Episode 18 | Kiosk Security xitter.cf/i/broadcasts/1YxNrbVjq…

Just spent 7 days on the front lines of the vulnpocalypse defending against an active cyber attack. The attack was on us. Some suspect the attack was us. Some thoughts: - Software factories are now mandatory. You can’t keep up with automated adversaries unless you become one. We have. Our attack surface now ships faster than our features. - We were lucky. We’d spent months perfecting our software factory. In hindsight, it may have manufactured the vulnerability. But it also manufactured the patch, so net neutral. Arguably net positive. I’m counting it as a win in the board deck. - At minimum, spin up a cloud coding server with read access to every log, every service, and every secret you own. Then point an LLM at it and let it read untrusted attacker input all day. What could go wrong? (Do not answer this. My agents are monitoring replies.) - Shared coding servers unlock multiplayer incident response. Everyone sees every session. Everyone can watch everyone else panic in real time. Sharing a forkable session link is so much higher bandwidth than talking. Talking is legacy. We haven’t spoken aloud since Q2. - You don’t need to be big to do this. We are a team of 3. We have no SOC, no IR plan, no security engineer, and no idea what a CVE is. But we have a forked agent framework and a Slack bot that runs crons, which is basically the same thing. - To get here, we stopped all product work for 6 weeks to build systems that let us ship PRs with zero human code review. People said that was reckless. Those people were right, as we found out this week. Customers were furious. Investors were thrilled. That’s how you know it’s working. - KYC for the AI labs’ cyber programs now only takes a day. A day felt like a lifetime. Imagine waiting a whole day to understand your own codebase. Couldn’t be me. OK maybe it was me. - Getting access to The Secret Model™ moved us from reactive mitigation to proactive patching. Wish we’d done it sooner. Wish we’d done a threat model sooner. Wish we’d hired one (1) security person sooner. Actually scratch that, sales are back up already. Anyway, get started now!