Another of those days where it days where it was the random talks I didn't expect that really captured my attention.
Robbie Litchfield in full devil makeup on stage talking about Building Leviathans, the worldwide supply chain that goes into chip manufacture from resource extraction and industrial chemistry, chip design through to fabrications just highlighting the immense complexity of it all, which explains why with all the world wide disruption we're starting to see things like 52 week timelines on orders of any quantity, feeding into challanges for enterprises getting the equipment needed given all the stupid demand right now. Some pretty sensible suggestions really, allowing for BYOD to reduce demand, trying to get more life out of the fleet you've got by adopting linux etc.
The talk that really amused me today was Bea Hughes "Kubernetes, iit's no longer cool, but let's secure it anyway". I almost gave this a miss but I'm so glad I didn't. Just a really hilarious and engaging talk with some good practical advice in it, not "just" install Itsio and you're done, but more "you can generally enable the baked in security profiles to reduce attack surface". That really worrying about people getting root is a lot less of a worry than them getting your database and AWS creds, so really focus on securing the apps. You can develop the regex from hell to filter cryptomining domains and just block them all to neuter the risk of crypto miners. But the part that really had everyone laughing out loud was the "shoot the hostage" approach to security. Don't just remove the shell from the container, replace it with a custom shell that just kills all the processes. If someone gets in, you're going to notice the pods rebooting a lot while also preventing the attacker getting much done.
The talk that I think will really sick with me though is "Heed the Wizard's Warning - Burnout mitigation strategies" this is another one I really need to watch again when the recording comes out. I have thankfully never hit the level of complete just stop burnout that was being talked about, but the shrinking world, the stepping back from all the things that bring you joy and fill your cup is disturbingly familiar. The brain and body are both complicated interacting systems, we can't neglect either one. As I so often find, the advice from personal experience hits harder, and our of that context the words can sound like trite, but the are valid none the less. Develop a physical practice, a mental practice, a social practice, develop a hobby where you make something physical. Engage with the things you enjoy and that fill your cup. But also there is a need to examine and tear down those learned assumptions that affect how you see the world. I know I have lot of that work still to do, get past those ingrained ways I see myself that hold me back.
There was also an interesting talk of notnotcharlie & pruby playing off each other about the role of modern red teaming. Very wizard and magic themed which seemed appropriate for the day. But the core message was really that you get a lot more out of these engagements by focusing not on "we leet hackers and look we got domain admin" but really working with the engineers and blue teams to assess the whole environment, don't treat it as a black box but rather know the architecture, have the access and see what can be detected, the problems are generally known, so finding one random path through isn't really as useful as hardening the whole environment. I was reflecting a bit on how this relates to the change in the vibe of KawaiiCon over the years. There is a lot less of what I always thought of swaggering about enagements where people broke in, they're good stories, but the vibe now is a lot more of lifting everyone up. One thing notnotcharlie talked about was the role of stories in making the attacks real and engaging people in why it matters and I think that's true. Thinking about my own journey in this space, it was the stories that got me started thinking and seeing how these things really could add up.
There were a few talks deeper in the tech, Ostap Cherkashin talking about the inclusion of post quantum ML-KEM in TLS was interesting. The math is way beyond me, but my main takeaway is that it's being rolled out as a hybrid where key exchange is done using both the current ECDH and ML-KEM in such a way that as long as either one is secure the key remains secure. So ML-KEM providing protection against a quantum break of ECDH and ECDH providing against a break of the less proven ML-KEM. Also that ~70 % of traffic is already doing this because it's just been quietly rolling out to browsers and infra without a big song and dance.
I enjoyed Shlee's talk about building his own colo-servers, though it mainly convinced me that I never want to do that for anything that people would be wanting to stay up. I like messing with this stuff, but not to that level.
John talking about using LLMs to port old windows games to the web so he can play the games he remembered from childhood was interesting, cool how possible this is, but obviously some issues to work through.
And the ever entertaining "Alex" talking about finding how often vibe coded websites are publishing API keys, .env files and similar things. Which is totally understandable when it's people who don't really have an understanding just telling the LLM to make it work. "Alex"'s point being not that we should laugh at the vibe coders, but that they need a safe path. Personally I think this is where there is a need for a "heroku for vibe coding" kind of thing, which I guess is what the likes of Loverable are tring to be.