Hacker Summer Camp and notes from 63 minutes on the "slopalcious" slopdemic

Aaron Mog put the Zero Sum episode up on Tuesday, under a title I did not pick and could not improve on: I'm Not AGI Pilled. I'm Human Pilled.

It runs 63 minutes. Below are the salient points with timestamps against them, so you can jump to whichever bit you actually came for rather than sitting through my throat-clearing.

The longer argument that came out of this conversation is in its own post, diagram and all. This one is just the notes.

The times are matched against the published video's own caption track rather than my recording, so they should land where they say they land. The ones sitting inside a long answer can be out by a few seconds either way.

3:04 Coming out of a very dense week

Black Hat, some of BSides, then DEF CON, sitting on two review boards. My honest summary was that it was just a lot, and that I got more out of the dinners than the parties this year.

4:13 The three cons had three different moods

Worth separating them. The AI conversation at Black Hat, BSides LV and DEF CON was genuinely not the same conversation, and treating "the industry thinks X" as one thing hides that.

4:44 The vendor floor is pitching the what, not the why

Vendors have moved from pitching why they exist to pitching what they contain, and what they contain is always agentic, always AI. That is a symptom of everyone recalibrating on how they create value at once.

6:56 Human-pilled, not AGI-pilled

I kept getting asked if I was AGI-pilled. No. AI has the same phase-shift properties the internet had, and the entire point of it is people getting some benefit from it.

10:24 BSides, and everything under the poverty line

The strongest urgency all week was here: critical infrastructure, hybrid conflict, and orgs with no budget, no people and no cultural buy-in. The tone had shifted from admiring the problem to asking what we actually do.

14:02 Where the balance instinct comes from

Most of what I do is lay out what I think happens next and name the equities we have to weigh. Being a counterweight to hype is not the same as being negative on the technology.

15:04 The sticker

I spent the week handing out stickers reading "artificial intelligence: do stupid things faster with more energy". Aimed at treating it as a panacea, not at the tech.

20:08 AI-assisted exploitation is not news

Competent operators have been pointing models at exploitation for three or four years, including small open-weight ones. Mythos got the headline for being loud and first, not for being novel.

20:27 The two axes

The line the other post is built on. Model capability is one axis. The fact that any of this is possible at all is the other, and most takes only hold one.

21:12 It's a minor miracle the internet works

Said with fifteen years of orchestrating hacking it at scale behind it. It is genuinely quite bad out there, and we are now all talking about that at the same time, which I think is good.

22:33 What the slopdemic is made of

Elite hunters get AI and become efficient and elite at once. At the other end, people at an 11 out of 10 for enthusiasm and a two out of 10 for usefulness add noise at volume. Both got the same discount.

22:58 Get out of the whack-a-mole game

Reachability, training, and whether you have any thesis at all about what you are protecting and why. Absent that, stack ranking what to fix is really hard.

23:49 Pain of staying the same

The expression I keep coming back to. Behavior changes when the pain of staying the same exceeds the pain of changing, and for a lot of orgs it currently doesn't.

25:55 What a vulnpocalypse looks like

Not the report flood. Discovery capacity overloading triage and remediation is the slopdemic. The vulnpocalypse is chaotic exploitation that reaches actual users.

26:31 Breaches mostly are not fatal, and that is the problem

Adrian Sanabria's BSides talk on breach-to-company-death correlation. Above a certain size it just isn't as existential as the Black Hat floor would like it to be. That's a commercial reality.

32:42 Policy is a pincer, not a switch

The disclose.io approach: work the top-level policy conversation and build ground-up precedent at the same time. Changing the law alone fixes nothing.

34:53 Everyone already has a VDP

They're just maybe not getting the report. Publishing one is less about finding bugs than about your organization accepting out loud that it isn't perfect.

36:45 Never sell security to people who don't care

From one of my first business mentors, around 2005. Let the bad guys teach them. If you sell to people who don't care, you cannot defend your value when it gets questioned.

38:08 Pen test has to be able to answer the question

"Why would I pay this firm this much when I could point something at it?" That may or may not be a fair question. It is one you now have to be able to answer.

39:19 Hygiene, and limiting the blast radius

Unfashionable and still true. Assume you get hosed, then look at what contains it. Nine times out of ten it is segmentation and the basics, and most companies start with the complicated thing instead.

50:59 The OODA loop got squished

We got used to that loop running at a certain size and cadence. AI compressed it to the point where we don't fit inside it anymore, which is a different problem to any of the others.

52:33 Advice to a 22 year old

If someone thinks they're a hacker and asks whether to get better at it, my answer is never going to be no. It's a portable mindset, and I took it from exploitation into business.

53:45 Powerful beyond their moral compass

The thing I saw over and over at Bugcrowd. Fifteen and sixteen year olds aren't deciding to be bad guys, they're just capable of wandering somewhere bad and getting stuck there.

54:43 Generational transfer runs both ways

They know things we never will because we aren't native to their era. We've broken more things than they have. Yelling at them to get off the lawn wastes both halves of that.

55:30 What disclose.io actually is

Started as standardizing safe harbor language, turned into a maturity model, then into a nexus for people trying to suck less at disclosure. The goal is making it feel like internet physics.

60:46 Who will be hiring juniors

The bad guys are. If the industry has decided it's done with juniors, that is who picks them up, and this is a pre-internet pattern that never went away.

That's the lot. The one I'd most like to be wrong about is the vulnpocalypse timing, and I don't think I am.