Shared tools can be open without exposing every detection rule

Transcript

Transcribed by machine (Whisper) from the episode’s audio, so a word may be off here and there.

1. 35:46

   So one of the things, you know, that folks get when they understand open source on the defense is lots of different people can look at it, can rattle it. Improvements are shared across. And so there's a set of things that, you know, traditionally, cybersecurity, et cetera, you know, the open source protocols for the fundamentals of the Internet, they get better. But one of the things that also is a tradeoff is the attackers can then also look at it.

2. 36:15

   Yeah. So say a little bit about the principles about this tradeoff between getting stronger defense by having a commons, but also how do you deal with the fact that the attackers can also see the commons and what that might mean for helping people navigate this? Yeah. Thanks, Scott. This is not a question that we have to take from scratch. It has been structuring the entire field of information security for over a decade. And so I think here we can take some inspiration, frankly, on how things work on the security side.

3. 36:45

   So if you are doing reverse engineering of malware, for instance, more often than not, you end up using open source tools to do the analysis. But because everybody uses the same tools, you can share the rule, right, amongst analysts. And saying we open source the infrastructure doesn't mean saying you have to share all of the rules for all of the investigative work that you're doing. But it does enable defenders to collaborate and then go faster together.

4. 37:16

   And so we see this in Osprey, for instance, right? Saying we have a rules engine that everybody can run for free in a way that's permissionless and you can adapt it to your infrastructure doesn't mean you have to publish all the rules for how you define and catch spam and define and catch coordinated harassment. But if you do find something that you think is a particularly gnarly activity that unfolds on your platform and you have good reason to think that it's also affecting another organization, and if they're also using Osprey, you can share that rule and then you fast forward the collective defense.

5. 37:49

   And so it's always that sort of thinking and muscle to develop between what needs to be in the commons to really lift up and enable all the defenders and frankly, widen the circle of what is protected online and across AI surfaces versus what is sort of like organizations own things to keep and share. And, you know, different organizations will have different preferences on that, too, which is totally fine.

6. 38:17

   Actually, I have two questions for you. One, coop, osprey, ROOST? What's the deal? What's the deal with birds?