Social Media Reform, PHP Patching and NVIDIA’s Challengers

Hey everyone. Welcome. What is this again?

Oh, Techstrong Gang. I'm back. I've missed, I think, the last 10 Techstrong Gangs, maybe more.

I've been traveling. I went to Austin, so I had a whole bunch of barbecue and Tex-Mex, and I actually did some events down here in Fort Lauderdale, of all places. Right.

But it pulled me away. But I'm happy to be back here on the Gang on this beautiful Thursday, and we've got a great gang of folks. Let me introduce you to them.

We've got my friend Guy Currier. Guy, welcome. Jaime Hampton.

Jamie, great to see you. Drew Gutstein from New York, Jon Swartz from California, and up in Harrison, Mike Vizard. How do I know it's really you and not some fake Paul McCarthy, that Paul McCartney that they brought out?

Well, you could ask my hairdresser, but I don't know how you would know. That's the problem today, isn't it? Yeah.

By the way, happy belated birthday, Alan. Thank you. Yes, yesterday was my birthday.

I got to be honest, it wasn't one of my better birthdays. I spent most of it in the doctor's office with a back pain, but I'm here today, and we're going to celebrate this weekend. But thank you.

Good. Thank you. Anyway, Mike, what have I missed?

Well, tons, but today's cycle of insanity starts with Meta. I guess there's a judge that went out there and said, going back to this privacy issue that they had with, is it Cambridge Analytica? I think that's how you say it.

Yes, it is. 25 billion, and this is the court-ordered fine, and whether that actually winds up being the final fine, of course, will depend on how many more appeals there are. But I guess, my question here is there seems to be a general need or agreement that we need some sort of social media reform, and it may require rethinking how Section 230 is applied.

But let's start with the money first. John, is this enough money to scare Meta straight? Well, they just settled for $18 billion in August over the teen case involving the 10 AGs and mental health.

And in this case, actually, they're a little bit fortunate in that the prosecutors wanted, the plaintiffs wanted 35 to 40 billion. And actually, Meta was willing to go and settle for $3 billion, so they got hit hard. But I got bad news for them.

Section 230 may not save them. It didn't do it in this case, nor will it perhaps in the future. So, that's the one thing that I kind of wanted to focus on.

So aside, they're going to appeal, first of all, Meta. But the ruling, I think, could redefine the broader debate around Section 230, and here's why. First of all, let me backtrack just a little bit and tell you that the decision does stem from this 2018 Cambridge Analytica scandal.

A consulting firm improperly obtained personal information, data on 87 million Facebook users ahead of the 2016 presidential election. And in a sense, this is what I think is key, and I would love to hear what Alan has to say about this. So the ruling highlights this distinct shift in legal strategy to hold social media platforms accountable.

So rather than suing Meta over the third-party political content distributed during the Cambridge Analytica era, the New Mexico folks targeted the platform's direct corporate misrepresentation in users regarding data privacy controls. So the state regulators demonstrated that massive financial penalties can be exacted through consumer protection law without directly triggering 230 protection, which typically immunizes tech companies from liability for third-party user content. So this might be a new strategy or a new attempt, and unfortunately for Meta, this might open floodgates for more action, more legal activity.

Well, not just for Meta. It could- Yeah. No, no ...

any of them. Yeah. So John, not to go legal scholar on you, but I don't think this applies, this isn't a 230 case.

Right? 230 is that the social media provider's not responsible for the content that someone posts. What they're alleging here was a violation of privacy policies and privacy.

Well, that was their attack. That was their strategy, to go... Anyway.

Yeah, no. It was, they intentionally- They started the issue entirely. Yeah ...

I think quite frankly, Meta knew they were doing it, and it was fine with them because it was helping them. But that's not a 230 where they put some stuff that was misleading or wrong or- Right. You know.

But the- No, they misrepresented the way they misused the data. That's the point. No, no, they illegally took data.

It wasn't about what they posted. No. Well, I think that- The judge is ruling that Meta knew about this- Yes ...

and therefore is responsible for all this. So Drew, let's have you jump in here. Am I going to see 1,000 of these cases going forward, between now and the end of the year, and is this going to be a bonanza for law firms?

Almost certainly. I think that would, in any case, that would happen. So I think it's interesting in that the ruling is on privacy grounds.

It's not about hosting harmful content, which would be the Section 230 thing. And this is the same tactic or a very similar tactic that was used in the earlier case that John mentioned for young adults. What is difficult about this is, and it's hard to overstate, is what happened with Cambridge Analytica, it was absolutely insane.

They were conducting psychological operations on the US population to sway an election. That's what they did. Now, this case doesn't have any of those claims in there.

No. But there's nothing that's happened between then and now to prevent other things like this from happening. That's interesting.

So it's- In fact, it's probably gotten more protected from these types of uses. So Guy, there's tons of people out there who purchase data. They're brokers, and all that information winds up in some sort of marketing campaign, AKA as what Drew just described, a psychological operation.

Is that going to change? Is this whole business going to change as a result of this ruling, and people are going to start saying, "Hey, I can't just assume that I can use all this data willy-nilly any way I want"? Well, I hate to disappoint you, and the others who know me, but I actually think it might.

Mm-hmm. I think it'll be probably slow to come. But John, it really interests me how the plaintiffs managed to win here.

Mm-hmm. Here's why. So Drew's point is really important about the nefariousness of what was done, the profiling that was done, and all that other sort of stuff.

The Section 230 protections amount to saying that the transmitter of free speech should not be responsible for the content of that speech. But what I've always been bugged by is the sense in which the, well, it's got sort of a different meaning now, but the way in which the algorithm, which is the responsibility in development, obviously, of the social media company, Meta in this case, the role of the algorithm. The algorithm maybe is not speech, but it is, to me, speech in the sense of what it curates, why it curates, and how it curates it.

" But it's just really nuanced or something. By trying to explain this, the court of public opinion matters as much or more as whatever happens in a court. So this particular method that bypasses 230, bypasses the targeting.

Mike, you've been in media, we've been in media for a really long time, and we are aware of all the different bits and parts that go into what actually hits the eyeballs of the audience. And a human being going in and editorially deciding this, not this, those words, not those words, that's easy to understand. Algorithm, not so much.

But this particular method, I think, could slowly percolate- Mm ... is that people are understanding the responsibility that the platform actually does have in their experience. Yeah.

I think to your point, and I know Alan's been on this drum, but if you are making editorial decisions about what content to surface, whether you're using a human or an algorithm, that's a gap in the current 230 understanding as it applies to social media, and maybe that's the part we need to reform. I don't know. Alan, what do you think?

Reform or just throw it out altogether. I think in many ways, a lot of people say social media's been the downfall of civilization over these last 15, 20 years. I think Section 230 has been its shield, right?

And it's been quite a shield. There is the editorial decisions that you're talking about, Mike, where they make a conscious decision, but there's other cases. I wrote an article on Techstrong AI about this a couple of weeks ago.

You had some lady, a college professor, who some wacko made up a story that she was responsible for killing four students or something. There was no proof. There was never any proof or anything.

The lady was exonerated. There was nothing to exonerate her from. But nevertheless, it went viral, and her life was ruined as a result.

" Well, you can't sue under 230. You can't sue... I think in this case, it was TikTok.

You can't sue TikTok because they're protected by 230, and the person who made the video on TikTok was some tarot card reader in Arizona or something, and didn't have a pot to go to the bathroom in and a place to throw it out. And so what do you tell this upstanding college professor lady whose life has been ruined? That's one story.

There's eight million stories in the naked city. This whole 230 thing needs to be revisited. There should be an obligation that before stuff goes out online- ...

there is some sort of fact-check. I don't know how many of you saw the new Facebook movie. "Social Reckoning," yes.

" I wrote something about that as well. There should be a responsibility. They purposely do this.

But we've heard so much from both sides, both Democrats and Republicans, for very different reasons about changing or reforming 230, which we've been hearing this for years, so I don't really have a lot of faith in them. You know what's interesting to me though, too, is that so Facebook, these fines are piling up. It's amounting to some real money, right?

Tens of billions of dollars. But their timing couldn't be worse. I don't know if you've noticed this, but during the NBA season just started, there was a major meta platforms commercial with Spike Lee, and it doesn't use the word algorithm, but it kind of dances around it in terms of appealing to the consumer.

And it landed literally the same day as this judgment. Well, they also issued- It's a market ... a new class of stock.

Mm-hmm. John, I don't know- Let me ask Jamie something here. Do you think that the average person is understanding this and trusting these platforms less because of it?

Or, is this algorithm in 230 conversation still something that they don't quite wrap their heads around, and so basically they're happily doom scrolling without thinking? Yeah. I absolutely think that there's a lack of public understanding, especially with some of these more nuanced laws.

And if these penalties come years after harm was done, we need mechanisms that can stop ongoing harm. And I think that's one of the things that the public may understand more off. Because when something happens, like a woman on TikTok being accused of something ridiculous, there's often no recourse for the users.

There are no mechanisms in place that can stop this ongoing harm. And I think that's something that the public is losing trust in these platforms to assist them when things like this happen. Well, you know what I think is awesome?

I think a jury of our peers- Yeah ... average people, figured this out and started understanding what the ruling was and how it should be applied. So there's hope.

But here's the thing- Yeah, I don't think that's ever the problem though, Mike, because I think- Mm-hmm ... that general sentiment is very much in favor of protecting the users and the people. I think the framing has been the problem and the political side of it too.

Like Alan, yeah, sure, let's get rid of Section 230. Better yet, let's understand what the role of the platform is. That's what just, politically speaking, seems to be totally absent, and that's why I'm encouraged.

Radioactive. Yeah. But that's why I'm encouraged by this particular case, because this is a relatively simple way to just go in and show where the liability lies.

Yeah. So we don't have to use the word algorithm. I love that.

But the thing is, Guy, this was a court of first jurisdiction here, first impression. Right? John- Mm-hmm ...

to your point about the numbers piling up, by the time this winds its way through the appeals court, and if it makes it to the Supreme Court, this isn't going to be $25 billion. Yeah. No, you're right.

And the $8 billion, it'll be a cold day in hell before they pay all that. But it does gain traction among the general public. It's hard to ignore or to overlook the number associated with this, and then the August ruling.

So it does send out this message that this company is doing some sort of damage to our personal data and to us. Although on the flip side, "Social Reckoning" came out and it absolutely bombed. It only raked in $8 million, so maybe people are past that.

Maybe they don't care unless they're directly affected. I hope not, but- I don't care to the point where I want to spend $18 and go to the movies and watch this, but bring it to my home on HBO- ... I'll be there.

I spent the money. I thought, look, anytime you could see something by Aaron Sorkin, it's worth the money. Yeah.

So ironically, it wasn't good. The Elizabeth Holmes documentary is getting all the buzz. We could talk about that- Oh, that's what's on Netflix ...

sometime soon. Yeah. Yeah.

And I guess we're waiting on a Sam Altman movie is next. Is that it? Yeah, that's coming.

There's a Musk documentary, which is four hours from Gibney. You know- All right. I think once the other two are out, we'll have an entire show that will be dedicated to a movie review.

So- I think we should do a documentary on Techstrong's news. All right. All right.

Hey, we're late though, Mike, we've got to hop to the next segment. We do. It is Black October out there.

That's the name that people are using. But there's a vulnerability that was discovered in PHP that was found using all these AI capabilities, and it affects, I don't know, millions of websites. It's kind of crazy.

It's being called PHP Shell, and it's just one of several now that are all coming to a head here in October. And so everybody's looking at their patching processes and discovering that they're all manual, and they're all one server at a time kind of things. And so the vulnerabilities are coming at machine speed, and the humans cannot keep up.

So Drew, is this going to get any better anytime soon, or is this the new state of affairs? Or is there some way to think about it differently? I would say there's nothing new about this.

A couple of things are interesting. So one, PHP as a community is fairly isolated, so you don't see a lot of crossover between say Java technologies and PHP technologies. So I think in other types of frameworks and other types of applications, a lot of these kinds of issues have been worked through.

Remember Log4j. PHP is just ripe for finding vulnerabilities in. I'm sure there'll be more.

All right. So- So, Alan, you and I were at a conference in Austin talking a lot about this whole issue, and it comes down to How many of these vulnerabilities are actually reachable and exploitable? And so, we've been talking about this vulnerability apocalypse that's supposed to be coming our way, but it's not clear to me that all these vulnerabilities are relevant, per se, to everybody.

So how are we supposed to sort this out? Well, yes, we were at that event. So here's the situation, though.

Before we had Mythos level scanning, we had Log2Shell, Log2j. We've had these kinds of internet-wide high impact vulnerabilities before. Dan Kaminsky's DNS findings back in the day could've broke the internet.

We're going to have more of them. This PHP one is a perfect example. The issue, though, is they're happening, Mike, as you say, at AI scale now.

It's a lot easier to find these mission critical widespread things, while at the same time, our remediation efforts have not kept pace. Right? And that was the gist of, it was a Qualys event we were at last week, and of course, they're all about ROC, Risk Operation Center, and about speed of remediation, meantime to remediation.

Right? And let's be clear, remediation is not just patching, because people are afraid to automate patching. They have been for as long as I'm in security.

It takes longer to test the patch than it does to apply the patch. But the fear is that by applying the patch, they'll break something that is more worse than the vulnerability they're fixing. And so you've got to find things that bridge the gap until you can patch.

Things like you said, Mike. Is it accessible? Is it exploitable?

Is there a way of containing that damage? Segmentation, containment, containing the blast radius, if you will. These are all the arrows in the quiver of remediation's Cupid.

But the issue is they're coming at such a pace, and something like this PHP one, so many sites affected. We can't afford the same old, same old. We need to put this into an AI scale framework.

Otherwise, we were getting overloaded before Mythos. We never fixed everything we had to fix, but it's really acute now. I want to chime in here, because I think there's something that a lot of folks kind of miss about this, and Alan, you kind of just shined a huge light on it.

Patching is not the only solution. It's, in fact, the worst solution. It's the hardest one.

There's so many things you can do to break an attack chain in your environment. If you're running a PHP web server just naked on the internet, this is a huge problem. But if you had any kind of reasonable security measures in place, this is actually fairly easy to address.

And so where I'm thinking about this is why are we so vulnerable in the first place? Why is the only solution patching because these other controls apparently are not widely deployed? And I think it has a lot to do with our regulators.

There's really no cybersecurity regulation for the US across the board, only within certain industries. And there's no incentive for companies to improve their security posture. It's an expensive prospect, so they don't do it.

And at the same time, our government is cutting support to CISA, the organization that's tasked with helping companies deal with these kinds of events. They've been cut by a third of their staff has gone. It's really, really deep cuts at a time when these threats are rising.

It doesn't make any sense. But alternatives to patching exist. Take a look at your environment.

See what you can do. I bet you there's an easier solution. And I think the term that people bandy about is virtual patching, but in itself doesn't mean I'm applying a patch.

It's to Drew's point, I'm implementing all these controls that mitigate the risk or isolate the threat. But why don't we have enough of those controls in place? It seems like we've been talking about this issue for as long as I can remember.

Guy, I'm going to kick this to you, but at the end of the day, people have not put these controls in place, so they're kind of, to use Drew's phrase, everything's out there hanging out on the internet bare naked. But we've been saying that for decades. Mm-hmm.

Gosh, I remember way back in the day, just trying to promote the idea of doing rough assessments of security vulnerability using simple calculations and assumptions. But it winds up being a nuanced conversation, just inherently, because we're talking about probabilities here, and nobody cares about the low probability until it hits them. So in a sense, isn't that the CISO, or it's not just CISO, isn't that the security operations and security professionals' just daily bread?

Hasn't it been for, like I said, decades of just being like, "Nobody listens to me. " Da, da, da, da, da. Risk assessment.

Yeah. So AI clearly, obviously, creates both solution and problem at the same time, and just accelerates the whole damn thing. And I think what Mythos is doing and what Anthropic and Mythos and the alliance whose name escapes me at the moment, Crystal Palace, whatever it is, it's welcome, it's helpful.

This is a great development in the sense of adding visibility. Hey, listen, PHP touches every web masters, of which there are also millions, touches their soul immediately. I like to say that at the end of the day, all of this AI and everything, it's all to benefit humans and what humans are doing day to day.

That includes the humans who want to cheat and steal on a massive scale, in an automated way and a reliable way. I think that the exposure of all these vulnerabilities and the ability of AI to help also solve and patch them at an accelerated scale, that all sounds really good to me. I'm just trying to figure out, and I really don't know, it seems like every plane of existence is turning over to AI to handle for us at a higher speed, including the security arms race.

I'll just put it that way. So let me take this to the next logical level, and I'm going to kick this to Alan. " And yet, this has been going on for decades now.

So at what point is it just like, look, you did not put the controls in place, you did not put the tools in place, and you were victimized, and you became attacked. So maybe we should start shaming people because you know what? We've been at this so long now that it's not new news, the fact that they're just ignoring fundamentals.

You know what? I'm never one to shame the victims, first of all. However, we've all known, I think those of us in the tech space involved in software development, involved in security, have known that most of our software is pretty crappy quality-wise in terms of security.

Security always takes a backseat to getting it out on time, then we fix it later. So we've known that. However, to say that someone who is using PHP to help build their website should do something saying, "You know what?

This PHP may have a backdoor or something, or some vulnerability we could find. " I don't know if that flies, because you would need it for every single thing. Because today it's PHP, it was Log before that, it was what before that.

The system's out of order. You're not out of order. The whole system's out of order, right?

Well, companies are not incentivized to create these controls. One, there's no regulatory pressure, right? Two, there's really no impact for most companies when they get hacked.

Their stock goes down a little bit for a while, and then it comes back up, and they pay out some cyber insurance. So it's like, where is the incentive for a business to actually do this? I mean- Insurance could be an incentive ...

a whole bunch of companies got affected by this. How many of them went out of business? You're suddenly reminding me, though, it's the second time you said regulation, and really, I'm pro-regulation in a lot of ways, but nonetheless, when you said it earlier, I was like, "Oh, regulation.

Why is it saying that? " I suddenly became a libertarian, which I'm not. But here's the thing.

I'm going to make a simple analogy here with phone service. When we were all using plain old telephone service back in the day, you always got a dial tone. Always.

It was like, five nines, six nines, whatever it was, right? But you had to go to a phone somewhere to make a call. When we got cell phones, the service is still much worse than it was way back then, but it is much more extensive.

And we can do way more things, and we accept there are fewer drop calls than there used to be, but we accept a certain number and blah, blah, blah. So on and so on. What kept the service so darn good and so extensive out to rural areas, all that other sort of stuff, was regulation.

That was the incentive. It was a single provider, and it was highly regulated. So I'm starting to come around, Drew, to I think you have a vision here that's worth paying attention to, which is that there really aren't market incentives.

So they have to be imposed. It's almost dissonant, right? Hmm.

I think, the other side of this thing is all these businesses are interconnected. So what happens is somebody gets attacked by something, and then the next thing you know, it's laterally moving. So at what point is the regulation akin to having, I don't know, regulations for cholera, right?

We don't want people spreading disease, and that's what this is roughly the digital equivalent of? Yes, no? No, look, we have great standards, right?

So, I think one of the articles was talking about NIST. All of the world's regulations are based on the US NIST standard that US companies are not required to follow, right? Only certain kinds, and you need to do that.

And it's absolutely insane. These aren't even expensive to do now. It's actually cheaper to make things secure.

So it's really just a lack of incentive, a lack of motivation to change things. It's expensive, and it's very hard from a security perspective to get businesses to say yes to things. It's a major problem in the industry.

It is. Alan, any hope, or is this where we're stuck forever? No.

You know what? Let me ask you a question. When was the last time you thought twice about updating an app on your phone?

Or you have it on auto, and it just gets updated. Yeah. I think it works a lot better on endpoints than servers.

Mm-hmm. Sometimes, but then you have the exposure problem. But this is my point.

There are lots of different layered controls that attack different parts of the vulnerabilities attack path. You can block it on the network, you can block it on your router, you can block it on the server, and there's a lot of different things that can block it, but- Drew, I think you've got to block it in the repo. I saw a recent announcement from Sonatype that now they're going to start testing stuff before you can put it into the registry, maybe in a plus or something.

Yeah, but any reasonable practitioner already does that, right? So you're talking about these really bad practices that are kind of driving maybe a lot of these incidents. And they're bad because no one requires them to be different.

No. They all want to- Fair enough. Mike, we've got to jump, though.

We're running late. We do, but I will just say that in some towns, they publish the names of the people who are patronizing services that they shouldn't be, rather than providing those, and it seems to have a positive effect. I'm just saying.

Public shaming. Yeah. What kind of service got Mike's name published?

So now we know what you are, Mike. It's just a question of the price. Okay, then.

Oh my gosh. In fact, I do believe there's even an owner of an NFL team that got their name in the paper for the very thing down here in Florida. Oh, who could that be?

Yeah. Someone in Ohio, maybe? Oh, that one.

So there's multiple owners who've done it. Yes, and Florida, too. Yes.

Yeah. So there's precedent, is all I'm suggesting, for something. All right.

All right. Let's shift the gear because, well, NVIDIA is definitely the king of the AI infrastructure stack, but there was two interesting developments around PyTorch, which are, one is, allows you to, I guess they're claiming, with a small change in a couple of lines of code, and suddenly a stack in CUDA can run somewhere else, or the PyTorch application can run somewhere else to be specific, and Google was pushing on something similar, and so let me go back to Drew here for a minute, but is this going to give us the freedom to move applications to different infrastructure as we see fit and put things back in control? And is it a significant threat to NVIDIA's dominance of the stack?

All great questions. So first off, I want to frame a little bit about just the high level what we're talking about, because this is a pretty in the weeds discussion, right? So PyTorch is a library that a lot of people use to write their AI algorithms.

Let's leave it like that. It is tuned to run on certain kinds of hardware, and you can run it on Google Cloud, on Google House hardware, or on NVIDIA, NVIDIA's data centers, or on your own, right, on your graphics card. And so you're not writing the little CUDA, very detailed parts of it.

You're using this higher-level framework that does what you want it to do. So this is not changing that equation, right? You're still writing at a higher level abstraction, but now you have the option to also run that on Google's TPUs.

And I had to look this up because there's a distinction here that I think is very easily missed. If you're running your AI workload on Google's Vertex, you're probably using NVIDIA chips, right? Google has this totally own ecosystem of AI chips that they've written, the Titan ones and the TPU architecture they've been working on for a long time.

This unlocks that capacity. So all of those TPUs sitting in Google's data centers are now available for people to run their inference on. So I think this will make a big difference in terms of the market capacity, which is really constrained right now.

And I think, given that this stuff is expensive, people will switch, right? So I think there will be demand for this normalized layer, so we can use the abstractions. The Google TPU is almost in its seventh generation now, if I remember right.

They've had this for a long time, and they've only just begun to expose it as instances. I mean, a year old or something, but significantly expose it across the world as instances for their customers to use. I sort of took Mike's question as, hey, you got a model in a harness and the service running over here on NVIDIA, and maybe now you can move it up because it's CUDA-compliant, and use the PyTorch.

Now you can move it over there onto Google. But I think there's going to be a real capacity constraint. Google is in this race along with everybody else, wants to use its TPUs, and it won't necessarily prioritize, but it has the same build-out problems everybody else has.

And at the end of the day, Mike, I just sort of laugh at the question to begin with because, again, I feel like we could go back 20, 25 years and you could just change the nouns and it's the same question. Everybody always wants to create their own software wherever and run it wherever they want. Whatever's cheapest, highest performance, whatever makes impact.

What they want to do now is just have a bunch of agents in a model router just go and say, "Hey, whatever the function is, use whatever models you want and rewrite the harness and put it wherever you want" and da, da, da, da, da. And I don't know. I don't think this makes us any closer than any other I think what's different is that people can't find enough GPU capacity, and the processors are hard to come by.

So people aren't going to look at this and go, "Oh, boy. " I think they're going to look at it and just go, "I need something to run my workload, and I can't get enough of these GPUs. So now I'm looking around, and there's a thing called the TPU.

Great. " So I'm thinking it's fundamental economics. Right.

I think that's exactly right. This is sort of like a capacity play. It's an anti-scarcity play.

Guy, you said Google's into their seventh generation of these or whatever. They've sold tens of millions of these chips. Maybe not this newest one, but over the course of the seven generations.

Google does not sell these. These are in their data centers. Well, they rent them.

Yeah. They're in use. Tens of millions of these chips are in use.

Broadcom- Are used mostly by Google is what I'm trying to say, Alan. Are they? They're not used by Google customers?

And exclusively up until maybe a year ago or something. It's a relatively recent development. So in order to use them as even an enterprise customer or even a high-level one that gets previews and all that sort of thing, you weren't even able to do that.

And then probably starting probably two years ago at this point, then you would just go into your interface and instead of it being an Intel or an AMD or an Nvidia, whatever instance, now you have a TPU instance available to you. Those reached general public availability comparatively recently. That's all I'm saying.

Jamie, you used to hang out a lot with the high-end data science folks and a lot of the folks doing high-performance computing. " I think the latter is more correct because some of these workloads are so complex, and this is kind of a software portability story, as much as it is a chip story. Because what if PyTorch becomes a better abstraction layer across all these different accelerators?

It's an interesting thing. And I think for Nvidia, it could weaken the lock-in at the framework layer. It could weaken this chokehold CUDA has on everything.

I don't know. Yes. See, I'm just thinking on a kind of more general level, broadly, thinking from the Wall Street point of view.

We've talked so much about Nvidia using software as their moat, and we think about CUDA, and I'm wondering perhaps this loosens the lock-in. Mm-hmm. That's the broader story maybe that resonates with the investors if this stuff catches on from Google and Amazon.

But it's still CUDA. It's still CUDA, right? So AMD has its own CUDA-compatible library with plenty of PyTorch in it called ROCm.

I take it as a little bit more for the engineer than the casual AI developer, whatever. Don't know if there's such a thing as a casual AI developer. But I don't know.

I don't mean to be utterly skeptical about this. It's just I feel like every time we've sat here and said, "Hey, something's open. " Right.

The cloud was supposed to do that, right? Cloud and containers were supposed to do that, allow mobility for applications. And the reality of it is that these things remain sticky on where they're developed and where they're hosted and used because the migration cost winds up being a problem.

It's not as mobile as it's- Let me throw this out at you. Gartner came out with a report, I think in the last week or two. 80% of the neo clouds, 80% of the neo clouds, within the next three to five years are going to have fundamental change in their business if they exist.

Mm. They won't be standalone. Mm.

What we're in right now in AI is a classic scarcity market, and you've got to hand it to Nvidia for playing this like a Stradivarius, right? Taking that scarcity of the GPU and making it a scarcity of the whole compute stack, and then financing it and all of the machinations that they've been through. But scarcity doesn't last forever.

Yes. Exactly. It's Jevons paradox.

The more it becomes indispensable, the more you use it, the more we're going to get alternatives like these chips, the more we're going to see other ways. This is the indispensability trap in action. Here, let me get the book up for you.

Hey, if you hurry now, you can get a second one for just shipping and handling. But I would just point out, we've been here before, right? It took us a longer, but Docker containers were created in part to get us out from underneath being locked into hardware.

I think developing community constantly does the same thing. They see these traps, and then they go out and innovate, and they come up with this abstraction layer, and PyTorch is now the latest one of those, Drew. Yes, sir.

Yeah, I think Alan's perfectly right. It's the indispensability, right? So what will happen is there's always going to be people, companies that want the maximum edge, right?

Like high-frequency trading firms, or I don't know, prediction markets or whatever, right? That little, tiny, incremental, marginal increase in performance actually makes money for them, right? But then there's everybody else who, the last generation is just fine.

It's okay if it takes my inference a few more seconds, right, than this really expensive, close-to-the-metal technology. And so that's when it becomes the commoditized facility that everyone just uses, and you have a cheaper version, and you have an expensive version. And I think we're kind of there, right?

This is sort of how the market has been maturing. Jamie's just back from Scotland, so I got one word. Freedom.

Aye. No, but I do think the near-term future is an age of the super harness, right? Where a harness that lets you use the right tool for the job.

Yeah. Yeah, that's what I was referring to earlier with the AI act. Yeah.

I don't need that. We don't need that high GPU for everything, nor do we need the latest frontier model for everything. That's right.

That sound you're hearing is the lock breaking. There you go. All right.

Hey, we're about out of time, though. But Mike, thanks for handling the hosting duties yourself here while I was out gallivanting, well, eating Tex-Mex. Hey, thank John because he plugged- Jon Swartz, I know you did a few things too ...

oh, yeah, the Tuesday crew is a very fine crew. Yep. So thank you both.

Guy, Jamie, Drew, thank you for your participation as always. Most of all, thank you for watching Techstrong Gang. Our numbers keep going up.

It's a good thing. tv, YouTube, Techstrong TV YouTube channel, or our OTP app, which runs on Android, iOS, Roku, Amazon, Apple TV. Wherever you've got a screen, we've got Techstrong for you.

We'll be back tomorrow for our Friday show. Unfortunately, I probably won't be on the Friday show, as I'm always pulled on Fridays into different things. But Mike, I'm sure you'll have a great crew and a great conversation.

And Jamie's expanding our audience as we speak. She's got a new fan. You see that?

I'm excited. There you go. Okay.

Until tomorrow, thanks for watching everyone. Have a great day.