Alex: Hello and welcome to a new edition of Open Internet Pod. in today's episode we're gonna talk about Black October and by Black October we mean the the collection of security vulnerabilities and hacks that have been happening. all over the place this month Richard here with me as always. could you explain to us a little bit what's what's really going on here? Richard: So, if you've been paying any attention to kind of the IT security, internet news, you would have heard something about this. basically there've been a whole slew of different vulnerabilities or issues that have come up in the security world, in the IT security world. I think probably the one that's got the most press is the PHP to sh to shell. because that got a lot of coverage when sort of Wikipedia shut down to f to update their software because of it. but it's actually one of about fifteen things that have happened this month and we were saying before the show. I mean I've been doing this for a long time in terms of IT security. It's been my job And I think any of the things that have come up this month, the significant ones would have been major news, possibly news of the year. in IT security prior to now. So what we're seeing is this unprecedented avalanche of AI related exposure to a bunch of things. Alex: Right, right. So just to get some perspective, what you're saying is that we we have this entire shopping list of big scandals and just one of them would have been event of the year in in quotes, and now we have to deal with all of them at once. I mean all of them that we know, right? 'Cause there are some people who are saying that this might be just the beginning. Richard: absolutely. So, just the the C V E list, which are considered the kind of big deal bugs in software that we use, a lot of them refer to parts of the infrastructure that will do things like host a website. So the actual web server software, whatever. Just that has hockey sticked like crazy, right? Where you used to have a couple of noteworthy CVEs at Corte. We've had a Alex: What's a C V E? Richard: Sorry, so CVE is, I bel we just talk about them all the time. I think they're critical vulnerabilities or exploits. so the idea is it's an actual report. There are different groups that kind of provide lists and certify them, etc. There are all sorts of processes in big companies when you get a CVE announcement to like keep it quiet, you know, coordinate with the different software providers to implement the fix. And then roll out the fixes and then announce all these fixes were for this big nasty way you could break into a server or something uninvited. So there's a whole infrastructure around dealing with this. And one of the things that happen that's happened this month is it's basically completely inundated, overloaded, because you know, whereas it used to be a kind of something that came along once in a while and you took it seriously, but you know, it wasn't a bat and down the hatches thing, suddenly there's one every three minutes or something and and Teams are just not, equipped to deal with that kind of throughput, if nothing else. Alex: a C V E is common vulnerabilities and exposures. so now we have an an idea of the scope of what what is happening and I think we've seen some some version of this even with the PlayStation situation where Sony got in a bit of a kafuffle with the with the Playstation fans which kinda Richard: Well this is Alex: like speed run the entire hacking scene on Playstation. Richard: one one man's meets, another man's poison to use an outdated phrase, right? Like Sony probably consider this, you know, a significant vulnerability that that needs addressing. A lot of users would think this is finally giving them the ability to get proper ownership rights of their software. But yes, i the the tech behind it and technically what's going on is not that different to here's a way to exploit a server and get into it. So It's a very much part of the same story. Alex: Right, the way I see it, the thing that has happened is that now hackers are able to speed run vulnerabilities, with the vulnerability patch cycle shrinking from maybe weeks to a few hours, right? Like Richard: Mm-hmm. Alex: the traditional patch management cycles they d they don't really apply anymore. Richard: Yeah, well there's and it's interesting the PHP to shell. versions of this were visible actually like in the early two thousands and got patched and and so forth. And then this specific thing has been known for a couple of years. It was kind of on a long to-do list. And the big thing there was it wasn't unknown. It was just considered too much of a faff. To actually exploit, right? So yeah, you could probably, you know, work your way through it, but i is anyone seriously going to do that? and you know, the big thing that changed there is, well, yes, now it's very conceivable that people could do it. and actually one security firm, one security researcher at a firm put Bitcoin on a server and said, you know, have at it folks, like try and use the exploit. And it took a while, but someone actually did do it. And they did it. It was a private person who did it. It wasn't, someone with the resources of a state behind them and, an office full of people working hard. It was someone who had time to spin up enough agents and LLM muscle to put everything in place in the right way to to cause this exploit to happen. So it wasn't a particularly simple exploit, but it was definitely there. and definitely needed remediation. And the patch for it was something like 13,000 lines of code, I've heard, which is also unheard of. so I think that's probably why it got left un untreated by the PHP core developers for so long was just that it was, you know, it was just so involved to fix it and keep all of the existing things. And this is this is an important fact with that one. PHP runs a lot of websites, it's a very old, venerable, system that was used to make dynamic web pages. So after, early internet web pages were just static. They were like a poster, they didn't move, didn't have inputs and outputs. PHP was one of the technologies that revolutionized that and let us have dynamic pages that you could do something like log in and they'd change and they'd show new content, etcetera. Been around for t thirty something years. And you know, it was originally why Facebook was r run and most importantly now WordPress. So the the prime way, your local plumber, your local newspaper, your school, all of those those institutions. The quick, simple, well-worn path to getting a website was to install and run PHP. Your IT team knew how to do it. You could rent a PHP instance very cheaply. There's you know, it was the kind of go to way to set up a website. So this was like literally seventy percent of the front facing content on the on the internet was exposed because of mostly WordPress and then also Media Wiki, which is the the software that runs Wikipedia and a whole lot of corporate and other private wikis, public wikis too, all run on MediaWiki. So between WordPress and Media Wiki, you're already looking at a significant portion of the internet. and that's why this was such a big deal. this this month and overshadowed a whole bunch of other stuff that was also stunningly, important. Alex: So as long as we keep ourselves to the 1% of the internet and not the then we should be okay. Alright, so let me get this straight. So so we have this this huge exploit in PHP 2 shell, right? The exploit was known, but people thought that nobody has the time or the energy to to use it. Now it turns out that for the use of LLMs, you can actually do that quite quite easily. So this dispatch had to be pushed out, right? But Richard: Mm-hmm. Alex: what I'm seeing here is that there's a new version of reality, right? And and I come back to the Sony part where the companies and and institution were used to having some buffering zone where where things were like a bit too hard for people to attempt. And that's no longer the case, you know, like attackers only need one unpatched vector while defenders might must secure everything, like Richard: Mm-hmm. Alex: AI tools can drastically lower the cost of finding and chaining exotic multi step exploits, right? So I'm just, reactively asking, is this the new normal? Richard: I th I think it is. and it's it's a very different, strange new world. So one of the strangest things that only started occurring to people, including me, once this happened was, you know, if anything about World War Two code breaking, when the British team at Blexley Park, you know, the famous the bomb Alan Turing's machine Alex: Enigma. Hmm. Yeah. Richard: Crack the Enigma machines, which were the coding machines used by the Germans, they suddenly had a problem, right? Like how we can't just give away that we know the code breaking system because, they'll just change machines and then we'll be back to where we were, but they'll also know, you know, we have a way in. So one of the strange things that was keeping all of us safe out there was the people who knew all sorts of exploits, how to get onto your iPhone or how to break in through PHP to shelf. For all we know, there was shelves full of these these at almost all of the big security agencies, probably some private firms, etc. But they weren't going to go and waste them on reading your email, right? They weren't going to go and waste them on like checking what you bought on Amazon. They could have, but it just wasn't worth it. They were going to save that for something like a stucksnet, right? They were going to save it for a serious let's infiltrate the nuclear infrastructure of another state kind of activity, or if the you know, one of these recent North Korean things, at least, you know, a hundred million dollars in Bitcoin, we're not gonna like waste our special heavily crafted, curated set of tools that will become useless once we've used them for something less than that. And so kind of we were under this weird security umbrella. of that. And so in a funny way, one of the things that these AI toolkits and tool changes done is weirdly democratized access to that set of tools. And so the kind of availability and how common it is to have you know access to these things has become, you know, has gone right down. And so that means we're now actually in this very different world where, in an analogy, nothing nothing concrete about this, but It's as if nuclear weapons were suddenly as easy to make as an oven or something. Right? It's sort of as if you could, you know, just change that world and then you have to deal with a very new world that you're in once once you're there. Alex: Right, so we're living in this new paradigm. obviously it's gonna take a bit of time before people adapt. But my question would be if there's anything that Black October proved is that our existing digital plumbing wasn't really built to deal with this, right? Like the the internet is a very bare bone situation. Richard: Yeah. Yeah. Alex: And now we we have these like rogue elements. it feels like Mission Impossible, you know, like I they're trying Richard: Ha ha ha. Alex: to close the the franchise, but this feels like something straight out of Mission Impossible. Richard: Yeah. it's super interesting because I think like you're saying, people used to, I think, up until very recently have this idea that these company security policies and security infrastructure are really great, And that they could be relied on and so forth. And I think one of the things that's come out in the podcast, I did a lot of prep for this, listening to different commentators from all over the kind of spectrum talking about this. And one of the big things that people who have been working on the corporate government side for a long time is like s have said is people need to realise the state of corporate and government IT security is terrible. It's really not great. and I think people maybe had in their pi heads like I remember as a kid I had this picture of watching a s a tram, a streetcar in Melbourne and it's you know it's like whatever it is, seventy tons of metal moving along a reasonably quietly. And I remember thinking having this picture in my head of all these experts, like people in suits, in a James Bond movie, a bunch of technicians in suits and stuff making this Alex: Hm. Richard: all happen and they're highly skilled and and then you're a growing up realizing like, this is a bunch of stuff that's basically ninety percent of it would fall over if not for someone called Stan in the workshop or Beryl in the office or whatever, right? And it's barely held together and it kind of works but it could break. There are lots of things could break it. and I think people have this picture of IT security teams in companies sitting around with like, you know, what's the minority report monitor scenarios, maybe one executive desk toy kind of monitoring stuff and it's just not like that. And What this is showing us is actually people could have walked in through a lot of these doors before, but it was an effort thing. Like who could be bothered? And now that the threshold is so low, y you can just go and see what's in there, right? You can just send a thousand agents out to walk through these holes and and find out what's out there. So That's one of the big things I think that will change for people and I think actually long term for the good is this losing this this kind of picture that well there is such a thing as secure online data storage or you know, secure systems in a in a way that people kind of naively have supposed, I think before. Alex: Right, right. So I I had a few questions here, but you you kinda jumped the gun there a little bit from my point of view. Yeah, it's okay. Richard: So I jumped around. Alex: so I'm thinking here regarding what you said, right? Like Black October kinda exposed how fragile centralized Richard: Hm. Alex: middleware really is, right? and I'm thinking because you know what they say, don't never never let a good crisis go to waste. There there's Richard: Ha ha. Alex: a version of this scenario where people see the error of their ways and they say, you know what, let's have a look at different architectures, let's have a look at s Richard: Mm-hmm. Alex: s s a better way of hosting data. let's look at how we see privacy, let's look at how we we treat databases, right? Because right now it feels like a database is literally like one of these like cost reward type of situation, right? Richard: Hm. Alex: Where you're no longer going like, that's you know, that's there's too much trouble to get to that. You're thinking like it cost me ten dollars to attack this specific point. Is there fifty dollars worth of information in there? Is there fifty dollars worth of loot? Then it makes sense to push that attack forward. So what I'm trying to get to here is do you think that that we will double down on on things that already exist and say now it's twice as hard to get in there and it's ten times more difficult to to to hack. Or are we gonna have a look at how we do things and say maybe let's make ourselves less exposed. Let's try to randomize the keys, spread all this information around a bit more decentralized so that the cost per attack even though it's low, there's very little to to get from attacking all these low value targets. Richard: I think the organism will not want to. there's a huge IT security industry out there. And there's a lot of people who've built around that, who whether they're legislators, regulators, administrators, you know, corporates, who have built careers around how things are done and their natural instinct will be to continue on the same path and to say, Well, we need to double down. Right. if if only because that's how they make their living, or they make their living, you know, administering all of that. So I think a couple of things will happen. I think one is we'll see an S shaped curve. We've seen this hockey stick up, right? And there is only so much software out there, and at the rate that we've seen exploits now, that'll curve off. There's another question about what will happen if, you know, everything out there is vibe coded, and what that'll mean, but I think maybe get back to that because it's slightly it's an interesting but but separate point. The one I want to make here is I think we will see a a tailoring off in that. and I will s I think we'll see a pushback from industries that will say actually we can make more money out of this because people will be more worried so we can sell more, AI defense systems using AI to defend ourselves against the AI, etcetera, and maybe try and yeah, like you said, double down on that existing kind of you know model and strategies. I think what we'll see is people who are paying attention and maybe some disruptors in industry, and that i that would include me saying no there there are better ways, right? there are definitely better ways to organize our our stuff so that we're not vulnerable. I think the most obvious one is something we've talked about a bunch of times here, which is what you're saying, if we all put our information in one place. So if someone collects all of our IDs for a reason, then there's a you know, whether it's to say a sell c cell company is, you know, has to collect all of the customers' identity documents, then all of a sudden that sell company is a massive target because they just have a lot of, you know, identities they can steal. if you don't give away that information, then there's nothing to steal if you do break in, at least on on that front. and so I would be pushing hard for us to think much more about working towards those kind of solutions and and that's definitely you know something that Sido pushes that I work on all the time and it's you one of the reasons we're talking about this today is there are better ways. Alex: What I hear in what you're saying and what comes to mind directly is that there used to be this capacity to offer comfort at no risk to security. You could have your phone store all your all your pictures, there was no risk of that getting hacked. you could have all your contacts in your phone, If someone called you pretty much could figure out who that person was and so on and so forth. There was some clarity to to how things work and you could have comfort and security at the same time. Right now it feels like we're we're back in this old school type of thing where you kinda have to walk around with your address book and if someone calls you, you have to check your address book and say like this phone number is not from my address book, right? maybe not pick it up because it's probably spam or something, right? So it's it's Richard: Mm-hmm. Alex: it's you're no longer curious to find out who called you your your default scam, right? So so there's a change in how people think around this. my my mother doesn't answer the phone if she doesn't have that person calling in her contact list, right? So Richard: Right. Alex: she already made this change. And it's I think I think it's maybe like a like a lagging effect. I think people are starting to understand this. And they're also maybe looking at like all the steps you have to go through to log into your la your account. Like for example, now if I wanna log into some email account, even if I was living v you know like a vigilante and didn't have two factor authentication, right now I kind of have to do that, right? 'Cause you can end up as collateral damage for something else. they maybe these hackers are going somewhere and you get s squashed against the window on their way there. It's not personal or anything, right? So Richard: Yep. Yep. Alex: you have these changes in in in in the way the way people interact with different services on the internet and different platforms where all of a sudden there is no more comfort in the way things were done because you have like three, four steps to log in. And then once you're logged in, maybe you're getting scammed or someone pretending to be your grandmother or something like that. So Richard: Yeah. Yeah. Alex: how do you see this this this change Richard: Yeah, no, it's it's super interesting. so yeah, I was taught as a kid to answer the phone with my name. Yeah. That's that's how you did. You answered by name. Hello, it was me. Yeah, so I I mean that that's how saw it, and I've definitely adapted. I don't do that anymore because I don't want to give anything away to to a spammer and and I'll also generally not answer the phone unless I know the number. unless I'm expecting a delivery or something and you can guess it's probably the delivery driver, but I'm not certainly not going to give my name before I work out what the call is about. So we've adjusted there. And I think that to me is the that to me is the hope here in this discussion that we're having. Because you're talking about there's the the the age old security and convenience comfort sort of dichotomy. And you're like what do we you know, what do we do if like security's getting actually harder and harder and harder. And the funny thing is I think that that's true, but that's because the security models are built the wrong way. Right? So it's it's true because what we've been doing is doubling down on a flawed methodology and so like the gate's a bit weak, so we put another fence in front of it, people got through that, so we put a couple of arches on the turrets, et cetera, et cetera. We haven't actually thought out a new fundamentally secure way. So what happens now is to get in, you have to answer six questions, get past the arch, just jump over the ditch. It's getting ridiculous. but and this analogy doesn't go anywhere for what I'm about to say. So let's just move on. if you're using things like private PKI, public key infrastructure for your logins, you can start again. And that can be handled in ways that are that are f seamless. Like, you know, when go on side of you get a public key private key pair. You can then just click on someone's avatar and you'll encrypt and secure your connection to them and you can start talking securely immediately. You don't need to jump over the fire pit. You can just click. Alex: W wh when you say a public private key pair, you mean an identity is being created for you on the spot, Richard: Right, Alex: right? Richard: right. So the kind of traditional thing and I think this is why we'll have that pushback I was talking about is the traditional thing is you have a login, right? So when you go to let's use your email example, an an email provider, they say, Okay, give me your details, I'll own them and I'll manage all the email for you, etcetera, etcetera, and you'll pay for that. Now if you're a progressive Quality provider like a proton or something, you'll charge a fee for that. and it'll be hopefully a fair fee, it'll be valuable to person. If you're not like that, you're going to have to extract your money out of the customer some other way by reading their email, by tracking them, by reselling the metadata. If you're doing that, then what you realize is you don't want to change to any other kind of encryption system, you like this password thing where people are so you will then buttress it. Alex: By password you mean account, right? Richard: Right, because it's tied to an account and it's tied to 2FA, et cetera, et cetera, that's on on my servers. If you look at it, it's actually expensive and difficult for me to run using that kind of tech as an email provider, but it's hung on. And why is it hung on? Because in the end, it's created a business model that companies like where They can provide pr perform the sleight of hand we all know these days, where you hand over your identity, you hand over your rights to your own stuff, they mine it and sell it, and you get a service at a reason you know, sort of for free or at a reasonable price because of that. well, until it gets insuredified. So that's why we've kind of persisted, and I think that's an example of why the industry will want to keep going with that model, because There's so much vested interest, there's so much built up momentum behind it that makes money that people aren't going to want to change. but there are fundamentally, better ways of doing things. And I think the kind of shift we've seen where people get used to just don't answer your phone with your name, don't answer your phone unless you know the person is on the other end of it, which has happened because phone calls have gotten pretty cheap, new phone numbers have gotten pretty cheap, and therefore you can, you know, profitably run a phone scam. you know, people are just going to adapt around this and say, I I assume that any information I give online is insecure. And in fact, I think you'll find the kids already do this, right? you go and ask a fourteen year old if they use their real name on online or if there's anywhere where they don't use their real name and they'll almost certainly tell you, look, I've got a whole bunch of accounts with s you know, pseudonyms and fake stuff and so forth because they've already understood at a base level that this is a this is not a good idea. And I think when they're presented what I hope is when they're presented with better ways of operating that they'll see and and understand that for the same reason that they said that they were Greg forty seven of Chiltenham, rather than I'm I'm a kid on the internet. Alex: right. So what I hear from what you're saying is that a lot of these internet businesses spend a lot of time figuring out how they wanna monetize their business, right? Like Facebook took a lot of time until they figured out how to make money with with their success. So what you're saying is that now that they found their success, and their success is based around harvesting user data and selling it for ads, right? It's the Google model, now it's the Facebook model. Amazon probably has a similar model as well. So they're not gonna change that. But do you think that we're gonna end up in a situation where they will keep pushing that? While at the same time, something like Cedo will be put to the side because it makes no sense financially for those type of people and organizations. But then the people that don't wanna be there, they'll start looking for alternatives and they'll say, you know, I don't wanna be part of that ecosystem because that's an ecosystem where they make all the money. I get the terms and condition change. if I click no, I lose Access to my entire account, they can change the terms of services. It's literally Darth Vader in in Star Wars. Like I've altered the terms, pray I don't alter them any further. Richard: Yes. Alex: While on the other side you have something like Sato where you can't really change the terms, and if anyone that builds a let's say a version of of social media and they change the terms, if you don't accept those terms, you can just leave and And everything that you created is attached to your specific identity that you have there. So they can't really impose any sort of exit tax. This feels like things are getting worse. Let's just keep everybody enclosed in the same situation so they cannot run away, right? And that's that's the digital ID, right? That's the central bank digital currency. It's that that's that whole play, right? We know things are gonna get very, very bad. Let's lock all the doors so that the the guys, the the people we are supposed to help don't run away and find better alternatives. Richard: Well that's that's in shidification, right? Whether it's in shidification for profit or in shidification for l for laziness or in shidification for, simplicity of exercising power, it's across the board. And I think the cool thing for me is that The same toolkit that keeps things open is actually incredibly capable of protecting you here. And I think it actually comes down to the fact that the vulnerabilities lie in the same in the same route. It's that centralization. It's it's taking things and putting them in a central pile. So the same way we've talked before about having, you know, centralized databases full of identities and things being a honeypot that will cause attention to attackers. the same is true with things like the routing system on the internet, which sounds crazy, but right like who who cares, right? Like it's the machines that tell you what what what's what. But DNS has been one of the things that's been that's come under attack this month, along with SSL, which is the secure sockets layer, that's the way you do HTTPS in your browser, right? And people are looking for exploits there because you can then Hop in the middle of conversations or you could redirect people's web traffic so you can trick them into you know thinking they're using the genuine article when in fact they're you're not their bank and they're now trying to log in, and when the login fails, they try again and then you know the details, right? So this this sort of attack is being engineered and it's being based on this centralization of the infrastructure. Right. And so where We'd looked at that from the CIDO perspective and said, this is a problem because it risks enclosure, it risks capture, it risks people being excluded, and we want things to be open, let anyone do what they want. It also has security implications, right? It also has this implication that not only can you exclude people, but you can also trick them. If you can do one, you can do the other, right? You can put them at risk. And so if you look at a PKI network like CITO, you don't have a system or a properly designed one, you don't need middle people to tell you where things are on the network. You can just connect directly to the people you need to connect to. This is a huge difference because once you know each other's public keys and you can find each other on the internet, you don't need anybody else to make your connection secure. You don't need to rely on anyone, you're just able to to do things in complete security. Now there are risks that people will break through the encryption there, but if that happens, we need new encryption. There's no safety there. But at least you don't have someone in the middle who you're forced to trust through a certificate authority or through something in your browser and and maybe you're at risk. Alex: What I hear here is that that we literally build the internet around this idea of centralizing information, right? if you look at the first search engine, so what were they doing? They were literally centralizing the information that was available because this was one of the problems of the early internet that everybody was running their own thing, but it was difficult to find things, right? You had to get tips from somebody, hey, check this website out, right? Because you couldn't find them. So You we kinda solved that problem, but long term we kinda created a new problem, which is that if you centralize search and then you attach accounts to using that search product, and then that product becomes very popular, all of a sudden you have these little entities that are sitting Richard: Right. Alex: on huge amounts of personal data and then they become a honeypot, like a a a very high value target Richard: Or just a privacy nightmare where data broking, right, is more valuable Alex: Both, both. They're both, right? Richard: than than selling anything. Alex: Right. so how do you let's say I'm listening to this podcast, I'm interested in what you're saying, but it still sounds like Greek to me. Like let's say I'm a I'm a I'm a brand new person, I have a choice between going and and creating a Gmail account or you know, using Sato for communication. How does the the login experience, the account creation experience differed between these two because I think that also kinda informs the architectural differences between the way Richard: Mm-hmm. Alex: Google tackles the issue and the way Sato tackles the issue. Richard: the the key difference is there done well a password system has a has the advantage that you can be helped with that. So if you lose your password, someone can come along and help you. Done poorly, a private key infrastructure has a problem that if you lose your key, you've just lost your access to the data. and the reason that difference exists is that a PKI network, you're on your own. Now that's that's got all of the good implications, right? You own your data, you are keeping it secure, you aren't relying on anybody else to look after it for you. the place where that can get difficult is then you ha you know, are responsible for your data and you have to make informed choices about things like the software you choose to pick to back it up, et cetera, that you understand how it works, that it's got a usable UI for you, et cetera, et cetera. So that's what we've what we've worked on at Sido is on that front, not the not the internals of how the network works, but on the software front, we've worked very hard on making it really, really simple for people to use. So that you just for instance come along to a website, you get an account for free. Your machine makes your account for you and you can just do whatever you want. You don't even need to be aware of it. It's super simple. As soon as you have anything you might value, wiz whether that's a connection in the network or a token of some value or a win on a leaderboard, the way we've built the software it tells you, okay, now you've got something of value, you might want to back up and secure that account. And we're hoping by doing that to to teach people that this can be done easily, it can be done very effectively. And when you do it correctly, then you're more secure than you were because you're not relying on a third party to secure anything for you that doing their job correctly, getting their updates done on time. You're encrypting things yourself. To that, it also is important that we use the bare minimum of, you know, third party tools, etc. You know, a an a a backed up SIDO wallet is a file that's encrypted. It's there's no special layer of packaging or anything around that that's possibly vulnerable. It's just encrypted data. And I think that's important as well. And that the reason that's different in between CIDO and a lot of products is simply that we have no interest. in getting between you and your data. So your software can do with it as it pleases. Whereas a Google or whatever, they'll s they'll want to enc you know encrypt it if you force them to, but they'll do that after they've read it. And so that data is still visible at some layer somewhere. Alex: Right, right. So so you know, if if I would flip this thing around, it would be something like you go to Google Docs and you don't have to log in, you just go straight into Google Docs, you write some documents, and then all of a sudden your document is there and and Google will say like, Hey, we saw that you wrote a document. Do you wanna save this account from which this randomly generated account from which you created your document, you know? Which if you think about it, is so much more user friendly than making you sign up for the account just to get to use Google Docs, right? but that's their business model. And it's a business model based on hoarding as much data as possible and being accurate about who that data belongs to, because I wanna sell this to advertisers and I want to know that, you know, this guy's is forty-one years old, he works in IT and he likes to buy cigars or something, right? And and that's the information that I need in order to Richard: Yeah. Alex: to monetize him as a customer, right? So this idea of more or less being able to you could in this system you could go to this version of Google and every time you go and create a new document, you can create it from you from a new identity. Right. So this way, let's say if you're a reporter, you could have complete privacy over what you write because nobody else would have access to it, right? So Richard: Yeah, absolutely. Alex: there there's a there's I think the easiest way to explain it is that it's a return of physicality, right? Because you wouldn't trust someone else with your wallet. It's like, hey guy, I have my wallet here, I have my my credit card in it, I have my driver's license in it, I have some cash in it. I'm gonna leave it with you because I don't wanna forget it somewhere. it's that kind of a thing. it's the same with the decan, like you you can't expect Richard: Well, it's it's a it's a great Alex: Especially Richard: it's such a that's such a great analogy too, 'cause what people have ended up doing is it's like, there's one bloke, who Phil, who's sitting on ten thousand wallets because everyone's been like, Well, he's reliable, he's safe. Exactly. Alex: Yeah. Here's the big strong guy. Yeah, give it to Phil, right? Richard: But now it's you know worth forming an army to go and take Phil out because he's got ten thousand wallets. Yeah. Alex: Exactly, no matter how strong he is, is not s as strong as ten thousand, small little Richard: Mm. Alex: AI agents who are like picking his pockets, checking his ears, looking behind his sleeves and everywhere to to find these wallets, right? Or find a way to get to the wallets. So Richard: Yep. Yep. Alex: if we would round this up, I think it's a great opportunity to look at what we want. the internet to be because Richard: Mm-hmm. Alex: I feel like this is also could be a splinter moment where we're like the old version of the internet we have a fork in the internet. You have the old version Richard: Yeah. Yeah. Alex: of the internet and the people that want to still use that. And then you have this new version of the internet that has so much more that is like coded on a constitutional layer, right? Richard: Yeah. Yeah. Alex: you should have privacy. You should have the capacity to create As many identities as you want in order to protect yourself from being spoofed, from being, cloned, and so on and so forth. Richard: I've always sort of held the line that things like laws to enforce truth in advertising hurt people because if you're gullible enough to get, taken for a ride by advertisers, then Thinking that you're being protected by those rules only makes you more vulnerable, right? and I think hopefully what we have is an inverse situation here where for a long time being a privacy advocate or talking about the problems with like data collection, et cetera, seemed a little bit wonkish. well, you know, like it's in a secure government server. People would say things like secure government server, right? it's it's safe there, etcetera. Why are you what are you really complaining about? And what I hope happens here is that people s start to see through that and say, No, no, this is a security and safety issue for me, right? And we can turn the tables on, you know, the things that get rolled out, protect the kids, you know, stop terror, therefore, you know, tell ev you know, tell the government everything you do, tell the regulator everything you're doing with this five cents, right? Because whatever reason. We point out no actually this kind of data collection puts people at risk because it creates ways to you know, it creates a honeypot that can be attacked. It creates a data store worthy of, you know, infiltration. so I hope that actually losing this idea that there's such a thing as a safe corporate server or a safe government server starts people pushing back at all layers, at at the kind of government and regulation layer. They actually push back against attempts to do these things and start asking questions like why? Why do we need to give up our, you know, passport or driver's license details to get a cell phone? Why? An internet account. Does this make any sense? so right from that level through to when you're picking software, when you're picking a provider, think this stuff through. What will I end up being putting on their devices, etc.? I mean, it used to be a lot simpler, like when you used cloud providers you've already started to, go down this path of handing over all your stuff. We used to keep stuff locally and it used to be a lot more secure. So I hope people start Alex: Exactly. Richard: thinking all the way through that and start looking for solutions to their communications needs, to their data needs, to all of those things that don't put them in front of these risks. And I hope that we end up with that change in culture we were talking about where people stop just answering their phone and giving away all their information where they actually start thinking, Do I need this login? particularly one thing I want to say, particularly multi reusing it like login with Google or login with Apple. That's the ultimate in risk taking behavior these days. And I hope that people start to get a good sense of of why they might want not want to do that. Alex: Yeah, logging with with Google or Meta or Apple is like going into vassalage out of your own will. You know, like Richard: Hm. Yeah. Alex: I wanna be a vassal, I wanna be someone that doesn't make any money and just works for the big company, So hopefully avoid that. And I think like the the the shortest version of thinking this is there's a physicality to the digital world that is available to you now. And if you think of it in those terms, right, using that old ad of you wouldn't download a car, would you? I would say you wouldn't leave your wallet with a third party just because everybody else does so, right? So think of it like there's a chance to to reintroduce some personal responsibility, but at the same time to not introduce it is also, you know, a lack of self responsibility. So Richard: Yeah. Yeah. Alex: yeah. Richard: No, absolutely. I think taking that that personal self-responsibility on genuinely and looking through and and and critically thinking about what people are offering you, what is the deal you're getting, and factoring into that for the theme of today's discussion, not just the cost benefit, the privacy implications, et cetera, but also the risk you're putting yourself in when you use a third-party service that puts your data online or unnecessarily takes and keeps data from from you. whether that's a you know a government service, a real life service or a purely online service, in all of those situations, thinking about this because it really is getting to the point where there is no such thing as online private data. things will need to be end to end encrypted and not online as such, or or they'll be public. Alex: Exactly. Well, thank you so much for all the great insights you provided, provide us in this episode, Richard, and thank you everyone for watching. Remember this is also available as a video on demand on YouTube every Sunday, twelve PM UTC. It's also available as a podcast in your favorite podcast app. So we'll catch you again next week. Thank you. Richard: Thanks everyone.