Mackenzie Jackson: Hello, everyone. Welcome back to another episode of The Security Disclosure. I'm thrilled to be here with Roeland.
Roeland Delrue: Hi.
Mackenzie Jackson: Thanks so much for joining me here today.
Roeland Delrue: Of course.
Mackenzie Jackson: Yeah. Easy.
Roeland Delrue: [laughter]
Mackenzie Jackson: I want to kind of get into some of the supply chain stuff at the moment. It's very topical. But I think at the start, probably a little bit about how Aikido came about. It feels like a lifetime, but it's only three or four years old since it was...
Roeland Delrue: The idea's about four years old. We're May now, and then this time four years ago, we were working out the idea.
Mackenzie Jackson: Right.
Roeland Delrue: Then we started a company in October, so like three years and a half ago, if you will.
Mackenzie Jackson: Why did this company start? So, a security company, yeah.
Roeland Delrue: It's kind of a scratching your own itch story, if you will. We've been building software for the last 15 years or even the time before Aikido. And we had to do security. We were building applications. We were hosting them in our cloud. So, we had code scanners, cloud scanners, dynamic scanners, static scanners. And, yeah, we didn't particularly enjoy using them, to say the least. They produced a lot of false positives, a lot of maintenance. They're also just many to manage. We had a person for it, a security engineer. And that person actually quit his job after a while because it's such a mundane thing to cobble it together, and then, you know, you're a security expert and spend your time triaging false positives. That's not the most exciting thing in the world. And it was basically at that moment that we realized, "Is this it? Is this the state of software security?" And that's what triggered us to start exploring the idea of Aikido, and then we got to it. And then, yeah, basically decided to go for it, yeah.
Mackenzie Jackson: Yeah, there's so much in the platform to tackle, but the reason I want to focus the conversation on supply chain is it's kind of crazy
Roeland Delrue: [laughter]
Mackenzie Jackson: at the moment. And I want to kind of just focus on that one topic. But one of the things that I'm very curious about from your perspective, throughout Aikido, we've been focusing on the supply chain as part of the product for a while, but it feels like there's been a pivotal moment in the last year or so.
Roeland Delrue: For sure.
Mackenzie Jackson: What do you think has kind of caused that? Why has there been such an increase in these supply chain attacks?
Roeland Delrue: Typically because it gets in the news with examples of a lot of damage. Maybe to go back in time a little bit, the first time that we all started worrying about open-source dependencies in general was when the Log4j thing...
Mackenzie Jackson: Yeah, that's right. Yeah.
Roeland Delrue: And all of a sudden, the world realizes, "Oh, I have dependencies." And, "Oh, if there's a nasty vulnerability in it." And that's kind of when a whole slew or a whole motion on the SCA or the dependency scanning started. And I guess this is kind of like now the malicious version of it because Log4j wasn't malicious by nature, or not with a bad party behind it, versus now the malware, it's kind of a different flavor but with that malicious intent. And so now it's getting in the news with lots of examples of lots of companies having a really tough time. So, you know, people are thinking, "I don't want that to happen to me." So, yeah.
Mackenzie Jackson: I'm going to briefly interrupt this episode to thank our sponsor of the podcast, Aikido Security. Aikido Security is your complete code-to-cloud security solution. It secures everything from the first line of code that you write all the way through your supply chain, your dependencies, and of course, Aikido is also a leader in AI pen testing and AI code auditing. So, make sure you check them out today. You can start for free at aikido.dev. All right, enough about that. Let's get back to the episode.
Mackenzie Jackson: It is interesting that the open-source dependency model, malicious or vulnerable, is one of those areas where you can do everything correct as a company.
Roeland Delrue: Yeah.
Mackenzie Jackson: Right? You've got great security. Your security guy's triaging like an animal.
Roeland Delrue: Yep.
Mackenzie Jackson: And then you still get, and we've kind of seen it recently with great companies, Microsoft, their source code...
Roeland Delrue: Yeah.
Mackenzie Jackson: Leak, you know, as a result, not because Microsoft was necessarily doing anything bad, but because one developer...
Roeland Delrue: Yeah, yeah.
Mackenzie Jackson: Saw one dodgy thing.
Roeland Delrue: Yep. Yeah, for sure.
Mackenzie Jackson: What is kind of the catalyst before the malicious areas here? Do you think that AI has had a big impact in the types of people that can create malicious packages? Because we've seen such a skyrocketing amount. Or do you think it's, as you said before, the fact that there's a lot of news coverage on that, people are getting a lot of ideas?
Roeland Delrue: There's definitely a rise. We scan all of these open-source systems or ecosystems like NPM, PyPI, Chrome extensions, and all of that good stuff. And about this time last year, we were scanning about 30,000 a day. Right now, we're scanning 100,000 a day. How much of those are AI-created? It's hard to pinpoint, but...
Mackenzie Jackson: Yeah.
Roeland Delrue: For sure, it's not going to triple because people started working harder, you know? So, for sure, it has to do something with it. So, that's one thing. Security in general is also like this endless cat-and-mouse game that will never stop. It's as old as humanity. And then it moved into the digital space, and now within the digital space, it has its own mini worlds or even universe, if you will. I think the attackers started to learn that's a great new way of a new attack surface that can be used or abused, and then specifically also the developer machine being part of that, or being a potential victim or a potential way of getting in. So, it's evolving. There's also a lot more usage of all of these types of packages. There's more extensions than ever. There's more AI skills than ever. There's more, and yeah, that's how that came to be.
Mackenzie Jackson: Yeah. You touched on something that I want to dive into, and that's the developer machine. So, it used to be that these vulnerable open-source packages, Log4j, it was about remote code execution on a cloud account essentially, is what that, and now we have followed that same path. It was mostly about attacking cloud infrastructure. But now there seems to be a shift in the target going to the developer themselves. Why do you think that shift has...
Roeland Delrue: It's a treasure trove, or maybe as we've potentially also gotten better at protecting the clouds, attackers have moved on to the next best thing. And then they probably looked at the developer machine and were like, "Hmm, there's a lot of interesting stuff on that device that we could use." And it turns out that the traditional endpoint security, if you want to call it like that, the McAfee's, the Norton's, the CrowdStrikes – I mean, there's many of them out there – they will scan your laptop device for the compiled stuff, the executables. But what they don't scan for is all of the JavaScript stuff that you install. And with stuff, I mean Chrome extensions, VS Code extensions, whatever NPM packages and stuff you have, because typically these things are JavaScript-based, and the old-age endpoint scanners don't scan for this JavaScript-based extension stuff. And it's also hard for MDMs or these traditional endpoints to block it because you can block VS Code, but you cannot block them from installing extensions with these traditional endpoints. And so that's kind of what led us here, you know, to create a new-age type of endpoint security, particularly focused on that developer machine to protect against attacks that will use and abuse secrets that they can find or packages that they can then abuse. Yeah.
Mackenzie Jackson: Yeah, it makes it kind of terrifying to know that I mean, if you look at a developer, you're installing so many of these open-source dependencies just when you build something on your local device. And a lot of the malware runs on post-install scripts, so it's kind of like the project doesn't even need to be running. It just immediately when it...
Roeland Delrue: [laughter]
Mackenzie Jackson: When it kind of goes in there. Why is it so difficult for traditional endpoints to detect that? You gave the example of the VS Code extensions, but why can't we, why can't traditional ones block just malicious packages?
Roeland Delrue: It's a different type of engine that sits behind it. So, the engine to scan NPM packages, Chrome extensions, and the traces that you're looking for, and the type of exploits to recognize those, it's very, very different than scanning executables or compiled pieces of code. And it just, I think the old-school endpoints or the traditional ones never got to that part of the attack surface. In the world, if you look at all of the devices, it's maybe a small percentage, and companies in general often even don't have developers, right? They have regular employees that don't have any software building activities at their company. But then if you zoom in on that world of software development, and then all of a sudden you realize, "Oh, there's a lot there." It might not be percentage-wise in the world that big of a group, but they do hold onto some of the most sensitive information. And so, I just think they didn't get around to it, or not yet. But you can tell that they're trying to catch up. Like there was a company doing this called Koi, K-O-I. They got bought by Palo Alto Networks, for example. So that's the signal that you can see where the big guys are like, "Oh, we need this as well." So, here we go.
Mackenzie Jackson: It's that kind of mask that you're talking about, right? Attackers have shifted, and now we're all trying to figure out how to do that. So how does the kind of device security work from Aikido's point of view? You know, we kind of mentioned that we're not going to go too much into an ad, but I think it's important to know how does the technical work? If I'm a developer and I'm trying to install something that's malicious...
Roeland Delrue: Yep.
Mackenzie Jackson: How does that actually stop it?
Roeland Delrue: Basically, to put it simply, it's some type of firewall or a proxy. It will literally monitor the traffic on the machine. It's an officially recognized certificate-enabled app that you install, basically. Most people will roll it out with an MDM and force install it on laptops and devices. But basically, it's going to monitor all the traffic, and then the moment it sees the traffic is pulling from NPM, Chrome extensions, whatever the ecosystems are, that's when a check will happen on, "Okay, what is this package?" And it will be cross-referenced with our database, basically, to make sure that there's not a hit. But also, what is actually a very effective way of not getting exposed is setting a minimum age or like a cooldown period.
Mackenzie Jackson: Right. Yeah.
Roeland Delrue: Because malware typically only lives anywhere between 30 minutes and maybe three days, maybe a week if it's really good and not getting detected. And then NPM or whatever ecosystem will take it down. But it's always that window of time, and you have to be unlucky that you kind of pulled within those 24 hours, 48 hours, whatever. And so, besides bringing that back to the endpoint, besides blocking the install of a malicious version, you can also just block installing any new package, and they have to be at least 24 or 48 hours old...
Mackenzie Jackson: Yeah.
Roeland Delrue: As a minimum age, and then that effectively, you know, protects you from 98% or, I don't know the percentage. I'm making a guess to me here.
Mackenzie Jackson: We, you know, you can kind of relate back to it. Like, one of the biggest examples of like chalk and debug when they got compromised...
Roeland Delrue: The whole thing, complete account takeover, all that. The whole thing, four hours.
Mackenzie Jackson: Yep.
Roeland Delrue: Done.
Mackenzie Jackson: Yep.
Roeland Delrue: You know, and that was actually quite long because he lost access to the NPM account. So then, you know, it... But that kind of goes to show that, all right, if we just, if we just wait a little bit. So that's... So here, it's kind of like counterintuitive. Like, there's a very complex process of detecting malware, which I've got to ask you about too. But if people want to know what's one thing that they can do, it's enforcing a minimum age.
Mackenzie Jackson: Yeah.
Roeland Delrue: It's as simple as that almost.
Mackenzie Jackson: Yeah.
Roeland Delrue: Maybe the root cause will get solved one day. That's also why us as a company, this is not our only reason of existence, because the moment that NPM and PyPI and NuGet were to build similar engines like we have, they could just kill it at the source and make sure it never gets online, or like that the window is reduced to, like, I don't know, two minutes or something, or...
Mackenzie Jackson: That they cannot even publish before it passes through that scanner. I'm actually surprised that they haven't gotten to it because of all the backlash that they've gotten on it. And the truth is...
Roeland Delrue: Wild. [laughter]
Mackenzie Jackson: Right? So, like...
Roeland Delrue: Yeah.
Mackenzie Jackson: Companies have to come and find solutions like the one that we provide. But I take it into account, or I consider it an option that it might get solved at the root one day, and then that product line offering might be a lot less valuable than it maybe is right now.
Mackenzie Jackson: It's a really interesting thought. I don't think people say that out loud very often, which is, you know, you're building something to solve a problem that is very real right now. I think we're getting a lot of people talking about it, but you kind of acknowledge that this doesn't actually solve the root cause.
Roeland Delrue: Mhm.
Mackenzie Jackson: But you're an advocate for doing that anyway.
Roeland Delrue: Yeah.
Mackenzie Jackson: It's a...
Roeland Delrue: [laughter]
Roeland Delrue: I mean, we've reached out to NPM, and we even offered, "Hey, should we work something out here?" For some reason, I don't know why, but they're not too responsive to that, at least so far. So, if you're listening, let's maybe have another call. We're definitely open to it. But, yeah, I guess, you know, people are busy, and then, I don't know. How do these things come around?
Mackenzie Jackson: Let's talk about the detection part now.
Roeland Delrue: Mhm.
Mackenzie Jackson: The actual malware detection. Because that's quite complex in and of itself. So, we've been scanning for vulnerabilities, you know, for years, and not Aikido, but just software engineers and security tools. Why is malware kind of different to finding like an injection type vulnerability? And why was, why are they taking so long for companies? Like, we're not the only company that scans for malware, but there's very, very few comparative. Why was, why is this a path that other people haven't taken?
Roeland Delrue: They're often very sophisticated or complex or with a lot of ingenuity put together. And so they're designed to not be found, right? The people that build these things probably spend a lot of time and effort on it. And then that's kind of like almost like a rule in security, right? Where the more effort you put in it, you want to get the returns for it. You want to get big returns because you're doing illegal stuff, so you better get a good payday, right, out of it. So, yeah, there's all kinds of different techniques, but what they often have in common is that typical phone-home principle because they're always trying to get something out or get something in. It could be as innocent as stealing your Bitcoins. Okay, you're still online, your life, your company is not hacked, but okay, maybe you lost all of your Bitcoins, which is bad enough on its own. But it's, there's different techniques, there's different patterns to recognize. Also there, it's like an endless cat-and-mouse game. Yeah, we've been over here broadening up our R&D team massively to cover all of the different cases, and you need to be continuously on it, in the news, read up on it. And then there's ways to detect it statically. So, actually, we use OpenGrep partially for it, so, as a static scanner to find certain things. But then we'll also sometimes dynamically test out certain things. Meaning if we're uncertain or we want to get into more detail of what something does, we'll do a controlled detonation, if you will. Take a siloed environment...
Mackenzie Jackson: [laughter]
Roeland Delrue: You install the damn thing, and then you're like...
Mackenzie Jackson: Yeah, yeah, yeah. That's awesome.
Roeland Delrue: What's going to happen, and then you monitor from a dynamic point of view what that thing is actually trying to do. So those are like two examples of detecting these things. But what it's all about in this game, it's about speed. Because of those very short windows, so the moment a package gets published, the scanner needs to be on it immediately. So, from the point of view of building it, you also need a very performing infrastructure to handle that volume of packages in a very rapid way. Also, if you do want to go to that dynamic installing and seeing what happens and monitor...
Mackenzie Jackson: Yeah.
Roeland Delrue: You don't want to be busy doing that for a full day, right? That needs to happen all very quick. And so it also involves people literally around the world to cover all time zones because hackers don't sleep, or hackers might plan it for a Sunday or a Memorial Day or whatever.
Mackenzie Jackson: Or in the middle of the night.
Roeland Delrue: So, that's all part of what goes into building such detectors or engines. Yeah.
Mackenzie Jackson: Yeah. It is fascinating that a whole process. And I guess like a key difference is if you take an SQL injection vulnerability, it's a vulnerable pattern, and you're not, it's there because someone's made a mistake. It's not there because someone's trying to hide it.
Roeland Delrue: Yeah. Yeah.
Mackenzie Jackson: Right? Where this is like fundamentally different because people are actively trying to hide...
Roeland Delrue: Yeah.
Mackenzie Jackson: The thing that you're trying to detect. And then you see the Unicode characters or white spaces or base64 or like weird obfuscation. So, from that, I kind of want to talk a little bit about some of the big threat actors that we're seeing. TeamPCP, you know, Lapsus is kind of another one. Lazarus, we see, we see a lot. Some of it's obvious, like Lazarus is usually always after your Bitcoins, right? The North Korean, that's kind of the MO. TeamPCP seems to be more just...
Roeland Delrue: Mhm.
Mackenzie Jackson: Chaotic, trying to create chaos in other areas. Like what do you make of these threat actors and what, why, why do you think that they're doing? I mean, it's impossible to answer that question, but I'm always curious.
Roeland Delrue: Personally, I don't think too much about it. I think TeamPCP, and then I want to almost stop talking about them. They got way too much attention. I even see competitors boasting on LinkedIn that, "Oh, Team PHP has done this and they mentioned this." I'm like, we should stop giving them oxygen. We should not recognize them. It's almost like a cult thing to be mentioned by them and like an honor, and it's kind of, we're all, the whole community, and the community I mean the vendors, the security professionals, we're all building towards not having these types of actors. So, like I don't give them the light of day, so to say. I don't even care if it's like...
Mackenzie Jackson: [laughter]
Roeland Delrue: State-sponsored or who's behind it. At the end of the day, it doesn't, the result is the same.
Mackenzie Jackson: Yeah, I think you're, I think you're right. We should stop, like, kind of thing. I, I won't mention them again, I promise.
Roeland Delrue: [laughter]
Mackenzie Jackson: Regardless of who it is, it is not fun, but interesting to see like why these groups or entities come into existence, what their, you know, what their goals are, what they're trying to achieve, and how they behave online and how the online community interacts with them, if at all. So, it's, it's definitely interesting to see that type of crime. I'm sure you could do like a PhD on the...
Roeland Delrue: On the motivation behind them, social dynamics, yeah, behind it. Yeah, yeah.
Mackenzie Jackson: Yeah, yeah. And also, like infighting amongst groups often comes out in the public and stuff. It's quite a, it's quite a weird and wacky world. I want to go back to, to double-tap onto something you're talking about, which is kind of the package managers themselves, the marketplaces that are kind of hosting us in this. What could they do to be able to solve this? So they could scan for malware and identify it. Are there other things that they should be doing to actually help us get on top of this? Like if you could, we've reached out, but if you could send a message to them, like what, what would actually help solve this problem?
Roeland Delrue: Yeah, I can imagine for the marketplaces or the people managing these marketplaces, it's not an easy task. A good comparison is kind of like the iOS store and the Android store. If you go back in time, anyone can publish any Android app, which is fun and easy, and it's open source, and anyone can do everything. And then when you wanted to have your iOS app online, everybody was like, "Ugh, now I have to register, get approved, I have to submit my app, I have to wait for the app to be reviewed by Apple."
Mackenzie Jackson: Yeah.
Roeland Delrue: And like Apple turns it into this whole long-winded process. But then it was interesting to see that the Google Play Store, to make that analogy, also got around to having verifications because it was getting a little bit too much out of hand with all of these random Android apps with malicious intent. And then so those are examples where they kind of shut it down. And also Google shut it down. And so this attack surface of the Android apps has diminished a lot because they killed it at the source.
Mackenzie Jackson: Yeah.
Roeland Delrue: To the most extent. There's still ways to install Android apps and go run it, but at iPhone you have to almost, you know, jailbreak your device or something. Anyway, so for, if you bring that back to the Chrome extensions, the VS Code extensions, the NPM packages, they could go to similar things, but then you need to be able to handle the volume of verifying, I don't know, tens of thousands of packages a day.
Mackenzie Jackson: Yeah.
Roeland Delrue: If they don't, like, the trust in these systems is eroding, and so they're almost starting to shoot themselves in the foot if they don't do something about it.
Mackenzie Jackson: It feels like they've put in so much effort to remove friction from this process, to make it easy to publish in these places, so that, you know, and you and you can understand doing that at the start to kind of get people to, you want the publishers there. But the solution kind of feels like, "Uh, maybe we need a little bit of friction."
Roeland Delrue: Yeah.
Mackenzie Jackson: You know, in there. Maybe we need to slow things down, and, and...
Roeland Delrue: Yeah.
Mackenzie Jackson: And it kind of feels like, yeah, maybe, maybe that is part of the solution.
Roeland Delrue: Yeah, if it doesn't happen at the source, I think even vendors could work together on, on, maybe there should be even something open-sourced that we all contribute to, to combat these challenges as a community. It doesn't all need to be, you know, made for profit or, or, or because, again, I feel like this might be a temporary problem until it's solved at, at the core. So, that's also why this is not the product line with the revenue that we're reporting to the board, that this is the, this is going to make or break this company. It's more like, not a nice to have, but, um...
Mackenzie Jackson: Well, it's very necessary right now. I think you can, like, the goal is that it's not necessary. Well, well, at least it's kind of there, but it's like, I mean, your whole company shouldn't fall over because someone...
Roeland Delrue: Yeah, yeah. Because someone's downloaded a malicious package. So, yeah, you're right. It feels, yeah.
Roeland Delrue: It could also be built in on where and how you install it, right? That it's part of VS Code itself, like before you install the extension. I mean, there's a marketplace, but then there's the device or the moment of installation. There could be checks that run right there and then as well. Could even be part of the operating system if certain operating systems would lean into that, and so like there's different places or different ecosystems that could get close to the source of killing this. Yeah.
Mackenzie Jackson: Yeah, very interesting. I got to say like that wasn't, wasn't the response that I was kind of expecting, but I love it. I like, I like that we're going down that, "Look, there's so much that we could talk about. I think we're going to have to have other episodes because we haven't even talked about mythos yet." And you can't have a podcast and not talk about mythos at this point. And AI and all of that, and we'll kind of, I think, but I wanted to just to focus this, this here. So, I want to start wrapping it up, but I always play a game on this. It's a nasty game, and you're not, just because you're my boss doesn't mean you're excused from it.
Roeland Delrue: [laughter]
Mackenzie Jackson: Other people have done this. I'm curious to know.
Roeland Delrue: Okay, so the game is called, "Would You Rather," right? I'm going to give you two really crappy options.
Mackenzie Jackson: Yeah.
Roeland Delrue: You have to pick one.
Mackenzie Jackson: Yeah, yeah.
Roeland Delrue: Okay, so we'll start off in line with kind of supply chain stuff. Here are your two options: You pin all your dependencies to your app on this current version, and you can never upgrade...
Mackenzie Jackson: Mhm.
Roeland Delrue: There, there, there, a vulnerability is discovered.
Mackenzie Jackson: Yeah.
Roeland Delrue: You cannot upgrade out of it. Or you automatically pull in the latest version every time you, you, you build. Which would you rather?
Mackenzie Jackson: The pin.
Roeland Delrue: The pin? Yeah, yeah, yeah, yeah. Also, I mean, I guess you have an expected explanation, but also, this is a little bit because we're doing this at Aikido, but we have these hardened packages or these back-ordered ones.
Mackenzie Jackson: Yeah.
Roeland Delrue: Retrofitted packages that allow you to just stick on the version. And, and just in the core of it, like it's not that you have to throw out the whole version, right? It's typically only one function, or only one line, or only like the vulnerability is not like...
Mackenzie Jackson: The whole thing.
Roeland Delrue: The whole thing. So, fixing the package, like the root problem, and then just staying on that package. That's, that's an option.
Mackenzie Jackson: I expected this response, but I do think you cheated a little bit with the "hardened." You, you've found a workaround around it. But anyway, we'll move, we'll move on. I'll give you another shitty one.
Roeland Delrue: Still, still pin, because like...
Mackenzie Jackson: Yeah.
Roeland Delrue: It's, that's what we see. Like the moment software starts to make money, so to say, that means like there's usage, it's running in production. You don't want to do anything that can disrupt that flow, because like if you disrupt it, money will stop flowing, right? So, that's why banks still run on COBOL, like...
Mackenzie Jackson: [laughter]
Roeland Delrue: You just like don't touch it, we're king.
Mackenzie Jackson: I loved how IBM just dropped when Cloud Coach started writing COBOL.
Roeland Delrue: Yeah, yeah, yeah, yeah, yeah, yeah, exactly, right? And then that was, but, uh, yeah, if it works, like rather stick on the old version and find a way to keep it alive than auto-upgrading.
Mackenzie Jackson: Okay, another, another crappy one. Would you rather have your secrets inside a private Git repository, so you have a .env file. It's private, right? But, you know, the engineering team has access to it as long as your service is everything. Or you have no firewalls on your application, so you, you know, open ports, no way to filter through traffic. Which would you rather?
Roeland Delrue: [laughter]
Roeland Delrue: I mean, that's a tough one. I guess the not having firewalls...
Mackenzie Jackson: I, I agree with this one, but it is a very shitty option.
Roeland Delrue: Yeah, yeah, yeah. It's pretty, yeah, I guess, yeah, that one.
Mackenzie Jackson: [laughter]
Roeland Delrue: The blast radius or the potential damage of the second option could be, I don't know, I want to say could, not would, but more manageable, I guess.
Mackenzie Jackson: Yeah. You can build around that. The secrets is kind of like you're just hoping and praying that no one ever finds them and nothing happens. Yeah, yeah, yeah, but it's kind of a little bit out of your control where one you have a little bit more control, but it's, you're still going to have downtime. You're still going to, it's going to be, it's going to be chaos. All right, I have one last one. Let me do it. This one's going to be interesting. The response of this has changed over the last years since we're doing the podcast. So, would you rather entirely vibe code an application? So, I'm talking lovable type vibe coding in the prompt, not like cursor, right? So, you have no idea what the code is doing, but you're just prompting. Or writing it character by character.
Roeland Delrue: In my case, because I'm the most shitty developer, I guess, I would go for the vibe coding. If I were a software engineer, maybe I'd type it character by character, but...
Mackenzie Jackson: Yeah. So, a year ago, 100% of the answers was character by character. Like now, it's kind of like 80% is, is like vibe coding because they're basically, it's like, "All right, maybe there's some security issues, but otherwise I'm dead in the water. Like otherwise the app doesn't exist." Because you just can't, can't, can't keep up. So, yeah.
Roeland Delrue: The buttons on the app, right?
Mackenzie Jackson: Yeah, yeah, yeah. It was a banking app, probably character by character in COBOL.
Roeland Delrue: Yeah.
Mackenzie Jackson: [laughter]
Roeland Delrue: Exactly. Yeah.
Mackenzie Jackson: Yeah, yeah, yeah. Well, Roeland, thanks so much for joining me. It's been a blast. We'll have to have you back. Yeah, you kind of can't avoid me, so I will hunt you down for the next episode anyway, but thanks for coming on. It was fun.
Roeland Delrue: Thanks.
More Memorable Quotes:
- Roeland Delrue: "Security in general is also like this endless cat and mouse game that will never stop. It's as old as humanity."
- Roeland Delrue: "Malware typically only lives anywhere between 30 minutes and maybe 3 days."
- Roeland Delrue: "If you do want to go to that dynamic installing and seeing what happens and monitor, you don't want to be busy doing that for a full day, right? That needs to happen all very quick."
- Roeland Delrue: "If it works, like rather stick on the old version and find a way to keep it alive than auto-upgrading."
