Vulnerability disclosure with Casey Ellis

Today, Open Source Security is talking to Casey Ellis. He's best known as the founder of Bugcrowd and also the founder of Disclose.io. I am extremely excited to have Casey here to talk to us because like, I, the last couple months, man, have been bananas. Yep. And, and we set this up a long time ago and it is just, I feel like the crazy knob just keeps going up.

Yeah. So I definitely, you know, the whole idea of like, let's dial it to 11 and see if that fixes things like that didn't seem to work. So now we've gone on and dialed it to like whatever, over 9,000 or something like that. Yes.

Yes.

So yeah, but it's good to see you, man.

It, yeah. Yeah. It's been, it's been a long time.

It's been a while.

It's always, it's always a treat. Uh, so one, I, I guess you are, I'm very interested in talking to you, Casey, because as most of us have noticed by now that the, the comment verse is filled with vulnerability disclosure experts now.

Yes.

And you are one of the, like, handful of people I know that's an actual legitimate real vulnerability disclosure expert.

So I really— I was trying to do it before it got cool. So yeah, I do appreciate that.

I know, right? And like, it's funny because I think, like, I spent 20 years complaining no one listened to us, and now it's like, I miss the old days. It was so much better.

Definitely. I think, you know, especially in terms of the, uh, You know, myself and some of the other old guard in this kind of space, we're definitely spending a chunk of time feeling like the dog that caught the car. Yes. Yeah. But you know, at the same time, the fact that it's a conversation that's being had that's kind of open now, that's a really important and a really positive thing. I think it becomes more an issue of how do we steer it and then how do the things that are most impactful strategically, like not get lost in all the noise because there's no shortage of that going around right now too, right?

Yeah.

Yeah.

Okay. I mean, let's start there, right? Why don't you tell us a little bit about yourself for anyone who might not know? Because I know like it's one of those things, you know, I've been in this universe forever. So someone's just talking about Casey Ellis. I'm like, oh yes, everyone knows Casey. But I suspect this audience might not know who you are or why we should listen to you.

Yeah, sure. Um, absolutely. Oh gosh. That's, I mean, you, that's a better question for my mom probably, but I'll give it a crack. Um, so yeah, Casey Ellis, I am, uh, you know, like you said, best known as the founder of Bugcrowd. So Bugcrowd didn't invent vulnerability disclosure or bug bounty programs, but we did pioneer this idea of putting a platform in between all of the security researchers that are out there wanting to help out and all of the ultimately kind of creative problems that need to get solved for, for defenders. Yeah, the core of the thesis was to basically outsmart or create, you know, a condition where we've got enough intelligence and enough creativity from like a firepower standpoint available to at least have a chance of outsmarting the bad guys and getting to things first. So that was back in like 2011 was when I started working on it and kicked off in 2012. So I've been at this for quite some time in that respect. Um, I think the other thing that I wanted to do, having grown up as a hacker, like gotten into pen testing and then kind of moved across into the, the entrepreneurship kind of founding role a little bit later on in life, um, was to basically create a better operating environment for people that, that hack in good faith, right? Because, um, yeah, I've been, I've been at this since the late '90s and the environment that security research and even just people that think like a hacker are now able to operate in, that's relatively recent in the story. I think a lot of new entrants to the mix and a lot of players on the field right now don't actually acknowledge the fact that this hasn't been, you know, as anywhere near as easy a conversation, um, as it is today. Um, you know, up until fairly recently. So that was a big part of what I wanted to try to make an impact on. And Bugcrowd partly helped with that. Um, Disclose.io is, is really kind of the policy and the overall, you know, environment shifting project sort of kicked off in 2018 or so.

Yeah. Yeah. So tell us about disclose.io.

Yeah. So disclose.io, like where it really started was this idea that, um, you know, as I just said, like, uh, from a, from a thinking, from a policy, from a legal standpoint, like a lot of the original kind of computer crime laws kind of assume that if you're hacking a computer, you're automatically a bad person. And then you have to prove that you're not right. Which is not how jurisprudence is meant to work. It's kind of just dumb in general, 'cause it nets out to a chilling effect for, for people that are doing security research that has ability to actually help make things safer. So like, that just to me felt like a really stupid problem. It's like, you know, hackers are the internet's immune system and we've got this like immune deficiency that we can actually solve. Um, why don't we do that? So basically what Disclose.io is, is a whole bunch of different tools. Um, it's a boilerplate full disclosure policy that focuses on making sure that there's safe harbor in both directions so that it's safe for the hackers that are trying to help and that it's safe for the organizations that are launching a program because they don't want to give bad guys carte blanche to to do whatever they like, right? Um, that language has been developed. Yeah, there's all sorts of different people from all sorts of different kind of positions of pretty heavy influence around this stuff that have, that have worked on actually crafting that language. So, you know, Department of Justice, Department of Defense, some of the biggest kind of internet providers over the years, all that kind of stuff. And the thing of it is like writing, it sounds kind of boring on that side. But the reality is that like writing, um, writing policy language or writing a legal document that's easy to read, um, you know, legally as complete as it can possibly be and provides adequate protections in both directions is a really difficult thing to do. Like that's actually kind of a design problem. So like that, that was the thing that we're trying to solve originally. And that stuff has been adopted since it got picked up for, um, the CISA, um, federal civilian, like the Binding Operational Directive 20.01 in 2020, it got rolled out into election security here in the US as well. It's been picked up, um, globally as well at this point in time, which is pretty cool. So that's sort of the core of it. Um, but then what we've gone and done on top is to actually build out a maturity model. So for, for organizations, for example, they have, you know, if you're a researcher and you're doing proactive research, or you just happen to stumble across something that's broken on the internet, um, it's really hard to figure out oftentimes like who to tell and whether it's safe to do that or not. And there are a whole bunch of standards and tools to try to make that easier, but those standards aren't very, very well adopted still, even in 2026. Yeah. So what we've done is created basically a directory and a maturity model to kind of rank organizations based on where they're up to in that process. And the idea is that, like, if you're, you know, a company that's being transparent about the fact that, like, yeah, writing software is hard, you know, we're going to do everything we can to keep vulnerabilities and risks out of our systems, but we're going to assume that we're not perfect, um, and that sometimes feedback's going to come in from the outside world. Like, to me, that's a gesture of security maturity that's like the average person can kind of understand, right? It's like, oh, it's a neighborhood watch for the internet. I get that. And ultimately, that should convert to trust. So that's kind of where we're trying to take all of that. That's a, those are a couple of things. There's a bunch of other tools as well. But yeah, in general, if you're, if you're a hacker, if you're someone who runs a piece of security program, go check it out.

Yeah. Yeah. And, and so the The framework thing you're talking about, is that on disclose.io right now?

Yeah, correct.

Oh, it is. Okay. I'll have to go dig for that. I told Casey before we record, I actually haven't looked at disclose.io in quite a while. And so I'm excited to dig through it again.

The whole project went through a bit of a, it had a little bit of a quiet period there. Um, you know, I mean, in terms of what I've been up to as well, um, something that I've shared a fair bit about and not, not to go into it too deep right now, but I actually had unexpected heart surgery about 2 years ago. Yeah. So I had a, had a genetic thing pop off that required some urgent attention, and that obviously took me offline for a little bit. So getting some time to sit and think and recover and actually think about what's important and then start to create some direction and strategy around this stuff and bring other people around it. That was the lull, but obviously it's getting a lot more active now. So yeah, it's good.

And for anyone listening who might not understand, Casey talked about safety and being worried and kind of legal issues. Probably 10+ years ago, if you found a vulnerability in something and you were going to tell the company, you didn't know, like, it was not uncommon for them to say, we're going to sue you, we're going to put you in jail, or for people to actually be arrested for doing some of this stuff. Like, it was scary.

Yeah, 100%. Um, that was the default environment that I grew up in. And, and like, it's, it's really, it's really cool to me that that default in a lot of places has changed. I think a part of, you know, what, what we're trying to get out there is that that change is not evenly distributed yet. Like, there is actually another, another project on Discloser, which is a threats, a threats database, and it kind of builds on the stuff that, um, Jericho did with attrition.org back in the day, right? So if you receive a threat, um, that's clearly intended to chill, it's not because you've been operating in bad faith, but it's because you're doing good faith security research that the vendor doesn't like, and they're trying to use CFAA FAA or DMCA or whatever to suppress that, uh, you can actually upload evidence of that onto this particular repo and, and we'll publish it. Um, because, you know, there's, there's this idea of like accountability, like actually telling the story that no, this is actually still a thing, right? Like it's definitely not the default thing anymore, but it is very much still a thing that happens out there. Um, and then trying to really, you know, tell stories to educate people on how to suck at it less is a big part of what we're trying to do with that on both sides as well. Because I do think that security Security researchers still have this habit of coming in really hot and not understanding that, you know, on the vendor side, like, they're trying to run a business and run a security program. Like, there's, there's, you know, empathy and pragmatism that needs to be kind of worked on on both ends of this. And I think that's always going to be true, but that's a, that's a big part of the problem that we try to solve.

That's right. Every security report is critical when it's reported by the researcher.

Yeah, yeah. And sometimes that's honestly, sometimes that's true. But as a researcher, actually going into it with a degree of humility and, and understanding that you're never going to have full context. Um, I think that's a really important place to, to start from as well. So yeah, there's, it's all, it's all a set of balancing acts. And you know, the challenge now is that like you throw AI on top of all of it, we're doing everything like stupid, you know, doing, doing stupid things faster with more energy, like right across the board in all directions now. So it's just, it's getting more and more important to solve these things, I think.

Yes.

Yes.

Okay. One more setup. And that's what do we, what do we mean when we're talking about disclosure? Cause you and I know what that means, but not everyone listening to that.

That's actually, yeah, that's a really, that's a really good call out. Um, yeah, so basically disclosure, for starters, it's a shitty way of saying it because like disclosure actually describes several parts of the process and they're not all the same thing, right? So the basic kind of chain of things is, is a finder discovers an issue. They're either doing proactive research or they just come across something that's broken and they're like, okay, I have a vulnerability. Um, I need to, tell someone about that so that they can fix it. Um, that's generally referred to as vulnerability disclosure, which is kind of dumb because it's usually not a public thing. Um, when that happens, it's, you know, I, I tend to refer to that as vulnerability reporting because it just is a bit cleaner from, from a process standpoint. Um, the entire kind of process is generally referred to as a whole as vulnerability disclosure, but, you know, words are hard. That's just kind of where that's at.

You also have a website literally named disclose.io. Yeah, yeah, yeah, yeah. No, 100%.

Sometimes you've got to go was, you know, if you pay the piper, you pick the tune, right? So sometimes it's good to go along with that. Um, but yeah, so you report the vulnerability to the vendor, um, the vendor and you and anyone else who might need to be involved from a fix standpoint get involved, and there's a conversation that goes on or not. Like, usually that's the bit that breaks initially, but if that part's successful, then there's coordination around what's going to be done to actually fix this thing. And off the back of that, generally the, the piece that follows is that there is some sort of, um, advice advisory. There's some sort of notification that's pushed out to the public, um, that says, hey, this thing is vulnerable, you need to apply a patch. Or if it's hosted, sometimes it's, this thing was vulnerable, if you need to do kind of any kind of proactive or reactive, um, you know, threat hunting or mitigations or different things like that. Like, that's, that's where you should look and what you should do. Like, the purpose of, of the disclosure part where it's actually published Um, twofold. One is to, is to like, you know, basically alert users of, of the software that there's a risk that they need to deal with, or there has been a risk they should go back and see if, you know, that caused any particular issues for them. Um, but on the other side of it, it's to basically educate everyone else. It's like, okay, here's an example of a vulnerability that was found. Um, you should probably try to avoid that. If you're a hunter and you're trying to help out, this is how you can look for it and, and different things that you can actually use to inspire your own research going forward. So yeah, that's, that was a really, I mean, I've got a blog post on this that I'll send you afterwards that was, is a lot more articulate than I just was, but that's the overall idea.

Yeah. I mean, I have no complaints with that. It's a hard thing to describe.

I appreciate that.

So, okay. All right. So that, that's all our setup. So here's like the meat and potatoes of the discussion is all of this kind of the, all of the LLMs, the AI, the, I mean, there's Mythos has been in the news for the last, how many weeks? And it feels like a lot of this is, is kind of becoming a real thing. And disclosure, or reporting, as you, I guess, more accurately would call it, feels like it's in the middle of it all. And it's, it's kind of bizarre just because I think historically this was a very small group of people that would often do these sort of things. And now, I mean, so, so my kind of my canary in the coal mine for a lot of this is Daniel Stenberg. He's the maintainer of cURL. Yep. And I know I talked to Daniel back in 2025 and he was talking about, you know, all the AI slop reports and how terrible they were and they were all fake and, you know, the AIs were hallucinating function names and it was just a ridiculous waste of time. And he like, he quit the bug bounty they had on HackerOne. And since then he has, we'll say, drastically changed his tune. And it's not that he's changed, it's that everything else has changed. And so now they're getting like real reports from, I mean, the reports sometimes still suck, like That's, they're not fixed, but you know what I mean? It's like the tooling has come a long way here. And so now this concept of disclosure, like anyone can run an LLM and find a security vulnerability, but that's the easy part. And it was always the easy part was finding the stuff, right?

100%. Yeah. Yeah. No, 100%. Um, I think the other, like the other thing to call out from a bona fide standpoint, um, going back to where you were asking at the front of the show, like I've been working with Frontier Labs, um, since late 2022 on security, like security of their systems, but also like offensive use of AI. How does offensive training of AI actually improve AI's ability to generate code that's less shit at being secure, which is kind of the main reason that the big vendors actually do that stuff. And also working with startups like, you know, Dreadnode, who do evals for open weight models and all that kind of stuff on basically like the pure offensive security application of AI in LLMs since probably late '23. So I've been kind of neck deep in this space for a little while now. And yeah, the convergence, I'd like what I saw at the time. Oh, on top of that, working with the White House around AI security policy and the National Cyber Strategy back in 2020 and '21 as well. So like there's been this whole kind of, okay, this thing's coming over the hill, it's going to drop itself on us real quick. It's going to become an issue of retail politics on the policy side, but it's also going to really upset upset the economics that we're kind of used to as attackers and defenders right across the board. So how do we start to get our heads around what to do with that? So yeah, just sorry to digress there, but everyone's talking out their ass about AI right now. So I feel like it's important to actually say, no, I've been working on this for a fair bit of time as well. So I'm not just, you know, working as hard as I can not to make shit up. I think the asymmetry piece that you're calling out there is exactly exactly right. Like, yeah, the thing that happened early on with, with, um, yeah, that Daniel, I think, really kind of made a, a commonly talked about issue is that if you've suddenly got the ability to put, um, uh, you know, vulnerability reports out into the world with the prospect of getting paid, and you're someone who wants to get paid, like, no matter whether you're a security researcher or not, that's just something that is going to attract noise, right? Like, that's— and we've seen that you know, through the last 14 years of doing Bugcrowd, like we'd have people, you know, Photoshopping false XSS returns back in like 2014, 2015. So this whole idea of people just kind of making crap up and throwing it at the wall for the potential of getting paid, that's not a new phenomenon. And to me, it's actually not, it shouldn't be that surprising to people either. Cause like you, you know, you're building like economically incentivized games that are designed to attract people to break things. So the fact that they fuck with the system that you've built to actually do that is not to me a huge shock. Shock, right? Um, so, so just putting that part out there to begin with. And I actually don't think that everyone at this point in time— actually, I've been saying this for a while— I don't think that every organization should run a bug bounty program in a public sense. Um, I think every organization has a vulnerability disclosure program whether they like it or not. Um, people are doing research, they just might not be getting the report. But there's a big difference between that and actively incentivizing people to to try to be helpful, right? So yeah, yeah, that's, that's one big call out, and that's an important one because I feel like the whole thing's kind of getting thrown out with the same bathwater right now. It's like, oh, researchers are super annoying, like screw this, blah. And I'm like, well, there's a bit more nuance to it than that.

Um, but researchers can be super annoying and they can be super correct. Like, I've dealt with many that are both.

Well, yeah, and yeah, and the most, I think, difficult case kind of deal with there is when it is both, right? You've got folks that don't necessarily understand, you know, all the stuff that we were just talking about around empathy for the defender and blah, blah, blah, blah, blah. But they're also right in terms of what they've found, and ignoring that ends up being at the peril of the user because you've basically exposed a risk or seen a risk exposed that you're now going to ignore going forward because it was annoying. Like, that's a That's a dumb problem to have, but it's a reasonable one at the same time. Right.

So, so you know what this reminds me of, Casey, is you'll probably relate to this completely. As I remember back when fuzzing was becoming a thing, this is probably like 2006, give or take. Yeah. And there was a researcher, I was at Red Hat at the time and I was doing, you know, just an obscene amount of coordination. That's basically was my job.

Yep.

And I remember at one point someone sent us, they're like, oh, here's 300 PDF files that crashed, like whatever PDF library was hip at that time. I can't even remember anymore. And we're like, We're like, you can't be serious. And he's like, what? I gave you 300 reproducers. That's great. We're like, no, this is not great. Like, this is an enormous amount of work you just dumped on top of us. Like, help, please.

Anything. Yep.

Yep. It was, it was wild.

It's, and, and, and this is the thing, like, like to me, there's a couple of different dynamics that are in play at the same time. You know, the first is that there are still a butt ton of bugs out there, which is kind of what you, what you were getting at with the way Dan's changed his tune over the past little period of time, because LLMs have objectively gotten better at vulnerability discovery, especially when there's source code available. Um, and that's, that's capability that's, that's improved for pretty much everyone right across the board over the last 6 months most dramatically, but it's been steadily improving for the last probably 2 or 3 years. Um, but then also I think, you know, the, the other thing that's happening for him is because he's removed that incentive to just try to get paid, um, his, his signal-to-noise ratio has changed in terms of the, uh, the kind of people that are motivated enough to submit a report in the first place. So I think that's the other part of what he's experiencing that's probably not getting talked about quite as much.

That's fair. I hadn't even considered that point.

That's a real thing. Yeah.

So that's fair. And yeah. Oh, completely. Yes. 100%.

Okay.

That makes sense. So, yeah. One other thing that's important, I think we don't talk about all the time is so like Curl, even if they're not paying money for the bug bounty, like having your name on a Curl security advisory. Is like, I always laugh about, you know, exposure is the greatest currency of all, but like in this particular instance, that is actually, if I'm like a security person looking for work or, you know, trying to show up my portfolio, my name on a Curl advisory is actually like huge.

100%. 100%. Um, yeah, I Am the Cavalry came out with this, like the 5 Ps of hacking and hacker motivations. It was prestige, uh, prestige, profit, protects, patriotism and puzzling. Um, and I love that because like, yeah, profit is definitely a reason to do stuff. Like prestige is a reason to do stuff. I think as, as like the job market and the general kind of global economic environment gets twitchier, that becomes more of a motivation for folk. Um, but in the middle of that, you've still got people that are just literally puzzling and actually wanting to make the internet safer in the process as well. So like there's all these, and then you got patriots who are like, that's a whole class that which we won't go into here. But, um, that's, you know, there's all these different motivations that kind of kick in. And I think, um, yeah, there's a bunch of different reasons to do this. I think going back to sort of where does this all go from a disclosure ecosystem standpoint, you know, the, the bit that I'm kind of getting more and more convicted about and more and more motivated to lean into and have been for a while now is the fact that like that's going to exist regardless, right? Like this is, you know, back to what I said before, this idea that organizations feel like they can shut down a bug bounty program or shut down a VDP, and then all of a sudden research stops, and, and like, therefore there's no more vulnerabilities. I'm like, that's ostrich risk management, you know what I mean? Like, that's not how this works at all. Um, so that is kind of a primitive to the system that we're working with. Like, that's sort of how I see it. And yeah, it's inconvenient, especially in this particular season that we're in right now, but we've got to actually figure out a way through that because I don't feel like we've really got a choice.

Uh, yeah, I 100% 100%. I mean, and the thing is, so, you know, I'll back to my fuzzing example maybe is this feels similar where I remember when fuzzing started, it was like very overwhelming and very, the world is going to end. And then what actually happened is we fuzzed a ton of stuff and a lot of tooling got better. This is where we saw like a lot of the compilers started getting, you know, stat canaries and, and what memcheck, I can't even remember all the crap that was added now. It's been so long, but you know, like the the ecosystem adjusted.

That's like pre-ASLR too, right? So like you've got all these memory randomization toolings that were ultimately a product of that research at a system level that we now take for granted. But yeah, there was a bumpy period that we had to go through to get to that place.

Yep. Yep. Yeah, it was rough. I mean, I remember I was at the coalface for all of that and it was just like, oh my goodness, this is terrible.

Yeah.

But I also kind of hope I don't have to live through that again, but I mean, we'll see.

Yeah, I, this is going to be really rocky. I think so. I think it's going to be worse. I think it's going to actually be a lot worse. And that's me doing as best as I possibly can not to be a doomer because I don't subscribe to that kind of fatalist or nihilist thinking about this stuff. But the reason that I'm kind of a little, yeah, I do feel like there's a more positive side to this that we can actually get to, but the road to that's going to be pretty rough. As an example, this whole thing around, okay, let's go clean out a whole bunch of open source library vulnerabilities and fix them and then figure out how we can do, you know, LLM-assisted patching and blah, blah, blah, blah, blah. Like, that's all great. And that's all gonna, I think, actually yield a ton of results. But the challenge is, like, you know, using curl as an example, okay, Danfix is a thing. Like, how many products does curl exist in that have now got—

All of them?

Yeah, that now have to regression test that and make sure that any of the changes that were made for the sake of improving security don't break the functionality of the product that they've sometimes gone off and sold, right? You've got this like crazy long chain, long tail of supply chain risk. And in the meantime, if that library or that fix is published publicly, then as a bad guy, I don't need to really go off and find it anymore. I just diff the patch. That'll tell me exactly where the vulnerable function is. And all I've got to do from that point on is, is to write an exploit for it. So there's a whole bunch of like that sort of, I feel like the internet's built on, you know, the pile of turtles that the internet's built on in 2026 is, is a lot taller than it was in 2006. And then I think that's a part of why I think it's going to get kind of bumpy to get to a steady state.

I don't think it's bigger. I just don't think we knew, right? The water was not very clear. I still think like we had open source all the way down. We had, I mean, we have more now than we did. And I will say with things like npm, where now when you like npm install one package, you end up with like 300, which that maybe didn't exist in 2006.

Yeah. I think I agree with what you're saying in terms of open source underpinning a lot of things back then as well. But yeah, that, that's kind of what I'm getting at, like the number of turtles, right? So like, yeah, I'm going to, I'm going to vibe code a project. Great. And it's like this like really simple thing, but all of a sudden it's got like 7,000 packages wrapped into it because npm decided that was a good, cool thing to do. Um, right, right. Yeah. One of those gets patched and you've got how many instances of that out there on the internet that are potentially exploitable at that point in time. And then what does the long tail of all of that getting fixed look like? There's just, there's like, that's the big one that keeps me up at night, but I think there's a bunch of different variations of that that exist that we haven't really tested yet as well.

Yeah.

Yeah.

Yeah. And like, we don't know. I mean, we've been working on this for, for decades at this point of how do we, how do we handle like all the dependencies, all the supply chain things. And we don't know. I mean, we, I wish I could say there was a quick fix. And the thing that makes it even harder is a lot of, I mean, this is one of the things I talk about on this show over and over again is just like the fact that a lot of open source is a person who works on it one Sunday a quarter and their problem isn't like you can't even give them money to make some of this better, right? They, the best you could do is employ them full-time because they just, they have a Sunday a quarter, like that's it. You know what I mean? Cause they have a job, they have a family, they have other things going on. And I don't think there's a good understanding of what this actually looks like. And, and my, one of my examples is like, if you talk to people like the Linux Foundation or the, the OpenSSF, the Open Source Security Foundation, like they don't understand this either, right? Like a lot of people think open source is, is, you know, the Linux kernel or Kubernetes or these, you know, well-funded, well-staffed giant projects when the reality is like 99% of it, probably 99.9% is like a random person. It's like, I hate that XKCD comic because it's, it's correct. Like all the fricking time. And like, except it's not one block of a person. Person in Nebraska, it's 1,000 blocks stacked on top of each other that are all one person in some random place.

Yeah. Yeah. It's, it's, um, yeah, I think, I think being able to talk about this type of stuff, like I wrote a post just after Mythos dropped that, that blew up way more than I thought it would. Cause it, I kind of called out the fact that like AI is not really the problem here. Like the, like the problem is that, you know, vulnerability management, vulnerability intake, like the ability to have a conversation between someone or something that's found a problem, you know, validating whether or not that's true, but then going off and doing something about it. Like, we're already pretty bad at that, um, and what we've gone and done with AI at this point in time is, is kind of multiplied effectiveness on both the discovery and the fix side. Yes, by a factor of 10, um, which is great because it's like, oh cool, we're better at fixing now, we've got more tooling. But then you, you go off and look at the other side and, and how of a gap that creates or reveals in the process. It's like, oh shit, okay, um, we, we maybe need to rethink. And this is where, because I know we're getting to time here, but like something to call out, I do think that, um, the bright, the bright spark and something that I've been talking to a lot of people about in, in the security industry is that like AI does make prototyping and building out tooling to, to, to go off and try out things that you think could potentially solve or help with problems like these. Like, it puts it in the hands of folks that aren't necessarily platform developers, um, but have like deep experience of what the problems actually look like at the coalface. And I think the more folk that are actually trying to think through like, what do the solutions that we're working with in 5 or 10 years' time look like, and how do I start actually proving or not whether or not that's a useful thing today, Um, there's never been an easier time to start doing that. I don't think there's ever been a better time to start doing that. So this idea of trying to like call, call out some of the entrepreneurial spirit that exists in the hacker community and say, hey, like go start building some shit because we're going to need it. Um, and, and you might have ideas locked up in you that you just didn't do because it felt like it was too hard to do that. Like it's easier now. So like get talking to folk about it and start thinking about what the solutions might look like.

Yeah. Yeah. Okay. So as we land this What does this look like for anyone listening who maybe isn't a hacker trying to solve the problem, but it's just, you know, an open source project or a company or somebody that, that like, what, what should they be doing? Like, what are the next steps for someone trying to just figure out what, what, what everything going on means for them?

Yeah. What does, you know, gestures vaguely imply for maintainers and for open source folk? I mean, for starters, As you know, I, I do think Daniel telling his story was really helpful.

Yeah.

Um, and it was funny because I think a lot of people just presumed I'd be pissed off by it because it felt like he was slagging on bug bounty, but I'm like, no, he's right. Like, like, like the stuff that he's talking about here is absolutely a problem. Um, and like truth needing war with itself. So let's get talking about it and start to figure out how to fix it. So I do think that those sorts of things and actually sharing for, you know, more broadly, like what is the experience of this like? For folks that are ultimately kind of, you know, propping up the internet. Um, I don't think that's well known, to your point earlier, right? So I do think there is definitely a storytelling and a socialization component of that that would be really helpful. Um, I do think just very practically, like, yeah, you— it's gonna get, it's gonna get louder. Um, so like, so like thinking through Uh, you know, even from like a threat modeling standpoint, um, if you've got the ability to do that in-house, if you don't, find people that'll help you with it and just kind of tiger team out your processes and try to figure out like, where are the weak spots? You know, where can we expect to see like supply chain attacks? Because those are ramping up pretty crazily at the moment and they're definitely an open source thing. Um, but also just this idea of like, how do we triage and prioritize vulnerabilities that are coming in? In, like, how do we improve our muscle group to be able to differentiate signal from noise in that process and then to prioritize, you know, with the anticipation that it's gonna just get noisier and noisier and that we'll never be perfect at writing secure code, and that's okay. We're gonna get better at it, but that's never a problem that gets solved to 100%, right? So there's always gonna be this kind of, this input that you need to figure out how to triage and prioritize. And I think honestly, that's the biggest problem that people have right now.

Yeah.

It's like, 'cause a lot of it, there's a lot of signal buried there in the noise. Both have gone up. So the question becomes, how do you distinguish between the two, but then prioritize the signal? 'Cause you're gonna end up, you know, still with a throughput problem if you don't do both. Yeah.

Yeah, for sure. And obviously you have a website people can go look at.

Yes. Yeah, yeah, yeah. Reach out to, uh, reach out to us at disclose.io in particular. Um, you know, there's a lot of tooling in there. Something that we're starting to do more of is to basically put together like best practice and and kind of frankly like etiquette guides for security researchers in particular. It's like, how do you get into this? You know, particularly for young players that are just getting into it for the first time, they're like a 3 out of 10 for usefulness, but they're 12 out of 10 for enthusiasm. And they're actually a big part of the problem without realizing it. Like they're not operating in bad faith, they're just enthusiastic and trying to jump in and help out. So it's like, how do you steer that energy into something that's more useful and more productive? Like I would love to hear from open source folk on how we can give better advice around that because I'm mostly talking about it through the lens of, you know, steering security research towards corporates on the backend. That's most of my background. So that would be cool.

Yeah. Well, and I mean, so I'll tell you now, one of the challenges you have with open source is like, there's no open source isn't like a thing, right? It's 10 million things and every one of them is a little different.

It's a universe of things. Yes.

It's tough. Right. And this is where like things like the Apache Software Foundation, for example, or Linux kernel, they have well-defined process for interacting with them if you're a security researcher. But like, if you pick on some random project owned by some random person, they might not even know what a security vulnerability is, much less what they hit. Like, what, a CVE? What, what the hell is that? What do I do here? You know?

Yep. Yep. And we, we didn't even touch that rabbit hole, but you know, I do think, um, yeah, that would be really helpful to get those stories out there and to, you know, frankly get some assistance from you guys on, on our end around how to do it. Better. But the other thing I would say, just parking it because you invoked CVE, um, is don't expect the cavalry to show up anytime soon. There's no cavalry. It's not, it's not coming. I, I think there's, there's work being done on, on solving that problem, but the safest assumption right now, just given the fact that like people that are trying to maintain and orchestrate on the vulnerability side are experiencing the stress that you are multiplied by 1,000, um, yeah, yeah, you can't necessarily rely on that and that's it's less fragile for you to think about how you're going to do it for yourself first and then be in a position to use help if it becomes available going forward.

Definitely.

Yes.

Yes. Well, I assure you, the people who think we can do some work on this in the, in like the CVE land, they do not understand the problem. I've talked to a bunch of them, like they don't know what open source is at all. And they literally like their brains cannot comprehend the size of what we're dealing with here. It is going to be a wild couple of years, I think, just because like, holy cow.

Indeed. Indeed. Yeah. The alternative advice is like, go buy a farm somewhere and learn how to use an abacus.

I have a friend, I have a friend who bought a farm to leave tech and they were like, this is so much worse than tech. Everything is broken all the time. I have to get up early and I stay up late. He's like, if I'm not helping an animal or a plant, I'm fixing something that's broken.

Yeah.

You've ruined my dream.

That does, that does tend to be, uh, yeah, that, that sounds about right.

I know, right? There's like, there's nothing else. There's nowhere to go. I guess we have to fix this.

Yeah. Grass is always greener. And you know, it, it's people that are irrationally pissed off about problems that they think that they can solve. I think they're the ones that are responsible for the internet still working in the first place.

So, oh yeah.

You know, if you're in that mix, like keep, keep at it cuz like we gotta keep going.

That's right. We need your positive energy.

Indeed.

All right, Casey, this has been a treat, man. Man.

Yeah, likewise, man, likewise.

Good to catch you up. So I'll, I'll put a bunch of links in the show notes for people, uh, they'll come find you. And, and yeah, it— this has been awesome. I just want to thank you so much.

Thank you. Uh, yeah, thanks, thanks for the opportunity to chat, and thanks for digging into this as well. You know, like I said, I think, I think, um, we've got some bumpy stuff coming up, um, but there are definitely roads through this. And I think the more people that are thinking about that and talking about that, the better. So I appreciate the, uh, the chance to have chat.

Yeah, I'm sure you'll be back. So until next time, my friend.

No worries, man. Cheers.