Mackenzie Jackson: Hello and welcome to another episode of The Secure Disclosure. James, thanks so much for being here and joining me today.
James Berthoty: Hello, thank you for having me.
Mackenzie Jackson: I wanted to kind of start, probably an obvious place, is kind of how we got here because you're known as a pretty prevalent analyst in the industry now. You run Latio.tech.
James Berthoty: We dropped the tech. We got the big domain name.
Mackenzie Jackson: Oh.
James Berthoty: So, we're ready to rock and roll.
Mackenzie Jackson: Okay, you're just Latio now, I love it. I really like the journey of kind of how you got there because it probably provides a lot of credibility as to what you know. Not that there's anything wrong with the analyst industry, right? We all love Gartner, but how did you kind of end up in this space?
James Berthoty: Yeah, I mean, when I was a cloud security engineer at all kinds of companies, I worked at a managed services company that was helping companies from Fortune 500 down to SMB. But then also working for some Fortune 500s, in all sorts of different types of companies, and I was making all of these buying decisions about cloud security tools, application security tools, security tools. Really, I didn't know what companies like Gartner were or why people use them. Occasionally, maybe an executive would bring it up, because I just wanted tools that would solve my problems. As part of that, I would always get so frustrated going to any of these different marketplaces, and now there's even more of them with AI coding and everything. It was just so hard to find the tool that I was looking for, something like an AI pen test for example. All of a sudden everyone's an AI pen test, and how do I even know what counts, what doesn't count? I really started trying to share my own categorizations, my own thoughts on the industry, and then from there realized that it was just this giant missing part of the market, of being a practitioner-speaking analyst firm that can help connect the dots from buyers to practitioners to vendors to understand who are even the most relevant people to look at within this segment. So, since I left my full-time role, which was a lot of FedRAMP in a SaaS environment and I wouldn't wish that upon anyone ever again...
Mackenzie Jackson: You just gave me anxiety the moment you said FedRAMP.
James Berthoty: It was very scary, and they're loosening the rules up so it's less scary, but I have the battle scars from when it was the real FedRAMP. About two years ago, I left that and started Latio as a full-time thing to help people find the relevant tools that they're looking for.
Mackenzie Jackson: Yeah, and I think what's something that's interesting is, when Latio kind of started, especially as an independent thing, it was right on the cusp of the AI revolution in this space, like right when it stopped becoming marketing and actually becoming real.
James Berthoty: Some of the early Latio sites, you can see ChatGPT's progression in code quality as the Latio site improved early on.
Mackenzie Jackson: Yeah, we're all like that. It's like, you can see how it's moved on. But what has been one of the most interesting developments from your perspective, with your background here, of where AI is actually making a game change? Because at the start, it felt like everyone just threw AI in there in the easiest possible way, which was pretty much for everyone, "Here's an alert, ChatGPT analyze this, provide more context." Where are we actually seeing meaningful change in the AI space right now?
James Berthoty: Yeah, I think it's interesting, even we're in the middle of research for our next AI security report, and during one of our calls, someone pointed out how insane it is how much things have changed from even last year's report that they were looking at. My thoughts were exactly that, where with AI, the risk for applications like ChatGPT is near zero because you're just asking questions, you're treating it like Google. We don't monitor employees' Google searches as though something crazy is happening. But it goes from that near zero risk to crazy high levels of risk the second we allow these things to start entering CLI commands and taking actions in an environment. What was hard about early AI security was it was mostly around DLP use cases to look for things like, "James put his social security number in a chat," and that's not good.
Mackenzie Jackson: Right.
James Berthoty: To now we're like, "Whoa, James's agent could take down the prod database, and we should probably figure out how to control that." I think we've seen such a rapid evolution, even in the ChatGPT browser use case, people don't really talk about that as much anymore. Now it's all about CodeX and Cloud Code, Cloud Co-Work. When we give these agents actual compute, now there's actual risk to track, and we've seen this new evolution of security solutions to try to deal with, now that these agents live on endpoints, how do we secure them? I think, even more high-level than that, about AI security as a whole. I was very close to the cloud security adoption early on. What surprised me about AI is it's much more of an executive push from day one than cloud was. Cloud had sort of this slower adoption curve as teams got comfortable with it and migrated. But there's this mandate from a lot of executive teams that if you're not adopting AI, you're a dead company, is how they view it. So, I've just been shocked by the number of teams who are willing to rethink their entire security program in light of AI. They're like, "Do I even need a SAST SCA scanner? What does a scanner even do now that we're deploying code so quickly in an entirely different way?" It's leading them to rethink almost every aspect of their security program, and there's such a willingness to throw out old tools, adopt new ones, and figure out the right stack that it's really been pretty crazy to see how quickly it's happened.
Mackenzie Jackson: And where are you at in that throwing out old tools kind of journey? Because it is something I think, from the vendor perspective, I put my little vendor hat on, there's a real need every time a marketing announcement comes out from one of the big models to very quickly say, "No, we're still relevant. We're still doing it. SAST is still important." But I think if we just remove all of that, I mean, I have to do it, is there still a world where SAST SCA scanning is needed? Is it more important? Is it more often? How does that future exist?
James Berthoty: That's even, it's so much of the goal of Latio as a whole is to provide people tailored recommendations for their environment. Because every single security team is so different, that makes even answering something like that really challenging, because if I'm at an SMB AI native startup, I probably don't care about SAST, SCA, ICIA, all the acronym soup, because I can just do automatic code reviews in the pipeline or some of the pre-code generation analysis where I'm doing it all as the code's getting developed and that's totally fine for me. I can accelerate and sort of shed the weight of all of those past false positive amounts and huge amounts of issues. But if I'm at a giant regulated enterprise, I can't just be like, "Oh, we don't do CVE tracking anymore. Now we just do this cool AI native stuff." That's really where we're in this mix of, what does it look like for teams of different sizes to adopt this tooling in a way that makes sense? To connect back to this, we just did an article on the Hugging Face OpenAI attack incident, breach, whatever.
Mackenzie Jackson: What do I call it? I don't even know what to call it.
James Berthoty: Yes. A lot of the think pieces on that are like, "What are AI attacks?" whatever, but every single part of that attack is stopped by a rather boring, overlooked, existing technology, whether it's Kubernetes security, AMI management, network security controls. It was a combination of the agent doing really sophisticated attacks, but it took advantage of very well-known vulnerabilities and misconfigurations in cloud environments. So, I do think it's a little bit of a shame that every vendor in the security industry is having to pivot into AI agentic security whatever, when we have these existing problems that are actually the solution to stopping the breach.
Mackenzie Jackson: Well, let's talk about stopping the breach then, because you made the mistake of bringing up the Hugging Face thing, so now I'm just going to jump on that. That has kind of shaken me a little bit. A number of things have kind of shaken me from it. One was the non-malicious intent of the AI agent. It's kind of like, I think you could understand if an AI agent had been given malicious instructions to do something. At least I kind of know why it did that. But here it wasn't being malicious, it was just cheating. Or not even cheating, how do we stop that? How do we stop those kind of breaches? Because this won't be the last that we're going to hear of this kind of, I don't even know what to call it, non-malicious attack.
James Berthoty: And I'm for sure seeing it more and more often as I talk to teams at enterprises, different people in accounting, people in marketing who are adopting AI tooling. They are spinning up websites and taking actions in ways that they would have never done before. Even something as simple as competitive research given to Claude code can get into weird spaces around what the AI agent is doing versus what it's not. I think what's really challenging is you have one perspective that's like, AI security as an emerging category is about how do I govern the agents within my own environment? So that's where you're more focused on the intent of the agent and how do I make sure that Mackenzie's agent doesn't go and try to take down our prod DB by accident just because he asked it to change a color somewhere and then all of a sudden it's reconfiguring the whole website. So, that's one piece of it. But then on the defender side, there's a lot of sort of abstract discussion in a way that I try to avoid from an analyst perspective, of like the guardian agents model, and there's blue agents stopping the red agents, and they're all fighting in real time, because that's just not, there's no magical these things are fighting each other. The agent is just a really fast attacker taking advantage of systems that when I used to do these risk assessments, something that's near and dear to my heart is Kubernetes security has always been overlooked. We used to grade those types of attacks as nation-state level threat actors would have to do it. So, we deprioritized those initiatives because the risk of getting attacked by a nation-state for a lot of smaller mid-size businesses is just not that high. But now an agent can accidentally do a nation-state level attack into an environment. So, it just raises the stakes on all of the defender initiatives. When we think about things like AI for blue teams, it's not so much this hacker wars fighting each other. It's more how can we use AI to implement these controls and patching frameworks that we know we should be doing, but implement them faster and at a more reliable scale.
Mackenzie Jackson: Diving on that blue team that you just mentioned there, and just sticking to the Hugging Face, it said this breach was ultimately stopped from another AI analysis that was being done on there. And that analysis wasn't able to be done in the major models because of the guardrails that come up here. So, I'm curious to know what's your opinion about guardrails in these AIs? As in, because they're up there to prevent black hats, they're up there to attack, but it kind of limits the defenders, and the attackers are going to find a way around it anyway. I'm curious.
James Berthoty: Yeah, I've generally avoided a hard position on this because I think a lot of people's political leanings get involved. Where it's more like if you're a libertarian kind of person and you want people to have access to all of these tools, that sort of feeds your ideology on everyone should have access. But then on the flip side, there are good arguments to limit some of these capabilities, right?
Mackenzie Jackson: Yeah.
James Berthoty: And I think even an interesting subpoint there is the first generation of AI security tools were basically ways to do prompt injection prevention and try to detect those things. Whereas the model providers are now baking a lot of that prompt injection into their own models. So, it is a really sticky situation of, where should the model push back? Where shouldn't? What should it or shouldn't it allow? I have to imagine that I got accepted into Anthropic's safe usage program. I assume they have AI reviewing those because I got accepted really quickly to it. I think that's an okay way to handle it. But I'm very sensitive to the fact that this is a new frontier. At the end of the day, it's really annoying to not be able to do your job with the frontier models as you're getting attacked by stuff. So, in general, I'm a fan of being able to do the stuff that I want to do, but I don't have much deeper of a thought than that.
Mackenzie Jackson: No, I get it. I think for my personal experience, today I'm delivering a talk on prompt injection, and how I've always kind of done this now is I have a design guideline that I put in, change all my slides around for this design guideline to make them all, you know, just a bit more readable. Because my slides were on prompt injection, I'm now banned from Chemnitz.
James Berthoty: That's where I am. A lot of security people enjoy poking at the holes, and I'm no different with that. But even along the line of, I remember Aikido's research on CI/CD pipeline discoveries where a lot of companies of all sizes were running models in their pipelines that could ingest from GitHub issues. I think that's really the issue is, it's just we've had this AI adoption at all costs sort of mentality without thinking about the new input vectors that are available for that. And yeah, that's what creates the challenge.
Mackenzie Jackson: So, what is kind of the most interesting evolution from the tool set that you come? You've mentioned about AI pen testing. We're kind of in this AI code reviewing space. What's like what really excites you about what's out there? It doesn't need to be the most important tool to have right now, right? Or something. But what's this tool?
James Berthoty: Yeah, yeah, yeah, yeah, yeah. And if as long as it's Aikido, it's fine to say no.
Mackenzie Jackson: One of the several tools available on Latio.com's marketplace. I want to briefly interrupt this episode to thank our sponsor of the podcast, Aikido Security. Aikido Security is your complete code to cloud security solution. It secures everything from the first line of code that you write all the way through your supply chain, your dependencies, and of course, Aikido is also a leader in AI pen testing and AI code auditing. So, make sure you check them out today. You can start for free at akido.dev. All right, enough about that. Let's get back to the episode. But like what's exciting you as a category that's coming out?
James Berthoty: I do think, whether or not we call it a new category, right? Like application security got bundled into ASPM in a weird way. Now I use agentic code security, other great analysts are doing agentic development security. There is a real opportunity happening to make software more secure more quickly. That's sort of scary from the vendor perspective because you're having to throw out a lot of these existing scanners that have become very robust. But the true opportunity is to implement your threat model in every code change. It helps security engineers take a step back in a way. Most people build their application security program from the inside out where they go and look for a vendor that does SCA scanning, is usually how it starts. Then they find all these CVEs, then they discover what software packages are, then they discover the difference between a SAST and an SCA scan, then containers, and then they're sort of unraveling this complex thing from the inside all just to say, "Oh, when it comes to SQL injection, we need to standardize on a library that prevents SQL injection." I think the opportunity here is to flip that paradigm to where we take threat modeling first and say what do we want our approach for SQL injection prevention to be, what do we want our patching cadence to be, our malware prevention strategy, and then you just prompt those into the threat modeling system. Then the AI coding agents basically just becomes this continuous developer security training where rather than every one year where the devs sit bored out of their minds getting talked to about security stuff, it's baked into the agent's context window on every single request to just say when you're doing this type of coding practice use this library. It's an opportunity to sort of standardize our code and create more secure software by default. I'm really hopeful about that flip happening where application security specifically becomes less of a reactive discipline and more of a proactive opportunity.
Mackenzie Jackson: I think that's a great way of putting it. I think along those lines, as you mentioned SQL injection, something that I'm excited by, this is one of the things that grinds my gears more than anything, is that SQL injection was coined in 1997.
James Berthoty: Look, if JavaScript developers would stop releasing new ways to do SQL stuff.
Mackenzie Jackson: But why does it still exist? I'm kind of optimistic that if we do have these models that hopefully some of these coding issues can actually start to be eliminated from the source by these. Now it doesn't mean that all it means security will probably shift into other areas, but at least we can kind of get rid of that space.
James Berthoty: And this is exactly when it comes to what's the most exciting trend, it's two things. One is the attacking side, the AI pen testing that constantly runs that Hugging Face as a simulation constantly on your environment, see what's there. But then the exciting opportunities around design across your infrastructure because I think the most fulfilling security work that I've ever done is doing cloud security architecture and software security architecture and all of that.
Mackenzie Jackson: Yeah.
James Berthoty: The opportunity with AI is that we can abstract away a lot of the day-to-day work that makes that not possible to do.
Mackenzie Jackson: Right.
James Berthoty: And instead you can do anything from the preventative cloud security startups that are all a thing now around trying to help implement data boundaries and SCPs to create a more structured isolated environment to on the software side that threat modeling first approach. And then even like detection engineering, when it becomes less about it taking a whole week to write a single detection rule in the SOC and it becomes more about what detections do we even have, what coverage do we have, and the writing the rule just becomes abstracted away. Hopefully it leads to a place where people can do the more fulfilling security work and not the dystopian view of everybody gets fired.
Mackenzie Jackson: Yeah, yeah.
James Berthoty: I realize I was presenting a pretty positive outlook on what AI was doing.
Mackenzie Jackson: Yeah, like I go back and forth between dystopian and extremely positive on a daily basis. It's quite a journey.
James Berthoty: I think. Yeah.
Mackenzie Jackson: Then Anthropic does something that kind of like, wait, is this going to destroy my job?
James Berthoty: Yeah, it's crazy. One of the biggest shifts that I'm tracking is the number of development teams that are getting tracked on their token spend as a positive. So, you're looked at as a bad developer if you're not spending the most amount of tokens possible. Certainly at some point that's going to have to shift in some way towards cost savings and how do we route these tools properly and using things like LM Gate and proxies to do stuff. But yeah, it's a challenging time to figure out how that all shakes out.
Mackenzie Jackson: For sure, and it's a time when in security it feels like you have to be particularly nimble in terms of and being okay with throwing away something that you've built that's been working because it just may not, throwing it away, but you know, just understand that that's probably not going to be the selling point anymore.
James Berthoty: That's what I mean. It's a totally insane time working with teams and their willingness that I've never seen before to pivot solutions because it used to be like a vulnerability scanner's a vulnerability scanner. How much better is the next one really going to be? A lot of the scene apps sort of started blurring together as far as what's the feature set? It's become very nuanced. Is this more of a runtime thing or more of a posture thing? But now with AI, there is a willingness to, do we need to do this anymore? Because we can. Finding misconfigurations in your cloud environment is now just a prompt away. It's not needing to go acquire a vendor to go do it. And so it becomes more about that architectural decision.
Mackenzie Jackson: I want to kind of shift into a different area now because something that's been dominating the headlines for the last year and taking up a big chunk of my life is supply chain security at the moment.
James Berthoty: Finally, it's about time it took up more space for people.
Mackenzie Jackson: Well, it hasn't been that enjoyable to be honest with you, James.
James Berthoty: Yeah, that's true.
Mackenzie Jackson: But why from your perspective did this take such a dramatic increase recently? The risk has always been there. The attacks have always been there. Four, five years ago I think was UA Parser, and then we had Event Stream before that. We've had examples.
James Berthoty: And SolarWinds was the biggest.
Mackenzie Jackson: Right, SolarWinds, but nothing like what we've seen now in terms of the just the constant velocity of it by different threat actors taking it. We'll talk about how to prevent this later on, but what's the catalyst that do you think made it such a predominant threat?
James Berthoty: Yeah, I think there are two. One is the actual security concern which is more than nation-state kind of stuff. XZ Utils is the one that always breaks me out as the biggest scary one because it was caught by a super nerdy, good in a good way, completely clearly, we're all engineers, benchmarking SQL statements and then the execution time and noticing the difference and then discovering this nation-state level phishing campaign basically through that discovery mechanism. I think what's scary about that is how many more things like that are out there. The only way to catch that is a super advanced runtime monitoring of your packages. So that was just such a wake-up call for a real security perspective. But then this giant wave of now supply chain malware is a constant thing is I think Team PCP sort of trollingly popularized so many of these things. A lot of hacker culture is very trendy following, fun, trolly stuff. So they're just finally realizing the other side of why it's limited is these attacks do require knowing how to code to do, which is a real barrier to entry for script kiddie level attackers. But now with AI, it's very clear that they're using AI code-generated tools to write most of these exploits and learning how to code as they're doing it. A lot of those things are combined to create the barrier to entry is much lower because anybody can code with a coding agent. Then the popularization has just hit record highs because it was such a, I mean, we had security vendors getting breached for this stuff. So it just became such a clear opportunity for people to just wreak havoc.
Mackenzie Jackson: Because we were never breached, we were targeted heavily during this whole thing. It was weird because Team PCP were making nice tweets about us at one point, whilst we were also knowing that they were very actively trying to break into our system.
James Berthoty: Very strange. And that's even, a lot of the motivations behind these are still very unclear of what they're doing with a lot of these stolen keys and data besides defacing companies for the most part. But there's also not a clear outcome, which is why to me again, the scarier things are those long-standing either low maintenance or almost unmaintained packages that have sort of skirted under the radar and we don't actually know who owns those anymore. And those become really scary attack vectors. And then on the other side, CI/CD pipelines, just like my Kubernetes security thing, CI/CD pipelines are super difficult to monitor especially at runtime, and they've gone unmonitored for so long. The other thing I want to say about this too is that the number of companies actually doing novel discovery of this malware is actually really small. Like you guys are one of them, but it's a small community of researchers that are doing this work. That sort of, I think the average person is always like, "Oh, how does this happen to this package, register, or whatever?" and it's like, there are like 10 people doing this. It's not like some massive crazy effort that's happening.
Mackenzie Jackson: This week I've managed to put a lot of those 10 people in one room. So we've got Socket, Ox, Step Security, and Open Source Malware to do one podcast together, so I think that's kind of cool.
James Berthoty: It's honestly a very different muscle to exercise than vulnerability disclosure, and I think a lot of security teams don't understand the difference fully between a vulnerability and a piece of malware in their open source packages, and I've been super encouraged to see that community develop because it's almost like an OWASP for incident response that has to happen, where it's a group of people doing incident response in the open to benefit everyone rather than just within a specific company.
Mackenzie Jackson: Yeah, yeah, I think definitely. And we've just seen some announcements too, of like NPM doing this. One thing that I kind of, who ultimately bears the responsibility for trying to solve this? Is it the responsibility of the select few vendors that are doing? Is it responsibility of the ecosystem? How do we, from your perspective, how do we solve that? Does it get solved from NPM, or does it get solved from other areas?
James Berthoty: Yeah, I mean, it's a very difficult decision that ultimately is in Microsoft's court to solve, but there are real trade-offs is I think what a lot of, it's easy to sort of sit back and say like, "Oh, why don't they just block all pushes or whatever?"
Mackenzie Jackson: Yeah.
James Berthoty: But it's like, open source exists because the barrier to entry is low. People love being able to share code quickly and freely. AI has only made that more important for people to have rapid access to be able to share resources. And trying to do that in a secure way at scale when you're dealing with people who have very strong beliefs about. Like, you look at, if you start pulling the thread on open source license types and agreements, that's its own super convoluted, highly opinionated decisions within those communities. And trying to unify all of that is an extremely challenging thing to do. Combined with novel malware detection is just really challenging. The approaches of doing it runtime have existed, but doing it at the scale of something like an NPM is really challenging.
Mackenzie Jackson: Yeah.
James Berthoty: But then on the like, using AI to do malware analysis is hugely freeing and makes this, it's a net new capability in general because otherwise you'd be running like obfuscation detection scans statically, and those aren't great from a false positive standpoint. So, it's just now becoming a solvable challenge in the first place.
Mackenzie Jackson: I want to kind of like start to start to wrap things up, but one thing that I would be remiss to not asking you is kind of where do you see the future a little bit in this space? Because one of the things that is, things are evolving so quickly here that we can, like tools become redundant like within a couple of years of that whole category being created. Is there a category of tools that maybe doesn't exist yet, or something that you're thinking about of when you look into the future, you know, three, four years ahead that you think this is kind of, I'm asking you to predict the future which is a ridiculous thing to do, but you know, like you came on my podcast so I ask the questions. But what do you think in the future will be the attack vector? Not necessarily tool, right? But what's the attack vector that we're all dealing with that perhaps is in its infancy or where we're not even kind of aware of yet?
James Berthoty: Yeah, I think what's really, I usually especially when we're working with customers like trying to separate out go to market from product, and in security those are unfortunately two things that are less tightly intertwined than you would want.
Mackenzie Jackson: Yeah.
James Berthoty: Because I can give you a lot of very technical products that are very cool that help with a lot of this stuff. I love a lot of the, what do you call it, ADR, CADR, like advanced runtime tooling that is the answer to these problems because you can block novel zero days as they're happening in your environment. There are a lot of challenges that teams have around getting the political buy-in to deploy agents or wrappers or like you guys have Zen. Like there's a million, there's a lot of non-technical challenges to a lot of the best security solutions. That's what makes the trade-off really challenging, is we have a lot of the technologies that we need to do this, but there are a lot of other things that make it hard to do it. But when it comes to what sorts of capabilities are emerging or are people paying attention to? There's a lot of focus on the endpoint at the moment, which I'm very grateful for, like developer endpoints have been super under-secured for a long time. I got into security via the IT route. Every time I hired a developer, they would ask me not to install Jamf on their laptop because they didn't want to be monitored. They didn't want to be slowed down. They didn't want EDR or anything on there.
Mackenzie Jackson: So, a lot of the governance capabilities were like, you know, we're going to make sure the accounting team can't access these websites, have to put in a ticket to install anything. Meanwhile, the dev's off like NPM installing everything in the world and just letting it rip.
James Berthoty: I think that's the success in this category, it I think inspired a lot of people to build solutions to address this unmonitored gap, whether it's from the agentic AI perspective because MCPs are really just NPM packages most of the time.
Mackenzie Jackson: Yeah.
James Berthoty: So, there's a tight coupling of these developer security tools with AI security tools. And I think it's just focusing more holistically on how do we protect developer endpoints, CI/CD pipelines, and Kubernetes clusters is sort of that underlying layer that has never gotten the attention that it needs.
Mackenzie Jackson: Yeah, yeah, yeah, for sure. Well, we have to start wrapping things up now, but I'd like to finish off on a game. It's a very crappy game, but it's my favorite.
James Berthoty: Good pitch.
Mackenzie Jackson: So, the game is called Would You Rather. I'm going to give you two terrible options and you have to pick one.
James Berthoty: Sounds good.
Mackenzie Jackson: So, the first option is, would you rather have all of your dependencies pinned to the current version and you can never upgrade them? So, you see the CVEs come in. Like yeah, right, yeah. Or auto-pull the latest version immediately?
James Berthoty: There are two kinds of security person, there is. There's the kind that works in like a big enterprise and has a lot of GRC concerns. And then there's like fun DevOps person that's like just letting it rip. And I definitely fall on the let it rip side.
Mackenzie Jackson: Let it rip. Just pull auto-pull the latest.
James Berthoty: You sort of deal with, if you got good runtime monitoring, you know.
Mackenzie Jackson: Yeah, I guess the theory that you can't kind of, you know, like that the answer to this question has changed over the last seven months as the time from exploiting a CVE is now zero days, right? You know, like, that's the under...
James Berthoty: Well, sorry, that's like, I just realized like Cloud answered so many questions with like, and that's the part nobody's talking about. But it's like, that's the part nobody's talking about.
Mackenzie Jackson: You're right about the, yeah, there is a real tension between patches fast as possible and, "Oh, but not too fast because then malware gets in." All right, what about this one here? You are, you're working on an application. You have all of your secrets, your API keys in a .env file in a private Git repository, but they're all there, all in the history, can't get them out.
James Berthoty: Sick.
Mackenzie Jackson: Yeah, nice. Fun times. Or your application has absolutely no firewall? So, there's no way to block malicious traffic, block malicious pay requests. Which one do you want?
James Berthoty: To have like EDR instead? Because now I can have no laugh and it's okay. If I have to have, I can't answer. That's too, there's just not, it depends on like what, there's too many variables.
Mackenzie Jackson: It's just, it depends on what secrets, right? Like if it's just a bunch of like old secrets to nothing, sure. But if it's some live ones to a...
James Berthoty: It's two cloud secrets. In a private repo, yeah. We'll let it...
Mackenzie Jackson: You let it rip?
James Berthoty: We'll let it slide. That's fine. Better than just leaving your front door open to anyone.
Mackenzie Jackson: All right, we'll finish on what is typically an easy one for most people, then we'll move on. But the last question here, what would you rather, if you could either, you either had to vibe code everything?
James Berthoty: Okay, that doesn't sound that bad.
Mackenzie Jackson: Yeah, yeah, yeah. Or code everything character by character? But by vibe coding, you can't edit anything, you can only and you can't see the code, right? You're unlovable.
James Berthoty: Yeah.
Mackenzie Jackson: And you just...
James Berthoty: I like that part.
Mackenzie Jackson: Yeah, yeah, yeah, yeah, yeah. I had to make it a little bit challenging for you.
James Berthoty: The problem, I would just be very limited by my actual developer skills if I had to code everything by hand.
Mackenzie Jackson: Yeah.
James Berthoty: I luckily became a stronger and stronger developer as the models were getting stronger. So I had a smooth transition experience.
Mackenzie Jackson: Yeah, I always used to call myself a Stack Overflow developer. Like before this, it was basically like, you know, when you the memes of like, you just take a bunch of code, you have no idea what it does, but it works.
James Berthoty: You can ask my old coworkers about our vulnerability management scripts, and they'll tell you my coding...
Mackenzie Jackson: I'll get them on the podcast next. But James, thanks so much for coming on. I really appreciate you spending the time with me and showing your insights. We'll see you hopefully again in the future.
James Berthoty: Yep, thanks, man.
Mackenzie Jackson: Cheers.
