AI Infrastructure Risk Hits GitHub, Security, and Trust

Hey everyone, happy Wednesday. We've got a really special Techstrong gang for you today. I'm joined here in our Boca Studios Live with my friend Stephen Foskett, of course, of Tech Field Day fame, but he's a regular gang member, but never here in the studio.

So we went two cameras and everything. This is going to be a lot of fun. But we've got a packed house.

We've got my friend Teri Robinson. Hello. Hello.

We've got Barbara Roos. Rose. Rose.

Rose. Rose. I always mess up, Barbara.

I apologize. I got you, Barbara. Oh, Barbara, you might be on mute.

I didn't hear you. Oh. All right.

We're going to have our engineers work on that, as it's live TV. But we'll get Barbara's audio working. But also joining us is Andi Mann from Boulder, Colorado.

Hey, team. What a Boulder accent you have, Andy. And then joining us from the West Coast, our man in the Valley, Jon Swartz, and as usual, holding down the dean's chair, Mike Vizard.

Mike, I missed the last two days of the gang, and I'm kind of having a hard time with withdrawals there. You're having withdrawal symptoms, is that it? Yeah, I didn't get a chance to talk about some great stuff.

But we've got great stuff to talk about today, don't we? We always have great stuff. That's the whole point.

Mm-hmm. Anyway, let's dive in, shall we? Go ahead.

We have an outage occurred in the GitHub service these days, and, well, we all see, a lot of organizations at least, including Andi Mann down there, are heavily dependent upon GitHub for their application development initiatives. And while there was a lot of screaming and ranting and raving all week long about this particular issue, because, well, it lasted for eight hours. John, you covered the story.

Bring everybody up to speed on the details. Okay. Well, yet another widespread outage globally for GitHub.

I think, and correct me if I'm wrong, I think there were eight incidents in July. This one took place Monday, and as you said, Mike, it lasted for hours. It was the latest in this just series of reliability features for a service struggling to keep pace with AI-assisted coding traffic, which is surging.

So just to give you a little couple of numbers, disruptions caused error rates to spike near 20%, the web interface and API graphic. I think archive and raw repository content downloads suffered 50% failure rates. Among the things impacted were GitHub actions, automated testing, webhooks, GitHub pages, AI pair programmer, Copilot was compromised, excuse me.

The minor outages extended to Microsoft Teams, and I guess in a sense, this underscores tools like GitHub Copilot are accelerating software development. They're also simultaneously being overwhelmed by overwhelming backend infrastructure, which Andy, I'm going to pass the baton to Andy, which he can attest to, and maybe from a first-person perspective, kind of tell us what the hell he went through on Monday and into Tuesday. Yeah, look, at Pico, we're heavily invested in GitHub, and we use all of those services.

And look, the thing which kills me, we all know that the cloud is other people's servers, right? We all realize that. But what kills me over and over again is the way that we do not treat dev test as prod.

I come from an ops background. You probably all know that if you've watched the show before. It's not like I make a secret of it.

And in ops, I always learned that dev and test is prod, for the people using it. For my engineers using GitHub, that's their production toolset, right? And we have all sorts of DRMs, disaster recovery and backup, and all sorts of recoveries for our prod systems, our applications, our customer-facing services.

But a lot of the time, we don't think about what happens when our backend, our internal systems don't work. And for something like GitHub to go down, and look, for my team being unable to work, that's a major impact. I don't have a huge number of people.

They all work really hard, and when they can't access their repositories, when they can't check in code, when they can't use the AI to help them build, then they're just dead in the water. And I think we actually deserve better from Microsoft here. As you said, John, eight outages just in July, and we're not getting any sort of understanding of real root causes here.

We've got eight separate incident reports here. And this seems like it might be a little bit more systemic than eight separate incident reports might indicate. So look, we all accept the cloud is other people's servers.

We all accept there will be outages sometimes. But these dev test systems are prod for engineers, developers, software creators, and the SREs that work with them, and so all of those people out without the right level of explanation, I'm pretty angry, actually. Can I just mention one thing as just a follow-up, and then I'll pass it over to Mike?

So Andy, during those eight incidents in July and including this one, have there been any satisfactory explanations for any of these outages, or what could've been the root cause, or what the fix may have entailed? No, not that I've seen. And that's the thing that's making me quite grumpy and make me not believe that the problem is actually fixed.

This is why we do incident reviews, right? This is why we try to get to proximate causes or if we can, to find a single root cause. And I guarantee, by the way, it was not an intern with a misconfiguration.

And so at the moment, we have not really had the level of explanation that I would like- But do we really need it? as a technology leader. Andy, let's just blame it on AI.

We blamed everything else on AI today. It cost me my job. It's making these people terrible.

It's letting China take over the world. Blame AI. That's the standard response.

You don't like what you read, it's the AI's fault. You know, I like blaming stupid people. All right.

I think you digressed. All right. Stephen, let me ask you something here.

Is this thing gotten to a point where maybe GitHub is simply not developed? And that's- Well- Yeah, it's interesting because, from my perspective, it looks a little bit like GitHub DDoS themselves by essentially sending too much AI traffic toward their own system. A lot of people that I'm talking to are talking about going to other platforms, GitLab, Bitbucket, open source alternatives.

The problem with that, from my perspective, is what makes you think that those are going to be any better and any more resilient than GitHub? And I'm not trying to defend GitHub by any means. I'm just like, I don't know that that's going to fix the problem.

I think the problem is essentially that we got too much AI traffic in here. So you're blaming AI? Yeah.

No, stupid people. Just stupid people. So you don't think, I guess SpaceX and the Cursor arm announced today that they were going to launch an alternative orchestration platform to GitHub, and I guess, do you know, it sounds like anybody's going to do that, or are we all locked in here and there's no alternative, no choice?

That's kind of suspicious, don't you think? Yeah, I was... In fact, makes them suspect number one with the knife in the living room.

Hello. Lead pipes. But no, guys, let's be realistic.

GitLab isn't GitHub. GitLab is not GitHub. GitLab's a, well, it's a DevSecOps platform.

Yes, there is Bitbucket. Yes, there are other alternatives in terms of a repo and system. But GitHub, I'm out of date, but the last time I checked, it had about 42 million accounts.

It's probably well north of that now. You're not getting 42 million people switching so quickly just over... As bad as this was, Andy, and I don't mean to minimize your angst and aggravation, but- But 42 million people aren't going to just walk away here.

Especially with RCS, this is hard to move. Yeah. This is truly a rip and replace.

And you can see some parallels in, not necessarily outages, but other movements away from major software vendors. And look, GitHub will suffer a little bit from this, but in the big scheme of things, it's going to be at the margins. Because you're absolutely right, Alan, it's far too big for everyone to walk away.

You could go to GitLab, you can start to self-host, you could do some work with Bitbucket, and I've used all of these in my team and beyond. They're not the same. You don't get the head-to-head swap-out.

Also, the pain of swapping repos is not nothing. You've got data gravity, you've got investment in what you've got in those systems. There will be a lot of people who, especially like I say, at the margins, who go, "You know what?

" But they will find that, yeah, is GitLab- Until wherever they go has an incident, and then they'll come back. But here's the thing, here's the lesson to take out of this, and this is just good security hygiene. Anytime you have an incident, you don't try to hide it and sweep it under the rug.

You want to come clean. You want to do a full-on forensics. You want to do a full-on postmortem.

You want to be transparent in saying what happened, how you've corrected it so it shouldn't happen again. And be upfront with your customers. And I think, Andy, I think that's where I'm sensing your frustration.

Yes, this happened, that was bad enough. But I'm not really sure this isn't going to happen again, because I don't know if they really understand what happened. I don't think they do.

So then, Andy, how do you protect yourself against this happening in the future if they're not protecting? What's the answer there? Well, Stephen, let me ask you that question as well and add to it, but we used to have a thing called failover, and- Redundancy ...

so can I have some local capabilities and a local server that kicks in maybe, so I can continue working, and then I'll just resync later? Is that feasible? Yes, no?

Redundant repository backup. No, they have GitHub Enterprise that you could run locally. Yeah, but would that really help?

I'm not sure. I feel like you could DDoS that, too. And chances are, I'm not a betting man, but I'm going to think Microsoft probably has more resources behind their GitHub installation than you and I might in our enterprise GitHub.

Oh, you've never seen my data center. Oh, okay. You want to show it to me?

I'll show you mine. I'll show you mine if you show me yours. You're rude, guys.

All right. But still, that leaves people like Andy. Seriously, what's the answer there?

What are you considering? Can you tell us? Look, there are no easy answers.

We've actually just recently stabilized on a single repo. Look, there's cost implications, too, right? For a business like mine, if we want to dual home our repositories, we're doubling up on our cost, and it's not realistic for us.

Could we run it on-prem? Well, we don't really have any on-prem infrastructure per se. Most of our business is cloud.

So it's a really good question, Terri. We're having internal meetings about this right now. What do we do about GitHub?

And there's no really good answers for us. For larger organizations, absolutely, you can tier your applications, you can tier your repo providers. You can deploy on-prem.

You can have some hybrid models where a cloud outage doesn't necessarily affect your on-prem deployment of, say, GitHub, or whatever it happens to be. There are alternatives, of course, GitLab, Bitbucket, Atlassian. But for me right now, honestly, there are no good answers.

I just want my service provider to stay up and running, be honest about when they aren't, and the difference between a good service provider and a great one is just that honesty. Everyone makes mistakes. Everyone has outages and problems and bugs.

But you know what? " Like you said, Alan, mea culpa. Here's what happened.

Here's what we're doing to fix it. This won't happen again. I don't think that's too much to ask.

No, it's not. Barbara, let me ask you this. Do business leaders care that Microsoft gave all their developers a day off?

It's funny that you say a day off because I've been thinking about this as we rely on these systems more and more, almost as coworkers or employees in a way, it's like this was a sick day, right? We all have a sick day now and then. More like a snow day.

Hey, how are you? Jak na się ki. Oh, goodness, Mike.

But I think we used to have a muscle that we developed for what we would do in the case of a sick day for an employee. You have a backup person. You have critical processes get handed off, and I don't think most companies have thought about the equivalent of that for their various cloud providers and AI systems.

And so I think we need to start bringing that mindset, and it needs to be recognized among executives as just part of the cost of doing business. And really, this is one of the recurring things that we keep coming back to in Techstrong, right, is this shift to the cloud and how we've outsourced so much of our control over our systems and over our business, and you have to account for that. You can't outsource it and then not plan for the implications of that choice.

Mm-hmm. And to that point, Microsoft and GitHub are not the only cloud service provider that is experiencing outages. It feels like it's becoming very common, for that matter.

So is this just the new fact of life, and this is the way things are going to be? Those services are probably more resilient than what I had on-premise, but at the end of the day, I thought we had some sense of resiliency. But I don't know, Andy, is that just something that we are crossing our fingers and toes for, but is not real?

I think fundamentally, you're right. There aren't a lot of backups to these services. You always have two ice cream stands on the beach, but you don't always want to buy ice cream from one of them.

And so it's absolutely a challenge across the board. And yes, we have given up control, and these cloud providers will never care about my service the way I care about my service. So you do see repatriation.

And certainly with my customer base, the large enterprises maintain their own on-prem infrastructure across the board, not just because things like mainframes are difficult to replace, but because there's a security blanket aspect to it. And you talk about how all clouds must go down. By the way, I would dispute that some of the large enterprise that I work with have lesser ability to stay up and running than Microsoft.

Big banks, insurance companies, large government organizations, these people have expert SREs and security professionals, and so on. They stay up and running a lot. I would posit they stay up and running more than AWS or Microsoft.

So it's not a case of just having the right people or not, that Microsoft's going to keep it running better than you can. I think we have to have these alternatives. And as an IT leader, I need to figure out what those alternatives could be.

Maybe I'll use Cloudflare to vibe code my own GitHub. You can roll your own. Well.

But Mike, we're over time. We need to hop here. All right.

Let's move on to the next topic, which is equally perplexing. So the folks at Stanford and ARP Institute are playing around with AI to create viruses, and their noble efforts have led to some potential cures for E. coli, and that's great, but in their pursuit of this work, they have also noted that there's not a lot of governance policies and frameworks in place for managing this stuff.

And if you happen to have tuned into Congress lately, you will notice that there are certain Republican congressmen that are yelling about the fact that, well, was that COVID virus manufactured or not? And we all still don't know, I don't think. But at the end of the day, we don't have a whole lot of policies and frameworks in place for any of this stuff.

So Stephen, as you look at this, is this two steps forward, one step back? What could go wrong here? A lot could go wrong here.

You ever seen a movie I've seen a movie, and a lot of them involve something bad that happens at the beginning, and then they spend the rest of the time trying to fix it. You know what I mean? That's a pretty good movie plot.

That's pretty much what I'm seeing here, is that as you point out, we've got this new capability, but we haven't really figured out how to deal with it. We haven't figured out how to govern it, how to figure out who gets access to this technology and who doesn't, who can use it, who can't. And also, this opens up the possibility that some of the LLM work that we've been doing might be able to be put to a secondary use to do something pretty nefarious, like generate a superbug that kills us all.

And so, given the impact of that, I think this is a really big challenge. I would say that my initial read on this story, when I first saw it come across, I was like, "No, no, this is just another case. " But that's not what this is.

" This is Johns Hopkins and Stanford. This is real scientists doing real work. Oh, no, there's no doubt it's legit.

This isn't make-believe stuff. I mean, was the timing manipulated for the congressional hearings? Who am I to say?

Yeah. I just wanted to drop that in there. I could see that that might be the case, and frankly, I think that that's probably the best thing that they could do.

The problem is that they're up against an entire industry built around this evil villain marketing that says everything is the worst-case scenario, and everything is going horribly, and everything is terrible, and you should definitely buy it. Yeah, but is this, again, an AI problem? Because look, CRISPR's been around for a while, and we've been able to manipulate DNA and genes and so forth.

And so we had the ability to customize viruses. And let me ask this question of Steven and the rest of the team. Is there a big difference between customizing the DNA to create a so-called virus versus manipulating the RNA to create an mRNA vaccine?

Because at the same day you see this out, we also saw there was a new mRNA vaccine for melanoma, a late test case that is wiping out melanoma coming back. Yeah, and this technology could definitely be used for good. We absolutely need new antibiotics, and this could be used to attack the things that are attacking us.

Absolutely. So this is not all bad news. No.

But it's all- But with great power comes great responsibility. Right. And that's really the issue here.

Interestingly, my rant on the previous thing about everyone hates AI, Dario Amodei from Anthropic says, "What do we need to get people to love AI? " Well, honestly, that's the funniest thing, is they've been saying for so long that this technology's going to cure cancer and give us new disease cures and blah, blah, blah, and then Google shuts down their project that's actually trying to do anything productive and practical on this. Well, it's difficult.

And honestly, it seems like they're not focused on curing cancer at all except in PR. Yeah. Well, there you go.

So let me ask Terry a question about this. There's a separate story over on Security Boulevard that John wrote noting that somebody hacked into the OpenAI LLM, the most advanced model, and they had to shut down work on that. What makes us think that a bunch of researchers at Stanford are going to be able to lock this down and secure this thing because history has shown that that's not going to likely be the case.

So is it just a matter of time before this stuff gets hacked? So who thinks they can lock it down, Mike? I mean, who's actually saying that?

I think that's part of the problem, talking about like- The guys in thought they could. Well, okay. So the- Just kidding.

I have no inside information. I guess we'll have to get on Truth Social to get the inside scoop on that. If you applied for the early fee.

That's right. Only $100,000 to apply. Yeah, 100,000 bucks, and I'll go over there and make the sacrifice.

Mm-hmm. So I think that's early on in this conversation, maybe Steven hit on this too, it's the governance, right? This is happening without a lot of governance around this, and I think it's always a big problem when it comes to technology and security anyway.

But in this particular case, the consequences... But with all due respect, Terry, you know what I'm reminded of when you bring this up? Molly the Sheep.

Do you remember Molly the Sheep? Dolly the Sheep. Dolly the Sheep.

Dolly the Sheep. Dolly. Hello, Molly.

Hello. Oh, boy. Nothing ring.

Yeah. But it was the same kind of thing, right? We were going to make sure we can't clone.

Let's not clone humans. We got to be careful with this cloning. And then every lab- Yeah, but- ...

in the world was doing cloning on the side. Well, right. So yeah.

So that's not very comforting when it comes to this. No. It's a little bit easier, I think, to make these synthetic viruses and maybe use them for harm than it was to clone Dolly the sheep.

I mean, you know? I'm just- That was pre-AI. It was definitely pre-AI.

So just imagine applying AI to it and what you could get. We're putting a lot of faith in maybe people having some restraint or doing the right thing, but that's not going to hold with the bad guys. I just think it'd be really cool with the good- Oh, sorry, Terry.

Yeah, I was just saying it's not going to hold with the good guys either. I don't trust a lot of people to hold some sort of line on this. I think the past is prologue here, and Mike nailed it with the show notes.

He referred to the Andromeda Strain. Remember that? Michael Crichton, 1971.

Was that you? No oversight. It's open source.

And I'm not blaming AI, but conceivably it could happen. Open source genomic models and AI platforms could be used to synthesize or enhance lethal pathogens. It could happen.

Right. Well, and look, under any government too, that would be pretty difficult to come up with the guardrails and the governance and all of that kind of stuff and the regulatory whatever. But under this one in particular, I think it's less likely that there's going to be any clinician to it.

All right. Also, I think there's a little bit of AI alarmism going on here. One of the things in the article that was called out that I think was treated a bit like a footnote, but I think should probably be a headline is there's existing pathogens that pose greater risk than these AI-designed scenarios that we're looking at here.

The potential already exists. If you have bad actors who want to use those for nefarious purposes, they don't need to create something with AI. There's already pathogens they could use.

Well, but- But it doesn't help AI's case when you have OpenAI for the first time intentionally slowing its rapid development pipeline with Astra. We're starting to hear more and more of these HuggingFace episode... It's starting to mount up, and maybe it's just because they become more cognizant of the security issues.

But I think when you start adding this all together, there is reason to doubt some of the downsides of AI. I'm not discounting its upsides, but there are these issues that- I was in the middle of an article on this this morning, and I got waylaid, but I'll probably have it up by this evening. Yes, you're right, John.

There are some negatives here, and they have been mounting. Because here's the thing, we're asking people to get on a train. Train pulls into the station, you get on a train.

There's the first class cars up in the front of the train, and they're full with the oligarchs living the good life, having champagne and celebrating all the great riches that AI's bringing to them. Is this Snowpiercer? Sort of.

Okay. And then you come onto the rest of the train, but it's not like Snowpiercer in that the train's fairly empty. Because the latest polls and everything else are showing that especially in Gen Z and younger people, they're revolting.

They don't think AI is such a great thing for them. Well, I mean, I've heard- And maybe they don't want to get on the train. I would add Pew Research poll- That train's leaving the station.

Yeah, the Pew Research poll just came out where people under 30 are like the rest of us. Not so interested in AI. Can we come back to the subject at hand?

Because I- Sure. This is a bad look for science, and we already see a lot of people out there are down on science, and there's a lot of negative comments against the scientific community. And if the scientific community is publishing a report saying, "We're messing around with AI and viruses, and we don't have any governance frameworks in place," if something goes wrong, you're just handing a lot of ammo to those people who are already going out of their way to basically- No, Mike, this is why I didn't go out.

This is the exact argument we're making, except we're using AI instead of science, but AI's part of science. The real question is, so what? Are you going to stop the scientists from doing this?

Are you going to just stop the scientists in Stanford from doing it? Because if we outlaw guns, only outlaws will have guns. You know what they could do?

Is they could make an AI-generated virus that kills off all the AI people. Exactly. Well, the guy with the virus is- Or they could go out of their way to detail what frameworks they're going to put in place to make sure that this stuff is as safe as possible.

Yeah, but Mike, is that going to work in South Korea, or North Korea, or Iran, or Israel, or France, or China, or Russia, or Ukraine? I cannot control the world, but here in the United States, we expect some responsible behavior, so act responsible. Okay, so we'll be responsible, and then the irresponsible people will do what irresponsible people do.

Okay, so wait. So what's the answer there? Do we just not do anything?

Do we say everybody's doing it, so we're going to do it like that? My mother always hated that argument. That's just a nonsense argument.

Just because everybody else is jumping off the cliff doesn't mean you should too, right? No, I understand that, but I think what you have to do is plan for those contingencies. I agree.

That would be part of the responsible behavior. I totally agree with that. But I think the issue is, I don't know, scientists, maybe they're too excited about what they're doing and they're not thinking through the politics of this thing, but- Well- I think that's where you're nailing the heart of this issue.

This is the nexus of politics and science. And at the moment, we have a body politic and a zeitgeist that is denigrating science, just as you said. But we also have a gerontocracy, at least in this country, running politics, where they're just not ready and prepared.

We have one senator who's probably been comatose for two months and still has their job. We have another representative who was literally in an aged care facility for six months. Right?

And in this country specifically, and I think this is replicated in other countries that I know of, certainly in the Anglosphere, the gerontocracy running the government has no idea that this even needs to be regulated. And then the dysfunction between right and left in this country means that even if there are good ideas for regulation, we're not going to see them happen because certainly this legislature can't actually pass legislation outside of its core self-interest. So look, I think you actually hit on the real problem here is, I think we do need regulation.

I think science is able to regulate itself to a point, but they're competitive, and they're interested, and they want to do more. So at some point we need external regulation. But in this environment, we just don't have the environment where we even have a hope of getting it.

So let me just say this, though. Congress may not be able to legislate, and science may not be able to police themselves, but here at Textron Gang, we can. And Mike, we are onto the next topic.

The next topic- Real smooth ... in my mind, the next topic is kind of a public services announcement here. And it comes down to, you've all heard or seen these deepfakes, or at least you know something of them, and Terry has an article up on Security Boulevard around this identifying 10 of the most frequently used deepfake voices, images, or whatever it is.

But inside that article is an interesting point about how people normally go to validate whether something's real or not, and are actually now contributing to the attack. Terry, explain. Yeah.

Okay. So yeah, a little more lighthearted, in comparison, unless you're being deepfaked or fooled by deepfakes. So I'm just going to say, Swifties, I'm sorry, this is not my thing, but your girl's number two in this particular thing.

So, the top 10 celebrities that are being used as deepfake fodder are female. In fact, a guy doesn't even enter the scene until number 19. So, chew on that.

Where's Dylan? It wasn't even... I thought it'd be Travis Kelce with Swift.

I wasn't surprised to see his name on there. But, anyway, yeah. So, this was all done by a group...

Oh, if you want to know who number one is, it's Pokémon. So not Pokémon- They're deepfaking Pokémon? No.

So her real name is Iman, but she, her stage name is- Oh. No, it's the Pokémon. No, not the Pokémon.

I was a little alarmed when I saw that. She actually edged out Taylor Swift. Really?

Yeah. Sooner or later, they're going to catch them all. Yeah, I guess so.

All right. As what I used to call myself, a Poké-mom, I appreciate that. We had fun with Pokémon when the kids were younger.

Yeah. No. But honestly, the whole deepfake thing, so Terry, you said it, let me emphasize it, the fact that the top 10 people on here are all female.

And it's the same thing, there was recently an article, I think it was last week or the week before, Steven. Some guy got arrested, took a picture of his stepdaughter when she was 11 and created 7,000 pornographic images of her using Grok. Right?

And he was arrested, and he's charged. I don't think he's been convicted, so maybe he's innocent, but- He gets it 7,000 counts? Please tell me he does ...

something like that. Yeah. But this deepfake thing, as it applies to women more than anything else, is truly disgusting.

It truly is. And it's just another- So let me ask Terry this question- Well, and they're harder to detect now, because the cues that you're, this is what you're alluding to, Mike, before, the cues that we used to use to be able to understand that this is a deepfake or other people did, I'd like to think that this panel maybe would recognize them. But all of that has sort of gone away with AI because the language is better, the images are better, the sound of the voices has improved tremendously.

And just to make it a little scarier or serious, think about when quantum comes along, what that might mean. I had one analyst say that all bets are off. Let me ask Barbara this question then.

Is it that all these deepfakes are women because guys are too stupid to realize that Taylor Swift is not inviting them to the wedding, so they're more likely to click on this thing, or what? Ever hopeful. The unfortunate reality is this is a reflection of demand.

It's that simple. Yeah. The list of the top 18 being women, that's where the demand lies.

I personally am out on the internet looking for the deepfakes of George Clooney, so I'm trying to- ... shift the demand the other direction. But yeah, I think it's a reflection of humanity, and I was thinking about this on the last topic as well, that AI fundamentally is a bit of a mirror and a bit of a reflection of what we already are.

So I see this in organizations that I work with who are adopting AI. If you have a functional and cohesive leadership culture, AI is a catalyst and a reflection of that. If you have a dysfunctional, broken leadership culture, AI is a catalyst and a reflection of that as well.

And now we're seeing this in the consumer space. It's a reflection of who we are, of who humanity is, and what we want. And AI is just rising up to meet that demand.

So- Whoa ... look inside ourselves. But don't blame the mirror.

Blame the person in the mirror. Yeah. That's right.

The man in the mirror, right? That's- I'm looking at the man in the mirror. Yeah.

I'm asking him to change his ways. Are you saying our leadership here is dysfunctional or anything, or? Well, no.

It's funny too, because when I was reading this as well, by the way, nice job, Terry. When I was reading this, I have to say that it brought to mind the ex-Twitter catastrophe And I personally am just so disappointed and ashamed and frustrated by what's happened to that website. And a lot of it has to do with what's tolerated now that wasn't tolerated then, and what's encouraged now.

And so you go in there, and I don't know about you guys, but as a, I don't know, a man who's had a Twitter account for a while, one of the first things I see is a lot of deepfake generated by Grok- Mm-hmm ... the official Twitter. Well, because they've purposely not clamped down on that.

And I'm not seeing much George Clooney either- No ... which is disappointing as well. But the point is, it's not just tolerated, it's encouraged by the platform.

And I think the same thing can be said, to Barbara's point, of all different spheres. If a government doesn't discourage things, then it's encouraging things. If a society- Yeah ...

doesn't discourage things, it's... And the same is true of social networks and so on. It is just really disappointing.

Let me jump on that. Yeah. But Mike, we've been talking about the E...

Mike and I have been having an ongoing private conversation around the EU AI, the new AI rules with the EU, and how does that apply to us as publishers, right? And we've got to make sure everything we publish is being viewed by a human, and we're making sure it's... Now, what is the gist of this EU policy?

Is it really whether Mike, Alan, or any of our writers are using AI to help assist our stories? No, that's not what they want. They want to come after these deepfakes.

They want deepfakes labeled fakes. Like in "Star Trek," the doctor had the H as a hologram on his forehead so that you know it's not real. It's not about how much did the AI edit your story versus how much did you write.

That's marginal crap. It's this stuff. It's this stuff, whether it's exploiting women or political gain or some other criminal activity.

It's this stuff that we need to be legislating about, that we need to have enforcement around. So tell me- Just to take a very, very cynical view, and I'll adjust my tinfoil hat appropriately at some point. Governments around the world hate the anonymity of the internet, okay?

I think that there is entirely the technology, the capability, and the learning, over not just AI, but 20, 30 years of pornography on the internet, to be able to do pattern recognition, image recognition, to be able to ban this stuff at source, to be able to not allow it to be published in the first place. Right. But that would infringe on free speech, and so governments are going to impose age limits and age verification.

We already see age verification happening all over the internet, and we all know that age verification is actually not age verification. It's de-anonymization. We could legislate this, and the technologists could prevent this.

We know they could. Is this really just a backdoor to making sure everyone identifies themselves on the internet? I don't know.

Maybe. If only there was a technology that could generate a fake video of somebody that could use to foil those sort of age verifications. Well, now you're talking.

Now you're thinking. So let me explain what my father-in-law regularly does, and I think I've talked about this in previous shows. But he takes all those spam calls, and he just sits there, and he chats away with all these people.

He's retired, and he knows damn well that they're all fake. But he's eating up their cost and sucking up their time because he's got all the time in the world, and this is the thing. So taking that logically to the next step, why not we could all create our own deepfakes that would engage with all these other fake deepfakes that are out there.

Because let me... Mike, this is why you're not a real security person. Because you know what those evil son of a b*****s are doing now?

They're listening. They're encouraging your father-in-law to talk so that they can clone his voice and then call your son or your wife or someone and fool them into doing something. This is why we can't have nice things on the internet.

Well- Right? fortunately, if I ever got a call from my father-in-law, since he lives downstairs, I would fall over because he almost never uses the phone. Well, granted.

But he could call the bank or something, and you know what I mean? This is the state of it. And again, I'm not here piling on AI.

I'm really not. I'm bullish on AI. But this is creating pressure points all up and down, whether we're talking about science and viruses, cybercrime, deepfakes, exploitation, all of these things, because society, we haven't caught up to the technology.

We never caught up to the social media technology correctly. Right. And so here's another thing, one of the points that a CEO that I talked to for this article said, too.

It's a matter of having people, the potential victims, look at this differently and training them differently, right? So you have to, as he said, stop treating a familiar voice or face as proof of anything. It doesn't mean anything.

It's not anything. Don't listen to it. Don't heed it.

Zero trust. Zero trust. That's what it is.

And so- Agreed ... but we can't get people to stop clicking on phishing emails, so. Yeah, no, this is the reality of it.

Right. We've got to catch up and catch up quickly. I'm not clear how that's all going to work, though, because at the end of the day, am I going to say, "All right.

Send me an email to let me know that you're going to call me so I know it was you, and you have to call at the exact moment that you said you're going to call. " Because, well, that's just a little cumbersome, don't you think? But you know what?

This makes all these post-quantum cryptography certificate holders joyfully happy because- Yeah ... that's the answer we have right now, especially when we're talking about communication electronically online, is do we need to go to some PGP or some sort of certificate type of validation, identification? Maybe.

Is that feasible? Can we do that with voice? We do it with everything else.

Well, it's feasible, but if you look at it this way, there's what, about four or five billion people on the internet? But there's how many machines that also need digital identities? There's how many agents that we're all using now that also need digital identity verification.

This is an immense... We all, Mike, John, Steven, me, we're all talking to companies that are working on agentic identity management solutions. This is the third era of identity management.

First, there was humans, then there were machines, and now there's agents. Mm-hmm. At each era, the addressable world explodes.

Mm-hmm. But it takes time. Some of those agents are fake, right?

Well, that's what we've got to ascertain, right? We've got to make sure. How do you tell?

How do you tell? I would like to think that I feel like we can hold responsible the people who are posting them, who are creating them. Some of this is known.

There are people propagating these images, and it's not like everyone on the internet is de-anonymized. There are people out there who are promoting these images. Surely, we can have some kind of legislation to protect the women who are, and mostly women, which, right?

As always been, we're persecuting women, and we're walking away from the problem going, "Oh, well, what can we do? Boys will be boys," right? I don't accept that, honestly.

Mm-hmm. And I think that there is some culpability within the tech community for individual programmers building software that will do this stuff. As a product manager, I'm not going to ask my team to build software that's capable of doing this.

Someone has asked for that. " This is reprehensible. I think we can't just throw our hands up in the air.

I think there's got to be some level of accountability for the harm that this creates. And ultimately- Well, and since it's a boys will be boys situation, maybe the simple solution is we need some sort of gating for all men before they can access the internet. There you go.

Maybe. We've shown we can't be trusted with our toys. I mean...

And do you guys really care if you get deepfaked? I mean, I don't know. Well, we're going to care when it's a phishing attack, that's for sure.

Yeah. It depends what they're deepfaking. But- If my digital wallet is empty, then I don't care.

No, but seriously, to Andy's point, there is a term for this, and I don't remember the term off the top of my head. But you can take anybody's head and put them on a naked body, and this happens. You know where it happens a lot, as you would expect?

In high school, colleges with young kids, and it's a problem. Again, even before AI, we had this problem, right? Yeah.

In a lot of high schools. I remember when my oldest was in high school, a boy on his baseball team sent around... It wasn't fake.

But it was pictures that the girlfriend sent him or something, and they got them. Yeah. No, that happened.

Yeah. That happened in my son's school in middle school. It was terrible.

The boy was suspended for the rest of the semester. Yep. Well, and I think that this gets to the point that Barbara was making earlier, that it's about the community deciding it's not going to tolerate this- That this is...

We're fed up ... and having real penalties to stop it from happening. And as long as we don't have a consensus that we're not okay with this, and as long as we don't have any kind of penalties, it's going to happen.

Yes. And honestly, I don't think I would ever do this normally, but I'm going to use the example of child pornography and CSAM as an example because there we have a general community agreement that this is bad, this is harmful, we will not tolerate, and we will punish it. And it really has stuffed that bad, terrible genie to some extent into the bottle.

Now, I'm not saying it's fixed, but I am saying that that's not something that we see- No ... quite as much as we could simply because we, as humanity, have decided no, and it's time for us to decide no to more of this stuff. Agreed.

Agreed. Hey, we're way over time, though, here. I apologize.

Guys, what a packed house today. But Stephen, first of all, thank you for coming in here to the studio and doing this with me here. I'm not actually here.

I'm actually a deepfake image. He's a deepfake AI. Yes, he is.

Yes. Well, we're not going to go there. But Barbara, Andy, Terry, a pleasure having you on as always.

Thank you very much. John, always good to see you, and I know you're here all the time, and as well as, of course, Mike. We will be back tomorrow with more Techstrong gang.

We're live every Monday to Friday at noon. tv, Techstrong TV YouTube channel, or our OTT channel if you like iOS or Android or Roku, Amazon Fire, and Apple TV or any other. If you like to watch videos on screens, you can get us there.

But we'll be back tomorrow with fresh topics and more great gang folk. But until then, this is Alan Shimel. We're out.