Post-Quantum Crypto with Michael Howard

0:00Hey, it's Kelly Rowland. You may not know this, but I have Exema. So I get how it can steal your time. But why let Exema take over when you can talk to your doctor about Epglyce? Epglyce, lubricism app LBKZ, a 250-mg per 2-mg leador injection, is a prescription medicine used to treat adults and children 12 years of age and older, who weigh at least 88 pounds or 40 kg with moderate to severe Exema. Also called a topic dermatitis that is not well controlled with prescription therapies used on the skin, or topicals, or who cannot use topical therapies. Epglyce can be used with or without topical corticosteroids. Don't use if you are allergic to Epglyce. A allergic reaction can occur that can be severe. Eye problems can occur. Tell your doctor if you have newer, worsening eye problems. You should not receive a live vaccine when treated with Epglyce. Before starting Epglyce, tell your doctor if you have a parasitic infection. Paid partnership with Lili Respect your time. Ask your doctor about Epglyce and visit Epglyce.com or call 1-800-LiliRX or 1-800-545. 5-9-7-9. Psst!

1:00How'd you like to listen to DotNetRox with no ads? Easy! Become a patron. For just $5 a month, you get access to a private RSS feed where all the shows have no ads. $20 a month will get you that and a special DotNetRox patron mug. Sign up now at patreon.netrox.com Hey and welcome back to DotNetRox. I'm Carl Franklin and I'm Richard Gavill. Michael Howard's here with us will have him jump in if he wants to in the beginning and introduce him a little later after the first bits. You know what those are. Here we go. Here we go. 2020. It's episode 20 when we're almost done, right? Right. This ends in 20 after 2026. So we got like six more of these. And it's becoming less and less interesting because most people have lived through the

2:01last six years. It's so current. Yeah. It's kind of now. Right. Especially 2020 because of course, what can you talk about except COVID? Oh my God. COVID. All right. I'm done, Richard. What about space? Yeah. Things are playing. Well, the other thing I would talk about is that's when the UK officially leaves the EU. Like. Oh, there's greatest. There's more news. But COVID is the big one. George Floyd. That is the big one. Yeah. It's a big, big, big reaction to that that sparked off a lot of stuff. Joe Biden beat Donald Trump. Yes, there I said it because that's the truth. Worldwide economic collapse caused by COVID lockdowns. Yeah. It's just stall. It was just horrible. Donald Trump was impeached for the first time all in the first year. I was the end. A lot of wildfires in Australia and Western US. The terrible ones. Here's a story you probably don't know about. And now and today, it's really relevant. In September, the second Nagorno-Karabakh war.

3:03So this is between Azerbaijan and Armenia. This is an enclave that normally is controlled by Armenia, but the Azerbaijanis wanted it. And so the Azerbaijanis are the ones with the oil money. They're Muslim. The Armenians are predominantly Christian. The Azerbaijanis attack. And to be clear, this is a very complicated conflict. It's gone on the dirty for centuries. But it was a drone war. It was arguably the first drone war. The Arzabra-Jani's bought Turkish-Berakatar drones. They bought some of the surveillance equipment from the Israelis. And so they had continuous surveillance. They were using drones for attack. They destroyed missile sites and so forth. They destroyed the Armenians for fighting the old-style with Soviet equipment. Just got rolled over. You'd think the Russians would have taken a hint watching their stuff be torn up by drones in 2020. Instead they got a lot of drones. Well, they did eventually. But first they got hit pretty hard.

4:04Anyway, it was only six weeks. That doesn't change the fact that a lot of people died. It did result in the fall of the region and the change in the environment over there. But it's just a precursor conflict. We saw an example. Just of course it was COVID. There was all the things going on at that time in that year that nobody was paying attention to it. A couple of other notable deaths in 2020, Ruth Bader Ginsburg. What a blunder. Yeah, Kobe Bryant. Yeah, they helicopter accident. And good trouble himself, John Lewis. Right. Dad said we're right, Tykon. Yeah, it was just a bad, tough year. A bad year, tough year. Do you want to know what happened in space? It wasn't in time. But this is an important one. So in February, solar orbiter launches. You don't really know much about this one. This was a joint ESA NASA mission in that order. It's really much a European mission with NASA, instrumentations, and they provided the Atlas 5 as well, but it was built by Airbus. And its goal was to get a view of the poles of the sun.

5:06Normally you're launching your spacecraft because the Earth's in the plane of the ecliptic, your spacecraft are going to be as well. Trying to get to high inclinations is very, very difficult. They go all that high. They'll fly down into a looping orbit inside the orbit of Mercury and then use Venus to do the slingshots and repeatedly tip the spacecraft. So it is about 24 degrees off the planet of ecliptic. Takes a ton of energy to do that. They borrowed lots of energy from Venus, but it's a one ton spacecraft. So you can do that. Right. But it'll get us our first visual views of the poles of the sun. Cool mission. Yeah. That is cool. First crew dragon demo mission. So this was Bob Benniken and Doug Hurley go up to the space station and demonstrate that the commercial spacecraft can actually go to the space station properly. And that'll be followed up in November with a regular crew flight of four astronauts to crew the space station. So there you go after, this will be nine years since the Atlanta has landed and the only support for the station was VSO used.

6:09Now the Americans had a vehicle again in the former crew dragon. I got a question which Michael might know the answer to, but you said isa and NASA did this thing together in 2020, but Brexit was in 2020 was was Britain part of isa in 2020. Did they participate? No, that's not the case. Yeah, it could be wrong, but I didn't think so. Especially Germany France. Yeah. Okay. It's Airbus defensive space. All right. July the perseverance rover. So this was the test article for the original curiosity rover with a bunch of upgraded things, better wheels, better suspension, new instruments, the ingenuity helicopter, all of that stuff gets launched in July. July is the perfect time to launch to Mars July 2020. There's a there's a synchronicity to the orbits right there in a two three period. And so every, you know, roughly two years, you get a chance to do much flights. And so July there's actually three. There's the perseverance rover, which is huge. There's also China's very first mission to Mars, Tianwen one. And then the UAE, the United Airmen's launches their hope climate orbiter to Mars.

7:13So three launches in the same month. Wow. Did they all make it in October? The US made it. They all make it. Yeah, actually. Very cool. And I mean, I'll talk more about the Tianwen one when it lands next year, so in episode 2021, because that was China's first attempt to go to the Mars and it fully worked. Nobody's pulled that off before. Everybody loses a few trying to get to Mars. It's name it. Everybody does, but China didn't. But you know, the advantage of being, I don't know, fourth or fifth mover or something like that. In October, Osiris Rex, one of the asteroid missions, touches on asteroid Bennu and collects a sample there. In fact, it does a little too well because when it touches, Bennu is very much a rubble pile and all that gravel goes everywhere. And they actually have trouble closing up the sample container because there's too much stuff. They have to come up with such technical maneuvers as shaking a little off to try and get the thing closed up so they can put it in the capsule to return. Another asteroid mission at the end of the year in December, high of Usa 2, will actually

8:14successfully return its sample payload from the asteroid Riku, and that is the Hachak submission. A little recap on what SpaceX did in 2020. There was actually 25 launches from SpaceX, which at the time was an amazing number. Just remembering that SpaceX will do 150 this year. So obviously, the two crew dragons, the test run in March and then the real, the full payload in November, they'll also fly 14 star-linked missions, 833 satellites for a network of almost a 900 by the end of the year. Have you ever seen the Starlink satellites leaving the spaceship? Yeah. It's like pizza boxes going out. Now they've gotten bigger because of the V2 minis and so they only fly like 24 or 28 of them depending on the inclination, but at this time they're flying 60 a run. That's great. Wow. Just these huge numbers of satellites. And that's where they also, this is the year where they have their reflectivity problems. Oh, right. And so you can see them for an extended period of time until they learn how to orient them

9:15and paint them correctly so they're not so visible and don't bother people so much. Do you remember there was a bunch of astronomers that were complaining they were polluting the night sky with their telescopes? Yeah. But still in the issue, although let's say the digital processing can fix that, but making bright lights make it worse. So making sure it doesn't reflect sunlight helps. I've seen them though. I've seen the trail. Go across and it's pretty fascinating and a little bit, I don't know. You know, SpaceX does some things that if you weren't paying attention, you'd think we're being invaded by aliens. Well, or you know, or Dr. No is in full swing. Like the line between supervillain and tech-bellion errors getting very narrow. Most people don't know. Like, you know, the first time that I saw the booster rocket spinning, you know, when it, yeah, I thought I thought it was like a spaceship. And so did a million other people until I found, oh, that's just SpaceX. That's what they do. And what are those lights going? Hey, is that Santa Claus? No, that's just SpaceX. Yeah, I use, I use Stellarium and it'll show you all the SpaceX. Yeah, it's something that's waving around.

10:16I know. Must be my Facebook friends. Here are a average intelligence or ability to look things up. Only 10,000 plus of them by the end of this year. Just saying, you know, there'll be a bunch of other missions as well, including a couple of GPS satellites. So also start doing their starship flights, the hop tests, and the first, what they called belly flop test, where they fire it up to a few kilometers up and then let it fall on as belly suit they could actually land it. That was SN8 by the end of 2020. It does not go well, but they'll solve that and prove that this whole idea is even possible. All right. Shall we move on to computing? Yeah.

11:18My idea, we've definitely come into other techniques from there, but this paper is kind of the stimulus for what will be the insanity coming in the next couple of years. Yeah. A January is also in Microsoft switches over to Chromium as the rendering engine in the new edge browser. The pandemic's in full swing and marches when lockdowns really kick off and everybody goes home and everybody's got Zoom teams explodes for better or worse. But a little thing I paid attention to was the Terry Breton, who is the EU internal market commissioner, reached out to Netflix and YouTube and Amazon Prime and asked him to turn off all the 4K features. He was concerned about the amount of available bandwidth across Europe as everybody went home and used the internet differently. Does it actually a crisis? Nobody knows for sure or releases not talking about it. They start turning up the bandwidth again in May and Netflix's posts about this are interesting

12:20because they talk about network changes and increasing capacity and things like that. So maybe there really was a crisis because of the change in the internet consumption due to COVID, but a lot of details aren't revealed necessarily. But that to me was very interesting. April is when Uncle Satya says, two years worth of digital transformation in two months. Because everybody had a hard work lately. This is when I started doing true running as a week, just talking about topics around what was necessary for Siss admins during where everybody was working from home. My brother is a programmer at a local company. He's been there for years and years and they basically do online vehicle registrations. They were the first in the area to do it. And their customers are states, not individual sales places, dealerships. But anyway, they were renting an office building and an office park out here. I'm team billion square feet and during COVID people went to work at home and I just remember

13:24Jay coming to rehearsal once and said, well, I've resigned myself to the idea that I'm never going back to the office. And they basically moved out of the office. They've had lots of stopped renting it. And I think in general office space took a big dive. Oh, it goes out of that. 2020. You make about all the property that Microsoft gave up in Bellevue. Yeah. They kept their buildings in Redmond, but all that rent is based in Bellevue. What do I, and all of it went to Zoom. Yeah. Well, to teams, the first virtual build in May is also when they do the full release of Blazer WebAssembly. Yeah. Obviously, a bunch of other cool announcements around building that time span. Of course, Blazer, not the first WA programming language go laying at a WA support back in 2018. In June, and again, no, people remember much about this because it was mid pandemic. Microsoft is a big splash about open AI GPT3 being built on what they called the Azure Supercomputer, which was a bunch of different Azure days and it's harnessed together with

14:2510,000 GPUs, 285,000 CPU cores to build a get this 175 billion parameter model. Wow. I mean, big, big, big for the time. Not so much anymore, but at the time. I remember Brian McKay, who's one of my happy next guys, getting on Slack and telling us how awesome this GPT thing was, but it was difficult to set up at the time, but then I tried it and of course, like everybody else, it's kind of blown away. Later that year in September is when Microsoft actually licenses GPT3 from open AI, which I presume is how GitHub gets access to it and will make it have Copa out of the following year. A couple more stories. In November, Apple announces the M1 processor. Yes. And I mentioned this because I would argue is Tim Cook's most memorable move. He was always a hardware guy. This is a staunch, he's a hardware. He's a system on a chip, where the GPU and CPU, NPU, the IO and security buses and so forth are all literally in the same die.

15:27The memory is in the same package. So this is made by TSMC, 5 nanometer process, about 16 billion transistors total. That includes 8 CPU cores, 8 GPU cores, a 16 core neural engine, and up to 16 gigabytes of RAM right on the package. So you get both lower power consumption and higher performance. Little would we realize I have a MacBook Pro with an M1. Yeah, first gen. And it's good. Is that 16? Is that megabytes? Well, gigabytes. Gigs. Yeah. That's RAM, RAM, not cats. That's RAM, RAM. Okay. Yeah, they're not putting cash on the cashes there too. But also that RAM is shared with the GPU, right? So there's what we're doing right now with LLMs and the new agent models and so forth. The M1 was built for it, not knowing it was built for it. They were just trying to make the most efficient computer they could consume at least power. This is my apples move back to ARM, having come from the Motorola chipset, moved to Intel for a few years. Now they're making their own thing based on ARM. Two more, December, both in December.

16:28The solar wind supply chain attack. So this is Russian SVR. The pure brilliance of this is unbelievable. So in September of 2019, hackers successfully break into the solar wind development environment. And the insert code into the development chain. The way they do it is incredibly in cities. It's part of their build system that they replace code in the build without actually changing the visible source code. So developers don't think their code has changed at all. But what they're actually compiling is different code with this thing called the Sunburst Backdoor. They take some a few months of doing testing to get this to work by March. They do their, they have actually figured it out. And the Orion monitoring software, solar winds builds this infrastructure monitor software is now distributed to 18,000 customers with the Sunburst Backdoor in it. The Russians are successful enough. Then in June, they actually remove the whole build injection system. Like they're done and are happily operating. And now, the minute they don't actually use that backdoor much, maybe 100 customers are totally affected. But it's in December when one of those customers, a security company called FireI, realizes

17:34they've been exploited and traces it back to the Orion code base and basically pops the whole thing open. It's incredibly sophisticated supply chain attack and scares just not out of actually everybody. It's not the first one, but in a lot of ways is the one that made the most news. It could be made into a feature film, actually, if it was handled correctly. It's astonishing. Yeah. And if they had, if the Russians had decided to go after FireI, who knows when it would have been detected? Yeah. Just do you went after the guys who were in the security space and good enough at attacking breach properly? Hmm. Yeah. I was invited to a meeting to be briefed on the attack when we sort of knew what was going on. And yeah, they all be frank. And I was kind of gobsmacked, actually, by gobsmacked. Gobsmacked, isn't it? By the sophistication. It's so clever, holy man. I don't expect bad guys to be this smart, right? If they were smart, they'd be good guys. Like the idea that bad guys would come up with something this clever. But again, state actors like they're working for more than just a paycheck here. Yeah, we remember though, you know, Sherrod Dugrapo has told me many, many times.

18:38This is their day job, right? They come to work. They clock in. They do the work. They work every year. They go home to their families and they start against them all. They get promotions by figuring this stuff out. Exactly. It's just a joy. Yeah. As Dwayne LaFlaut would say, oh, this is awesome, guys. This is awesome. It's a stunner. All right. I'll finish out the year of Compute in 2020 with China's shoe-hanging, photonic quantum computer, which I think is a particularly relevant for today's conversation. This was a dedicated machine using photonic quantum entanglement, which is very, very clever, unique, very different from Sikamor with the Google's device from the previous year, which was the hanging chandelier and liquid helium. This doesn't need any of this, but it was built specifically for Gaussian boasts and sampling. Nobody knows what you're talking about, Roger. I'm OK with that. I'm OK with that. Michael, is one of them. I'm not enough to be dangerous. It's all about the software side of it. Yeah. And that's the whole thing is this is nowhere near a general purpose computer, even a super computer.

19:39This is a machine to demonstrate the quantum entanglement, contact one kind of problem, the Gaussian boasts and sample problem. Now that's an important problem, it was sort of a proof point. I think very much this is a, hey, we get to play too. And I think everybody reacted to it that way, because this 200 second run for something that in theory would have taken its computer, super computer, two billion years, not that anybody's going to test that. You just put China instantly on the map and really made it very clear. There's more than one way to quantum. And this is a wildly different way, not that we've heard much from them since, but in 2020, that was a really big deal. But does it run doom? It really doesn't. No, not a bit. No, it won't. I mean, and you know, super computers are limited in their own way too as well. But this was literally built for one thing. This is like, you know, Turing's device for cracking enigma. Good for one thing. Right, the idea of general purposes computing is a much different idea than what we're doing in this kind of class award anyway. 100%. I think people need to understand that, you know, is still people don't grapple at.

20:39These are, you know, there won't be an office for quantum, you know, it's not going to exist. Oh, man, I'm sorry. You sold me that subscription. Let's get them on the phone. Yeah. This is a, and as much as we can tell at this time, these will always be super computers for particular problem spaces. These are the very deterministic problem places too. But let's wrap up the history lesson and get on to our larger conversation about quantum. Well, but first we have to do, but first better know a framework. Roll the music. Awesome. Awesome. All right, so as people who listen to me on my various podcasts and stuff probably know, I have, I bought this big GPU machine a year or so ago, just because I anticipated being able to run local models and you've got it ahead of the hardware crisis too. So how smart are you? Yeah.

21:39I got it at Walmart.com for $6,000. He uses an Nvidia RTX 5090 with 32 gigs of VRAM. I, today that card's 15 grand if you can find one. I have, yeah, now it is. I have 96 gigs of system RAM and it's, you know, Blinky lights and quiet is anything, right? It's amazing. So on coated with AI, Jeff Fritz and I did a series on taking on a whole bunch of models that would run on Olamma and running them and then putting it through a test. Basically, a lot of them failed. So because of context, I think, then this is what I'm learning now, the context size, if it's too small, we'll just barf, you know, the LLM will just, and lose it or get into an infinite loop. And basically what I came down to is running llama.cpp and llama.cpp is like Olamma, but

22:45it's not. It's a different thing. It's open source. And I can run the new fairly, fairly, fairly new, Quen 3.827B model and llama.cpp will use V-RAM and system RAM at the same time and it will balance them out and figure out automatically how much of which to use. And let me tell you something. This is what I've been waiting for. It works so well that I don't feel the need to go back for what I do. You know, debugging, coding, all of that stuff, I don't need to go back to any frontier models anymore. Right. I haven't found, I've been using it for a couple of weeks. You just work at local now. I'm just working local. Yeah. The only thing that's costing me is electricity, but I got solar panels. There you go. Some pretty good, especially in the summer. You feel feeling good in that machine you bought, like to build that machine today. That's the big, big bucks. Yeah. I think, well, I thought it was big bucks back then, but now it was.

23:48Yeah. It was a lot of money for a PC back then. Yeah. Doesn't seem that way at this moment. Anyway, almost sort of a performance you're getting out of it, like token processing. That's great. It's as good as any frontier model that I've been using. I've been using GitHub Copilot CLI, mostly with CloudSonic. It's as good as that. You know, I don't find myself waiting around. It can do anything that I throw at it. It handles local stuff on the computer, stuff in an Azure and GitHub. It's just really good. This model compared to other models is good, but you run it in Lama CPP and it's like beautiful on this particular configuration I've found the sweet spot. So I wrote a document and that is the link that we'll put on the page. To get, read me basically running Quinn 3.827b with Lama CPP and GitHub Copilot CLI on Windows. And it tells you exactly how to install everything, all the stuff that you got to go, put everything

24:53where it needs to go, and download Quinn and run it and how you access it remotely. It's great. Have my dev machine, have my GPU machine, and it's a match made in heaven. There's a lot of people running those kinds of headless systems with Windows, mostly the Linux. Cool. It's good. And also, this model, Quinn 3.8 has vision support so I can pay screenshots in, you know, and it just works. It's wonderful. Cool. That's when I got Richard who's talking to us. I grabbed a comment of show 1963, which you did last year with one Michael Howard talking about 30 years of application security. This is back when you were still the red teamer. So I know your life is different now. And this comment comes from also a past guest, Arnold Axelrod, who said great show is always one comment regarding input validation because of course we talked about input validation. Toward the end of the show, Michael mentions that all inputs should be considered evil.

25:56It must be validated in order to be considered secure, right? Yeah, hard to argue with that. I'm not a security expert, but I have a different take on that. I don't think that the problem lies in the lack of input validation, but I think that input validation should be a business requirement. The example being zip codes, I don't necessarily know what a formal zip code is or will ever be consistent around the world. Answer is absolutely no. When you consider the idea that Ireland only got postal codes in 2015, like good luck. In my opinion, the problem lies with the use of parses and interpreters and not using escape sequences or other structures to separate arbitrary input from structure ones, like separating the inputs from the SQL statement itself appropriately. Both SQL JavaScript and command through the process start and C sharp are interpreters. And if you construct an input to them, that contains an arbitrary user input without sanitizing it with the correct escape sequences where is where unpredictability comes to play, which causes the risk. A URI also having structured format that is parsed by a browser and constructing a URI,

26:58let's say with an arbitrary query string that may be harmful, but you're probably using URI encoding on the inputs and that should be safe. This doesn't require you to limit the input in any way, just to format it correctly. There is where the focus should be if as far as I'm concerned, not just to invalidate all inputs. I'd love to hear your opinions on it. Are you on my opinion? Go for it. Yeah, Hitchie. Yeah, you know, it all got turned on its head right with LLM's and jail breaking. What is the input? What is it? What is valid? Can you even escape it? Even escape versions can still get through any kind of checks. So yeah, it's wrote about that recently in the... Our new injection attack starts with ignorable previous instructions. Exactly. So Matt was in a bit, actually, has a T-shirt with that on the back. He showed it to me at Bill's last time. I almost fell over laughing. It was so proud of it. Hey, Michael, check this out. No, it's completely turned on its head.

27:59That's how we've got all the other defenses that come into playing these guard rails and so on in LLM's because we need to... We don't know what the input is. LLM's need to get a sense of humor, right? A sense of sarcasm, a sense of irony and they got to get sensitive to that just like we humans do. I feel. I don't know. Yeah, we really want to pass every input through an LLM to say is it's a potential attack. Good luck with that. No, but of course not. But I mean, if you're dealing with an LLM and you're at the keyboard and talking to it, right? And you give it some ridiculous prompt, that's clearly satirical or something. It should laugh back at you. Well, that happens to me once. It's a good one. Yeah. Do that happen to me once. Oh, seriously. Yeah. I was working on the podcast website or something and asked it to do a quick security review of the code. And it found something. I was just running Visual Studio, I think. And it found something and it said, here is an outdated HTTP header that been deprecated.

29:03I didn't know. I suppose it was a security header that had been deprecated. And it said, by the way, this HTTP underscore blah, blah, blah has been deprecated for security reasons. And it's really ironic that you as the author of running secure code didn't find this. Oh, that's great. Yeah. That's what I'm talking about. Yeah. I don't know what the backend model was because of course Visual Studio, you can jump around, but I don't know. But yeah, it was quite a quite happy to yell at me and laugh at me. That's pretty good. When the tool says the word, it is trying to detect irony, that's just ironic actually. Right? Yeah. It's very recursive. Arnon, thank you so much for your comment and a copy of Musicobiles on its way to you. And if you had copy of Musicobiles, write a comment on the website at dot there rocks.com or on the Facebook's that public show ever show there. And if you've got my data reading the show, send you a copy of Musicobiles. If you'd just rather buy Musicobiles, go to Musicobiles.net. You get the tracks in MP3, Wave, and Flak formats. But before we introduce Michael, let's take a little break for these very important messages.

30:06And we're back. Dot net rocks. I'm Carl Franklin. That's Richard Campbell. Hey. Yeah. Let me introduce him formally. Your bio has changed a little bit. Michael Howard's been at Microsoft since 1992. Wow. Always in some form of security, IIS, SDL, founder of SDL. Well, it's one of the guys that worked on the very, very earliest versions. It was like two or three of us, yeah, back in the day. Awesome. That was the security lifecycle. Security development lifecycle, yeah. Yeah. Back in the earliest, like, 2004. So you worked in Azure Data on the red team. Last time we talked in now, you're in Post Quantum Crypto. Woohoo. Yeah, baby. Man, I'm happy to be here. It's a lot of fun. I mean, how can you post quantum if we haven't had quantum? Yeah. Because the real attacks start post quantum, you know, that's the reason why. Yeah, you're right. Yeah. I got it. Yeah. You need to be ready. Yeah.

31:07But we can discuss that later. But yeah, what does it mean post quantum crypto? Well, so you know, you think of things in three ways. This is where we think about it at Microsoft. Then around the shore, most of the industry does. Data and transit, data at rest, and then cryptographic trust. So data on the wire, you know, stuff flying across the internet is probably protected by TLS today, more than likely, perhaps SSH. But certainly TLS, data at rest is encrypted most of the time, or should be. And those encryption keys are wrapped with other keys, key wrapping keys. And then you got cryptographic trust, which is signatures, certificates, all that sort of good stuff. The real threat is dead on the wire is being, you know, being ployed as it flies across the wire. Yeah. And then when a quantum computer comes out in the future, that stuff can be broken. And the break, the breaking aspect is essentially just breaking the RSA or the elliptic curve of wrapping that goes on and pops out pops the AES key that's used for the bulk encryption

32:11and they just decrypt everything. And then the case of data at rest is the key wrapping keys, right? They can be they can be broken because they usually, for example, RSA, which can be broken with an algorithm called Shores algorithm, SH, O, R. And it basically finds periodicity in the way those algorithms work, that's what takes advantage of your. So are logs at risk for being pilfered by crypto, you know, post-ponsum crypto? I mean, if they contain sensitive data, which you shouldn't be logging sensitive data, right? No, no, no, but even if it wasn't containing sensitive data, is that something because it can go through so much data so fast that it could, I mean, if I had to prioritize stuff, I would focus on the actual data itself. Yeah, okay. So data in transit and then real data in your databases. Correct. Yeah. And they can be, you know, snuffled today and then once a quantum computer is made available. And that's where a lot of you say snuffled, hostile and snuffled, poloined, snuffled. That's the good British word. Snuffled. Yeah. That is actually a real word.

33:12I don't even know. It's a real word. It is. I don't know, but I never heard it before. It is now. I don't know. Things you learn on Don Errung's. Alright. That's all good. Yeah. So the risk is the asymmetric keys that are used to wrap. Right. And these that do the, they depend on the prime numbers. In the case of RSA. Yeah. But that's not the attack. The attack is the period. There's a, there's a period. Decidity. You actually look at the way shores works. Not that I say, not that you should. It basically does a, a quantum fast Fourier analysis. Yeah. After, shores is actually hybrid. It's actually quantum and sort of classic computing. Right. The hard work is done by shores and then some of the less easy, less difficult work is done classically because it's just easier. And so that the real issue is that those asymmetric keys, RSA, elliptic curve, Diffie Harmon, they all exhibit some periodicity that can be detected by, by shores. And that gives you a whole bunch of possibilities that then classical computing can then just sort of sift through and find out which ones are the actual keys.

34:14Right. So narrow is the scope of the testing needed. Correct. So you're pointing, yeah. Until you're pointing before rather than, you know, squallions of ages of the universe, it could be ours or, you know, days. Right. It's, it's a real thing. And, you know, developers have a big part to play in this. It's not just, you know, flips on switch and everything's golden. There's a lot more to it that, you know, developers need to understand as well. Mm-hmm. So everything I've barely hung on understanding about quantum is that we're all screwed, right? And because of the way that TLS works and, you know, SSL and all that stuff, it dramatically has to change, doesn't it? If we're going to be not less susceptible to quantum interference, but you're, I think what you're saying is that there are ways that we can do that now.

35:14And that's what, you know, post quantum crypto is all about is trying to use cryptographic methods now that will survive the quantum onslaught. Is that what you're basically up against? Yeah, one of the beauties of TLS, whether I can't believe you said SSL, like wash your mouth out. It's been a, you know, some of us were around. It was I. It was I. And so they don't use those words TLS. I don't know. I know. I'll just pretend you didn't say that. Yes. So TLS, one of the beauties of TLS is that it's very agile, right? You can change the way it works. The site, the, the ciphers that are used, the cryptographic primitives that are used. And you're talking about TLS 1.3. Right. Correct. So TLS, why would you be using it? Yeah. So actually, it's a really important point. So TLS 1.2 and prior. So TLS 1.0, 1.1, and deprecated anyway. So don't use them. TLS 1.2 does it cipher sweet and its key establishments and authentication. All is one string called the cipher sweet.

36:17It looks like someone sneezed on the screen, basically. It's a list of all the algorithms that are used for all of those things. TLS 1.3 is different. It broke apart things like the key establishments from the bulk encryption and the bulk tamper detection. They're completely broken apart. Yeah. So you can negotiate the two separately. That's the big difference in TLS 1.3. So the key establishment is a thing called a group. And the reason why it's called a group is because mathematicians got a hand, a hand hang on this and they said, you know, these things are mathematical groups. So we'll call them groups, terrible name. But for the key establishment, that's where you set the algorithm and or algorithm in some cases. And then after that, separately is how you do bulk protection of the data on the wires. So TLS 1.3 broke those two apart. So it is completely not compatible with TLS 1.2. And TLS 1.2 will never be post quantum. I mean, it's just software. I mean, essentially, I suppose you could make it post quantum.

37:17Right. Yeah, but why would you? But the interoperability story would be horrendous like no one would do it. And it also seems unnecessary too, right? Because I set the TLS 1.3 with a drop down in Azure. Right. But the thing is, so here's the issue. And this is one thing that we're having to work on for products like Front Door, for example, is you will be able to control the group. Not just the bulk cryptography that's used. OK. And the group is where the post quantum part comes in. For the most part, symmetric stuff, AS256, Shr384 and so on, which are the baselines are fine. There's another algorithm that called Grovers, which is an attacking and symmetric algorithms. And it essentially cuts the number of bits in the key in half. So if you have a AS256 in a quantum world, that's the same as AS128, which is fine. So you must use AS256 and Shr384 as the minimum as well. They're kind of OK. They're fine. The problem is the asymmetric stuff. The elliptic curve, RSA, Diffie-Harmann, that's where the problem is.

38:21And the nice thing is that NTS1.3 is that it's defined in a group and that's negotiated separately from the bulk cryptography. And that's where the hybrid algorithms come into play. And the reason why they call hybrid is you use two together. Use elliptic curve and MLKM. MLKM is the quantum resilient algorithm. Elliptic curve is classic. You build up keys in both your smoosh together, pass it through a hash and then you derive the session keys after that. So they're both used together. So that would have to be implemented both at the browser level and at the server level, right? Yeah, everywhere. I mean, you say browser, but I, you know, client. I mean, that's being clients in general. And in fact, you bring up a very important point there, Carl. And that is that all modern browsers support hybrid TLS1.3. Yeah. So I mean, even the humble Xbox has hybrid. I've tried all sorts of iOS, Android, Windows, Mac, Linux and all the common browsers support.

39:25So anything that uses it like curl or any little command line tool, all those things have to support it. Correct. Correct. So SSH, both clients serve a support as a version 10, I think maybe 9.9 or 10 supports MLKM. So the important part there in MLKM is the letter L in that there's lattice. And the two major algorithms that oppose quantum resilient is actually a small number, but the two major ones MLKM and MLDSA, the L is lattice. And the lattice that lattice construct that is quantum resilient. Right. So when you say quantum resilient, do you mean what you perceive as the first generation of quantum or all quantum going forward till the end of time? No, I mean, nest is still going through other algorithms. The industry has settled and nest have settled on MLDSA and MLKM. And there's been a lot of research for the last 20 something years in lattices, looking

40:26at it through a quantum lens. And they look good. But everyone's quite happy to say, let's go and look at other algorithms as well, just in case, and in fact, for no other reason than the resulting cipher blob is big. So I'll give you an example. If you have an elliptic curve, say an EC25519, which is a curve, a digital signature for that is 64 bytes in size, it's pretty small. If you take an MLDSA 87 certificate and you sign data with the private key of that, it's about four and a half K. So you imagine if you've got a whole series of certificates or with their signatures, it adds up real quick. And you can have problems with M2U's, where people passing stuff on query strings, the amount of space that's aside on disk for signatures. Yeah, so it's a real issue. So nest is continuing to evaluate other algorithms with an I to potentially smaller signatures.

41:28So now I get why it's called lattice because it kind of makes a web of data that's hard to penetrate. Is that good analysis? No, it's terrible. Terrible. It's terrible. It's terrible. I can take it. Okay, here's how it's all good. The way lattices work and this is a terrible description, but it's an interesting way of thinking about it. It'll be better than mine, I guarantee. I may not be. I'm not a fan of analogies, so here's an analogy for you. Okay. Imagine a chess board, right? Eight by eight with a knight. We know the knight moves either one and two or two and one, right? That's what it does. If I give you an endpoint and I give you a starting point, what route does the knight take to get there? That's pretty straightforward to do, you know, because it's just eight by eight. Now imagine if that was a schooling and by a schooling and chess board. Right. Right. It's harder.

42:28Now imagine it's a thousand dimensions. Now imagine I don't tell you that one by two is n by m. Right. Okay. Now just to make things even more difficult, it's not like a equates square chess board. The squares are kind of funky shaped, they're not quite squares. That's the thing called learning with errors. That's hard. Here's a point somewhere in this end-dimensional space. Here's your starting point. How do you get there? So essentially the n by m is essentially like the private key. That's one way of looking at it. Terrible analogy, but it's about as close as you can get without introducing math. Okay. Yeah. All right. Good. And so you don't think that quantum computers could ever get so good that they could just figure that stuff out quickly. You mean when you throw in some AI as well? Yeah. Yeah. Well, and go on. But nobody ever comes up, cut things. Hey, we solved cryptography. You're always looking at new algorithms. Yeah, you're always looking at new key links. Like, we expect to routinely replace our algorithms and arms race because right to bad

43:33guys are fighting back. Which is a beautiful segue into the next topic, which is crypto agility. If nothing else from a developer perspective, one thing that quantum, post quantum crypto will bring to the table is the need for crypto agility. What happens if you wrap some keys in MLKM, KEM sends for key encapsulation method. Let's say you wrap some keys in that and ends up being broken. You know, five years, 10 years from now, how can you update your application to use a new wrapping method without breaking your existing? Like you can still read your old data, but you would write out using some MLKM plus plus or something. Right. And crypto agility is just so important. It's really brought it to the forefront as a need because we don't know long term if these things will be successful or not. And again, to your point, you know, cryptographers are very, very conservative when it comes to these sorts of things. And they want to have a big security buffer knowing that some things will start to potentially

44:37creek a little bit. Yeah. And of course, you're immediately going to the at-rest encryption problem. I'm always thinking TLS and it's just we handshake and encrypted stream. We do our thing and then it disappears again. And so I don't have any other than the, you know, harvest and decrypt later, I don't have to think about this. It's all transitory. We'll just use the newest algorithm. But if you've stored under an older algorithm and now it's been breached, you have to decrypt or at least, you know, decrypt over time to get by that. You may have to increase the data size of your fields to take those things because it's going to take more. Yeah. So you go to assume that there will be change. And unfortunately, a lot of people don't know how to build crypto-hage or solutions. It kind of drives me a bit bonkers to be honest with you. I see you in the press. You don't really need cryptos agility. You've got to do cryptos agility. Hey, cryptos agility is really important. Is that, you know, are you guys doing cryptos agility? Yeah. But no one says, because it comes in a squirt bottling, just spray it on all your devs and you'll be good. I know, but no one says how to do it.

45:39Yeah, that's like, so to me at Microsoft, there's two canonical examples of cryptos agility. One is as is equal DB, or SQL Server, with always encrypted. And then the other one is the open Office XML file format, which you use to encrypt documents in Office. So the way it works in as is equal DB, which to me is a beautiful and simple way of doing it. It's also very, very fast. If you have a look at the cipher text in an always encrypted cell, the first byte is always a one, and that's the version number. And that basically means AS 256, cipher block chaining with a chr 256 hash, like an integrity checker over the data. So in the future, if they decide to upgrade it to something else, then that could be version two. So the first byte would be a two. And they could always read back and say, okay, that's a version one. We need this particular set of cipher primitives. Let's read as decrypt it with these primitives. But when they write it back, they would write it back as whatever the latest number was,

46:39which we have version two, and it would be whatever the new cipher suite is. So you could always read the old data and you would write back using the new version. And the way Office does it is it's an XML file. There's an XML file header. And it contains all the cryptographic primitives. I say, yes, cipher block chaining, here's the initialization vector. Here's the password, the key derivation count. Here's the key derivation algorithm and lots of other metadata. So you can actually build the cipher collection completely dynamically, which is really, really nice. What network hardware will have to change in the? Yes. I mean, will we be able to go to Best Buy or whatever it is you have in the UK and buy an off the shelf router that is crypto happy? I mean, in theory, I think a lot of. Want them happy, rather? I mean, unless they're doing some kind of inspection, if they're just like passing data on, there should be no need for it, rather than decrypting stuff.

47:40But if they are decrypting stuff, then yeah, they're going to have access to these algorithms. If you're doing, you know, TLS termination, then yeah, for sure, the other. There's not something you'll have in your home. I did that stuff in racks of computers for companies, but there's a fly in the ointment. There's a huge fly in the ointment, though. And that is your laptop and your computer with TPMs and trusted boots and that sort of stuff. Right now, those keys are probably RSA and L... Well, they are, RSA or Lipset Coo. They are. And we're just going through the secure boot crisis, thanks very much. Right. So that will all get busted. And, you know, so the hardware to be created. They're all working. You mean here, Mike? They're just squinting, but I think of it. You got to look at it like this. Hey, you got to buy a new laptop. Well, that's not a bad thing. But there's also like, we are fixing keys all the time. These are BIOS updates. Like, this will come in firmware. You think they'll be new drivers. Right. And they might be slower than a hardware dedicated version of it. But I just don't feel... A lot of the stuff you're describing here, Michael, to me, sounds like configuration

48:43settings in Azure. Already you already done the work in the browser. Like, as long as I haven't done these things stupid in code, I don't think I have to do anything as a web dev. That's correct. 100% correct. I just got to make sure that my admins have set stuff right. Well, if you're using IAS, you're going to have to make sure you're in the latest version of that supports it. Well, in Azure. Well, HTTP.Sys. Well, so I actually wrote a blog post on this because about six weeks ago, we released a version of S channel, which is the Windows TLS stack that supports TLS 1.3 hybrid. And I wrote a dumb ASP.NET application, dumbed on a bucket of rocks just to keep it really, really simple. And did no configuration whatsoever in the code. That's a really important point. That will not do any TLS configuration in code. Like leave it to the OS or to some configuration somewhere else, definitely not in code. And yeah, I just turned on that I wanted X25519 MLK 768 in priority zero in the Cypher

49:44suite and group order. And I ran this application and I connected using a browser and I was living in the future. Nice. Michael, how long do we have before we need to configure our things correctly? How long do we have? I mean, it depends on risk. I was talking to a large retailer. You know who they are, but I can't say who they are. And they're not concerned. The one I bought my computer from. They're not concerned about right now anyway with their devices that they use for shop floor inventory management, right? Because it's just shop floor inventory management. It's not sensitive data. So their Android devices that they're using will never support post quantum. They're okay with that. Now their corporate systems that run HR and payroll and all that sort of stuff, yes, they do care. So how long do we have? I mean, the clock started now for certain types of data. Depends on the data. If you've got really sensitive data or data that must be set the secret for a long time,

50:45healthcare information, military secrets, intelligence, financial records in some cases, perhaps I don't know. I'm not a regulatory person. They have a time that they must maintain their secrecy. And that clock's already started because if we take a 20, 29, 20, 30 time frame, that's only four years. It's only even four years away. On the screen behind you, sentence came up a little while ago. There's no such thing as low risk data. But apparently this large retailer seems to think there is. I see. I think it's a no low risk secrets. Right. No risk secrets. That's right. Yeah. Yeah, low risk secrets. Secret is a secret. So if it's a secret by default, it's by definition a risk. Well, a small, a quote, small secret can lead to access to bigger secrets. Is there like a low credential, for example, it can lead to something like a key deal? Sure. Yeah, the old classic I broke in through your, I got your Wi-Fi password from your light bulb. Because you thought, well, it's just a light bulb. What are you going to do to me?

51:46Right. But the fact that I got, yeah, I once I got into the Wi-Fi, there was a whole lot of the things that were there. Yeah. And that's why I put all my IoT stuff on its own virtual network. Is our own isolates it? Oh, you're done, right? You do. Absolutely. Yeah. But at the same time, you know, I'm still sorting through what do I have to code as a dev versus what I have to, you know, what's going to come to me just by making sure we're using the latest bits. So I love your info on always encrypted. It's like, hey, now I want to go talk to my DBA. And it's like, we're up on this version, right? Because we have all this encrypted and rest stuff and you don't want a crisis. So if you're already running always encrypted and SQL data, then we should be good. Like, when the new algorithms are needed, they'll work. The big issue, and this is one thing that the, you know, a lot of products that Microsoft I happen to deal with is the symmetric stuff's fine. It's the key wrapper. Yeah. That has to change. The beauty of it though, is it's just the key wrapping. So if you have a 256 bit AS key, you just decrypt it or unwrap it using RSA, for example,

52:52and then you rewrap it using ASKW, which managed HSM and ASU and now key vault actually, key vault premium in public preview supports ASKW key wrapping, which is post-consum resilient. So yeah, great. So there's two, there's two issues that I see developers need to really, really think about. Is please don't put any TLS anything in your code. Yeah, it'll hurt you later. Don't restrict protocol version. Don't restrict cypher suites. Don't do any of that. Just let it be configured completely outside of the application. That's number one. Number two is this whole cryptocurrency thing. You know, if you're, if you got crypto code, you know, with the algorithms, hard coded in the code. You're in trouble. And you're encrypting, you know, squiggy bytes of data. You know, you got update your code and probably can't read all data. So they got, you know, it's just a mess. Yeah. And that's where the whole cryptocurrency comes in. And honestly, if you haven't got crypto agility in place that are patterns you can use

53:54to wrap existing non crypto crypto agile blobs into like some sort of crypto agile envelope that contains all the metadata. So Azure is really good about letting me know when I need to move off of some version of something and onto something else because it's being deprecated. Do you think that sometime in the future, we're going to get an Azure thing when we log into the portal that says, Hey, you need to upgrade your whatever it is to be quantum happy. You think that's going to happen? Like, should I just leave it up to Azure to warn me about things like that? Or is there stuff that I need to do now? I think it depends. If you look at the shared responsibility model, that's where it really becomes important. Like if you got a platform managed key to encrypt data, then we're going to take care of that right? Yeah. Because a platform managed key. But if you got a customer managed key, which is basically a key wrapping key, then they'll probably look at I can't predict the future. But my guess, just my guess is that there will be notifications say, Hey, you know, we've

55:00now got the ability and Azure blah, blah, blah to wrap your encryption keys in quantum resilient keys. Would you like to do this? Yeah. Click here. Yeah. And the consequence is going to be very likely that the data streams are going to get larger because the quantum resilient keys are bigger. But I don't know what other impacts I'm going to see. No, you shouldn't see it. No, because the only thing you're really changing is the key wrapping, which is, so if you've got a 256 bit AS key, you're going to wrap it in AS to ASKW. And in fact, it's probably smaller than RSA, to be honest with you. But if you wrap it in MLCam, it will be bigger. Right. But it's just the key. It's just the key. Yeah. I'm even choosing that or I'm just configuring to allow this and it'll optimize itself. What do you mean? What do you mean? I don't get. Like when do I have to make a decision about this? About what? About the re wrapping? Well, first of all, the nice thing is it's very low friction. Very, very low friction.

56:00It's microseconds to do the work. You're not decrypting and reencrypting petabytes of data. Right. So my guess is personally, as soon as it becomes available, I would just opt in and just re-wrap your keys. So I'm going to wait for your blog posts and then I'm just going to switch this stuff on. No, we'll push it through as your update. I guess it'll be through the Azure updates website. Yeah. Good. So it'll be a little bit more convenient in the next year. Yeah. It'll depend on the service. Yeah. So we don't want to point something out here. There's post-quantum stuff is very layered. Right. So the very bottom of the layer, you've got the algorithms. Well, that's been in place in Windows for ages. Yeah. And we have called SIM crypts. The Veloin Windows, Linux and Mac. Hand up to my C code. Absolutely beautiful to read. It's so well written. Honestly, it really is. Then above that, you've got, say, TLS 1.3 with hybrid. You open those floodgates because now people can use that stack. So basically on Windows, it's to use the US Channel Stack.

57:01In the case of Linux, you open SSL 3.5, which has MLK built-ins. So you've got those two options and now available to you. So that's the data and transit taken care of. And then the last one, which is incredibly important, is the key wrapping. And we now have that in Azure. So managed HSM has had ASK wrapping since day one. As you keep on now, has it ASK? So what's going to happen is that's going to open these floodgates. And there will be a Cambrian explosion of services coming online, right? Is there a adopt? And look, it won't happen overnight. Because everyone's going to be testing, make sure it works, make sure it fails correctly. And that's all the stuff. But to, you know, Richard, to your point next year, we'll see a lot of services rolling this out. Starting to switch over. But I also remember when we started switching up keys, when a task got smarter and so forth, like there was a period where we changed a number of times, different flavors of SSL and then into TLS.

58:01Like we are restarting this in some respects with these new cryptography. I've got to think, like the first move we make may not stick for more than a year or two before it's like, hey, now we found some problems in you. Probably want to switch to this. I just remember going through this as a yes and a few others. Like we've done this before. I mean, some ways we've gotten really lazy because it's worked so well for so long. Well, actually, it's worse than that. And that is that so we've actually become really lazy because of RSA. Right. RSA is interesting. RSA can do all the crypto primitives. Right. It can do signing, you can do encryption and all that sort of stuff. It'll let's occur if you're home and cannot. They can't do everything. And so it would have been used, like you said before, Richard, I'm not trying to laugh at you, but you said your prime numbers. Well, that's just an RSA thing. That's not an LITICIRV thing. Right. Because everyone thinks of RSA. Yeah. And RSA is the Swiss Army knife. It does absolutely everything. Sure. And the problem is it does absolutely everything.

59:01Absolutely everything. Absolutely everything. Which means you've got to change it absolutely everywhere. Yeah. It's permit. It went everywhere. Well, you know, the other side of this was because compute. I remember when it was expensive to do encryption, where we literally had separate servers from the website for doing just the encrypted pages. Right. Okay, well, now you're going to take your shopping cart and start a payment cycle. That needs to be SSL. So now it was this big thing about moving the cart over to the other much more expensive dedicated staff for completing a transaction. Yeah. Because encryption used to be so costly. You know, these days our CPUs are so damn fast. They're sitting around playing poker and smoking cigarettes waiting for something to do. So sure, encrypt everything. Who cares? RSA is fast. Well, the funny thing is that first of all, it's just the key wrapping and unwrapping part. Yeah. All the key. Let's just call it key establishment because there's all different ways of doing it. That's really what's going on. That's the expensive part because all asymmetric stuff. And Windows, I think it still exists.

1:00:02There used to be a registry key called ModExp offload from Modulo Exponunciation offload, which is a very expensive RSA operation. And there was a way you can actually set a DLL in there. And then the DLL, it would actually offload that work to a DLL, which is a shim into some hardware. It's actually do the Modulo Exponunciation work. But we don't need any of that stuff anymore. You know, when I look at the work that, you know, as your front door of DUM, for example, they've done a whole bunch of analysis on performance. And the performance is like just a couple of percent, you know, going from elliptic curve to elliptic curve plus ML, ML cam. And that's because of optimizations made in the library. Sure. I got to tell you, Michael, this is weird dichotomy going on where it's like the catastrophizing of quantum destroying everything. And the, oh, just touch this button problem goes away. Yeah, yeah, I'm feeling that too. You're right.

1:01:03I wish it was that simple. Yeah. I keep waiting for what's not the simple part. I mean, for me is the front line debt. Right. I mean, I mean, like the administrator of me is, you know, a little sticky in the shorts right now, because this is all very scary. Like, I want to check everything. I don't want to be the guy who didn't do his homework. Right. But for the dev, unless you've done something dumb, I think you're good as long as your administrators are on it. The two, as I mentioned before, the two big, big dumb things are baking in crypto algorithm and into your code and not being crypto actual. That's dumb thing number one. Dumb thing number two is if you hard code, it's your less configuration. Right. Those are the two big, you're right. Those are the two big ones. Let's just ignore compatibility for a moment, you know, if you change a server to use TLS 1.3 hybrid and only hybrid. By the way, the reason why it's called hybrid is because you do an elliptic curve and MLK together, the keys are derived from both. That's why it's called hybrid. But if you do hybrid and the client doesn't talk hybrid for whatever, you got like a crusty old Java application or a C-Sharp application written 15 years ago, it's probably not going to work.

1:02:10Yeah. And it's really a question of, is it going to fail with some grace to tell you what the hell's going on? Yeah. Right. It says, don't understand this cypher suite and gives you a hex value. Yeah. Really useful. Yeah. Well, that's better than object not found. Absolutely. Or one of the best ones in office back in the day is outer memory. Yeah. Yeah. Michael, tell us about your book. Oh, well, your book, man. Yeah. So I wrote this book with Sean Hannon, Lee Holmes and Sherrod DeGripot. So Sean and I have known each other for many, many years. He's a partner engineering manager in Azure Security. I've been around for a long time, got the utmost respect for Sean, great guy. Lee Holmes, he was the security guy in PowerShell. Yeah, he's been on the show before too. Yeah, my boy Lee, great guy. Yeah, he's good man. He and I actually worked together when in the earliest days of the SDL, because when Monad, as it was back in the day, had to go through all this SDL checks, I was the... Precursor to PowerShell? To PowerShell, correct.

1:03:10Yeah. And I was like the SDL contact from Monad. And so Lee and I got to know each other incredibly well. And he's also a partner engineer, a partner engineer in Azure. And then Sherrod DeGripot, she's actually left Microsoft now. She owns a PowerShell. So labs, she is easily one of the preeminent experts in the world on threat actors. She knows absolutely everything about threat actors. So the book is threat-driven software development. And basically what it is is looking at software development through the eyes of threat actors. Like what the threat actors actually do. And every chapter starts off. So first of all Sherrod has her own chapter at the beginning. But every chapter after that looks at the contents of that chapter through the lens of threat-in-tell. So every chapter starts off with, anyway, between half and two pages of threat-in-tell perspective, where Sherrod gives it a whole bunch of color. And then Lee, myself and Sherrod, go through an expert, you know, to explain that particular topic in detail.

1:04:10And a lot of it's not just, don't think of it like just security best practices. It's not, it's DevOps as well as, it's operational security, AppSec, and also threat-in-tell, all sort of munch together into one book. Sounds good. Yeah, a lot of fun. I do want to do one. I was in the red team. But funny thing is, so my recentovich wrote the forward. And my manager at the time, Craig Nelson, a CVP of the red team, he said, oh man, I really love this book. I gave him draft to look at. So you might, you know, it kind of writes a chapter. Well, I'm like, well, why don't you write the afterword? I've never had an afterword in a book. Why don't you write the afterword? So he did. Nine pages. Oh. But the afterword? The after chapter. Yeah, the after chapter. I'm not trying to dismurch Craig at all. Yeah, sure. That afterword is absolutely brilliant. Oh. If you're to sum up the afterword in like one sentence, it were two words, it would be so what? And he does a really, really good job of answering.

1:05:12So what? Yeah. It's really good. Yeah. That's good. It's really cool. Michael, what can we say? It's been enlightening having you here and talking about all this crazy stuff that we barely understand. Well, I barely understand anyway, but I understand a little more. Thanks to you. So thank you very much. Well, you're welcome. Thanks for having me on. Great show, friend. Thank you so much. And we'll talk to you next time on DonnetRox. DonnetRox is brought to you by Franklin's net and produced by Klopp Studios, a full service audio video and post production facility located physically in New London, Connecticut, and of course in the cloud. Online at pwop.com. Visit our website at DOTNTROCKS.com for RSS feeds, downloads, mobile apps, comments, and access to the full archives going back to show number one.

1:06:22Recorded in September 2002. And make sure you check out our sponsors. They keep us in business. Now go write some code. See you next time.