Interesting talk by Feross Aboukhadijeh, CEO of Socket, on where we are with security, open source, and AI.

How’s the whole skills.md thing going?

English is the malware now

Ok, what about MCP?

[Researchers] found nearly 2,700 instances of vulnerable servers running on the open internet and we know this has been actively exploited in the wild. This is the kind of thing that can happen when we start bolting MCP onto things.

So, not good?

The time to exploit has gone massively down. In 2018, you had 2.3 years to patch before there was an attack against you. Now you have about 10 hours. It’s wild. 10 hours from disclosure to active exploitation. If your team finds an exploit on Monday morning, attackers are using it on Monday afternoon. We can’t use our old, manual processes to respond. We need automation.

C. Thi Nguyen talking about how we let others define meaning for us:

Someone says, “Here’s a watch. It measures your health.” And if you accept that, you’re letting someone else — maybe like Apple [for example] — define what health means for you. And they typically define it by what is easy for one of their devices to measure cheaply.

John Stewart on algorithms and social media:

the one place where speech isn’t free [is social media]. It’s speech incentivized for engagement and profit...social media is a machine designed to stimulate the reptilian parts of your brain that would otherwise beg you to go outside.

He continues:

social media is free speech in the way that Doritos are food: it’s ultra-processed, it’s designed in laboratories, it’s the same mechanism that somehow convinced you you should eat a [whole can of pringles]