorting through large numbers of people you profile, you're looking for people who look like, I dunno, me, right?

You know, long hair, hippie looking, uh, folks, or, you know, some other stereotype. And with humans in the loop, maybe, you know, again, let's not go down that rabbit hole. We haven't been great at this, or we're gonna automate the same systems with no accountability, no audit auditing, and no verifiability.

Uh, no, no. You know, guy, I'm sorry. Go ahead, Kate.

No, And, and one of the things that you said Guy, was, um, about, uh, training. You know, we've had, you know, these models that have been, you know, so many images that we have trained, you know, what about data poison? What about poisoning of the, I mean, what are the controls to know that the models that we're training the this facial recognition is, are good models?

You know, do we know that, You know that, that's a really good point, Kate. What I was thinking about is, you know, it's, it's the quality of the tools and put into the quality of the people in the hands that those tools are being used in, right? And, you know, it can be their own training on how to use that.

I mean, facial recognition has been, you know, blind to the point we've talked about of, of, of, of, uh, kind of biasing against, or people of color. 'cause it has been like Indian people, black people, et cetera. Um, but it is an area that is, is got a, I mean, that's been part of AI since I worked in AI in the eighties.

And it's all about image recognition. And it's not generative AI that you use for facial recognition. They use something called a convolutional network model or neural model, which is basically edge detection to determine trying to understand the structures of an image.

Um, and it's different when you're looking at a photo or a still image or a semi still video versus somebody walking through an airport, you know, you're trying, like they do on an FBI on tv, right? Um, so I mean, the, the accuracy has gotten much better. I just question is, is this just lipstick on a pig on a, an ice pig that, uh, yeah.

Okay. So they're using facial, but are they using it effectively? Is it really helping?

Is it just like, okay, move on. You know what, we, we don't have a lot of trust in the process. Yeah.

We don't have any trust in the process of what they're doing. So this seems more like a pr move than an actual, let's, let's use this to be better at our jobs Guy. When you said a privileged class, because we fly a lot, that's not the privileged class, my friend, the privileged class is that we're all white.

Yeah, Absolutely. Let's call it what it Is. I have a question.

I think there's, I think it's Both. Are we, are we sliding into, um, a surveillance state in the name of security Sliding, how about head first? Um, We're already in a surveillance state that's already go to London and we're Accepting it.

It's not just London, it's New York. It's every true, it's every city. I I, I seen you remember Ben Franklin when saying something to the effect that if you sacrifice liberty in the name of security, you deserve neither I, with all that, I, I'm gonna, you know, assume my cliche role, you know, I think we're driving through an inflection point that that leads to a positive to, to potential positive ends, right?

I see this again in cybersecurity, everywhere in the supply chain, you know, just yesterday, uh, which will be two days ago when the airs. Yeah, I mean, a bit of a knockdown drag out. Now people who know about whether we really can know everything that's in this, in the software all the time right now, you know, and are we at that point we can actually do that.

I think we aren't, uh, we weren't last year, and we will be at some point in the future. Same with this, we've been accepting systems without the transparency and visibility, and I forget who mentioned it, but yeah, again, the, the, the penalty, you can get information now if you are really enthusiastic, if you really wanna file the paperwork and get into it and spend the three to six months, you can get the transparency, that's not good enough and never has been. I think we're driving ourselves to a point where we have to decide whether we're gonna accept opaque surveillance states or demand the transparency that we wrote down, you know, 250 so years ago, right?

So it's not just the surveillance state. It's a question of, of, of freedoms of, of living your life free if you, you know, you don't have to be entangled with government and so forth. You know, one of the things they always say about the state of Singapore, the country nation of Singapore city state, whenever is they traded their freedoms for security.

They traded their freedoms for prosperity and their constitution, and their society reflects that. Right? You know, if you throw gum on the ground, you're gonna be in trouble there.

Uh, if you do, you bring drugs in, it's a death penalty, right? That is, that is the trade off they made in Singapore. I think we're coming to a point here in the US where we've gotta decide, are we, do we want to have that kind of trade off?

Do we want to give up some freedoms, not some, or at least some freedoms in some of our constitutionally protected rights for maybe a better shot at prosperity, or, I, I don't even know why one would do it, to tell you the truth, but, well, you know, I'm willings to do that. Singapore, as you point, Singapore is a particular case, and I don't, I just, I'll just put it this way, right? It's, it's, uh, isolated city, state, small.

It's in a particular part of the world with particular had particular security concerns of its own 'cause it's a majority, uh, uh, Chinese population in the middle of a lot of other populations. And the Chinese population had been there for centuries. But its particular situation.

I, I think I'm optimistic, my saying is, the truth always wins. Um, and the truth is that there is no security crisis in the United States. The truth is that, um, the, the, the various stories around why we need to do crackdowns or have more security or, or, you know, send Marines into California or whatever, right?

They're just, they're invented, they're bedtime stories for people who want to, you know, feel like, Or invo 20-year-old. So, so the, the question is not when whether reality will win. 'cause the reality is that we don't need this kind of stuff.

It's when, when is it going to win? But I'm optimistic that it will win in a reasonable amount of time, or maybe a re there's no reasonable amount of time, but in a certain amount of time, it will not perpetuate surveillance state has particular connotations to it as a phrase. We already are in a surveillance state, if you wanna look at it one way, because it's just to go take a plane.

You're gonna be watched, you know, for a thousand yards on your way to the plane or in other ways. Surveillance states are extremely hard to achieve right now, uh, because, uh, there's so much data, so much information available, but there are still human actors even behind or across next to the AI that is developing that need to actually do stuff in reaction to it. So I think that it's a dangerous point, and we need to call this stuff out, but that does not necessarily mean we're on that slide.

Well, I think of the false dichotomy to say it's a choice of either or, right? You know, I have been, and continue to be a, an absolute believer in the fundamentals of this. You know, this is, you know, and I'll say it as American, it's America, it's western democracy.

It's open source, it's freedom of speech. It's the internet. You know, it doesn't work because it's good and chewy and hippies like it.

It works because it's more effective, more efficient, and it works. And the actual transparency that, that our country is founded on, and this whole internet was founded on all this stuffs founded on, hasn't really been practical, and it hasn't kept it up with the needs of the times. So it's not about whether cameras are gonna be everywhere.

They have always been going to be everywhere. Now they know. The question is, can you actually tell what other people, like governments who have control over you, that we seed voluntarily control over you?

What they know about you when they know it, and what they do do with it. And in this, the case of this piece, the answer is no. You know, this is not something a free government does, period.

The whole system is, you know, does not work. Would it be done in a way that was free and fair by possibly? This isn't it.

I agree. All right, let's leave this alone and let my blood pressure calm down here. Um, let's take a break here.

We're gonna come back and talk a bit. Well, we'll talk about more deep fake regulation coming at you on techron Gang. Discover Techron Group, the epicenter of tech innovation.

We are your go-to for reaching IT, leaders and practitioners worldwide. Our secret impactful content that sparks awareness, engagement, and top quality leads with us. You'll access editorial websites, streaming videos, virtual events, custom content analyst research, and more.

Join our satisfied clients. Let's revolutionize your tech journey. Contact us today and tell your story to the world, world in the most powerful way with Textron Group.

Hey, folks, we're back in. Well, I don't know about reduced Allen's blood pressure because, well, we got another interesting topic here, which is regulations that it applies to. Deep, big, Ireland has joined Denmark in creating some regulation that grants people the rights over their likeness and their voice, and is pushing for additional controls.

And the whole idea here is that there should be some legal remedy that I can invoke when somebody steals my image and tries to impersonate me in some way that creates mischief or mayhem. Chris, are, are these laws gonna be applied more globally? And frankly, are they enforceable?

Uh, yes, they are gonna be applied more globally, and yes, they're enforceable. Now, these particular ones we'll see, right? But it's absolutely the right step in the right direction.

And as you're saying that, I, I, I know my mind has been so wrapped up with Civic AI Canada and all that, but this is specifically rules in, in the civic ai, you know, uh, uh, ethical arch architecture we've created that, that AI are required to obey. You know, you cannot pretend to be somebody else. And if you do pretend to be somebody else, you need to, you know, tell them about it.

And it needs to be situational, and it has to be attested to. And like a lot of things in developing this ethical framework, we're working through things that we find that humans do implicitly without really understanding. So we're having to codify them so the AI understand what it's like to navigating human world, um, at this level on the, on the, this side of the class for humans.

Yes, we have to have rules and regulations like this that say, you know, if you were going to pretend, you have to say you're pretending and you don't get to, you know, free speech is not, you know, any, everything I, I wanna send. And that paragraph with is a cliche, right? But, oh, ahead.

This is perfect. Ahead. Let's Hear your cliche.

You know? Yeah. You have to.

Now I forgot what the heck it was, but, uh, you know, you know, this is classic stuff, right? Your grandmother told you this, you know, don't lie. If you're gonna lie, say I'm lying.

You know, you know, comedy is a wonderful thing. Caricature is beautiful, but you know, no, you don't get to pretend to be other people. Or it's like, or it's like referencing if you're writing a paper where you know where you got, yeah.

We've been doing this, right. For, for years, So, right. You know, and, and you know, as you folks know, I and my ai counterpart co-author all the time, and we have, we have designed into the ethical structure, you know, what that specifically means.

And we do it better than I do with human co-author, authors, you know, am I just advising someone on a piece? Are we really writing it together, or are they writing it and I'm, you know, sub or whatever it is. So there are ways to codify this.

And again, it's humans, we sort of muddle through it because we haven't written, written it down for AI as we have to. And I think it's a good mirror for human behavior sometimes. Well, you know, I think it also opens up the whole what is a deep fake, because as it as this technology is good enough to make a video of myself, let's say for example, that is a deep fake, it's not actually me talking or me on the video.

I might have created that for myself. I might have to do that. 'cause I don't have time to go shoot videos or whatever.

Is my reason for doing it is that a deep fake, even though I created it for myself. No, no, but that, that's okay. It's Super interesting point.

So hang on, Alan, because, um, my state where I reside state of Texas, um, has actually been a little bit advanced in, you have Good regulations in Texas about this. Yeah, yeah. Well, so, so I looked up, uh, how the phrase deep fake is defined in Texas law.

And part of that definition is the intention to deceive what, what in, in, in the law, if, if I have, you know, um, that's like race, race or something like that, you need the intention to deceive in order to do it. So, so, so the interesting conundrum here is you're not intending to deceive if you are creating a Mitch Ashley AI video. Well, maybe I do wanna deceive them and make Really, maybe I'm not, you're missing the point legally, guys.

Okay, well, Legally need to Lawyer guy, you went to law school too, right? No. Or Lee Lee went to law school.

Sorry, Lee. No, I, I watched Legally Blonde a Few times. So look, from, from a, from the legal tree, hear me out from the legal tree.

This is an IP issue, an intellectual property issue. Who Has, this is where Mark got it, right? Go on.

This is where this is. Yeah. Okay.

This is where Denmark got it. Right? This is an IP issue.

This is who has the right to your likeness, to your being, to your image, to your, to your ip. Your image is part of your ip. Now, here in the us the most famous case that kinda set the mark for this was the estate of Bella Lago Jaa.

Um, his, his, his heirs sued because they were using Lago, you know, for Eular, uh, uh, advertisements all over the place. And the Supreme Court ruled, that's one's likeness is is one's ip. So Mitch, in the case of point that you brought up, you own your ip.

If you wanna make a deep fake, if you want to call it a deep fake, if you wanna make a copy of yourself that you use electronically, it's your ip. You could do what you want with it. When Mike does it, that's a whole nother story.

And if he's doing it and not asking your permission and holding it out there, it's a, it's an IP violation, right? That that is wrong. And, and you're entitled to compensation.

Now, here's where it gets interesting. Obviously, one could say, well, my image is, is part of my ip the case of Laci, uh, the, the state of Laci versus I think it was MCA or something, um, holds that, what about your IP in terms of what you've written that an LLM is then taking? And, and, you know, and when I go into the l into the a i, and I say, write this in the style of Mitch Ashley, and it writes an article that is in the style of Mitch Ashley.

Does Mitch have ip, you know, does Mitch have an IP claim there? Because it was, it was still your ip, whether it's someone's image or some other form of their intellectual property. How, how far can you, does that extend to letting the AI Or, you know, what's the intents?

Yeah, Sarge. So to me, that that's the thing behind these defi regulations. Now, yeah, they're there to stop people from deceiving you, but the underlying, even if they're not deceiving you, you shouldn't be able to use my IP without my permission, without me being compensated.

It's a good point. A public exception. You can even bequeath your, your ip, your likeness.

Einstein did that. Um, ly Salesforce is using Einstein in their AI advertising. They had to pay you $20 million.

Well, the Legi case, university of Jerusalem, the Legi case was his estate, not, he was long debt, long gone. Well, maybe I the unless silver thing in his heart, But it, I don't know the legal principle upon which one's, at least in, in, um, uh, the United States one's, uh, uh, image is considered your ip. It Absolutely, But if it's based, don't say absolute and Supreme Court in the same five minute span.

That's all I'm saying. Well, there's a law That's true. This is what Denmark, this is what Denmark did, um, was codify it as a law.

Um, and I don't, I just, that's, I would be cautious about, about Here. We probably don't have a law. We, we, we have case law, but the other thing, person to be saddened, I'm personally saddened that a topic or an issue that I would've thought would've been covered by common law, stretching back to the dawn of time is now has to actually be written down on the age of ai.

But what do I know? I, I wasn't thinking about this from the IP perspective coming into this segment, but I kind of like it, and I, and the end of the, the end of the back and forth, right? This is, you know, when I'm writing something, co-authoring things, you know, musician friends, you know, we talk about this all the time, you know, I tend to write like the last author I've been reading, you know, so is that IP or is that what, you know?

So I think rules and regulations we need when we can't avoid them, but they only go so far. And I think getting past the cases you're, you're talking about, um, it comes down to ethics and that we can navigate personally, we don't hopefully need wills for, but I think we, we need this one now. Yeah.

I mean, there have been cases where you heard a, a a, a musician had a jingle in his head and he wrote a song to it, and then it was found out. I'm sorry. Yeah.

And then if that they, you know, that, that, that jingle was someone else's ip. So Kate, I wanted to ask you, so this attempted deceive side, if I think about it specifically from a risk and insecurity angle, um, I don't think, would there be any argument that, whether it's through social engineering or through, you know, stealing credentials or using, or whatever it is, if somebody impersonates someone else or simulates someone else in order to gain access to a protected resource, is the, but then doesn't do anything. They don't steal anything.

They don't copy difference anything. They don't use it in any way. It's still, it's still a crime, right?

Mm-hmm. Absolutely. Personally, I think so, yes.

I think it's still a crime. And because I think what you see, especially when you look at cybersecurity attack methodology, that's what they do, right? They start to look at the steps on how do I get access to resource A, B, or C?

And sometimes they will test to see where they can go. So absolutely. I mean, Right, breaking and entering is a crime.

Even if you just broke, entered, looked around, Take anything, right? So even If there was no robbery, this, This, this is where like common law, common sense, all those other sort of things, they just all combine because you're sitting here and you're going, how could that be a crime? And yet whatever deep fake use for whatever, like deep fake as, as defined as an intent to deceive, forget about all the rest.

Well, how could that not be, I don't know, inherently criminal, how could that be legal anywhere? But these are resolved through lawsuits, aren't they? Allen?

I mean, I'm thinking about the, um, the Vanilla Ice and the Queen under pressure song that was, they settled that outta court. You had to pay like $4 million to Whatever it was. It's an IP claim.

It's a monetary Claim resolved outta court. It doesn't get hauled into the judge. And so you, Chris, you did a felony, you know, IP theft.

Well, well, Here's The difference between civil and criminal. So that's here, Here, they're making a criminal is what I'm assuming, but I'm Gonna, yeah, there you go. I'm gonna bet that there's gotta be a satire exception or something like that, you know, especially for a public figure.

Yeah. Like an SN l type of, you know, like Yeah, I'm, you know, the absence of malice, all of that stuff. So if you have this warning, it's satire or this, you know, a water or whatever kind of Marking, I don't know if there's a warning, it's satire, right?

I'll, I'll recognize it when sre I see it, it kind of fake. That's That, that even, even the, you know, the best of the like live real person in makeup, whatever satire that you see, there's enough generally speaking of a clue that it's not the actual person. Now, does that, does that apply in every single case?

No, but in enough of the cases, but now we're talking about where 100% of the time or approaching 100% of the time, it could be very, very difficult for the average person to tell. And so then it goes out in the wild, and here's something that was built and intended as satire expressed as free speech. That is now off who knows where being used to smear the person in question We need, which is why we need to separate though, we we're really talking about is media authenticity.

Right? You know, you know, IP and, and satire and so forth are real, but, you know, we all understand the issue right now is that nobody trusts the media or has any reason to. Right?

And with these sort of simulations, arguably showing up in what we regard as information sources, without any, you know, digital consent system, um, there's no reason to, to have trust in the media we're getting, so, Chris, I didn't work higher label. Think that's the fine beginning, but you know who people trust less than the media, The government. Yeah.

Right? Yeah. And that's who we gotta be careful about using this.

But well See the last segment. I, But yeah, but I thought you were Gonna say lawyers, but Well, no, they're kill the lawyers first. Right?

But, but that being said here, here's the other thing. I, I do believe there's a way out of this rabbit hole, and, and it's, Chris, it's something I read in some of the things you've been publishing, which is we need a better system of identifying what's fake. That, that, you know, whether it's called civic AI or whatever you're calling it, Chris, you know, is there, is there something that people can go to that will tell them this is genuine?

That's, and that's the answer is not the first part. You know, what's fake? Who knows?

But we know what some things that are real, and having enough of those that we all reference against allows us to make better decisions about the rest. And that's how we all get through the life. I mean, literally, you know, that's how our brains work.

We're not processing all the information. We focus on what's important and the real things we can pivot off of things that may or may not not be real are, are much more numerous and always will be. Now Here's, here's my belief in this.

I think for people, baby boomers, gen Xers, the D is kind of cast, right? We, we have gotten used to being in a world where we have, you know, a thousand channels of tv nothing on, and, and some of us believe everything that it's on, that we're told. Some of us don't.

Some of us just have our own opinion, and that substitutes for facts. I did believe that Gen y, gen Z millennials being digital natives, have a better true north, a better compass of, of separating, um, fact from fiction, deep fake from reality. I'm not So sure anymore.

I'm Mitch's eye roll and Mike Mitch. Yeah. And Mike, I saw Mike.

I haven't seen any Stu, maybe I haven't seen any studies to that effect. So better. Sure.

Better enough. We'll, we'll find out. But I, I, but I do think there's an answer technically that'll help.

And it, and, and I think, you know, it may be too late for us, but it'll, there'll be in time for that. So you're saying there's hope, it's Gen Z, there's always hope. It's that's what you're Why's the Optim?

He's the optimist. You're alpha Gen Alpha. I dunno, I was the optimist, a Gen X.

That's pretty Phenomenal. I, I think we're premise missed that everything is untrue. And working our way back, I hopefully forwards Mike, it start, it started with Believing some things are true and build yourself up.

That's a lot easier. Well, Let's take a break here. I don't know what's true or not anymore, but we're gonna come back and talk about gluttony.

Well, we're just on like the 7 cents today, huh? com is the leading resource for news analysis and education on challenges facing the cybersecurity industry. com covers all aspects of cybersecurity, including data security, DevSecOps, cloud security, application security, network security, security threats, and more.

com has the largest selection of security content featuring breaking news, blog posts, podcasts, and more. com to learn more. com.

Home of Security Bloggers Network. Hey folks, we're back. And it turns out that open source isn't free after all, and there is a cost in running all the infrastructure to support it, but it turns out that a lot of folks are using it in a way that shall we say, is fundamentally inefficient and not realizing that they're running up the cost of using that infrastructure in a way that might threaten the existence of open source one day.

But I'm gonna let Brian Fox, CTO of Sonotype explain here in this little video segment we did at the Open Software Summit last week. We've, we've modernized our practices to the point where all of these open source projects, everything is dependent upon, you know, CI/CD in the cloud, right? And GitHub actions, GitHub, you know, sponsors lots and lots of machine and compute time for, for GitHub projects to run their builds.

And lots of other companies do it too. You know, Sonatype, we run the Maven Central repository. We, we pay for the bandwidth and all these things, but I think people have, they don't recognize the underlying cost because all these companies are bearing that, that burden, right?

And so it, it's led to this sort of sort of, uh, mentality, you know, the gluttony mentality of it's all free. And so I'm just gonna run my build as many times as I possibly can, every commit. I'm gonna run a, a pretend release.

And, and so what I'm, what I'm seeing when I really look at this is I'm seeing really just, frankly, irresponsible consumption by, by, uh, individuals and, and companies, big trillion dollar companies that really should know better, right? And are just eating up all of the resources that are causing every company that has to donate this stuff. Alright, we're back.

So, Mitch, to Brian's point, is this becoming a larger issue or is it a narrow set of projects and maybe only the smaller projects that this is gonna affect, but it does seem that best practices are not being followed consistently, shall we say? Well, I was, I was lurking in the background or side of that video listening to you guys talk about it during the open source summit. It was pretty interesting.

I i, it, it's not like a theme or a cause that's bubbling up and people are getting kind of building steam around it and some momentum. But it does raise the question of are there good practices in, in being considerate of the resources that you're using? The problem with some, when something's free, it's free whether to use it once or we pre use it a thousand times an hour.

If it's free like that, then you use it for whatever you want, not really thinking about, well, if everybody does this, then there's resources at Sonatype or at Docker or GitHub or wherever this is suddenly are now responding to a whole bunch of requests that isn't really needed for that and they've gotta start putting limiters and governors in place. So I, I don't know that it's a rampant problem. Maybe it is, but um, you know, I think Brian was responding to it because he's digging into what they're doing at Sonotype and the resources that are being acquired, and why is somebody hitting, you know, our repositories this, this fast or this quickly, this many times per hour.

Do they really using that many build processes or just a gone amuck, Not just somebody, a trillion dollar vet tech company is what he Said? Yes. Yes, he did.

He didn't name any, uh, names, but there's not too many $2 trillion tech companies, right? Well, In my desk, Dr. Richard Stallman voice pity, pity, I was gonna Mention Stallman.

Go ahead. Pity, pity these poor people who can't make more money off of open source. If it's open source, it's open source, right?

We've seen this, Mitch, and I've seen this, Kate, you were around then, so will you, Chris, right? Look, I remember when Ron Goer and Rena Jason said, oh, everybody's getting rich using Nessus, and Nessus is in everybody's scanner, and we're not gonna keep it open source anymore. It's free, but it's not that free, right?

It's free as in beer, not as in freedom. And, and, and so they, they took masses of open source Marty Rash said, well, you could still use the snort engine, but you're gonna have to pay for those rules. The syntax rules, this is if something is open source and you make a decision to open source something, people can use it to the letter of the license.

And if that disagrees or conflicts with your open source business model, then don't have an open source business model. I have a ton of respect for Brian. I have a ton of respect for Sona type, but when you put something out there, you can't cry if people are using it pursuant to the license that you put it out under.

But To that point, a I'm, I'm kind of of the same mind of, is it just, you know, this is a problem, you know, the sky is falling. And I'm not saying Brian is being that, you know, dramatic about it, but on, on the other hand is, of course, people are gonna abuse it and overuse it, maybe intentionally, maybe not at times. And if you're gonna provide a resource that you're paying for, you're gonna have to manage it and you'll have to put some limits on it, some governors or whatever, or not.

I mean, it's just a cost of you hosting that open source, you providing those servers, those repositories, et cetera. So it, it's part of it, it isn't, you don't get to do get open source because you just provide code. There's other parts of it you have to support as well.

All right, I'm gonna just, I'm gonna disagree with this on a multiple points here. One is we're not talking about open source, whether it's open source or not. We're just talking about whether or not I need to provide the infrastructure to host that open source project.

And I may not be under any obligation to do that just because I made something available as open source. So you could see companies that are making those resources, deciding that, hey, we're gonna continue to give you that open source license. We're just not gonna continue to fund the infrastructure underneath, underneath it.

Sorry. And, you know, there's a trillion dollar company out there that might wanna kick in a few bucks to help with this thing. Secondarily, there is much room for improvement in terms of just making people aware that this is an issue.

Because most folks, when they know will do the right thing, I would argue that most of the people who are probably abusing this stuff have no idea. And they're just kind of like using It. So here, here's the thing, Mike, you gotta draw a distinction between open source software and open access, right?

In, in the case of Sonatype, with all due respect, the 2 trillion pieces of Java code or JavaScript that they've got up there, they weren't written by Sonatype, they were written by people who contributed to a repository. Now, is all of that code open source? Yes.

Does the repository, is the repository itself open source? I don't think so. I think instead of crying in the beer about what was me, all these trillion dollar companies using my, my open source, they're not really using your open source.

They're accessing open source, soft or open source code on your repository. So say, look, all the code in there is open source, but to use the ingress and egress of my repository, you have to have a paid account. It's a very simple thing.

Now, you're gonna p**s off a lot of people because Mike, they're not as naive as you think. They know exactly what they're doing and it's open source, and they can, and you're gonna p**s them off. And you may or may not have a good business after that.

And Chris is gonna burst. Go ahead, Chris. Craig, Chris.

Alright. I I'm gonna go against all precedent and agree with Mike, right? And don't get your expectations up.

This is never gonna happen again. But, uh, you know, Alan, everything I'm hearing from you is, is you know, well-founded cynicism, right? You don't believe the companies, you don't believe what they say, you don't believe their motivations, you don't believe, and there's no reason to believe because you can't tell, right?

You know, and I think this, you know, I think this sort of issue, you know, I, I, I watched the, the episode, I don't exactly know how some type's doing things, and maybe they're right or wrong, but if you, I can see myself being in that position where suddenly I'm, I start up a little company, now it's a big company, and I open source everything, and I find out that everybody's clicking on things that I wasn't, I I shouldn't have set up that way. I wasn't immature. And I'm saying, look, I can't afford another data center to support this, and I have to ask, but there's no way for people to actually believe and see and know that this instead of lack of transparency at every level.

But again, I'm asking you what, go ahead, Kate. I I know, but I have to agree with Alan being, you know, from a true networking background, right? This, you know, you start to see, you know, these, you know, ress and you know, ingress and Yeah, I mean, you know, Alan's coming at it from, I think Alan, from a networking perspective perspective.

And you see this. Yeah. I mean, what, what's, what's Sonatype's open source software here?

No, no. Monotypes providing a service. I, okay, so I don't agree with anybody except you, Mitch.

'cause I don't know what you've said. I can't remember. Um, It was important, whatever it was.

I know Here's, here's what's, here's, here's what you're, you're all missing open source as a market has changed. It's changed significantly, maybe even more than like, maybe it's changed radically in just the past, what, three, four years? How so?

It has invaded the commercial enterprise space. And I'm not talking about, you know, it ops software. There's been tons of open source, you know, infrastructure, operations, software and all that stuff going on.

I mean, that, that, whether it's delivered through, uh, independent software vendors, software packages, or used by development teams in the enterprise, it has become a really big thing. And so the terms under which Sonotype and others have created, their repos, made them open are old terms that predate this kind of, you know, accelerated adoption and use. And so that's really, in my sense, what is concerning Brian, even, even if, or sonotype even if, even if he's not stating it, which is we built this thing with a certain expectation, but now something else is happening.

Now Sonotype gets something extremely valuable out of making this a free available service, which is they see who all the users are, they have all of those accounts. I don't know what, what agreement you have in order to set up the account as a repo or whatever. But you are a central market actor, actor, if not a market maker.

So I don't cry any crocodile tears for sonotype here. And I think that they just need to, if they haven't already, they probably have understand the value that they're getting back from doing this. I'm gonna do, I'm gonna do a Mike Vizard here.

What makes me scratch my head about this one is, isn't this just like, um, why are all, why are these IP addresses hitting our website so frequently? Why are they, where are they from? Who is it?

What are they doing? Who do we block? Who do we reach out to?

We've been dealing with this with networks since Ping Absolutely. That came, came about, right? It it's the same, it's really the same issue.

People over accessing a resource, and you have a couple of options about how you manage it, but you gotta manage it. It's your resource, whether you're giving it away for free or it's part of your core business, um, and you charge for it. You, you're, you see abuse, whether it's intentional or not.

You, we've been doing this, Kate. Yeah. Am I right here?

Am I going down the right path as a network person? Sure. But, but let me, there's another aspect of the open source community that needs to be heard from, and that is the Saints who freely give their code to these, to these companies without any More Crocodile tears coming from me.

Continue. No, No. You know what?

There's a lot of people who write Java script snips, Java code snips. There's a lot of pe I'll give you, let's take, go away from Sonatype for a second. Let's go to GitLab.

Open source, CI/CD every month for the last 12 years, whatever it is, 10 years, eight years. They, they released on the 22nd of the month a new version. And that version has new code in it.

And not a lot, but some of that new code is code that was developed by members of the community and contributed to the project. So Harvard Business Review did a study of this last year and found that like something like 96% of enterprises are using open source, but only about 35% are contributing to It. Yes, it's the parasite problem, but I'm talking about the people who do contribute code guy, they contribute that code without any expectation of being compensated.

They do it because they want it to be available to everyone. Now, when they, when they contribute to a repo, It's more complicated than that, Alan. But yeah, when they contribute, go ahead.

When they contribute this code, they're doing it under a license with the expectation that it's free and open And, and not an expectation that everybody's gonna contribute. I'm not Gonna contribute. Right?

They know every know piece of Lin knows Code running on my server. I mean, Look, I, I've, I've covered the open source business models for 20 Mitchell knows 25 years. The fact of the matter is, if you're very lucky, 3% of the people who play with your code and open source will at least report a bug, right?

Most open source projects you could count on two hands may be one foot. The amount of people who actually contribute code to an open source project except the biggest, biggest, biggest open source projects that that's the nature of this beast. Plain and simple.

And so, and, and you're okay with it. I guess that's how it is. And, and I'm okay with it because these are passion projects for people, or they are building the name for themselves, or they are practicing, or they're getting something out of it.

They're definitely paying, they're paying in their time at least time. Sweat and toil, if not in money. Well, a lot people have monetized Contribution.

Mm-hmm. I mean, You know, and the only reason I said it's more complicated, Alan, is because, uh, public institutions as well as lots of private commercial ones are paying salaries if, maybe not bonuses or things like that, but they're paying salaries for people to spend all of their time contributing to open source. And so those people's jobs and their salary and their career advancement is based On well, so that, that's a relatively recent, so I, I've spoken about it before, but here's the deal.

You Had to, so I'm saying it's changed. Yeah, go ahead. No, it hasn't.

So under Richard Stallman in that era of open source, kind of the cathedral and the bizarre, like the book, it was, it was very much wild westy and more power to the man down with the pigs, all that stuff. Then you had this big brother era of open source where you had like IBM supporting some great projects and you know, basically an open source project had a benefactor. It was kinda like Renaissance Europe, right?

Every artist had a benefactor who paid and really managed that open source project, but also did it for their own material benefit. And in many of those cases, the code contribution was by paid employees at an IBM or, or what have you. Then we moved into like the foundational era of open source, which is kind of where we are now.

We have like Linux Foundation, CNCF, eclipse Foundation, you know, who they have coopetition between competitors who are all contributing to that open source and it, and it kind of makes it an even C and then you jump off from there, right? Um, there are plenty of companies who contribute full-time and not all IBMers too. I mean, you look company like Linker DA big mesh in CNCF, they, they, they support that project with full-time people.

They also have a better, a commercial business built around it. I think Sauna types the same kind of situation. So there's two ways to think about this.

One is they could just give this to some consortium and let them figure out the cost of hosting all this. Aaron b maybe they just need a better tax attorney to write this thing off, You know, Sonatype. So look, so, so Sonatype is a PE owned company.

They're, they're a private equity owned company. There go, I think they got good tax accountants. There you go.

And that's why they're watching the pennies too. But I, I think that the key here is they probably need to put a toll booth at the door of the repo. Well, so, so one, one second.

Now just one, uh, fly in that ointment, let's say, which is this trillion dollar company. There's no reason they can't do, you know, uh, um, fire firewall like inside the DMZ or DMZ based caching, right? They're just, they're not doing that.

Who this is carrying, so You mean No, no, not Sonatype's. A trillion dollar company that's doing a thousand. Why?

Okay, What my point is that, um, uh, that is a, a different, so there, there, I think the fear here, I've been wanting to say this, the fear here is that rapacious capitalists are gonna go in and just say, wow, free stuff. Go grab it, make a few twiddles, and then, you know, hey, it was open source. You know, know that's capitalism.

Yeah, that's been true. No, no, no, I agree. I agree.

Change, change in the market, change in the user base. Change in how open the, the open source market is gonna have a reaction. We just haven't reached that point.

You know what, my political science teacher in St. John's University told me something probably close to 40 years ago. Now, communism's a great system.

If you have a society of atheistic saints, we're not communist, nor are we a society of atheistic saints. If people can get away doing something legally, they will. Mm-hmm.

Here's the flip side of it. You know why Sonotype doesn't put a toll booth in on that repository? Because if they did, someone else will start a new repository And, and be a new center of gravity for Jala.

Yes. And there you go. New center of gravity, open source job.

I think they should try the pro model 9 99 a month per user premium access. There you go. I, I'll just, I'll just say, you know, we're not obviously not gonna solve this one right here, but I think Guy, you know, you, you, you know, I want been wanting to say the same thing.

Like, we need to recognize what people want and what they're trying to get out of it. And, and, you know, I write open source because I feel like it, I want a dopamine rust. I wanna get some experience.

I want to get my name out there. I wanna get paid, whatever it is, and actually reflect that the systems we have right now, the problems we're having is because we're not always reflecting that, which, you know, Alan, you know, may, you know, may allow certain mechanisms like the normal capitalist, uh, impact to highlight the flaws of the system we're using. So if that stays that way for long term, then I guess that's fine.

But I don't think it is, I think it's a combination of these things that, you know, to, to sound like a broken broker allows transparency or for, for everybody involves, you know, the consumer and the producer and the, you know, the open source contributors so they can see whether or not it's being handled ethically and make their own choices. And that doesn't exist yet. Alright, we gotta end, wrap it up, but let me just end it with this thing.

What could be next? Socialized medicine. You're watching Texture and Guy, we're gonna be back tomorrow with a lot more.

We hope you've enjoyed this, this, uh, episode. As usual, stay tuned for text from tv. Thank you for joining us on behalf of Gaia Mitchell and Chris and Mike and Kate on her first show.

We hope we didn't scare her away with this one. You'll see more of her. This is Alan.

We're out.