A perfect perimeter cannot replace testing security capabilities

Transcript

Transcribed by machine (Whisper) from the episode’s audio, so a word may be off here and there.

1. 48:45

   And that's been this very long process to figure out like, OK, what does it take to actually secure our critical infrastructure against like CCP, for example, like Chinese attacks? if we're building a super intelligence project. And it's this weird like kind of challenge because of the stove piping, no one has the full picture. And like, we don't think that we have it even now, but definitely don't know of anyone who's come like that, like this close to it.

2. 49:11

   The best people are the ones who, when they encounter another team and other ideas and start to engage with it, are like, instead of being like, oh, like you don't know what you're talking about, who just like actually lock on and go like, that's fucking interesting. Tell me more about that. Right. People that have control of their ego. Yes. 100%. With everything. With everything in life. The best of the best, like, got there by eliminating their ego as much as they could.

3. 49:39

   Always the way it is. Yeah. And it's also like the fact of, you know, the 30 layers of the stack or whatever it is, of all these security issues, means that no one can have the complete picture at any one time. And the stack is changing all the time. People are inventing new shit. People, things are falling in and out of. And so, you know, figuring out what is that team that can actually get you that complete picture is an exercise.

4. 50:04

   A, you can't really do, it's hard to do it from the government side because you got to engage with data center building companies. You got to engage with the AI labs and in particular with like insiders at the labs who will tell you things that, by the way, the lab leadership will tell you the opposite of in some cases. And so it's just this Gordian knot. It took us months to pin down every kind of dimension that we think we've pinned down at this point.

5. 50:29

   I'll give an example actually of that, like trying to do the handshake, right, between different sets of people. So we were talking to one person who's thinking hard about data center security, working with like Frontier Labs on this shit, very much like at the top of her game. but she's kind of from like the the academic space kind of berkeley like the avocado toast kind of side of the spectrum you know and um she's talking to us she'd reviewed our the the report we put out the investigation we put out and she's like you know i think i think you guys are are talking to the wrong people and we're like can you say more about that and she's like well i i don't think like you you know you talked tier one special forces i don't think they like know much about that. We're like, okay, that's not correct, but can you say why? And she's like,

6. 51:20

   I feel like those are just the people that like go and like bomb stuff. Blow shit up. Blow shit up. It's understandable too, because like a lot of people- It's totally understandable. A lot of people have the wrong sense of like what a tier one asset actually can do. Well, that's ego on her part, because she doesn't understand what they do. It's ego all the way down, right? But that's a dumb thing to say if you literally don't know what they do. And you say, don't they just blow stuff up where's my latte that's a weirdly good impression but she did ask about a latte she did but to her credit did she talk in upspeak you should fire everyone who talks in upspeak she didn't talk in upspeak but the moment they do that you should just tell them to leave there's no way you have an original I don't want to rip on that too much, though, because this is one really important factor here is all these groups have a part of the puzzle.

7. 52:17

   And they're all fucking amazing. They are like world class at their own little slice. And a big part of what we've had to do is like bring people together. And there are people who've helped us immeasurably do this. But like bring people together and and explain to them the value that each other has in a way that's like that that allows that bridge building to be made. And by the way, the tier one guys are the most like ego moderated of the people that we talk to.

8. 52:47

   There's a lot of like Silicon Valley hubris going around right now where people are like, listen, like get out of our way. We'll figure out how to do this like super secure data center infrastructure. We got this. Why? Because we're the guys building the AGI, motherfucker. Like, that's kind of the attitude. And it's like, cool, man. Like, that's like a doctor having an opinion about, like, how to repair your car.

9. 53:05

   I get that it's not the, like, elite kind of, like, you know, whatever. But someone has to help you build, like, a good friggin' fence. Like, I mean, it's not just that. Dunning-Kruger effect. Dunning, yeah. It's a mixed bag, too. Because, like, yes, a lot of hyperscalers like Google, Amazon, genuinely do have some of the best private sector security around data centers in the world, like, hands down.

10. 53:33

    The problem is there's levels above that. And the guys who, like, look at what they're doing and see what the holes are just go like, oh, yeah, like, I could get in there, no problem, and they can fucking do it. One thing my wife said to me on a couple of occasions, like you seem to like and this is towards the beginning of the project, like you seem to like change your mind a lot about what the right configuration is of how to do this.

11. 54:00

    And, yeah, it's because every other day you're having a conversation with somebody who's like, oh, yeah, like great job on on this thing. But like, I'm not going to do that. I'm going to do this other completely different thing. And that just fucks everything over. And so you have enough of those conversations. And at a certain point, your your plan, your your game plan on this can no longer look like we're going to build a perfect fortress.

12. 54:20

    It's got to look like we're going to account for our own uncertainty on the security side and the fact that we're never going to be able to patch everything like you have to. And that means you actually have to go on offense from the beginning because, like, the truth is, and this came up over and over again, there's no world where you're ever going to build the perfect, exquisite fortress around all your shit and hide behind your walls like this forever.

13. 54:48

    That just doesn't work because no matter how perfect your system is and how many angles you've covered, like, your adversary is super smart, is super dedicated. If you see the field to them, they're right up in your face, and they're reaching out and touching you, and they're trying to see, like, what your seams are, where they break. And that just means you have to reach out and touch them from the beginning.

14. 55:08

    Because until you've actually, like, reached out and used a capability and proved, like, we can take down that infrastructure, we can, like, disrupt that cyber operation, we can do this, we can do that, you don't know if that capability is real or not. Like, you might just be, like, lying to yourself and, like, I can do this thing whenever I want. but actually you're kind of more in academia mode than like startup because you're not making contact every day with the thing right you have to you have to touch the thing and there's like there's a related issue here which is um a kind of like willingness that came up over and over again like one of the kind of gurus of this space was like made the point a couple of them made the point that um you know you you can have the most exquisite capability in the world but if you if