Mackenzie Jackson: Hello everyone. Welcome to another episode of The Secure Disclosure Podcast. I'm so thrilled to have you sitting with me here today, Michael. Thanks for coming.
Michael Farnum: Thanks, Mike. Thanks for having me. Appreciate it.
Mackenzie Jackson: I, uh, we got, we've got a lot to cover. I was putting together the show notes for this, and I was kind of like, we're going in a lot of directions here, but I kind of like that. I kind of just want to start. I'm always curious about people's journeys. You're a military man, which actually is quite common in cybersecurity, like for down that path, but maybe if you could explain, you know, you used to be a man driving tanks, now you're working in tech. How did that kind of progression happen?
Michael Farnum: Well, I always knew I wanted to be in computers when I was a kid. I grew up in a very small town in Mississippi. I was like the only kid that had a computer that my dad got me, unless you had like a Commodore 64 or something. So, I always knew I wanted to do that, but when it was time to figure out how to pay for college and everything, the military was a good way to do it. So, but in order to do only a two-year stint in the Army, you had to go into a combat specialty. And so I said, "Well, let me choose tanks because it looks really cool to get in a tank." I like a lot of people that went in the military or unlike a lot of people that were in the military that go into cyber, a lot of them did cyber in the military or if I talk to a lot of Israeli people, they were in 8200 or whatever.
Mackenzie Jackson: Seems like every startup comes from 8200.
Michael Farnum: Absolutely. So, the joke I tell them when they tell me that when they're on my podcast when I'm working, it's like, "Yeah, you did cyber in the military." My entry to cyber was putting a device into our radios to encrypt the signal, and I promptly accidentally deleted the encryption key on the device and that device had to go back to Brigade and I got in a whole lot of trouble because I... so that was my entry into encryption and cybersecurity was in the military. But yeah, I just drove a tank because I had the ability to do two years instead of a four-year stint. And you know, if I wanted to extend, I would do that. The bad part, I guess if you want to call it, is I went in July of '90 and Saddam Hussein invaded Kuwait in August of 1990, and so I got sent over to Desert Shield, Desert Storm. So, I had to do a combat tour over there. But I came out of it relatively unscathed and but after that, it was again, I already knew I wanted to do this. I just it was just a matter of finding my path after I got out. So I went into college, had some friends who had a friend who owned a computer shop and started building computers, you know, in the early '90s when it was still mostly bulletin board system days and things like that, and just kind of went from there. I mean, I was more of an IT guy in the beginning than I was cyber. Cyber wasn't a word.
Mackenzie Jackson: Yeah.
Michael Farnum: Cybersecurity wasn't a word. It was information security when I got in probably in the late '90s, early 2000s. So, and then just kind of went from there.
Mackenzie Jackson: And what was it kind of like the catalyst for you that made that kind of made you want to stick in the InfoSec or the cyber sec world? Because I mean, there's a lot of directions you can take from tech.
Michael Farnum: A whole lot. Yeah.
Mackenzie Jackson: And you're, and I was looking, you know, going through just preparing for it, there's, you know, just about every job title you've had.
Michael Farnum: Yeah.
Mackenzie Jackson: But this one stuck and this one's, you know, kind of clearly the passion, what you're, what you've been doing. So like, what was it that made you want to stick to that area?
Michael Farnum: I can tell you almost to the day of when I decided to go that route, and I was, I was a local area and wide area network engineer at a staffing company and it was very early internet days. This was probably '96, and most people didn't have an internet connection into their, into their, you know, everything was just local area network and if you had a wide area network, you were it was going to your offices. It was like frame relay or something like that. And then I, we got our first internet line in and we had a special guy, a specialist come in and connect up the firewall, which was basically just a Unix firewall that was like, you know, and I just saw like different packets on the, or, you know, different messages on the screen and I found out later it was just logs of, you know, traffic logs and things and I just saw it and I was just enthralled.
Mackenzie Jackson: What is going on here?
Michael Farnum: And the guy kind of mentored me and told me about, you know, about the security side of it and everything and this was like right when Check Point was, you know, really started coming out with the first firewalls that were like commercialized and you could do. So, yeah, I, slightly before that, I actually got to do or after that, I mean, I got to do some work in doing scanning with eEye scanner, eEye Retina scanner back in the day. That was the first one I used. And it just, it just enthralled me to do something different than just trying to say, I'm going to hook a connection up for you to be able to communicate. I was like, I'm actually trying to protect this and find out how people are getting in here doing bad things. I think that was really close to when L0pht went and did went in front of Senate and all that. So that all enthralled me. I started learning about different, it just, it was just something different. I get goosebumps thinking about it back then versus just, you know, like I still remember the biggest switch I put in and that was really cool. The big Cisco Catalyst switch. Yeah.
Mackenzie Jackson: That was neat.
Michael Farnum: But it just wasn't doing protection. All it was doing was fostering communication. I wanted to do protection. So.
Mackenzie Jackson: Yeah, I can, I can totally understand that from that perspective. There's a couple of things to kind of dive in there from now. One, one thing I, I kind of want to ask you, we're already off track from our.
Michael Farnum: It lasted all of like 10 minutes.
Mackenzie Jackson: But one of the things I, I'm curious about and I wanted to ask you is just you've been in the industry for a while and you've been like pretty prominent and present in the industry for a while. We're getting into this kind of crazy new era of AI and we can't not talk about it. What I'm, rather than talking about that now, what I'm curious about is from your perspective, you've gone through multiple revolutions in this space, right? The original .com kind of era, the cloud computing, the API kind of microservices era.
Michael Farnum: Was doing Y2K, all that.
Mackenzie Jackson: All that. And now we're, now in the AI. Is this different? Like, does this feel different or can you look at this as a veteran and just be like, it's going to be rough, it's going to be okay? I don't, I'm curious how you kind of with your experience, look at this next era that we're going into.
Michael Farnum: I think there are two, two questions there actually. Just because it's different doesn't mean we're not going to be okay. Yeah, I, I that one doesn't necessitate the other. There are a lot of similarities of the changes with cloud, the changes with just networking, the changes with just PC computing overall. I mean, I know that really started in, you know, late '70s and '80s, but that there's a lot of the same characteristics. This is just, in my view, a hell of a lot faster than it was back in the day. The changes are happening so fast from a what is AI giving you the capability of doing both from an attack, you know, an offensive and a defensive side, whether you're getting attacked or whether you're trying to defend against it. I don't think there's a whole lot of changes in how we protect against that. I think the same defenses still work. We've just we've got to take it seriously now. I was having a conversation with somebody today and we used to say we presume breach. Now we need to presume exploitability.
Mackenzie Jackson: You can't just say, "Oh yeah, you're probably breached, but that doesn't mean that somebody's done a bunch of bad stuff."
Michael Farnum: Yeah.
Mackenzie Jackson: Now you kind of have to presume because humans couldn't find the exploits as fast as they can, can it, can be found now. Yeah.
Michael Farnum: With with the new models and that's just going to get worse. So I'm not a doom and gloom. I'm just like it makes me tell people all of this technical debt that you've just ignored for the last 10 years plus. You really need to take that seriously now. If you don't, then you're definitely going to get exploited because there are things that no human has found yet that these models will absolutely find.
Mackenzie Jackson: Yeah. It's an interesting thing too, this, you know, when you when you look at it because apart from prompt injection, there's no new kind of classifications of bugs that being found. It's just finding the old ones very, very, very quickly. You know.
Michael Farnum: Prompt injection is still just injection, right? Just a new thing to go against, but it's still an injection attack.
Mackenzie Jackson: Yeah.
Michael Farnum: So, but yes, it, it's it's happening very, very, very quickly and the exploits are being found much more quickly and like how do you protect against that? You put in the same stuff that we've talking about we've talked about before. What it has created in my mind is you have to look at context as well. You have to go, okay, these things are going to come at me so quickly. How do I find what's going to have the biggest impact? That that's always been a thing. Like you want to rate criticality, but the criticality rating has happened through somebody creating a scoring system or through KEV where there's a known exploit. With this, you've got to look AI, what it allows you to do is absorb a lot of your infrastructure information and your policy information and everything that's going on in your environment and go, I know that that one you've got it and it is absolutely more accessible than any of this other stuff and therefore you need to hit it even though it's only a 6.2 or something, you know, CVSS. So that I think that's what AI gives us a capability of doing is absorbing all of that information and giving us contextual data where it was really difficult for us to do that before as humans.
Mackenzie Jackson: Totally. And that is exciting. I go on waves of like absolute depression and euphoria, like it is and it really, I can have it multiple times within a day, too, especially, especially this week.
Michael Farnum: We're just as fast as the AI, our emotions are.
Mackenzie Jackson: Yeah, because you'll see something and you'll do a use case, you'll be like, oh, this is amazing. Like, this, this gives us such a better capability, like the one that I'm enthralled with at the moment is we're looking at finding vulnerabilities, like the classic one, IDOR, which is, yeah, it's a good, which is a vulnerability that only you can only really find if you know what the app does and scanners never knew what the apps did. They just looked for vulnerabilities. Now we know what the app does because, you know, we can look at it.
Michael Farnum: It's amazing.
Mackenzie Jackson: But then you, but then you look at the other side, it's like, yeah, but crap, it's like they also, like the bad guys can do that. But I think what it also and one last point and I think I've worked a lot in the critical infrastructure space and worked with OT companies and why I'm excited about it is because they are typically extremely slow to make any movement. They're, they're, you know, they're 150 year old companies, like everything goes slow there. They're being forced to pick up their pace because like if you saw the all of the water utility attacks that have been happening, there's several different states that are getting hit by these things. That's going to happen quicker and quicker and quicker. They were able to air gap and you know, pull, pull that stuff apart and they're just not able to do that anymore in the modern world. And I think this, it's, it's scary to your point because those are critical infrastructure. We do not want our water messed up and we have to live and we need water to live. At the same time that it's forcing people to wake up and go, okay, we actually need to spend money and do these things and support these small critical infrastructure companies so they can survive and we have basic needs. I think that's kind of exciting.
Michael Farnum: Yeah.
Mackenzie Jackson: Hopefully they learn that lesson and push on that hard. So.
Michael Farnum: I, I, I think so too. And there needs to be like a, a lot of support and there's some good things coming from this in terms of us realizing the critical elements in there that are often volunteers, open source, you know, small companies that play this like very overpowered role in it. And now.
Michael Farnum: Yeah.
Mackenzie Jackson: And that is a pretty strong attack vector for attackers at the moment because they, we've been underfunding it. Like isn't, imagine explaining to someone about open source and how the whole world runs on it and we just, we just, we just, we, we hope that these guys just keep doing it for free. Like you explain that to someone. It just sounds so cartoon.
Michael Farnum: Yeah, it's so good. It's not a, it's not a conference until someone puts that up, right?
Mackenzie Jackson: Oh yeah, you got to have that. You got to have that up on a slide. Yeah.
Michael Farnum: I just going to make that my intro slide for other presentations.
Mackenzie Jackson: I have it in a couple of presentations because it's just like, I know you've all seen it before, but we need to see it again.
Michael Farnum: We need to see it over and over and over.
Mackenzie Jackson: Yeah. One of the things that I really wanted to talk to you about here is the community culture and security and this kind of leads into it because like the open source parts, these critical infrastructures, they exist because of communities.
Michael Farnum: Absolutely.
Mackenzie Jackson: And I don't know if I mean, it's maybe a little bit less true for Black Hat per se, but if you go to DEF CON or BSides and it's your first security conference, you're pretty amazed by the community and this is something that you're working in in the conference space.
Michael Farnum: Yep.
Mackenzie Jackson: For that, I guess that's a start off is why, why does security have this kind of community vibe to it? Why? Because there are a lot of places that don't. And the area at the moment that I feel has the least amount of community is kind of like if you go to an AI conference, the vibe is very different.
Michael Farnum: Oh yeah.
Mackenzie Jackson: You know there's a big one happening here this.
Michael Farnum: Yeah. Yeah. Yeah. So, what's made the security community successful?
Michael Farnum: I think the fundamental aspect of cybersecurity it a lot of areas don't have is curiosity. Like engineers of all stripes and sorts are curious. They want to know how things work so they can build them. Engineers in our world or hackers in our world want to break things to learn how they work, make them do things that they're not supposed to do and then put them back together like they were before. It's a, it's a fundamental curiosity that I don't like outside of like just somebody that's a pure scientist and you know that works in a university. Yeah. And even they don't have that sort of like they're trying to figure out the fundamental aspect of the universe but they can't get their hands on it, right? So, in cybersecurity it's just it's just a different feel and I and I've seen it so many times and I've mentored and advised so many people getting into cyber whether they're young people or changing their careers or whatever if you go to generally, you know, a BSides or, or, you know, a smaller regional conference or whatever at any kind of hacker conference and you get in there and you show curiosity. You ask people.
Mackenzie Jackson: Yeah.
Michael Farnum: Like how does that work? It, it doesn't matter what color, what gender, what hair color, no hair, whatever. They will embrace you and just, and I just, I have and obviously this is anecdotal. I've not worked in to any great extent in any other fields, but I've just that that never fails that those people will embrace you and reward your curiosity by trying to teach. And I see that in other places and especially like gamer world or AI world or whatever. They call you a noob and they make you feel stupid and all of this stuff. And I don't know what it is about those cultures that feel that way. We have some aspects of that in cybersecurity, but generally probably 90% of the time, if not more, they're going to embrace you and just and it's just something about that fundamental curiosity in cybersecurity that just I just don't see anywhere else.
Mackenzie Jackson: Where, where are we kind of most failing in this area, too? And I know one of the things that you're very focused on in the conferences that you build out is things like admission cost, making it accessible to to everyone. I'm choosing my words carefully because we're right outside like the most overpriced conference on the planet.
Michael Farnum: Like.
Mackenzie Jackson: There's another one that might beat it. RSA maybe?
Michael Farnum: RSA. Yeah. Yeah.
Mackenzie Jackson: Even DEF CON has gotten expensive.
Michael Farnum: Has gotten expensive.
Mackenzie Jackson: Its whole thing was, and I get that like, you know, it's not, I, I get that it's expensive to put on these shows, but, yeah, it's a bit of a, it's concerning sometimes when you see it because you don't want the trend to happen. I think DEF CON's the one, look, Black Hat's for business people, it's going to be expensive, whatever. Yeah.
Michael Farnum: When I start seeing the other ones kind of following, I get a little bit concerned.
Michael Farnum: Well, but Black Hat used to not be like that. The, you know, the earlier ones it didn't cost as much. And it wasn't a business one. Look, I, I'm never one to try to beat up other because I don't really look at the other conferences as competition because I do want to have a community. I want every, I want it to be accessible. I, I've worked with other conferences. I've had conferences have booths at my conference. I've been at other conferences and been had booths at theirs. I always want that to be a community feel. But you're absolutely right. Like I, if you can't, if it's not affordable, then what happens? You get a glut of business people that are just doing business versus having talks. Like the Black Hat has still got very quality talks, it's really good. And if you've got a, if you work at a company that will send you there, like that's great. I, I have no issue with that. But when you've got people who don't have companies that, you know, they're smaller organizations or even media size or whatever, like I just don't want that to ever be a barrier. Yeah. I want students to be able to come to my conference and learn about it. At the same time, I realize the reality of the situation and vendors are not going to sponsor my event if all I have is students. Yeah. So, we, we do put a lot of emphasis and a dependency on our sponsors to support our show. But we also make sure they get good value out of it and and we're able to so far do that without charging a high rate. Now, you know, long run will tell whether our business model is real or not.
Mackenzie Jackson: Yeah.
Michael Farnum: We've been able to do it since 2010 and survive and we've grown and it's becoming an event where people want to want to show up and we're, we're getting more and more. I mean, we'll be, you know, three to 3,500 people this year. I mean, that's, it's working, I think. Yeah. It's getting a lot more busy and we're able to do it at a lower rate. I, I'll be completely honest, we had to quit providing food for everybody.
Mackenzie Jackson: Yeah.
Michael Farnum: We, we just can't, we lost money every single year on our tickets and we had to bring in like food vendors and stuff. But saying that you go to Black Hat or you go to RSA or some of those you don't get fed.
Mackenzie Jackson: No. Yeah.
Michael Farnum: And it's still what, $2,500, $2,700 a ticket. So.
Mackenzie Jackson: Again, not to punch anybody in the nose, but it is just.
Michael Farnum: It's working for them. And it's not about saying that like that shouldn't exist. It's just about saying, we just got to make sure that that's not the only option. We got to make sure that that doesn't become like the normal for everyone.
Michael Farnum: Yeah. And I don't I, I have vowed as long as I'm alive and running this thing and my partner, my co-founder's the same way, we will never be that high. That kind of ticket prices. It just will not happen. Yeah, as long as we're able to pay our employees and, you know, feed my family, then then I'll just, I'm going to keep doing it that way.
Mackenzie Jackson: I'm going to briefly interrupt this episode to thank our sponsor of the podcast, Aikido Security. Aikido Security is your complete code to cloud security solution. It secures everything from the first line of code that you write all the way through your supply chain, your dependencies. And of course, Aikido is also a leader in AI pen testing and AI code auditing. So, make sure you check them out today. You can start for free at aikido.dev. All right, enough about that. Let's get back to the episode. Well, one thing too that I wanted this kind of to go into is that you're very supportive of like what you talked about students, grassroots entry, people coming into it, the culture, the community, all of that, providing a, a place where people can come, grow, and learn. How are you like, what's the advice that you have for people trying to get into cybersecurity and trying to get into anything at the moment with AI? Because you know, for, for people that have been in the space a minute, it's kind of like AI becomes a very powerful enabler for them, but it's, it's, you know, it's tough for the juniors out there who are kind of seeing specifically their role. So like I get, I don't, I actually don't really know what I'm struggling to ask a question around it because like where, where do you start? Like, I guess how do you feel about this? What advice do you have? Like, where do you see it? Oh, I guess like 70 questions, but you can probably guess what they all are.
Michael Farnum: I think about it all the time. We, so, the conference started out when it was called HOU.SEC. It was a nonprofit. We created CyberSec Community as a a for-profit in order to be able to be more flexible and do some stuff, but we still have a nonprofit that we partner with called CyberSec Careers, and that's all workforce development and cybersecurity. So, I think about this constantly and it's worked, it's we're working it with students and with veterans, both high school students, college students and veterans to try to get into cybersecurity. And what I've come to realize, especially since AI entered the stage, and I've been called a gatekeeper for saying this, so forgive me anybody if you become offended. I don't mean to offend anybody. Cybersecurity has entry-level jobs. Cybersecurity is not an entry-level career. That's how I see it, especially now with AI taking the entry-level jobs, like the analysts and things. I see master's degree students coming out of college trained to be essentially nothing but an analyst with a master's degree. I literally see this all the time. They go into my user groups and just begging me to help them. And my advice to them is use your skills and go get an IT job if you can get one ancillary to cyber. And it, it sounds a little like, you know, old man get off my lawn type of thing, but like this, I just described to you how I got into cybersecurity is I went in IT first. You have to have fundamental skills and some of the universities don't emphasize experience. They emphasize the just the educational part of it, like the theory part of it, like to teach you some things, but they don't, you don't a lot of them you don't come out with actual practical skills. So I've told them like try to go find an IT job, try to do that. Like you've got it, you've got enough knowledge to do that. Or go to a community college versus a university because a lot of the community colleges actually have practical skills type things they'll teach you and then just be prepared to do some type of IT job and then move into cyber because if you come out with nothing but an analyst type of experience, AI has taken that and you're not going to have basic skills to be able to move to the next level. And I mean AI is taking level one and level two analyst jobs quite easily.
Mackenzie Jackson: Yeah.
Michael Farnum: I see it. I've just worked with a company that replaced a lot. Didn't replace people, but were able to move people up because they put in an agentic SOC.
Mackenzie Jackson: Yeah. This is I've hearing this the word a lot.
Michael Farnum: Yeah. And like and the SOC was the training ground. Like that was it. Like when someone told you that, you know, two years into SOC, it's like, oh yeah, you're putting in, you're putting in the odds. You're putting in the odds, you know, like because that, that.
Mackenzie Jackson: Colleges, yeah. But colleges haven't caught up to that. Universities haven't caught up to that trend.
Michael Farnum: And so they're still teaching these young people and people changing their jobs that you're going to come out of college and you're going to have a $75,000 to $100,000 job right out of the gate and they can find nothing. Yeah. And and they're a little hesitant or a lot hesitant to try to find an IT job because they just spent all this time and money and these are students that are coming here like I talked to going to like University of Houston and stuff that you're coming they're on visas like student visas and like from India and Pakistan and other countries and their whole next step to staying in the United States and getting a job is dependent on them or to staying in the United States is to get a job. Yeah. And they're struggling and they're like, I've got, you know, two months before I have to go back and it's very frustrating for them obviously because they want to have a career going forward. So.
Mackenzie Jackson: Yeah, it's a tough one. I've been in the position of I was in France and you know my visa was dependent on my job and there's nothing like, you know, I moved there with the job and everything, everything was fine, but there is always this change of dynamic of power when you know when you're going in there to asking for a raise, knowing that like, you know, okay, you can find another job but it's very stressful, you got a time limit, you know, like the whole thing, it's, I do not want to be in that position that plus the AI plus that, I imagine it's pretty stressful out there for, for, what, what advice do you have for people? What makes, what makes someone stand out? I mean, coming to these conferences, learning, hearing about it, that's a great step. What, what, like, what can you do to make yourself get ahead of the curve, to stand out?
Michael Farnum: Yeah, I think it's pretty typical, but I think it's a proven, proven thing is to go try to first what you're saying, come to conferences or or go to user groups, like meet those people, but you've got to show some level of experience. So, that doesn't necessarily have to be on the job experience. If you go do something from a home lab perspective, and it's so easy to build these things now. And I really don't go tell them anymore like I used to go, you know, go to and Casey Ellis, forgive me for this. Don't go to BugCrowd and become a bug hunter anymore and stuff like that. I just saw Casey at BSides, he's going to come after me. I mean, you can still do those things, but AI has taken so much of that that even, you know, those bug bounty companies are having to change their model of business to to help companies with penetration testing and those kind of things. So you go do as much as you can, meet with people and learn what they're doing and to like we're doing in our mentorship track at CyberSecCon this year. We're doing home lab. Steven Brenstein that's coming does BSides San Antonio. He's going to teach a couple of classes like level one and level two. Here's how you can create a home lab. If you go build that stuff out and you put some real effort into it, you can put on your resume, this is a project that I worked on.
Mackenzie Jackson: Yeah.
Michael Farnum: And and it's not a lie. It's not dishonest like you worked on this. And if they interview you and ask you about it, be honest with them like this is what I did. But at least you put forth the effort. And we've also got some, one of our scholars at CyberSec Careers that we've gave a scholarship to. He's got an internship with the USDA. This, I don't want to again sound like an old man. This kid, but he's young, like he's really young. He went and pushed and pushed and sought these things out and applied for them and showed that he was curious and showed that he was going to do a good job. That in of itself just, I know there's not an unlimited number of those, but I've got some of these guys that come to me and women that come to me and go, I can't find a job. And I'm like, what have you done to go get your name out there?
Mackenzie Jackson: Yeah.
Michael Farnum: To talk to those people. And they're like, oh, I, I haven't done that. And I'm like, you're not going to get a job if you don't go push that. Like you can't just rely, you can't rely on HR anymore.
Mackenzie Jackson: Yeah.
Michael Farnum: You can't rely on the basic resume and let me go apply for a million jobs anymore. You're going to get massively frustrated.
Mackenzie Jackson: And I think too, like the home lab one is such a good example because I've been to some really interesting talks at conferences by people that are just discussing their projects that they have built. Right?
Michael Farnum: Absolutely.
Mackenzie Jackson: You've got people talking about gigantic research stuff and yada yada. And then you have people that are just talking about here's my hobby thing that I built. Sometimes they're the most interesting.
Michael Farnum: They absolutely are.
Mackenzie Jackson: You know, and so like that's also another strategy like, it's very intimidating especially, you know, if you're kind of pre in the career to come and try and talk, but there are tracks for that at conferences. There's talks for that. And that's also another way I think that you can kind of get out there and you get your name out.
Michael Farnum: We do lightning talks at CyberSecCon and it's you, you can be any level of experience, but if you've got 15 minutes, you want to talk about something that's a perfect place for somebody who's just getting into cyber to go talk about something that they've done. So.
Mackenzie Jackson: And going back to their supportive community and the culture around it. Yeah. I do remember I was at BSides Berlin and there was a talk there, a student, a group of students that had hacked a Tesla to turn on the the heating when, you know, it's a paid extra, whatever, and one of the guys was so nervous, he was he was shaking, like you could really see him shaking and just trying to get into it and that they got the biggest cheer when they finished because that was so cool to see that like, yeah, that was tough for him, you know.
Michael Farnum: That's cool. Yeah, it's, I mean, it's tough at all stages of you putting yourself out there.
Mackenzie Jackson: Yeah.
Michael Farnum: I mean, yeah. I don't Jeremiah Grossman talked about that like he just like he.
Mackenzie Jackson: How many times has Jeremiah spoke at conferences? Like thousands probably. And he's like he still gets stage fright when he goes out there.
Michael Farnum: It's just it is what it is.
Mackenzie Jackson: Probably still finishing his slides 10 minutes before.
Michael Farnum: Oh, I know. I am most of the time.
Mackenzie Jackson: I have, I shouldn't admit this on camera, but I had a workshop this morning and I was sitting there. I was exhausted last night. I was like, "Do I finish my slides now or get up at 5:00 a.m. and try and finish it there?" And I chose the 5:00 a.m. offer and I hated myself for it.
Michael Farnum: But it sounds so good when you're not trying to, when you're like nodding off.
Mackenzie Jackson: Well, look, we, we have to kind of start wrapping, wrapping it up here. But it, it has been a pretty, I know we've gone a lot of directions, but it's really interesting the perspective of kind of having that, that industry experience and sometimes this feels so new and sometimes it's nice to hear that well we this is new, but we've also been through a lot of new things.
Michael Farnum: We absolutely have.
Mackenzie Jackson: So far we've survived.
Michael Farnum: So far.
Mackenzie Jackson: Hey, these models keep getting better. We'll see. For the record, I welcome our new AI overlords. Um, and I say please and all my prompts. So, be nice to me when you plug me into the machine.
Michael Farnum: Okay. Got it.
Mackenzie Jackson: Uh, and we could keep going forever.
Michael Farnum: Oh, god.
Mackenzie Jackson: But I do like to finish up on a little game that we have here called Would You Rather. So, basically going to give you two options. Both are going to suck, but you have to kind of pick one.
Michael Farnum: Okay.
Mackenzie Jackson: So, we'll start off. We'll do a warm-up one here. Uh, what would you rather? Use the same password for everything, but it can be as complex as you like, but same password, right? Or you could use different passwords, but it's all stored in Notepad on your phone.
Michael Farnum: I don't think the first one sucks that bad. Yeah, I mean it's the same for all of them, but if you can make it as complex as you want, I can do sentences that are easy to remember and I can stick some few numbers in there, do some leetspeak in there. I don't think that's bad.
Mackenzie Jackson: Okay, the argument against that, the argument against it is that if it gets leaked in plain text once then, then you're, then you're pretty, for, for credential stuffing.
Michael Farnum: The likelihood of that happening in this day and age, especially when it's they're hashed and salted typically. That's what I'm saying. So, like you can kind of you can kind of talk your way into both of these ones, I think. Yeah.
Mackenzie Jackson: Yeah.
Michael Farnum: The last one would I don't, I don't want it in Notepad, but I guess you can do some crazy stuff with Notepad if I can't use a password manager. I don't know.
Mackenzie Jackson: Okay. Uh, let's do another one here then. Would you rather, uh, have an application completely exposed to the internet with no firewall? So, just all the ports are open. You can't monitor traffic. You can't block any malicious payloads or you have all of your application secrets, your API keys, everything stored in a private Git repository, it's private, but it's in your history. It's there forever. If the Git repository is breached, you're breached. Which would you rather?
Michael Farnum: Oh, that's a killer. I can't monitor the application in any way, shape, or form. It's just out there.
Mackenzie Jackson: No, you just, it's just out there. But you have, but you, like, you can build it really well.
Michael Farnum: I think I would take the first one again because I've, I've been in apps. I, I, I think I can do a pretty good job.
Mackenzie Jackson: This is this was everyone, well, this one's probably 50/50, but I had Tanya Janca on the, on the, on the podcast, major AppSec, and she picked that one too because she was like, "Well, I feel more in control."
Michael Farnum: I, that's where I am with it. I think I could do something with it to make it lock it down. Just not vibe code. Yeah.
Mackenzie Jackson: Yeah. Uh, all right. See, as you mentioned vibe coding, let's do this one here. Would you rather if you had to build an application entirely from scratch and you have two options. One, you can vibe code it. And when I mean vibe coder, I'm not talking about using claud code in an IDE. I'm talking about prompt. No, no seeing the code. What's happening? No seeing it. Like you've got amnesia. I don't know how to code or no AI in building the application. You got to do it character by character.
Michael Farnum: Oh, first one.
Mackenzie Jackson: First one. Yeah. You going to vibe code?
Michael Farnum: I would vibe. Yeah. I don't have, I don't have time for that second one anymore.
Mackenzie Jackson: This answer has changed.
Michael Farnum: I've never been the "must code" either. So.
Mackenzie Jackson: Yeah. Yeah. Me neither. This one has been, this one was like most people when I started the podcast, it's a year and a half old. Nearly everyone was, I don't know if that's correct English or not. Nearly everyone, but whatever. A lot of people.
Michael Farnum: Yeah.
Mackenzie Jackson: Uh picked, you know, building a character by character. Yeah. Almost nobody picks that.
Michael Farnum: To me it's purely a time thing. Yeah. I building some, can I even use open source components on the second option or.
Mackenzie Jackson: Yeah. Yeah. Yeah. Yeah. You can use.
Michael Farnum: Okay. If I can use open source components, I might just use the second one because then I can piece together something without having to remember how to code everything. So, I mean, Vibe Code is a lot of open source components, too.
Mackenzie Jackson: It is, but you just don't know how it's piecing it all together.
Michael Farnum: You don't know the open source components even exist to be honest. A lot of time they don't. I wrote one the other day. I had it pull from a open source and it did a pretty good job with the old pew pew. You remember the pew pew when they came from North Security with the map and all of that stuff. And I had it pulled. It did a pretty good job with it. But, yeah, I did not see any of the code. I was like, it's, it's contained and dockerized in one machine. I'm good.
Mackenzie Jackson: Yeah. Yeah. Yeah. Yeah, for yeah, for sure. Well, look, thanks so much for coming on the podcast. I really appreciate it. It's been a fascinating conversation and, uh, hopefully we're back in the same place again in the future. Um.
Michael Farnum: Another year.
Mackenzie Jackson: Yeah. Uh, but just before we finish up, can you give the dates and locations next coming up for your conference?
Michael Farnum: Uh, September 15th and 16th in Houston, Texas at the George R. Brown Convention Center. Very large convention center. Almost Moscone size if you know that one. So, yeah, September 15th, 16th. And then we've got, um, I don't have dates for CyberHackCon yet, which is the one we do with Phil Wylie in Dallas. And then, um, we've got an OT specialized conference that'll be in April next year as well. So, those are the three dates. But yeah, I'd love to have everybody at CyberSecCon and a cyber without an E because we're cool like that.
Mackenzie Jackson: Very great. True startup fashion.
Michael Farnum: True startup fashion. The domains are much easier to register without.
Mackenzie Jackson: Well, thanks so much. I really appreciate it.
Michael Farnum: Thank you, Mike. Appreciate it.
