Transcript
Note: This transcript has been edited for clarity.
Mathew Schwartz: Hi. I’m Mathew Schwartz, executive editor with Information Security Media Group. It’s my pleasure to sit down with Jeff Moss, the founder of Black Hat. Here we are, this is the 24th annual Black Hat Europe conference now in London.
Jeff Moss: So when Black Hat started, we were really sort of a crystal ball. You could look in it and you could see – back then, it was authentic code, it was credit cards, it was certain things that, you could see where the whole industry was moving.
Now, the industry is everything, right? It’s operational technology and IoT and smart cities and satellite, space, aerospace. It’s so pervasive now that any one of those fields could have a really interesting breakthrough or security moment. And you might miss it.
I remember when the physical security community discovered Black Hat. And then access control, and then it was home security systems. And it was telecom. Everybody bumps into Black Hat at some point, or into the security community, and they have a rude awakening. Fare card systems for subways or whatever. There’s a number of those that had problems.
But now it seems like it’s some industry is more mature – biotechnology, the FDA implantable medical devices. They’re getting better because they’ve endured a certain amount of scrutiny, and it’s a highly regulated area.
The next area I’m hoping that gets a bunch of focus: We had election systems that got an exception under the DMCA in the United States; there’s been some around right to repair, we’re hoping to reverse-engineer; and so I think there’s going to be some big battles around right to repair, right to own your code.
I think that kind of, not data sovereignty, but you need to have some rights over your digital, not identity, because it’s not purely just identity. But it’s sort of like in the newer social media landscape, after the collapse of X, there’s more of these distributed social media platforms. Mastodon being one of the most popular ones. But there’s other things in the distributed Fediverse and Cory Doctorow wrote an interesting piece where he says, basically, Blue Sky looks really interesting, and I know some of the people, and it’s vibrant and it’s great, but I’ll never go there. I’ve been tricked, fooled too many times; I’m only going to put my energy into platforms where I can move my identity to another platform if I don’t like how [it’s going]. And by doing that, it’s this –
Mathew Schwartz: Portability?
Jeff Moss: Yeah, it’s like portability, but what he called it [answer: Ulysses Pact].
Essentially what happens is, if, if I’m running a site, but my customers can easily move, I’m constrained in how much I can abuse my customers, because there’s like that network lock-in effect, right? And my VC might be demanding that I mine the data more, I run more ads, I maximize the revenue, but if they know if they do it too much, customers can just move, the VC might not pressure the business as much, and the business might be able to still do things that the customers find novel and interesting.
So in his article, he’s saying, even though Blue Sky is new and interesting, you’re still sort of locked in. Until you can move to other instances, no matter how noble they are today, five years from now, when you’re really locked in, they might have new owners, new things.
I’m fascinated by that concept. Because it goes back to the old bulletin board days. You could change bulletin boards. Is there something to this distributed nature or are market forces so great with the centralization and efficiency of Gmail or whatever, that nobody’s ever going run their own mail server again? Is there room in today’s highly efficient and centralized internet for distributed experiences?
Mathew Schwartz:: Even if it gets messy
Jeff Moss: Yeah, even if it gets messy, but is there sort of a grassroots approach? It’ll never be as competitive or as great as a Threads or whatever, because right now, there’s no monetization pathway. So if you’re a super influencer, you wouldn’t really go to Mastodon. You can’t make money there. If that’s your business model, it’s not going to work, but if you can get paid for clicks on Threads or X or whatever.
You won’t ever get those super celebrities looking for that kind of adrenaline-rush connection. But maybe it can be that third space. It can be another space, that’s complementary. It’s not going to ever replace. But also it can’t really be replaced because it has features that are orthogonal, like Facebook will never let you easily move to Facebook Two and Facebook Five? Like, not gonna happen. So I’ve been thinking about that a bit.
I’m trying to think, there was one other thing I wanted to bring up.
Oh, I don’t know if you if you’ve been reading or coming across it, but there’s this sort of meme that I’ve run across and read it in other places. People are talking about the sort of accelerationism, whether it’s the fall of Syria or whatever, and it’s kind of a quaint thing. They say: Oh, well, we’re already in World War III. World War III has already started, we just haven’t noticed it yet.
Historians sort of liken it back to is all the pre-World War II, pre-World War I conditions in Germany, that it just didn’t happen on a specific date. It was years of historians looking back saying: Well, really, you know, it was the Bavarian beer hall riot. It was this, it was that. So they’re arguing that we’re in that period of a World War III. We’re not in the heat of the battle, but we’re clearly entering a phase. And so I’ve been thinking about that a lot. What does that mean? What do you do differently? How do you behave differently? Do you have different expectations?
Mathew Schwartz: Could anyone tell at the time? Was there anybody who was accurately –
Jeff Moss: Right, predicting it, or was it a super minority, and since they were super minority, they couldn’t influence the outcome, because they were too, you know, inconsequential?
There’s this thought experiment I did about the U.S. election, and it was basically: there’s three clocks running:
- There’s the first clock, of uncertainty. You don’t know who’s going to be elected, and that’s all the way up, for years. We don’t know who’s running, then we know who’s running, who’s going to be elected.
- Then [there’s the second clock, where] you know who’s been elected, but they’re not in power yet.
- Then there’s the third clock. Now they’re in power, now they can get about their governing.
So the question is: Do you do anything differently during each one of these clocks? Because if you don’t do anything differently during these three periods, it’s as if they don’t matter. So why worry about it? You’re just stressing yourself out.
But if you’re like, well, in the first clock, I need to come up with a plan for if person A or person B wins. In the second clock, I need to diversify my portfolio or sell my car – or whatever goals or whatever your crazy thing is, right? But if you don’t have plans like that, because I have a lot of friends who are very anxious and stressed out about whatever it was. Is there going to be inflation? Should they get their mortgage renewed now before the rates go up? With a job insecurity, should I retrain? Because the new administration is probably going to crack down or have a trade war, and that’s going to raise the prices, and then I can’t compete.
When I laid this out, I’m like, well, are you going to do anything differently in any of these periods or not? In the end, it was just a lot of undirected, frenetic energy, but no real plan. And I’m wondering, is it sort of the same thing with this idea of like we’re in a World War III? It’s like, OK: do you do anything differently? It seems like all the social pressures are to do nothing differently. It’s fascinating.
Mathew Schwartz: That’s a great concept, especially as things feel like they’re getting out of control. A little bit of a mind over matter, perhaps, takeaway there in terms of: control what you can control; try not to sweat the other stuff.
Jeff Moss: Because I think it’s sort of self-care. You can get stressed out about so many things, and you only have so much time to be stressed out, and so you have to decide what you care about.
In your career, people who come charging into information security and they’re going to solve the world, and fix everything, and everything’s on fire, it’s like: Dude, things have been on fire for as long as I can remember, this industry will never not be on fire. So it’s really about the journey. You’ve got to pace yourself. You’ve got to pick your fights and pick your battles, and you have to be OK not winning. You have to be OK not solving everything. You have to be OK with half measures and half solutions, which suck, but if you have a black-and-white absolutist view, you’re going to burn out.
And I saw a trend in friends. They would enter security. They do it for five, six years. They get burned out. They go into development, like, I can write code, I can ship code, I can do my thing. Then after a while, they’re like: Yeah, but now I want to go fix a thing. And there’s this cycle between where they control everything in the code, to it’s all sort of chaos and battling insecurity, and back and forth, back and forth. That was the way people kind of modulated their mental health.
So you’re like, what phase are you in now? “I’m thinking of going to work for Amazon?” Ah, okay, I know what you’re doing next.
Mathew Schwartz: Thank you for bringing us up to date on where Black Hat stands these days.
Jeff Moss: Yeah, I wish I had more kind of specific, technical Black Hat talks I could dig into. But really, I’m having such a good time running around talking to people, popping into this talk, popping into that one, but I’ll just watch them online later and really try to use the time here for more of the social interactions and help orient me to what I should be caring about technically.
Mathew Schwartz: Curate your long term thinking a little bit, as you say, though, the social networking aspect, the community building aspect of this, well, I should never be under –
Jeff Moss: I had a friend whose whole careers had been kind of in security and networking, and I’ve been in security, but we’ve been at different levels, like when you’re organizing conferences and you’re just getting the researchers that are doing the novel work and finding the newest interesting bugs? That’s different than if your security is like: My product’s end of life, can I update it one more time?
They’re very different.
So I talked to him about problems, and he had to stop me a couple times. He’s like: I’m in security, but we’re in completely different universes, you know? I’m working at a “hyperscaler,” but all my networking gear is end of life a year ago, nothing’s been updated, right? I have to fight to get anything done. All my printers are vulnerable. I bet nobody wants to change them, because that’s how the invoices get printed or whatever it is. It’s like: and you’re sitting there worrying about AI taking over the world, right? They’re completely different universes. You live in one world, and I’m living in another.
So it’s really fascinating then to talk to your peers and find out, well, what do they find interesting, versus what’s practical? Because you can find yourself kind of disjointed. Sometimes, especially in research, there’s this quest to find the green field. How do you make a name for yourself in security? Well, you have to find something new, or you have to go two miles deep. The last guy went a mile deep, you’ve got to go two miles deep. That’s how you’re going to get noticed.
That leads to certain kinds of outcomes, like you don’t always fully develop fixes to the last problem, because you’re off to the races to find the next problem. That’s how you get rewarded.
Maybe in academia, it’s about publishing, maybe here it’s about releasing CVEs or bug reports or writing a great paper. So there’s a little bit of, you’re at the top of the apex. But the problem is that the vast majority, for solving harm to users, is at the bottom of the pyramid. But all the exciting stuff is at the top of the pyramid. And there’s a paradox there.
I don’t know if you saw, there was an insurance company talk, about where they can correlate what actually improves security outcomes for companies, for claims, and the number one thing that had the highest correlation was if your data was on the dark web. It didn’t matter what it was, it could be an email address that one of your employees used to sign up for something else. It had nothing to do with your company being compromised. But just the presence of your data on the dark web was highly predictive.
Then, second was if you patch within seven days, or whatever the measurement was – eight days or something. Well, that’s not very sexy. That doesn’t sound super exciting, right? But those are the two things that had the biggest outcomes on companies having security claims. So we have to be OK. We have to accept that there are these two worlds that we’re operating in.
Mathew Schwartz: So you can love the whiz bang research – I’m going to come for the great “we pwned this,” “we pwned that” talks, but never forget that the practicalities can often seem alarmingly mundane.
Jeff Moss: Right? And maybe that’s an outcome. And then you use that to say, like, hey, we really need to do the basics. And then maybe that frees up money to do the more exciting stuff. But you’re never really going to do the super advanced stuff if you can’t even do the basics. So, super fascinating.
Mathew Schwartz: Jeff. Thank you so much for your time and your insights. It’s much appreciated.
Jeff Moss: You’re welcome.
Mathew Schwartz: For ISMG. I’m Mathew Schwartz. Thank you for joining us.