All right, hello. Good morning. I'm extremely impressed that you have made it here.
The talk just before me, if you did not watch that, go to the recording. It is also very
good. If you care about these topics, that talk is right on the point. So today, I'm
talking about this life of infrastructure. So in part, the reason why I think you are
here is because you've discovered a love of open source or you live with an
experiential knowledge of digital commons. And I don't need to convince this room
necessarily that I perceive open source as a verb. I will participate in all other
definitions, but unless you're doing something or building something, I'm not all
that interested. But I might need to convince you that developing an individual
awareness of your rights, your autonomy and your data exposure is a little
existential. And this comes from the ideas of blending between law and actual
technical work. The computational justice is about assuring fairness, accountability,
and transparency in digital spaces. And I cannot personally take any more talks around
computational justice unless they specifically include open source, cryptography,
and verifiable compute. Otherwise, it will not be computational justice. So I'm
giving this talk today because I want there to be a larger awareness around what are
the things that we are actually at risk of losing. If we participate in open
source as something that's nice, kind, and fun to do. But unless you protect the
pillar of transparency, the entire thing will fall down. So I wrote this book. I just
put the latest update out on it two weeks ago. It's code chips and control. There we
go. And very specifically, here's how I want you to perceive this book. It is like
a medical taxonomy. It's a narrative walkthrough of understanding how we built these things,
why we built these things, and why we had to develop an immune system response in open
source to the security threats that we were seeing. I am happy for you to pay for this book
if you want to, but what would be much more valuable to me is that when you read this,
I need you to understand that you can and you should participate. You can send me notes.
You can tell me stories. If it's worth putting in the book, it will go into next year's version,
and I am willing to maintain this for 10 years. So about me, I do have a very weird pathway here.
I'm an education maximalist. So when I was doing my undergraduate education,
I got a national institutes of health scholarship, and at the time I was also doing a public
law like minor, which meant I got to go talk to a professor, and I had him read my NHS,
and I aged contract, and he said, did you realize there's no upper bound on the amount of money
they'll let you spend on your education? So I proceeded to get two majors and two minors,
maximizing the literal amount of classes they would let me take. And that kind of energy,
that kind of like go out and grab and do and build, maximalizing your education,
is the kind of thing you can only do over a lifetime in something like open source.
Another thing that really impacted me in the way that I perceived the world is I worked on Boeing 737
cockpets, where we were doing cognitive design, and we would take pilots that work together all
the time, a pilot and a co-pilot with hundreds of hours together, and we would put them in a
four-dimensional simulator. So it's not just visual, it's also half-decks, and we would put them into
failure conditions, and see how they behaved, and how they inserted information with language,
or notes, or movements that wasn't available in the cockpit in order to get out of a failure
condition. And uniquely in this case, those were considered real training hours.
So if you crashed the simulator, that would go on your record permanently. So people took it really
seriously. And to this day, I always think about that, because an open source, what you're effectively
doing with your downstream consequences, is not realizing that you are the pilot of an airplane,
and an airplane can maximally have a thousand people on it. How many people are
consuming your system? How many people sit in a database that you protect? It could be
hundreds, thousands, or millions, and that's how you should calculate the blast radius.
I also did a very cool and fun PhD at NIH, where I asked the question, can brain computer interfaces,
change people's brain networks, below conscious awareness? And the answer is yes. So if that's very
interesting to you, go and read that paper and figure out how we were able to pull off that study.
But while I was doing that, NIH, so I was going back and forth between National Institutes
of Health and the Metacognition Lab at University College London, and Metacognition is specifically
the ability to calculate how well a person knows that they're right before you provide them any
of different evidence to validate it. There's a massive difference between being highly
metacognitive and highly confident, and I'll just put it this way. Expert tennis player knows
before they see, after they hit the ball, they can tell you where it's going to go before they see
the outcome. That's metacognition. On the other side of the street, a gambler will tell you
that they are certain next time that they're going to win, despite all previous or upcoming
evidence that is low metacognition. And I'm skipping over this one quick part, but yeah, I ran this
course called Online Brain Intensive, where I accidentally invited like a thousand contributors
to a very specific neurodebian ecosystem, and I massively overwhelmed us, and to this damn a
little bit sorry, but we had a lot of fun. Okay, also who is Sal? How does Sal exist? It's a moniker
chose it by asking mechanical Turk? What three-letter word is authoritative and memorable?
It does port onto a personal name that I use in my personal life, but when you look for Sal,
it is always an exclusively open source. By design, and it's very hard to offend Sal,
because Sal is an entity. I don't identify. And lastly, when I talk about all this, there's the
secret part of my life, that people at Faustum don't always really love. It's the fact that
I went and I worked for the Department of Defense, then there's a lot of defense agency,
and for Castle Run. Castle Run was the briefest time I've ever spent at a
institution, and that's only because I moved to the UK. But very specifically, I needed to understand
that I was only in that space, because I was in a tribally owned cooperative, and it's very strange
to tell you that I worked in and around open source for so long, but it was only in this specific
context that my specific ethics were fully respected. I will never take a life, and I will never
participate in the taking of life. Flat. So what is Godfly? So Godfly, yes, do we have a website? Have
you looked at it? Do you not understand it? Yeah, we did that by design. It is one specific thing.
I'm so interested in finding individual maintainers that maintain things for lifetimes,
because they're coming out of it with a very, very different energy. And over time, over seven years
now, I've changed these questions, and these are the questions that I think really matter.
If you don't want to waste your time while writing code before you write that code,
why don't you ask these questions? Number one, what is one problem that you want to see deeply
solved in your lifetime? That's why we call it Godfly. Socrates called the things he was
upset he couldn't get done in his life. Godfly's. Two, who are two or three, like what are two or three
technical solutions that might separately or combined solve this problem? Like quite literally,
is this problem technically tractable? The most important question is this one, and I wish everyone
will ask themselves this, who are three people living or dead, who you would be proud to explain
that you solved this problem for? Tell me what it would feel like when you told them that you
fixed this problem forever. And if you don't have that motivation, there's probably no reason
to maintain the code. Are there any examples of people or communities that have previously done this?
And based on all answers above, do you still believe that technology is the best way to solve this
problem? You can simultaneously say yes or no to that answer. That's a really good way to make sure
you don't waste time with code. All right, so a couple of the guidelines that have come through.
This is a Nova Howe. A Nova loves doing really interesting data science and visualizations as art.
Oh no, okay, okay, and here's an example. So every year I get to send a Nova Howe all of the
news software supply chain reports. They take them and they add additional information like
very specifically for log4j log4 shell. They compare it to the instances of log4j and log4 shell
being recorded on Twitter against the patches. And when you get another genius to come into the room,
I never would have put those two data sets together. You can tell that for the downstream non-cordinated
disclosure environment that I don't often think about, you learned about log4j log4 shell,
statistically from Twitter. We have to fix that. There's also, here's the lane a couple years ago
and I was working them on SRE stuff but I want to highlight this one because they asked me this
terrible and great question like why don't we do chaos engineering over blockchain and it made
me realize they're absolutely zero stupid questions. They're just really good blogs. They're really
that blog. And then here's a like full absolute godfly. This one came in and we only worked together
for like two and a half months and here's what happened. Their godfly was that specifically in the
U.S. C4 hair products do not have the same federal regulation as all other products in that space.
So they could have harmful chemicals in them. They told me the reason that they wanted to fix
that problem was for their grandmothers and their aunts and every single person they know highly
motivated to do this work. They built an app that goes and scrapes the information about the chemicals
behind C4 hair products and puts it plainly visible and searchable and the reason why this is the
shortest godfly I've ever had was because in less than three months they were acquired and that
sits inside of the target app. I want you to think about solving really, really massive problems
and not in like the past like I made something beautiful and people can consume it. I want you to think
about how do we actually solve some really, really big problems with technology and I used to see
that energy and open source so hard and I'm keeping it. So welcome to computer societies and the way
that computer society I think has meaningfully changed because of security. Right, the book is
dog food, read it, for free, give me feedback, tell me when there are updates that are meaningful
and I've gotten too meaningful updates that fall so far. The review of that book looks like this
and thank you. But I also want to say that was the first version of this book and because it's
been edited, it's so much better now. But it is much closer to a medical taxonomy. With my background,
I've got MDs and PhDs all around me. Read it like you're about to figure out how to understand
like a human body system. Research mentions, four years of investigation, 37 conferences,
12 countries, hardware security, software security, cybersecurity regulation, 112 formal interviews
with kernel maintainers, hardware engineers, security engineers, policymakers, and literally anyone
was sovereignty in their name if they were an engineer. If I could get them to talk to me.
And then a bunch of fun field work, but also infrastructure side on this. So this is all on our
personal server. Nothing was recorded. We used galene for our video conferencing. It's free
and open source and it is quite literally my favorite installation from 2025. It's a good software.
It's a very French software so it will always be available. No third-party surveillance
and also just final note on galene. Like it's like better than jizzy y'all.
Just switch to galene. It fits your principles and it solves the problem better.
Research deficits all interviews were in English except for one where I attempted to speak Spanish
but we both agreed that the two worst words in Spanish to speak are vulnerability that is
E.C. Red or C. Goody that. So we switched to English and that really impacts my ability to
give you the total surface area. And secondly, the first question I would always ask is like how
do you define sovereignty and I literally never got the same answer once? Does anyone in this room
except for the people that have read the book? No, what this is and there's two correct answers.
Eth. Well that's a Pentium processor. It also happens to be a Navarro or Dina weave. This is from
Merrillu Shults. She's about her entire career doing Navajo weave of computer chips, and I specifically
reach out to her and I put her on the cover of my book so that you could see and understand
this. There's real good historical reasons why specifically that nation would be very invested
and understanding and holding their history of being involved in chips.
Why my book? 30% will go to Lean Pub. It also exists on Amazon. Ignore that.
The version controlled and always updated is going to be on Lean Pub.
30% goes to Lean Pub. We pay the maintainers. Everything else will go to Asus.
This is the American Indian Engineering and Sciences Society. And I specifically am
reserving that money for cybersecurity scholarships in that space.
Okay. Defining sovereignty. And I'm so sorry, y'all.
I'm just going to move really, really fast. Okay. Five dimensions of sovereignty, authority,
territory or domain, autonomy, recognition, or consent. And it's very, very good to understand
that sovereignty regulation is very, very clear that revocation is also a right in this space.
A right so strong that I think it represents a dimensionality.
All right. So what is sovereignty traditionally? We've got Westphalian sovereignty.
This is the idea that a state has an authority over its territory and its domestic affairs.
A sovereign state that possesses a monopoly and legitimate monopoly within its borders.
That really basically defines sovereignty by the edge between two sovereigns.
Legal sovereignty. This is very habsian. sovereignty is the supreme,
absolute and uncontrollable power by which an independent state is governed.
Popular sovereign theme. This is a lot closer to what we have moved towards in many western
countries. But it's the idea that sovereignty resides in the people and you cannot have a sovereign
without the consent of the people. The federalist papers are what to find that for the U.S.
And it is so cool to know that grab exists because they specifically wanted to know which of the
founding fathers of the U.S. wrote which federalist papers. It was designed specifically to solve
that problem. And there's a great, finally someone went and like communicated the story because I
think it's great. Then there is relational sovereignty. Have you all ever heard of this?
Surrelational sovereignty is the inherent right of indigenous nations to govern themselves based
on their own laws, their own territories, their own knowledge systems recognize both internally
and in relation to others. In digital sovereignty is not the mimicry of a nation state.
It's about the continuance of indigenous life in relation to land, law, and kin.
And cyber slash digital sovereignty. It's an emerging definition, but it's the right of a nation
or community to control its digital infrastructure, data governance, all minor activities
without external interference. This is not well enough to find
to allow us to implement the CRA cleanly. You're trying to cut a cake which hasn't been baked yet.
Sovereignty security postures. So I will we will have no more legal or political slides
moving forward. Now we're just going into my brain. Sovereignty is a lot more interesting
because you can actually define it. So sovereign security is data infrastructure, military
defense and strategic autonomy. Sovereignty is the ability to put your policies and your actual
practice in alignment with laws, values, and government structures. Typically for a nation state,
but these are for all kinds of sovereign structures. Digital sovereignty makes sure that you
control it. Information sovereignty makes sure you know that you know where your information is.
Technical sovereignty know that you understand and own the infrastructure, including hardware,
software, protocols, without a reliance and external suppliers and frameworks. Sovereignty
is a security remet is extremely expensive and very hard. Sovereignty is a security. So
like let's look at some examples of this. The China Russia model is a like full control over digital
domain. Security sovereignty in the UN context is perceiving it as a fundamental right of nation
states to define their own security interests. And in the same profile indigenous data sovereignty
right now, I think is leading the way that we are thinking about and building out security
protection right now. And specifically right are tribal nations just like, it's a legal thing.
It often has a physical boundary, but the legal definition of a dependent nation is that tribal
laws are considered domestic dependent nations. So we are in the most unique and interesting
security position you could imagine. Because we have both all of the requirements of security
of our tribal citizens and we have to somehow figure that out often while respecting all of the
requirements of the United States. And last year the US government asked tribal nations if they
wanted money in order to align their security to the federal government more closely. And that
is like the most interesting case study I think you could ever look into. The unique relationship
between tribal cyber security means that we have direct federal support and we also have
a sovereign boundary. It's complex. And in the EU, I don't think it's any easier.
But if you want to scrape away, if all the slides that I just showed you, you're like, oh wow,
this is irritating and non-technical and awful, I agree. Every time I see the word sovereignty
in a technical document, it worries me because that's not very clearly defined.
So put it on a technical scale. From my research, what I can tell is if you have a fully sovereign
stock, it's going to have these four principles. It is going to respect location, operator,
cryptographic keys, and attestation. So I'm going to go as fast as I can through eight chapters
of stuff. And I left a lot of it out. But I went really, really hard on chapter one.
Here, let's go. I start this story with the transistor. And then we want to follow that up.
Right? There's a couple of really interesting years of moving, I get us to, there we go.
This pipeline from sand to wafer to chip. The semiconductor supply chain,
the entire reason why chapter one of this book is on semiconductors is because no matter which
kernel I talk to. And I got to be honest, I think now, spiritually, my favorite,
kernel is free BSD. I get it, finally. Every kernel maintain or ask me to cover this semiconductor
supply chain first. That's where they perceive the threats. Risk and says, if you don't know
about this, great go for it, but this room does. I want to jump us to the fact that the 90s were great.
It's when we broke Moore's law, and there's good reasons for that. It's a change in both physical
production and also our ability to do planar. So that was our inflection point and regulation
stopped keeping up at that point. In the mid-2010s, there was a rise in specialized chips
and request for specialized chips in production. And right now, the entire industry is shifting
us towards GAI. If you don't know what that is, go find out. You probably do. Okay, so this is the
evolution. In the 1970s to the 2020s, there's like no other world in which I can tell you the entire
history of a supply chain in 50 years. But in this case, we can. And it has some gaps and we should fix it.
So the United States, how do they handle all of us? Any connector supply chain? They're a design
powerhouse and they are strategically rebuilding right now. Their design dominance is still there,
but they have lost their tractability on manufacturing. Japan, they lost the memory war in the 1990s,
and they now own the materials that make everyone's chips possible. They're quiet, they work in the
most upstream wall of the streams because that's physicalized production. European Union.
In my view, I got it. ASMR is the crown jewel in semiconductor specific production. It's the
only source of EV. It's a critical and artificially created bottleneck. And without it, no one
can make advanced chips. Taiwan, it makes 90% of these advanced chips, and it is 130 kilometers
from the Chinese mainland, and I wonder it did anyone see the news last week. South Korea,
Samsung, and this is where memory dominance lives. And I think that's like a reasonably
healthy fracturing, like you can own a pillar of a space, that's okay. But it is caught in a really
interesting diplomatic situation of trying to still supply to both the US and Chinese markets.
And China is the largest consumer of chips in the world, and they are building a sovereign stock
because we have sanctioned them into doing that. Single points of failure in the semiconductor
supply chain are these. These are the ways that building a system with extreme dependencies,
as we have it built a world on chips. These are concerns, and I don't super know how to solve
some of these problems, because it comes down all the way to where does the material physically
come from, and I can't change that with words. So, transistor evolution, I'm going to skip.
Remember on a chip? I'm going to skip because I will provide you these slides, and I assume
half of you know this. Process our architectures, more interesting, risk, and then we find risk
via the risk devroom yesterday is the thing that when I'm done with Phasem, I'm going to
watch every single talk. And I recommend that you do too, because that line up looked great.
Compute units, these are all just aspects of a chip. Integration paragraphs, you can have
sock or chiplets, and I do think we are likely to be moving a lot more towards chiplets.
They're a better yield cost mixed process nodes, and from a security perspective,
Composibility is important to me. And then we got specialized chips.
RF chips, opto, electronics, again, wrote a book on it, just follow those. We're down to chapter two,
already, kernels. Here's the thing about kernels. They run with the highest level of access to
the chip. They're the first thing that comes alive. It is literally the animus and the machine.
It is the difference between having a chip and a brick. And we are at a really exciting point in a
almost 130-year journey of actually being able to give a security guarantee, because in 1883,
someone said, security should not depend on the secrecy of design, but on the secrecy of keys.
And we all agreed, and then we couldn't do it until the 1970s and 1980s, the department of
defense was focused on security kernels, formal verification, reference monitors, and it was the
first line that we decided not to trust the kernel until it was mathematically bearable.
2004, things start to get really interesting. We decide, and this is globally genuinely,
that networks cannot be trusted. You have to assume their hostile. The assets have to protect themselves,
and we shift it from data, from perimeter to data centric security. And it's like, I think that's
the year where security starts to get interesting to me. And then in 2010, we started to come around
and start really banging the drum of zero trust. To understand all of that, I'm going to give
us these slides on how we can understand zero trust. Have to understand secure isolation,
is the ability to keep data and workload separate from untrusted entities during computation.
CIA triad. Secure isolation can take a lot of different forms. It can be process isolation,
memory isolation, or workload, isolation. And as we get more agentic into our spaces, both
as things that we like and our adversaries built to contact us with, I am so interested in
understanding how to observe and limit non-human identities. And I'm going to go super fast because
I have 15 minutes now. Trust boundaries. Care about them. If you were alive when an orange book
would have been in your desk, then you understand this process. But the thing that really matters
is that zero trust means I can throw the instructions on the ground. My adversary can pick it up.
They can build their own, but they can't get into my system. There, we did it. All right, Kubernetes
has this. It is everywhere. So if you think that you're like sitting at a layer, where zero trust
doesn't impact you because you don't think about it, that's only because someone else did for you.
So Thompson's trusting trust talk. Most of us know this. And I'm going to ignore it because
I actually think this is fixed reproducibility. They are now doing like two compilers and checking
them against each other. I can't tell you the details on that because I learned the details of it
overbears two nights ago in a very foster way. But as soon as I get the details on that,
that will go into the book because I think we've solved a problem that was
previously insolvable. All right, let's skip all the kernels. But care about them. The secure
kernel. I think is very cool because there is absolutely no nonsense. It just isn't mathematically
provable or not. I'm not lovely. But okay, layer one. Harbor root of trust. Layer two, secure
boot. Layer three, measured boot. Layer four, attestation. Y'all, I will send you these slides in the
book it's free. Layer five, runtime hardening, layer six. I didn't fix, but this is really about
syntactical security. So like the shift to rust is very much around that.
If you want to consider the reasons why we are doing security at this level and putting controls
more globally into place, then think about meltdown. And if you don't want to think about meltdown,
think about specter. And specter has new variants that are still emerging. The legacy of that
means that there's a massive hardware shift that hardware cannot be implicitly trusted.
Dirty pipe sits in the space as well. None of my pictures are coming up. So y'all, I'm so sorry,
we're just getting words today. Wanna cry? Also, a terrible disaster. But this is all sitting at
this layer of the kernel. Also, this one, this story, think about this one. The best intentions
of observability on the kernel can create security conditions. You really need to be careful and
hygienic about that. Our defense is cryptographic, trust, chain, and software with materials,
if they are valid, verifiable and attested only. Reproducible builds and transparency logs.
Those four pillars are what we need. Chapter 3, oh no, we made some mistakes and now it's in
our embedded devices. So, oh god, my picture is though here. Does anyone see the security concern in
this picture? Okay, in 2017, there is a breach that I absolutely love because I find it very cool.
I hate it. I got it. We can't like security breaches, but we can if they're really cool.
So, there's what they did. We're targeting a casino to get access to their high-roller database
and they used a Wi-Fi thermometer to get to it because it was trusted on the same network as the
servers. That's interesting and concerning. How often do you think your personal security as an
individual or an individual in a database has possibly even been compromised by that kind of thing?
Garmin ran somewhere, same problem, but this is where we have to understand the difference between
upstream and downstream security and how big the downstream can be. Garmin, not a big deal.
If you can't access your like watch, but a very big deal, if it's also tied to the ability
to get flight plans, we not just took down some like smart watches, we took down airplanes with
this attack. Rowhammer, I'll skip it because you probably know about it and we'll come back to it.
Well, probably in the book. All right, trust anchors fail. I'll ignore that. Four shadow,
if you remember this one. Great, but what's interesting about it is that made us
question our hardware route of trust. Chapter four. I got it. I'm going to do it. Yeah, I can do this.
I can do this in 10 minutes. I got it. Okay, chapter four. The price of reliability is the pursuit
of the utmost simplicity. It is a price which the rich find most hard to pay. That is a quote that
I find extremely interesting from a turning award lecture. So once we get into embedded devices,
we're talking about the thermometer issue, but also this one. This is my favorite. The Janet
Jackson Rhythm Nation, specifically I've played on YouTube, will destroy circular drives, non-SSDs.
And it's cool. Stocksnet. This is also sitting in a physicalized space. Their target was
Iran nuclear center fuses and they succeeded by using a USB. Bad USB, cool issues. The researchers
in this space are very cool. Go look up OMG cables. Chapter six, the Tower of Babel, where I get
to regain my sanity because a language that does not affect the way that you think about programming
is not worth knowing. So proofs and reality, proofs meet in the real world, and five familiar
gaps happen. There's model mismatch, composition failure, opaque, trust, anchor, and our beloved
side channel. And tool chain vulnerability, which I'm going to include in the space most people
would separate them. I don't think you can. Then there's heart bleed, which I'm just going to speak
to at a cultural level, because it started to make us really, really focus in on the syntax level
of security. Grammar determines what kind of vulnerabilities are allowed, right? So like a great
example is this is like rust gives you some hygienic properties to syntax, but it's not perfect.
Just converting to rust doesn't make sense unless you really understand why you're doing it.
So the idea of testing failed. Now we have to go against a specification, which again is a limited space.
But that brings us to the five verbs of assurance. And if I can just give you these,
we're probably in a good spot. So you have to start with measurement, which is observing a system
state in order to understand the baseline. Attestation. We need to know that what was measured has
not been altered at a specific time and that that attestation can be trusted around that information.
Isolation easy to understand just don't let other people touch it. Mediation. The practice of
regulating how isolated systems interact and update. Get update right. Those are the five
verbs of assurance. And together, you have the CIA triad and a couple of other security profiles all
represented by isolation, enforces confidentiality. Mediation, enforces authorization,
attestation, should, prove, integrity. My communication of linguistics and cognition in the book is
very good, but it's also incredibly limited due to specifically language I engage with, right? Like
closure is the way that my mind thinks and I might think that people with other language experiences
might be able to speak to something else. Chapter seven, hypervisors and the politics of virtualization.
I kind of want to skip this slide because I don't think we figured this out and it's a very hot
and active topic and that's why the book has to be updated because I want to say next year that we
solved all these problems. Right now, here's all the different certification categories for
security over cloud, just in the European Union, it's challenging. XE Utels, I'm also going to put
into this category in space because it was particularly interesting and aware to cloud engineers.
But the fact that a maintainer just has to get a bad feeling about something and notice that
something is off before they can find these things means yes, these issues will always happen.
But I hope we can get better over time with not doing detection as luck.
Trust in hardware, that's got a lot more serious about that. If that's a discussion that you want to
have, I'm happy to have that. Where are our trust anchors? How do you verify our trust anchor?
And if you didn't build it with your own hands, how do you know that you can?
The pain pattern, most sovereignty architectures optimize for external interception,
but the highest impact threat is usually authorized malicious actors and I think that's what XE Utels
showed us. The threat models around this space, I'm just going to jump through these slides
extremely fast and I will send them to you. There's external threats inside or threats
and that not yet solved. But no your threat model, don't deploy expensive controls for threats
that you don't face and don't assume you've solved what you haven't. Location, operation,
he control runtime integrity. If you're touching the cloud, you need to take all of those seriously.
Enforcement, build, run, and export. Reject on the sign code, require attestation, policy
grades, and egress, and enforce on it every stage. The patterns of cloud services are something
that you can probably get from looking at someone's paid for platform requirements, or by looking
at really interesting things like the shared confidential computing system between like France,
Italy, and Switzerland. There's a lot of really cool sovereignty cloud stuff happening now.
All right, I'm going to skip all of these because no, this is important. We're moving from
static to dynamic trust. This means work led at any matters. All that's changed about doing
like multi-tannet is like to do that. Well, you might not be able to avoid problems there,
but you can at least include time in your threat model. So if you reduce the amount of time that
something has access to a system, bound it to only the time that it's doing it's job.
Putting time into your architectural decisions as a security decision is the thing that I find
the most interesting about specifically this like hypervisor space. If I had more time,
would say that this is the space where we really have to be hygienic about understanding
our trust policies or trust tokens, but chapter 8 is where everything gets super cool.
So the fact is, originally, I had a publisher reach out to me and they asked me to write a book
about space technology and like I really tried, but I couldn't because you have to understand
all of those seven chapters before we can even start with space.
So Spatnik. The one thing you have to know about Spatnik is that everyone's like,
oh, I see it in the sky. They didn't. They were probably seeing the R7, which was up there with Spatnik.
Creating the first space located in the Continental Ballistic Monitoring System.
Spatnik is very hard because you send it away and you can't get it back.
And our treaties are old and don't understand that this is now a digital attack service.
I'm going to, ooh, the via stat attack. I've had more time. I would go into it, but it's cool.
I want us to think about radiation.
So radiation is the primary adversary of space technology and the way that they do resilient design
is something that I deeply respect and will probably one day write a book on once I eventually
in 10 or 15 years of looking at it. Understand what they're doing. But to understand radiation
just think about this. So we sent some cherry blossom seeds into space and then we brought them back.
And one of those space seeds was planted right next to the ancient tree that it was specifically
taken from. And that tree produces upside down flowers. It is bizarre. Something happened
to that literal kernel in space that we didn't know or understand until six years later
when it was a fully grown and developed tree. That feels so much to me like all of our like
best security controls and then finding out problems and runtime, right?
And basically, Rohammer radiation is just usually like a Rohammer attack. And if I had more time,
I would have covered Rohammer more. But we're just going to get there today. So the one thing I want
to talk about is that the thing that actually bothered me about space technology was not like how
scary the satellite starts. The satellite hacks can be, but actually the fact that satellites
all around the world run on different time signatures. And that's quite literally like a
sovereign decision for them. It's a sovereignty claim to choose specifically what time signature you
want. But the problem with that is it makes it much more likely that satellites will crash into
each other. So we could create a signal that respects everyone's idea of time as long as we share
that signal and we yield to distress to ensure that things don't fall out of the sky. So I'm going
to skip all of these very good things that you should know except this. Someday, the last packet
on this planet will route through the infrastructure that we leave behind. The real test of sovereignty
is not who controls the switch, but whether the system keeps its promise when no one is left to watch.
So sovereignty is a habit to build a sovereign technical stack is to build a world where the
truth can survive distance, delay, and decay. And I want to remind everyone in this room that
one day, the only proof that we were ever here will be the system that we designed to outlive us.
So let's get that right. If now you're interested in reading this book, please do so for free.
Thank you.