The Talk Show

00:00:00 ◼   ► Every Mac user is the smugest bastard in the world.

00:00:03 ◼   ► A virus is never going to affect us, we're immune, whatever.

00:00:06 ◼   ► And the reality of course is some people feel that way.

00:00:08 ◼   ► Most people who've looked at the situation at all know that, um, we're not immune.

00:00:14 ◼   ► We're just really lucky.

00:00:15 ◼   ► It's just the target's been small.

00:00:16 ◼   ► Apple does a good job upgrading, um, in pushing people to upgrade.

00:00:19 ◼   ► They support systems back many years.

00:00:21 ◼   ► The target is so small that it's usually not worthwhile for

00:00:25 ◼   ► malware makers to target us.

00:00:27 ◼   ► So that's been our immunity is because we're insignificant as a target, not necessarily in absolute numbers.

00:00:33 ◼   ► So this new thing is this group at Cisco, Talos, um, or Talos, they, uh, are one of many security firms.

00:00:40 ◼   ► It's constantly researching for weaknesses, usually to help clients.

00:00:43 ◼   ► They are trying to make sure their clients are protected.

00:00:46 ◼   ► They find something, this fellow who, um, had some communication with Tyler Bowen, uh, found five previously undiscovered,

00:00:55 ◼   ► fairly severe flaws in the way that image format files get parsed.

00:01:01 ◼   ► And the trouble was like three or four of them were reasonably severe, but you had to kind of open a file and whatever.

00:01:06 ◼   ► But there's one related to TIFF. John, you've been using TIFF for your whole life, right?

00:01:10 ◼   ► Since you were born.

00:01:12 ◼   ► That's right.

00:01:12 ◼   ► Ancient format. So there's a part of the something in the parser,

00:01:16 ◼   ► if you use a tiled TIFF file and it's formatted in this very specific malicious fashion,

00:01:21 ◼   ► the iOS and ostensibly OS 10.

00:01:25 ◼   ► And probably I think the other two OSes

00:01:27 ◼   ► are also patched tvOS and watchOS.

00:01:30 ◼   ► If it's rendered, it will actually think in that case,

00:01:33 ◼   ► it's a memory, it's a buffer overflow,

00:01:35 ◼   ► usual typical old thing.

00:01:36 ◼   ► And it can allow the potential for malicious code to execute

00:01:40 ◼   ► and take control of the machine and do whatever.

00:01:42 ◼   ► - Just by displaying the image.

00:01:44 ◼   ► - Yeah, and here's the reason it's considered

00:01:46 ◼   ► particularly insidious.

00:01:47 ◼   ► You could load it with a webpage in Safari,

00:01:49 ◼   ► You could have iMessages open and somebody could text,

00:01:53 ◼   ► you know, send you a text message with a TIFF in it.

00:01:55 ◼   ► There's a few other vectors.

00:01:57 ◼   ► Merely by rendering the preview,

00:01:59 ◼   ► it would have to parse the file enough

00:02:01 ◼   ► that this condition could be exploited.

00:02:03 ◼   ► That sounds pretty horrific, right?

00:02:05 ◼   ► And that's why it was considered,

00:02:07 ◼   ► it's considered very severe.

00:02:10 ◼   ► And some discussion about how severe in Apple's patch,

00:02:14 ◼   ► did they use responsible disclosure?

00:02:16 ◼   ► It's not a zero day.

00:02:17 ◼   ► there aren't exploits in the wild.

00:02:19 ◼   ► And if you update to all the current OSs,

00:02:23 ◼   ► if you just update to the latest micro release,

00:02:25 ◼   ► you are protected against that particular TIFF exploit

00:02:28 ◼   ► as well as the other four image format related exploits.

00:02:32 ◼   ► - I have so many follow up points already.

00:02:35 ◼   ► - By the way, BMP format, BMP is actually also affected,

00:02:38 ◼   ► which is kind of hilarious.

00:02:39 ◼   ► Like TIFF and BMP, nobody's looking at them

00:02:41 ◼   ► and I think they're just old implementations.

00:02:43 ◼   ► - Let me see if I can keep them on my head.

00:02:46 ◼   ► One of them is, yes, I used to use, as you know,

00:02:49 ◼   ► and I know you have the ink-stained hands as well,

00:02:52 ◼   ► I came from a world of print design,

00:02:54 ◼   ► and in the world of print design in the '90s,

00:02:57 ◼   ► TIFF was the de facto format, at least for line art,

00:03:02 ◼   ► for any kind of bitmap.

00:03:06 ◼   ► Everything went through Photoshop into TIFF

00:03:09 ◼   ► before it went into production.

00:03:11 ◼   ► But it's sort of a notorious file format,

00:03:14 ◼   ► 'Cause I seem to recall vaguely that over the years,

00:03:16 ◼   ► there have been an awful lot of security issues like this

00:03:21 ◼   ► that have to do with TIFF parsing.

00:03:24 ◼   ► - That is my recollection as well.

00:03:25 ◼   ► I didn't go back and look it up,

00:03:26 ◼   ► but I think it's that old code thing.

00:03:28 ◼   ► Like people wrote TIFF parsers in 1980 something,

00:03:32 ◼   ► no, sorry, early 1990s, or late 1980s maybe,

00:03:34 ◼   ► probably late 1980s.

00:03:35 ◼   ► And the parsers, the basic code is probably mostly unchanged

00:03:39 ◼   ► in a lot of ways for 30 years.

00:03:41 ◼   ► - And it's probably a very difficult format.

00:03:43 ◼   ► It's probably a poor format spec, that's my guess.

00:03:46 ◼   ► That therefore it makes it hard to write the,

00:03:48 ◼   ► easy to write, not easy to write,

00:03:51 ◼   ► hard to write a parser and easy to make mistakes

00:03:56 ◼   ► with memory management in the handling of the parser.

00:03:59 ◼   ► So anyway, all right, here's another point.

00:04:00 ◼   ► Because it's such a weird old format

00:04:02 ◼   ► and it was never really part of the web in any way,

00:04:06 ◼   ► I'm very surprised that iOS and watchOS

00:04:10 ◼   ► even have to parse some code.

00:04:13 ◼   ► I know this is part of the, um, like the quick

00:04:15 ◼   ► look thing though, like everything in, um, all

00:04:18 ◼   ► the different OSs support quick look for, you

00:04:21 ◼   ► know, every major file type and include some

00:04:23 ◼   ► weird image formats and other things that you,

00:04:26 ◼   ► you know, might never be previewing, but you

00:04:28 ◼   ► can preview a raw images in some cases, PNGs,

00:04:31 ◼   ► are they DNG files, one of the digital formats,

00:04:34 ◼   ► um, all these things, PNG, by the way, when

00:04:37 ◼   ► that specification portable network graphics,

00:04:40 ◼   ► that's kind of TIFFs replacement because it

00:04:41 ◼   ► has all the different kinds of things need lossless

00:04:44 ◼   ► and lossy and different alpha whatever.

00:04:46 ◼   ► In the specifications, I met one of the people

00:04:49 ◼   ► who wrote the spec years ago, 1990s.

00:04:51 ◼   ► It says ping is pronounced ping in the spec.

00:04:54 ◼   ► So there's no question.

00:04:55 ◼   ► (laughing)

00:04:57 ◼   ► - How else could you pronounce it?

00:05:00 ◼   ► P-N-G, I guess.

00:05:02 ◼   ► - I don't know.

00:05:02 ◼   ► - The only other way you, yeah,

00:05:03 ◼   ► the only other way I could think you could pronounce it

00:05:05 ◼   ► would be P-N, or just saying the initials, P-N-G.

00:05:09 ◼   ► - I pronounce it pang, I don't know.

00:05:10 ◼   ► so she knows someone would find a way.

00:05:13 ◼   ► - Ping is a-- - Pinge, ping it.

00:05:15 ◼   ► - Ping is an odd historical success

00:05:18 ◼   ► because a lot of times when people get together in the open

00:05:22 ◼   ► and say, you know, there's even like an XKCD comic about it

00:05:27 ◼   ► where it's like, we have way too many specs

00:05:28 ◼   ► and they all stink.

00:05:29 ◼   ► You know what the solution is?

00:05:31 ◼   ► A new spec.

00:05:32 ◼   ► You just add to the pile, usually,

00:05:35 ◼   ► even if it's a noble goal.

00:05:36 ◼   ► Whereas Ping had the noble goal of saying,

00:05:39 ◼   ► We've got a couple of bitmap image files,

00:05:43 ◼   ► formats that are out there being used

00:05:45 ◼   ► and they are all terrible for one reason or another.

00:05:49 ◼   ► On the web we had GIF files

00:05:51 ◼   ► and don't even tell me that you're a GIF person.

00:05:53 ◼   ► - Oh my God. - Are you a GIF person?

00:05:55 ◼   ► - I'm choosey programmers choose Jeff.

00:05:57 ◼   ► That's the--

00:05:58 ◼   ► - It's a graphic image change, interchange format.

00:06:01 ◼   ► Anyway, it's a GIF file.

00:06:07 ◼   ► Just, I mean, horrendous format.

00:06:10 ◼   ► I mean, you can only have 256 colors at a time.

00:06:12 ◼   ► I mean, it's goofy.

00:06:14 ◼   ► - It was great.

00:06:16 ◼   ► It was great for CompuServe.

00:06:18 ◼   ► - It's juicy.

00:06:19 ◼   ► - It was great for CompuServe

00:06:21 ◼   ► because I was a CompuServe user.

00:06:23 ◼   ► Were you, I can't remember.

00:06:24 ◼   ► Were you a CompuServe user?

00:06:24 ◼   ► - No, I was never on CompuServe.

00:06:26 ◼   ► - Okay, so I can't, for a long time,

00:06:28 ◼   ► I can remember my five comma four digit address.

00:06:31 ◼   ► It begins with seven.

00:06:32 ◼   ► I've totally lost.

00:06:33 ◼   ► That's one of the problems with aging.

00:06:34 ◼   ► I cannot remember my 1979 CompuServe login.

00:06:37 ◼   ► It makes me sad, but on copy serve, it was great.

00:06:39 ◼   ► We dial up.

00:06:40 ◼   ► We had like, I don't know, 1200 bod modems or 1200 BPS modems, something like that.

00:06:44 ◼   ► It was a great compact format when you had, and it was rendered, you know, rendered

00:06:49 ◼   ► in a way that made sense, like line at a time or interlacing was, you know, all

00:06:53 ◼   ► these things, just most computers, most computers only had 16 color displays.

00:06:57 ◼   ► So yeah, it was perfect for the day and it's astonishing that it still is great,

00:07:02 ◼   ► but yeah, ping and you remember the most boring thing in the world, the

00:07:06 ◼   ► The LZW algorithm was patented and Unisys tried to enforce it and Ping is an outcome

00:07:12 ◼   ► of efforts to patent.

00:07:14 ◼   ► The patent expired in, I had to look it up 2003 because I'm already gone off.

00:07:18 ◼   ► Um, but that was part of the issue.

00:07:19 ◼   ► Like TIFF used LZW, which meant how to be licensed.

00:07:22 ◼   ► Uh, GIF was being attacked or potentially Unisys wanted to license it.

00:07:27 ◼   ► Uh, I believe LZW may have been one of the early attempts to, uh, one of the issues

00:07:31 ◼   ► like business, not business method patents, but it was a software-ish patent

00:07:34 ◼   ► algorithm patents.

00:07:35 ◼   ► There were some issues there anyway.

00:07:37 ◼   ► Yeah. And it came out of that and historically we're getting sidetracked

00:07:39 ◼   ► here, but it's all good stuff.

00:07:40 ◼   ► The, the, it was, uh, it was a big story locally because

00:07:45 ◼   ► Unisys is a Philadelphia area company, at least they were, I don't know if they

00:07:48 ◼   ► still are. Um, so it was a big story locally. Um, but the gist of it is that

00:07:53 ◼   ► they own the patents behind or patents that were part of fundamental part of

00:07:58 ◼   ► the GIF GIF format.

00:08:01 ◼   ► Uh,

00:08:02 ◼   ► son of a bitch.

00:08:05 ◼   ► uh...

00:08:06 ◼   ► and they never enforced it and it you know people there were

00:08:11 ◼   ► gift

00:08:12 ◼   ► sping displayed and parsed and created

00:08:16 ◼   ► you know and every image editing tool and i was all over the place and then

00:08:20 ◼   ► netscape added you know put support in to render them in

00:08:26 ◼   ► mosaic or whatever that you know whatever the first one of their browsers

00:08:29 ◼   ► that images which was a big deal

00:08:32 ◼   ► It was actually a big deal when they added image tags

00:08:35 ◼   ► to the web browser.

00:08:37 ◼   ► - Oh my God.

00:08:37 ◼   ► - And they waited until like, all of a sudden,

00:08:42 ◼   ► like when the internet exploded

00:08:43 ◼   ► and everybody was buying, you know,

00:08:47 ◼   ► like Adam Eng's internet book and everybody is like,

00:08:49 ◼   ► I'm gonna get on the internet

00:08:50 ◼   ► and Bill Gates is writing a memo that we're gonna,

00:08:52 ◼   ► you know, turn the whole, you know,

00:08:54 ◼   ► Microsoft around at the internet, internet, internet.

00:08:57 ◼   ► And then all of a sudden, somebody at Unisys was like,

00:08:59 ◼   ► hey, we own a patent for this.

00:09:00 ◼   ► (laughing)

00:09:02 ◼   ► And the open community responded and said,

00:09:05 ◼   ► "We've gotta create a new format."

00:09:07 ◼   ► And they did it, they did it quickly.

00:09:09 ◼   ► They got support into all the tools quickly.

00:09:12 ◼   ► And Ping took over the world as it was supposed to,

00:09:17 ◼   ► very quickly, and that almost never happens.

00:09:20 ◼   ► - It's where Ping is such a great format in a lot of ways.

00:09:22 ◼   ► I mean, I think it's funny that it didn't actually

00:09:24 ◼   ► ultimately replace everything except JPEG,

00:09:28 ◼   ► but it's just, it's great.

00:09:29 ◼   ► as all the different kinds, you know, two modes, you can do 24 bit with alpha transparency.

00:09:35 ◼   ► And it's just, it's not quite as compact, I think as GIF for the same thing.

00:09:41 ◼   ► But yeah, patents, patents are issued, almost came up, you remember with the, the committee

00:09:48 ◼   ► that runs the, it was H.264, whatever the underlying patents are there, there's a patent

00:09:53 ◼   ► pool.

00:09:54 ◼   ► But I think there was at one point, there was a question about whether if you used,

00:09:58 ◼   ► If you displayed H.264 video on your site without going through a third party package

00:10:03 ◼   ► like Adobe flash, for instance, which wraps it, that you might actually owe separate licensing

00:10:08 ◼   ► fees and using flash.

00:10:10 ◼   ► One of the reasons that flash was successful, uh, is because Adobe handled the licensing

00:10:16 ◼   ► for video patents, or at least they said they did.

00:10:18 ◼   ► I think that fact was overlooked because the, you know, flash is so terrible, but it meant

00:10:22 ◼   ► there was no, if you were a, you know, CBS or something, if you put it in flash, your

00:10:26 ◼   ► your lawyers must have assured you it's cool.

00:10:28 ◼   ► We don't have any fees.

00:10:30 ◼   ► If you'd use HTML5 as if it existed to show,

00:10:34 ◼   ► you know, to directly stream that kind of format,

00:10:37 ◼   ► I think there might've been a patent issue.

00:10:38 ◼   ► And that's been resolved since the patent holders changed it

00:10:41 ◼   ► so they wouldn't, you know, poop in the pool.

00:10:42 ◼   ► - I seem to remember that.

00:10:43 ◼   ► You know, it's always a good sign

00:10:45 ◼   ► when the lawyers are making engineering decisions

00:10:48 ◼   ► (laughing)

00:10:49 ◼   ► for your web technologies.

00:10:51 ◼   ► - It's great, I like that.

00:10:52 ◼   ► - Now what could go wrong?

00:10:55 ◼   ► All right, back to the security issue.

00:10:56 ◼   ► So all of Apple's operating systems

00:11:01 ◼   ► were vulnerable to this threat.

00:11:04 ◼   ► So it's- - Yeah, all the current ones

00:11:06 ◼   ► and also two previous version of OS X were tested.

00:11:09 ◼   ► It's possible that older versions are also vulnerable

00:11:12 ◼   ► and they just didn't test them.

00:11:14 ◼   ► I don't have the clarity on that

00:11:15 ◼   ► because the particular library

00:11:17 ◼   ► may go back a bazillion years,

00:11:19 ◼   ► could be back to 10.6 or 10.0 for all we know.

00:11:25 ◼   ► But there are no actual exploits in the wild, right?

00:11:29 ◼   ► Or at least none that are known.

00:11:31 ◼   ► - None that are known.

00:11:32 ◼   ► It's possible, so I talked to the folks

00:11:34 ◼   ► at the Cisco division directly,

00:11:37 ◼   ► 'cause I could not find, I saw this coverage.

00:11:39 ◼   ► So you know how this works.

00:11:40 ◼   ► Something happens related to Apple,

00:11:42 ◼   ► and the news story is Apple computers burst into flames.

00:11:45 ◼   ► That's like the next day.

00:11:46 ◼   ► It's like, well, it was one computer in a lab.

00:11:48 ◼   ► It was under controlled circumstance.

00:11:49 ◼   ► No, no, Apple computers burst into flames.

00:11:51 ◼   ► So Apple releases these updates,

00:11:54 ◼   ► then the engineer at Cisco, or I sorry, Talos

00:11:56 ◼   ► is the division.

00:11:57 ◼   ► He writes up a, uh, the guy is in charge of

00:11:59 ◼   ► this team who's credited with the discovery

00:12:01 ◼   ► by Apple.

00:12:02 ◼   ► So it meant he used responsible disclosure

00:12:04 ◼   ► reported months ago, Apple patch at all,

00:12:06 ◼   ► everything's cool.

00:12:06 ◼   ► He writes up a very detailed blog post that

00:12:08 ◼   ► explains the severity and then has some details

00:12:11 ◼   ► about exactly what gets dumped.

00:12:12 ◼   ► He puts some, you know, core dump information

00:12:15 ◼   ► in or traces and things.

00:12:16 ◼   ► And, um, people like, you know, the register

00:12:19 ◼   ► and Forbes and whatever, right?

00:12:20 ◼   ► These it's stage fright for Apple, you know,

00:12:23 ◼   ► which is Android still is wrestling with stage fright,

00:12:26 ◼   ► which was an MMS deliverable, among other factors,

00:12:29 ◼   ► a way to send a maliciously formatted message

00:12:33 ◼   ► for Android 2.2 and every subsequent system,

00:12:37 ◼   ► and the problem with upgrading older Android systems

00:12:39 ◼   ► and on and on, right?

00:12:40 ◼   ► So stage fright remains, it's possible

00:12:42 ◼   ► there's a couple hundred million Android devices

00:12:44 ◼   ► that remain susceptible to stage fright, it's a big deal.

00:12:47 ◼   ► And there were viruses that were discovered in the wild

00:12:50 ◼   ► within I think weeks of the first stage fright release and then months later some more for

00:12:55 ◼   ► devices that couldn't be patched. This touches on one of my very most precious pet themes in what I

00:13:06 ◼   ► write about like in media criticism which is false equivalence. Yeah, yeah. And it's a huge

00:13:11 ◼   ► issue in politics and it's definitely an issue in the tech world too and it's this idea that to be

00:13:17 ◼   ► fair or cynic more cynically to sensationalize the story because I think everybody knows

00:13:26 ◼   ► that putting Apple into headlines gets more clicks.

00:13:34 ◼   ► So Android had stage fright or has stage fright, you know, and has this issue that is actually

00:13:39 ◼   ► being exploited in the world.

00:13:41 ◼   ► And there are lots, not most, you know, I'm not, nobody is saying that every Android phone

00:13:47 ◼   ► out there is hacked or even most of them are, but that there are many people with Android

00:13:51 ◼   ► devices that have malware, perhaps even unbeknownst to the user because of this exploit.

00:13:58 ◼   ► Then Apple has this, you know, Cisco discovers this security problem in Apple's operating

00:14:04 ◼   ► systems and it's presented as though it's, you know, like you just said, they're actually

00:14:08 ◼   ► calling it Apple's version of stage fright, even though there aren't any known exploits.

00:14:12 ◼   ► Right.

00:14:12 ◼   ► The right, the right, it's great narrative.

00:14:13 ◼   ► And there are similarities except sandboxing and code signing and so forth.

00:14:20 ◼   ► There's a lot of spaces that are different in terms of how Android deals with incoming

00:14:25 ◼   ► everything or, you know, malicious software that's trying to execute on a system.

00:14:28 ◼   ► There's other protections, even if you manage to deliver a payload, you may just crash a process.

00:14:33 ◼   ► Right.

00:14:33 ◼   ► So the, you know, I talked to the engineer, I went back and forth through email.

00:14:37 ◼   ► I had to go through the PR folks and, um, you know, it's like, is there a proof of concept?

00:14:40 ◼   ► Because with Stagefright, the researchers who did that

00:14:43 ◼   ► delivered an effective proof of concept

00:14:45 ◼   ► showing not just that they could crash a process

00:14:47 ◼   ► or overwrite a buffer,

00:14:48 ◼   ► but that they could actually commit acts and gain root.

00:14:50 ◼   ► If I recall, some Android systems you could get root

00:14:53 ◼   ► and some behalf you could take control of the microphone

00:14:57 ◼   ► and things like that.

00:14:58 ◼   ► So there were ways to get access to system resources,

00:15:01 ◼   ► even if you couldn't potentially gain root.

00:15:03 ◼   ► And the Talos researcher said,

00:15:05 ◼   ► in effect, we have a provable exploit

00:15:08 ◼   ► that allows us to do nasty stuff with Safari and OS 10.

00:15:13 ◼   ► And the reporting had been about MMS,

00:15:16 ◼   ► but they have no exploit for that.

00:15:18 ◼   ► They think there are some major hurdles in the way

00:15:20 ◼   ► that might be able to be overcome.

00:15:22 ◼   ► They weren't focusing on that

00:15:23 ◼   ► because they knew it was gonna be patched.

00:15:24 ◼   ► They focused on something

00:15:25 ◼   ► where they had a path already to do it.

00:15:27 ◼   ► They suspect that the Safari plus OS 10 pathway

00:15:30 ◼   ► would also let them exploit iOS and Safari, mobile Safari.

00:15:35 ◼   ► They haven't tested it, but everything seems the same.

00:15:37 ◼   ► They think there may be a few more bars in the way there too, that can be overcome.

00:15:40 ◼   ► This is all with the unpatched version.

00:15:42 ◼   ► So, you know, the truth is, this is that it's going back to the

00:15:45 ◼   ► beginning is it's a severe bug.

00:15:47 ◼   ► You know, a few years ago, Apple had some wifi bugs where you could drive by and do

00:15:52 ◼   ► terrible things to someone's wifi network and gain access and, you know, do all kinds

00:15:56 ◼   ► of stuff to an airport base station or Mac, or sorry, Macintosh's, if you could

00:15:59 ◼   ► just gain X, you know, just have physical proximity.

00:16:02 ◼   ► And it's terror, that's especially terrifying because you don't

00:16:04 ◼   ► actually have to be in their house.

00:16:05 ◼   ► in their house, you just have to be within range of their wifi, which could

00:16:08 ◼   ► be, you know, in a car in front of their house.

00:16:10 ◼   ► Yeah.

00:16:12 ◼   ► Just put a high gain antenna out the window and you can do it.

00:16:14 ◼   ► And those, they were patched and people have the same argument then.

00:16:17 ◼   ► And this happened since I think in a lot of times is how severe

00:16:21 ◼   ► is it if the threat is over?

00:16:22 ◼   ► It's like, well, this is very severe.

00:16:23 ◼   ► We don't know the it's.

00:16:25 ◼   ► It's severe as an exploit.

00:16:26 ◼   ► You know, these things really are doing something really terribly

00:16:29 ◼   ► wrong they shouldn't do and shouldn't be in the code.

00:16:31 ◼   ► That's true.

00:16:32 ◼   ► And conceivably it's a pathway.

00:16:34 ◼   ► the next steps are in the lab or, you know, malware could be developed that

00:16:38 ◼   ► would then take advantage of it.

00:16:40 ◼   ► And we could find out how severe in practice it is.

00:16:42 ◼   ► In theory, it's very severe, but because of responsible disclosure and Apple

00:16:47 ◼   ► being able to patch it in a timely manner, there's no evidence anything is in the

00:16:50 ◼   ► wild that said, this is the kind of thing when the, um, was it, uh, I'm blanking on

00:16:55 ◼   ► the group in Italy that had all its files, hacking, hacking team hacking

00:17:00 ◼   ► team or something like that.

00:17:01 ◼   ► Yeah.

00:17:01 ◼   ► Those guys.

00:17:02 ◼   ► And it's true of some other outfits that have had leaked information.

00:17:05 ◼   ► These, you know, there's all these companies, it's individual researchers and companies that exist to find zero days and sell them to governments, right?

00:17:11 ◼   ► And governments are also working on similar things.

00:17:13 ◼   ► It's possible things like this are already completely known, maybe even to multiple parties, and they're being deployed against some Iranian official or American official or Chinese official or a company for, you know, for industrial espionage.

00:17:28 ◼   ► and it's being specifically deployed in a very quiet way

00:17:31 ◼   ► in which it allows them to exfiltrate information

00:17:34 ◼   ► or tap communications, but the idea, it's not,

00:17:39 ◼   ► if that's the case, that hasn't been found yet,

00:17:41 ◼   ► maybe it will now the bug is known,

00:17:43 ◼   ► virus signatures will get updated, people will find it,

00:17:45 ◼   ► but so it's not in the wild.

00:17:46 ◼   ► - Yeah, there's, the most obvious source of malware,

00:17:51 ◼   ► the one that we see and hear about most often

00:17:56 ◼   ► is the one that's sort of stuff that's sort of out in the open,

00:17:59 ◼   ► where it's just almost like-- you almost

00:18:03 ◼   ► want to say more like common criminals who either find

00:18:07 ◼   ► exploits like this that you can go through a web page

00:18:10 ◼   ► or certainly email, click link, click this link in an email.

00:18:14 ◼   ► And if you're using a certain type of computer that

00:18:16 ◼   ► has a known exploit, just by clicking the link,

00:18:23 ◼   ► you've got malware on your computer.

00:18:25 ◼   ► And what does the malware do?

00:18:26 ◼   ► A lot of times it sets up like a botnet

00:18:28 ◼   ► or something like that.

00:18:29 ◼   ► And it's like a shotgun approach to the crime

00:18:33 ◼   ► where they're trying to just get hundreds and thousands

00:18:35 ◼   ► of random people, they don't even care who you are,

00:18:38 ◼   ► to run this and steal your Bitcoins

00:18:41 ◼   ► or whatever they wanna do.

00:18:42 ◼   ► That's the stuff that we see.

00:18:47 ◼   ► The part that, the paranoid part of my mind is the,

00:18:51 ◼   ► well, what about the Chinese government?

00:18:53 ◼   ► The Chinese government would be, you know,

00:18:55 ◼   ► are they employing people to find exploits like this?

00:18:59 ◼   ► Of course they are, right?

00:19:00 ◼   ► I mean, who, does anybody believe they're not?

00:19:03 ◼   ► Does anybody think the NSA doesn't have

00:19:05 ◼   ► really, really smart people doing this exact same thing?

00:19:10 ◼   ► You know, and then there's the companies,

00:19:14 ◼   ► not just governments, but companies like the hacking team

00:19:16 ◼   ► that you mentioned that sell their services,

00:19:19 ◼   ► you know, to governments and stuff like that.

00:19:20 ◼   ► But find these zero days and then hold,

00:19:25 ◼   ► instead of letting them loose,

00:19:26 ◼   ► they're like a precious commodity.

00:19:28 ◼   ► I mean, I think last year somebody was actually

00:19:30 ◼   ► like in the public was saying,

00:19:32 ◼   ► we're gonna pay a million dollars

00:19:35 ◼   ► if you can find an exploit for iOS 9 or something like that.

00:19:38 ◼   ► - Yeah, yeah.

00:19:39 ◼   ► - I mean, a legitimate, I mean, sort of legitimate.

00:19:42 ◼   ► I mean, it's sort of a scummy underside of the world,

00:19:44 ◼   ► but a serious offer, a legitimate offer for a million dollars

00:19:48 ◼   ► if you could deliver them an exploit that would let them do

00:19:52 ◼   ► it.

00:19:52 ◼   ► Well, it was just jailbreaking often falls that right.

00:19:55 ◼   ► As there's companies that make a lot of money off, um, third

00:19:57 ◼   ► party app stores for jailbroken, uh, uh, iPhones, I think.

00:20:02 ◼   ► And so there's money to be made if you get the, the, uh, the

00:20:05 ◼   ► exploit first, uh, the jailbreak, uh, um, pathways first, some of

00:20:09 ◼   ► them sell jailbreaking is funny.

00:20:11 ◼   ► Jailbreaking went from a very innocent enterprise in the early

00:20:13 ◼   ► days to something that is now all enmeshed in viruses and criminal

00:20:16 ◼   ► enterprise and so forth.

00:20:18 ◼   ► There's still, I'm sure, legitimate people out there doing jailbreaking,

00:20:20 ◼   ► but everything I read about it makes it sound like you don't know when you

00:20:24 ◼   ► download the jailbreak tools what they're going to do.

00:20:26 ◼   ► I was talking to a friend of the show, Craig Hockenberry at WWDC,

00:20:31 ◼   ► and we were laughing,

00:20:34 ◼   ► thinking like reminiscing to 10 years ago when the iPhone was new about how we

00:20:39 ◼   ► all jail broke our phones.

00:20:40 ◼   ► We all jail broke our phones at before the first C4 conference,

00:20:47 ◼   ► because somebody had created the Lights Out game.

00:20:54 ◼   ► And it was a really nice game.

00:20:56 ◼   ► Like, it was just like a-- there was no Xcode for iOS yet.

00:21:01 ◼   ► I mean, these were some really smart people.

00:21:03 ◼   ► And there were no public tools at all to create iOS software.

00:21:10 ◼   ► And somehow--

00:21:10 ◼   ► Oh my god.

00:21:11 ◼   ► And Craig, eventually, during the jailbreak era,

00:21:15 ◼   ► I got Twitterrific working.

00:21:18 ◼   ► So like, I don't know, of course,

00:21:19 ◼   ► so of course I jail broke my phone

00:21:20 ◼   ► 'cause then I had an iPhone with Twitterrific on it.

00:21:22 ◼   ► And this is before you could have apps.

00:21:24 ◼   ► I mean, of course I jail broke.

00:21:26 ◼   ► But it was, it just seemed, it was a lot easier too.

00:21:31 ◼   ► - Innocent days back when it was just us kids

00:21:34 ◼   ► playing around with the phone.

00:21:36 ◼   ► Sidebar counselor, EFF has just filed a lawsuit

00:21:41 ◼   ► about section 1201 of the DMCA,

00:21:44 ◼   ► which I'm sure you're aware of.

00:21:45 ◼   ► I saw the announcement.

00:21:46 ◼   ► Yeah.

00:21:46 ◼   ► Uh, it's the, so, you know, DMCA digital money and copyright act, which I think

00:21:50 ◼   ► is a largely unconstitutional piece of legislation that has never been fully

00:21:54 ◼   ► tested if the Supreme court ever got his hands on it, I got to say there's so many

00:21:58 ◼   ► things in there that, that, uh, give the privileged commercial speech at the, in

00:22:03 ◼   ► the face of free speech and whenever I've seen anything like it, that's been decided

00:22:07 ◼   ► by high courts, you know, either appeals or up the Supreme court, it's usually,

00:22:11 ◼   ► even if I don't agree with the decision entirely,

00:22:13 ◼   ► it usually opens up the way for more speech,

00:22:16 ◼   ► meaning more, encode is speech.

00:22:17 ◼   ► It's sort of now been encoded at a certain level

00:22:20 ◼   ► of the court systems, even if it's not totally understood.

00:22:23 ◼   ► So one provision of the DMCA is this reverse engineering

00:22:26 ◼   ► thing related to digital rights management.

00:22:28 ◼   ► And if you put DRM on something as a manufacturer,

00:22:31 ◼   ► it's illegal and you can be sent to jail for years,

00:22:34 ◼   ► for, I'm sorry, four years, not for four years,

00:22:36 ◼   ► I forget, see if it's like five years, I think.

00:22:39 ◼   ► reverse engineer it, even for yourself, like in the privacy of your own home, FBI

00:22:42 ◼   ► breaks in, you've been breaking DRM and not distributing it, you go to jail.

00:22:46 ◼   ► And, uh, there's a provision called section 1201, which is the most hilarious thing

00:22:51 ◼   ► in the world every three years, more or less, uh, the librarian of Congress

00:22:56 ◼   ► holds hearings, not them personally.

00:22:58 ◼   ► And the last, you know, we just got a new one.

00:23:00 ◼   ► Isn't this awesome?

00:23:00 ◼   ► The Senate actually approved the confirmation, uh, new librarian of

00:23:04 ◼   ► Congress understands technology has run a library system.

00:23:07 ◼   ► She's the voice of the future.

00:23:09 ◼   ► This is going to be great.

00:23:10 ◼   ► The guy who's been in charge for decades has been kind of a know nothing,

00:23:13 ◼   ► Luddite, just terrible in terms of the technology side, great in terms of books.

00:23:17 ◼   ► Anyway, so the section 1201 hearings, it's a circus.

00:23:21 ◼   ► You have the process described in the law is terrible.

00:23:24 ◼   ► So the librarian of Congress created a process that basically people who object

00:23:30 ◼   ► to limitations and want to get them removed temporarily only for a three

00:23:36 ◼   ► only for a three-year period have to essentially file something like a legal

00:23:39 ◼   ► brief, although it can be in more plain language explaining why there's a

00:23:42 ◼   ► legitimate public interest to be served in providing exemption. And then the

00:23:47 ◼   ► librarian, so they have this circus, they have hearings and people parade through

00:23:50 ◼   ► and they testify and there last time I think there were 47 different subgroup

00:23:55 ◼   ► items being presented and it's just and it's you know farming, it's companies

00:24:00 ◼   ► like John Deere who have DRM on their tractors, automakers, video game makers,

00:24:05 ◼   ► printer companies, as well as the software and, you know, like iPhone

00:24:10 ◼   ► locking and the rest of it.

00:24:11 ◼   ► And, and then there's people who, you know, file these objections and there's

00:24:14 ◼   ► back and forth, and then the Library of Congress issues a set of rules about

00:24:18 ◼   ► what's going to be exempted, if anything, in the next three year period.

00:24:21 ◼   ► It's a ridiculous process.

00:24:22 ◼   ► So the EFF is suing, basically on the unconstitutionality of the, of this

00:24:28 ◼   ► provision, and if it were struck down or even minimized, it would dramatically

00:24:33 ◼   ► enhance the ability of people to do self-repair, which is, you know, Kyle

00:24:37 ◼   ► Wiens at iFixit, he's been a huge proponent and deeply active in this process.

00:24:41 ◼   ► And, um, you can read a lot of stuff about right to repair that

00:24:44 ◼   ► relates a lot to DRM these days.

00:24:46 ◼   ► Uh, I did a specific provision in the D digital D M C a not DCM.

00:24:54 ◼   ► D D yeah.

00:24:55 ◼   ► Digital cause it was a millennium copyright was sunny.

00:24:58 ◼   ► I can't remember if Sonny Bono was involved in that one, but maybe

00:25:01 ◼   ► - Maybe. (laughs)

00:25:02 ◼   ► - We might have. - The Sonny Bono law also,

00:25:04 ◼   ► but that's a different one.

00:25:05 ◼   ► - It's specifically, it more or less outlaws backwards

00:25:08 ◼   ► reverse engineering how DRM works.

00:25:11 ◼   ► And reverse engineering is, you know,

00:25:13 ◼   ► here, you've got this thing, you own it.

00:25:16 ◼   ► Are you allowed to try to figure out how it works?

00:25:18 ◼   ► And that's, you know, I think that's been considered

00:25:21 ◼   ► part of, you know, I guess free speech,

00:25:25 ◼   ► but certainly seems like something that, you know,

00:25:28 ◼   ► I don't know, the engineer in me objects to,

00:25:31 ◼   ► We've got this magic thing called copyright

00:25:35 ◼   ► for our movies and music,

00:25:37 ◼   ► and it gets a special exemption for this

00:25:40 ◼   ► that nothing else has.

00:25:41 ◼   ► - Yeah, and I just learned something,

00:25:44 ◼   ► and that's terrible because it keeps innovation.

00:25:46 ◼   ► How did everything interesting happen that's going on?

00:25:49 ◼   ► Some people point to giant corporate research labs.

00:25:52 ◼   ► So many interesting things we're doing in technology

00:25:54 ◼   ► came from people tinkering at little stuff

00:25:57 ◼   ► that they took apart, right?

00:25:58 ◼   ► I saw Kate McKinnon, who I love,

00:25:59 ◼   ► We're going to talk about Ghostbusters later, right?

00:26:01 ◼   ► We'll talk about Ghostbusters.

00:26:02 ◼   ► I have not seen the movie yet though.

00:26:03 ◼   ► We'll talk about the movie.

00:26:04 ◼   ► We'll talk, we're gonna talk about Twitter or whatever.

00:26:05 ◼   ► Okay.

00:26:06 ◼   ► Yeah.

00:26:06 ◼   ► Yeah.

00:26:06 ◼   ► I am one of the, my, one of the few people who still watches SNL.

00:26:09 ◼   ► I watch it and Lynn and I, my wife, we fast forward, we tape it.

00:26:12 ◼   ► We watch it like a few days later.

00:26:14 ◼   ► We fast forward through the bad stuff.

00:26:15 ◼   ► There are a bunch of really great performers.

00:26:18 ◼   ► A lot of people our age have given up an SNL longer.

00:26:21 ◼   ► Like it's, you know, we're big SNL fans here.

00:26:24 ◼   ► Oh, good.

00:26:24 ◼   ► Yeah.

00:26:24 ◼   ► And it's hit or miss as you know, sometimes you're watching an entire

00:26:27 ◼   ► episode, you're like, where I don't even know what happened.

00:26:29 ◼   ► And then another time you're crying for--

00:26:31 ◼   ► - It's always been like that.

00:26:33 ◼   ► It's always been like that.

00:26:34 ◼   ► - You're totally right.

00:26:35 ◼   ► I have this, I have the same memory of,

00:26:36 ◼   ► no, wasn't it always, no it wasn't.

00:26:38 ◼   ► So Kate McKinnon, you love her then 'cause you watch it.

00:26:40 ◼   ► She's an incredible mimic and she's great in "Ghostbusters."

00:26:43 ◼   ► She is such a, I've seen her interviewed.

00:26:45 ◼   ► I just think she is so great.

00:26:47 ◼   ► And we're at the beginning of her breakout part

00:26:49 ◼   ► of her career, like Kristen Wiig already had, right?

00:26:52 ◼   ► This is it.

00:26:52 ◼   ► So Kate McKinnon, I see this interview.

00:26:54 ◼   ► She's on the red carpet for "Ghostbusters."

00:26:55 ◼   ► And this tiny little girl,

00:26:57 ◼   ► It's supposed to be like eight or nine is doing interviews.

00:27:00 ◼   ► And she asked Kate McKinnon question and Kate

00:27:02 ◼   ► McKinnon looks so touched and in love and then

00:27:04 ◼   ► looks at her very seriously and gives you this

00:27:06 ◼   ► answer.

00:27:07 ◼   ► And the girl said, what was it like to work

00:27:09 ◼   ► around all this cool technology in the movie?

00:27:11 ◼   ► And Kate McKinnon said, when I was a kid, I

00:27:13 ◼   ► used to love to take things apart, radios,

00:27:15 ◼   ► things that look at the circuit boards and

00:27:16 ◼   ► whatever, and this whole movie, I walk in

00:27:17 ◼   ► everything is circuit boards.

00:27:19 ◼   ► And it's just, it was a dream.

00:27:21 ◼   ► It was like my childhood again, something like

00:27:23 ◼   ► that.

00:27:23 ◼   ► And I'm thinking that is the kind of thing

00:27:26 ◼   ► that kids today, they don't know,

00:27:28 ◼   ► they're not encouraged to take things apart.

00:27:30 ◼   ► They could actually be violating the law

00:27:32 ◼   ► if they were to know, on the software side,

00:27:34 ◼   ► to circumvent things.

00:27:35 ◼   ► Literally, these kids could be violating federal law

00:27:38 ◼   ► for doing the stuff that you and I did,

00:27:40 ◼   ► and all, you know, millions and millions of other children.

00:27:41 ◼   ► - It is certainly the case

00:27:43 ◼   ► that the overwhelming majority of all people

00:27:45 ◼   ► have almost no curiosity about how things work.

00:27:47 ◼   ► - Which is fine, which is fine.

00:27:48 ◼   ► - Right, but for the minority of people

00:27:51 ◼   ► who are curious about how things work,

00:27:54 ◼   ► those also tend to be the sort of people

00:27:56 ◼   ► who create new things, you know?

00:27:58 ◼   ► And I mean, I think you could find that

00:28:00 ◼   ► with creative people and, like you said, entertainers.

00:28:03 ◼   ► Even entertainers, it's just like a mindset of,

00:28:06 ◼   ► I would like to take that apart.

00:28:08 ◼   ► (laughs)

00:28:10 ◼   ► It is a very-- - I saw her at StuffMiner

00:28:11 ◼   ► saying about refinishing tables too.

00:28:12 ◼   ► She's got a crafty aspect to her, she does.

00:28:15 ◼   ► - So my take on it is that I think it's,

00:28:20 ◼   ► I object philosophically to the idea

00:28:22 ◼   ► that you should outlaw being able to take things apart

00:28:24 ◼   ► and figure out how they work,

00:28:26 ◼   ► But on the flip side, I also think that the people

00:28:28 ◼   ► who make things have every right to make them

00:28:30 ◼   ► as difficult to take apart or as, you know,

00:28:33 ◼   ► like in the case with Apple and cell phone encryption,

00:28:38 ◼   ► that if Apple can figure out a way to mathematically

00:28:40 ◼   ► make the contents of a phone effectively unbreakable,

00:28:45 ◼   ► encryption wise, they have the right to do that.

00:28:48 ◼   ► And the NSA has a right to try to find the holes

00:28:51 ◼   ► in their logic.

00:28:52 ◼   ► - Oh, yeah, I don't think manufacturers should be obliged

00:28:55 ◼   ► to make it easy.

00:28:56 ◼   ► And some do that.

00:28:57 ◼   ► I was talking to a company that I can't reveal

00:28:58 ◼   ► that said, because of various regulations,

00:29:01 ◼   ► they're not allowed to promote the fact that

00:29:03 ◼   ► their product is modifiable because it would

00:29:05 ◼   ► actually put them in violation and put them in

00:29:07 ◼   ► a new regulatory framework.

00:29:08 ◼   ► However, they can make their product

00:29:11 ◼   ► viable, a modifiable, including the firmware,

00:29:13 ◼   ► and they just can't say anything about it.

00:29:15 ◼   ► So they are actually doing everything they can.

00:29:17 ◼   ► A great example is that I can talk about is

00:29:20 ◼   ► Chumby, which is Bunny Huang, who's one of the

00:29:22 ◼   ► plaintiffs in the EFF suit that's coming out

00:29:24 ◼   ► Uh, suit that's coming up, uh, bunny, uh, lives in Singapore.

00:29:28 ◼   ► I think still lives in Singapore.

00:29:29 ◼   ► It goes to Shenzhen all the time.

00:29:31 ◼   ► He's a hands-on designer.

00:29:33 ◼   ► He's been designing an open laptop.

00:29:34 ◼   ► This is too fascinating.

00:29:35 ◼   ► It's not, there's a little ideology in it, but it's also an

00:29:38 ◼   ► incredible technical exercise.

00:29:39 ◼   ► He was one of the people behind Chumby, which was, uh, it was originally

00:29:42 ◼   ► this kind of soft alarm clock that you could make apps for like many years ago.

00:29:47 ◼   ► Yeah.

00:29:47 ◼   ► And it went through a lot of revisions.

00:29:48 ◼   ► It's still out there at company.

00:29:50 ◼   ► So they left everything in such a state that when the product didn't succeed,

00:29:54 ◼   ► People could keep it alive and then a new company

00:29:57 ◼   ► came in to support it.

00:29:58 ◼   ► And then that company is now making new chumby

00:29:59 ◼   ► stuff and running the servers.

00:30:01 ◼   ► Um, because enough was open and available.

00:30:04 ◼   ► I don't think the whole thing was open source

00:30:06 ◼   ► and forgetting all the details, but they had

00:30:07 ◼   ► left everything open enough.

00:30:09 ◼   ► And then I think when it was shutting down,

00:30:10 ◼   ► they opened it even further.

00:30:12 ◼   ► And I'm like, that was a wonderful thing.

00:30:14 ◼   ► So as a company, you could choose to do that,

00:30:15 ◼   ► but you can also choose to be, you know, rat

00:30:18 ◼   ► bastards or pursue security, let's say

00:30:20 ◼   ► it, whichever you want and, uh, not make it easy.

00:30:23 ◼   ► That's totally, I mean, I don't, I don't think being, there's a difference there.

00:30:26 ◼   ► Like should Apple allow third-party apps that are not sold from its store?

00:30:30 ◼   ► I should say non app source apps.

00:30:31 ◼   ► That's a whole interesting debate.

00:30:32 ◼   ► And there's an argument to be made that they should be required, even if they have

00:30:36 ◼   ► to put hurdles in and switches, and you have to agree, you're going to

00:30:39 ◼   ► avoid your warranty or whatever.

00:30:41 ◼   ► That's separate from should Apple let its firmware be hackable.

00:30:45 ◼   ► That's a very different situation.

00:30:46 ◼   ► They, they shouldn't pursue people who have broken into it.

00:30:51 ◼   ► That's where the DRM issue lies rather than they should make it easy, which is a sort of philosophical,

00:30:56 ◼   ► ideological situation.

00:30:58 ◼   ► Um, all right.

00:31:00 ◼   ► And that's where I disagree with the, what's his name?

00:31:03 ◼   ► Wines from, uh, the, uh, Mac fix it.

00:31:06 ◼   ► What's the point?

00:31:07 ◼   ► Yeah.

00:31:07 ◼   ► I fix it.

00:31:08 ◼   ► I fix it.

00:31:08 ◼   ► Like the pentalobe screw thing was a big, that was an inflection point, right?

00:31:11 ◼   ► Is Apple switched to pentalobe screws.

00:31:14 ◼   ► It was hard to get such a screwdriver then iFixit made it, which is great, but Kyle maintained, I think that, uh,

00:31:20 ◼   ► - Yeah, from your right.

00:31:21 ◼   ► Yeah, he said Apple is doing this to make it hard to repair.

00:31:25 ◼   ► Some people said maybe it's because it's easier

00:31:27 ◼   ► to do machine creation, but that was machine assembly.

00:31:31 ◼   ► That's, who knows?

00:31:32 ◼   ► But it definitely made it harder to repair.

00:31:34 ◼   ► And then, you know, Tana Lobe screwdrivers got made

00:31:36 ◼   ► and now it's possible.

00:31:37 ◼   ► But I agree that Apple probably does some things

00:31:40 ◼   ► to make it harder for third,

00:31:41 ◼   ► for consumers and third parties to make changes.

00:31:44 ◼   ► And other things, I think it's, they don't care.

00:31:47 ◼   ► They just engineer it

00:31:48 ◼   ► because they know they're gonna repair it

00:31:49 ◼   ► so they don't give a damn if it's hard,

00:31:50 ◼   ► 'cause they'll take care of it.

00:31:51 ◼   ► - Right, I think that there's,

00:31:54 ◼   ► it's funny, 'cause that's a perfect example,

00:31:56 ◼   ► and I try to be like this as much as I can.

00:31:59 ◼   ► So I disagree with Kyle on his take on this,

00:32:03 ◼   ► but I'm intrigued by his argument,

00:32:05 ◼   ► and I don't, you know, I don't think that,

00:32:07 ◼   ► I don't say this guy's an idiot.

00:32:09 ◼   ► I disagree with him.

00:32:11 ◼   ► I do believe that he's wrong,

00:32:13 ◼   ► but I always do enjoy reading his pieces, arguing about it.

00:32:16 ◼   ► He's pushing and he pushes the, the, he pushes the envelope in a way that's good for everybody.

00:32:20 ◼   ► Even if you disagree with them, there's nothing wrong with the idea that Apple could roll back to

00:32:26 ◼   ► Phillips head screws.

00:32:27 ◼   ► Like that doesn't make things worse for anyone.

00:32:28 ◼   ► Even if you disagree with why they switched to Pentelome.

00:32:31 ◼   ► Um, I want to point that since we're in a sidebar, we're sort of side barring a sidebar, there's a great piece

00:32:35 ◼   ► about warranties and motherboard last month.

00:32:38 ◼   ► I don't know if you saw this house Sony, Microsoft and other gadget makers violate federal warranty law.

00:32:42 ◼   ► I am going to send you a URL.

00:32:45 ◼   ► This is a great piece. I never knew this.

00:32:48 ◼   ► Most, all the things that say,

00:32:51 ◼   ► break the seal and you violate warranty

00:32:53 ◼   ► are actually either illegal or unenforceable.

00:32:56 ◼   ► I had no idea.

00:32:57 ◼   ► - I did not know that either.

00:32:58 ◼   ► - 1970 law called the Magnuson Moss Warranty Act.

00:33:01 ◼   ► Federal law says you can open your electronics

00:33:03 ◼   ► without voiding the warranty,

00:33:04 ◼   ► regardless of what the language of that warranty says.

00:33:06 ◼   ► People should read this 'cause I had my mind blown.

00:33:09 ◼   ► - Every single hard drive I've ever purchased

00:33:10 ◼   ► has a sticker like that somewhere on it.

00:33:14 ◼   ► But I always thought that it was kind of reasonable

00:33:16 ◼   ► for like a hard drive because,

00:33:18 ◼   ► especially in the spinning disk era,

00:33:20 ◼   ► if you get to the point where you open up

00:33:22 ◼   ► and expose the disk and it picks up dust

00:33:25 ◼   ► and then doesn't work right,

00:33:27 ◼   ► well, why shouldn't your warranty be blocked?

00:33:28 ◼   ► - Oh yeah, it's not that, but the thing is,

00:33:31 ◼   ► the warranty isn't de facto violated by breaking the seal,

00:33:35 ◼   ► and that's the thing.

00:33:36 ◼   ► Or even doing a repair, the article notes,

00:33:39 ◼   ► and they got some great liability lawyers,

00:33:42 ◼   ► that lemon law lawyers talk about is the manufacturer

00:33:45 ◼   ► has to prove that your, whatever you did caused the failure.

00:33:48 ◼   ► - Ah, gotcha, that's fair.

00:33:49 ◼   ► - So they can do that.

00:33:50 ◼   ► They can say there's dust on the drive,

00:33:52 ◼   ► there wasn't dust originally,

00:33:53 ◼   ► it worked when you got it, so screw you.

00:33:55 ◼   ► - I see that, going back to Kyle Wines,

00:33:58 ◼   ► I think his argument would be bolstered

00:34:01 ◼   ► if he stopped attributing malice to Apple

00:34:04 ◼   ► and simply stated why he thinks

00:34:07 ◼   ► these would be better devices with standard screws.

00:34:10 ◼   ► And I know one of his other bugaboos

00:34:12 ◼   ► is the use of glue.

00:34:13 ◼   ► - Oh yeah.

00:34:14 ◼   ► - Just make the argument that this would be a better device

00:34:19 ◼   ► for everybody if they stopped using glue

00:34:23 ◼   ► and stuff like that.

00:34:25 ◼   ► - Oh yeah. - Instead of saying

00:34:26 ◼   ► that they're doing this to make it hard to repair.

00:34:29 ◼   ► Apple does not care about the repair shops.

00:34:31 ◼   ► They don't.

00:34:32 ◼   ► They give no shits.

00:34:33 ◼   ► - It's tiny, yeah.

00:34:35 ◼   ► It's also, this is a case,

00:34:38 ◼   ► this is not a sidebar, I swear to God.

00:34:39 ◼   ► parentheses Nestor as you know.

00:34:40 ◼   ► Um, but Walt Hickey wrote this great piece that I

00:34:43 ◼   ► think he's at 538, I think that's right about,

00:34:46 ◼   ► um, he's, I love his writing and he wrote this

00:34:48 ◼   ► thing about how IMDb, uh, movies, uh, movie scores

00:34:52 ◼   ► are, um, are sunk by male trolls because he did

00:34:57 ◼   ► the analysis and you can see that men more highly,

00:35:01 ◼   ► uh, downvote or give poor ratings to movies that

00:35:04 ◼   ► women like better than, and women do not do the

00:35:07 ◼   ► same thing to male films.

00:35:08 ◼   ► films that men like better.

00:35:10 ◼   ► So, you can look at films that more men have seen,

00:35:12 ◼   ► there's gender split, you know, and so forth.

00:35:13 ◼   ► And you can do that analysis and figure it out.

00:35:15 ◼   ► And the article is really interesting, but the one

00:35:17 ◼   ► thing I disagree with him on is he was attributing malice.

00:35:20 ◼   ► He said effectively that men are trolling as

00:35:23 ◼   ► opposed to internalizing their own toxic masculinity

00:35:26 ◼   ► and voting stuff down because they thought no one

00:35:28 ◼   ► should see it, sort of the Ghostbusters thing.

00:35:29 ◼   ► Again, like, well, if you haven't seen the movie and

00:35:31 ◼   ► you're voting to three, you're kind of a troll, but

00:35:34 ◼   ► some people may have, may have seen it.

00:35:36 ◼   ► You don't know how many haven't seen it.

00:35:38 ◼   ► haven't seen it, how, have, and whatever.

00:35:40 ◼   ► I feel like the same thing a bit with people

00:35:41 ◼   ► who attribute things to Apple.

00:35:43 ◼   ► If you know, if you could pull it out and say,

00:35:47 ◼   ► I talked to, or an Apple engineer goes public and says,

00:35:50 ◼   ► I worked at Apple for 20 years,

00:35:52 ◼   ► and the things we did to screw repair firms,

00:35:55 ◼   ► then you could say, malice.

00:35:56 ◼   ► - My job was to make it difficult or impossible

00:35:59 ◼   ► to replace your screen at a third-party facility,

00:36:02 ◼   ► because Apple wants the $100 replacement fee.

00:36:06 ◼   ► I was the extra glue engineer at Apple,

00:36:08 ◼   ► continuing glue engineer.

00:36:09 ◼   ► - Before, this is good.

00:36:12 ◼   ► I think I can unwind.

00:36:13 ◼   ► I wanna go back to the security bug.

00:36:17 ◼   ► So all the way back to this responsible,

00:36:24 ◼   ► what is it called, responsible?

00:36:26 ◼   ► - Is it like, I don't know, I may know if this is right,

00:36:27 ◼   ► it's like responsible disclosure policy

00:36:29 ◼   ► is what I'd label it.

00:36:30 ◼   ► - So in some aspect though, it's not responsible

00:36:33 ◼   ► because the only things that are updated

00:36:36 ◼   ► are the very latest update to the OS.

00:36:38 ◼   ► I'm talking to you right now through an iMac

00:36:42 ◼   ► that has not been updated,

00:36:43 ◼   ► because I didn't feel like restarting my Mac

00:36:45 ◼   ► before we started the show.

00:36:46 ◼   ► - Right, right.

00:36:47 ◼   ► - So the Mac I'm talking to you on right now is not updated.

00:36:51 ◼   ► My iPhone is.

00:36:53 ◼   ► I thoroughly doubt that my son's or wife's iPhones are.

00:36:58 ◼   ► I'm pretty sure my iPad is not because I haven't,

00:37:01 ◼   ► oh no, it might because I'm running iOS 10 beta,

00:37:04 ◼   ► so I don't know.

00:37:05 ◼   ► But I have devices, I'm technically adept

00:37:08 ◼   ► and I'm in tune to the news.

00:37:10 ◼   ► And I have devices that aren't updated yet.

00:37:13 ◼   ► And let alone anybody who hasn't updated to El Capitan yet.

00:37:18 ◼   ► If you're running, you know, what was the one before?

00:37:26 ◼   ► - Yosemite, I don't have to keep looking it up.

00:37:29 ◼   ► - You know, you're still vulnerable.

00:37:34 ◼   ► And I don't know if Apple, you know,

00:37:35 ◼   ► nobody knows 'cause Apple won't say it,

00:37:36 ◼   ► but whether Apple's gonna do a security update

00:37:38 ◼   ► for those things either.

00:37:39 ◼   ► So in some sense, I often wonder

00:37:41 ◼   ► about disclosing these things, you know,

00:37:43 ◼   ► whether it's good or bad.

00:37:46 ◼   ► - Well, yeah, there's a couple of different aspects to it.

00:37:49 ◼   ► If there's a zero day, you know,

00:37:52 ◼   ► which just for the benefit of listeners who don't know,

00:37:53 ◼   ► zero day is an exploit that is known as something is patched.

00:37:57 ◼   ► So the patch comes out and it's known

00:37:59 ◼   ► that it's in malware that's being used, right?

00:38:03 ◼   ► So it has to be patched immediately

00:38:05 ◼   ► because you have to protect people who are in active danger.

00:38:07 ◼   ► So this is not a zero day.

00:38:09 ◼   ► There's no known attacks in the wild.

00:38:11 ◼   ► I haven't seen anything in the last couple of days

00:38:12 ◼   ► that suggested anyone had managed to exploit this

00:38:15 ◼   ► in any broad way.

00:38:15 ◼   ► And we'd know that 'cause Mac users and iOS users,

00:38:18 ◼   ► if it had been sent out as general malware,

00:38:20 ◼   ► would have been reporting,

00:38:21 ◼   ► I've been hijacked or whatever,

00:38:23 ◼   ► because malware distributors are not subtle, typically.

00:38:26 ◼   ► There'd be ransomware.

00:38:27 ◼   ► I mean, the big thing right now is ransomware,

00:38:28 ◼   ► as you know, I've been writing about that recently.

00:38:30 ◼   ► I got a couple articles on it.

00:38:31 ◼   ► And anyway, so this isn't a zero day,

00:38:35 ◼   ► but this is the tricky part.

00:38:37 ◼   ► Like if you don't think that it's in the wild,

00:38:39 ◼   ► like you're working for a security company,

00:38:40 ◼   ► there's no reports of this coming out,

00:38:42 ◼   ► that you've been analyzing,

00:38:43 ◼   ► you've found it proactively in advance or prospectively.

00:38:47 ◼   ► And the patch has been made and distributed

00:38:50 ◼   ► so anyone can get it has it.

00:38:52 ◼   ► That removes the financial incentive

00:38:53 ◼   ► for any criminal organization to try to find an exploit

00:38:57 ◼   ► because the window is closing so fast.

00:38:59 ◼   ► Like, you know, 25% of it's closed in the first few hours

00:39:03 ◼   ► and Apple pushes updates so heavily

00:39:06 ◼   ► and makes it hard to ignore them,

00:39:07 ◼   ► especially in iOS and other platforms

00:39:10 ◼   ► that the odds of having a target are very small.

00:39:12 ◼   ► So you spend weeks or months developing the payload

00:39:15 ◼   ► of the exploit technology to deliver the correct payload.

00:39:18 ◼   ► And by then 93% of people have updated

00:39:21 ◼   ► and you have, you know, a couple hundred thousand people

00:39:22 ◼   ► you have to reach and even spam and phishing

00:39:25 ◼   ► doesn't make it worthwhile to send out the messages

00:39:27 ◼   ► to reach a fraction of them.

00:39:29 ◼   ► So the economics of it are bad when it's not a zero day.

00:39:31 ◼   ► When it's a zero day, you disclose because it's so dangerous

00:39:34 ◼   ► and you want everyone to patch right away.

00:39:36 ◼   ► And the economics there change instantly too,

00:39:38 ◼   ► but there's exploits out there that will be tried

00:39:40 ◼   ► to be put out as fast as they can before people patch.

00:39:44 ◼   ► - Let me take a break here and thank our first sponsor.

00:39:46 ◼   ► I love, this is a brand new sponsor and it is a great app.

00:39:51 ◼   ► It's called Boom.

00:39:52 ◼   ► It's a Mac app from Global Delight.

00:39:54 ◼   ► Have you ever wished that the audio playing

00:39:56 ◼   ► your Mac could be richer, crisper, and just better. If you like listening to music, movies, videos

00:40:02 ◼   ► through your Mac or any other audio, then you may have searched for ways to boost the volume on your

00:40:08 ◼   ► Mac but haven't found anything yet. Well, that's what Boom does. It's an amazing audio enhancer for

00:40:12 ◼   ► the Mac. It is simple. It's gorgeous. It has great looking UI. These guys at Global Delight have always

00:40:19 ◼   ► always done really, really high-end, you know, classic indie Mac developer attention to detail,

00:40:26 ◼   ► and all the icons look great and everything like that. So it's just a volume booster. That's it.

00:40:33 ◼   ► Just it works on a system-wide level, so you don't have to install it like inside apps. It's not a

00:40:39 ◼   ► plug-in or anything like that. And anything you play on your Mac suddenly sounds amplified.

00:40:45 ◼   ► It works with headphones, it works with speakers,

00:40:48 ◼   ► and the best part, it's a MacWorld Best of Show winner.

00:40:52 ◼   ► This is an app that has been renowned.

00:40:54 ◼   ► It really, it sounds almost like snake oil,

00:40:57 ◼   ► but it really does work.

00:40:58 ◼   ► It's won the MacWorld Best of Show

00:41:00 ◼   ► back when MacWorld was a show.

00:41:02 ◼   ► And here's the best part.

00:41:04 ◼   ► Anyway, I keep talking in circles here,

00:41:06 ◼   ► but the best part is right now, for a very limited period,

00:41:09 ◼   ► I don't quite know how limited the period is,

00:41:11 ◼   ► so if you hear it, you better go get it now,

00:41:12 ◼   ► It is 33% off in their store.

00:41:15 ◼   ► It's just $9.99.

00:41:17 ◼   ► It's usually $15.

00:41:19 ◼   ► Where do you go?

00:41:20 ◼   ► Here's their URL.

00:41:21 ◼   ► It's a Bitly URL.

00:41:22 ◼   ► So go to bit.ly/boom2mac.

00:41:28 ◼   ► That's the digit 2.

00:41:30 ◼   ► Bitly/boom2mac.

00:41:34 ◼   ► And you will get more info.

00:41:36 ◼   ► They have a seven-day free trial.

00:41:37 ◼   ► Can you believe that?

00:41:38 ◼   ► Seven-day free trial.

00:41:39 ◼   ► What a-- it's like in the world of the App Store,

00:41:42 ◼   ► it's like you forget about free trials.

00:41:43 ◼   ► Well, guess what?

00:41:44 ◼   ► That's why the Mac is awesome.

00:41:46 ◼   ► Seven day free trial.

00:41:47 ◼   ► Try it, listen to it, see that you like it,

00:41:51 ◼   ► and then you can get it for 33% off.

00:41:53 ◼   ► That's boom two, that's the reason the two is in the URL.

00:41:57 ◼   ► This is version two of the app.

00:41:58 ◼   ► Boom two, 33% off.

00:42:00 ◼   ► Bitly/boom2mac.

00:42:02 ◼   ► It's a great app.

00:42:03 ◼   ► We were talking before about the sort of,

00:42:12 ◼   ► I don't know what you'd call it,

00:42:13 ◼   ► but the idea that Mac users are insufferably smug

00:42:17 ◼   ► on security issues.

00:42:18 ◼   ► - So true.

00:42:20 ◼   ► - And that's another one that's sort of like

00:42:21 ◼   ► a pet issue of mine, is the incessant,

00:42:26 ◼   ► inevitable need to boil everything down to a binary.

00:42:32 ◼   ► It's either this or that.

00:42:35 ◼   ► Either the Mac is completely invulnerable

00:42:38 ◼   ► to malware and security exploits,

00:42:42 ◼   ► or the Mac is every bit as vulnerable and exploitable

00:42:47 ◼   ► as every other system that's out there,

00:42:50 ◼   ► when the truth is in between.

00:42:53 ◼   ► It is nuanced.

00:42:54 ◼   ► You know, and it was a lot, you still see it,

00:42:57 ◼   ► and part of it is that iOS is so spectacularly popular

00:43:02 ◼   ► and such a lucrative target.

00:43:05 ◼   ► But in the old days, pre-iPhone,

00:43:08 ◼   ► it was always, almost always boiled down to an argument

00:43:13 ◼   ► that the Mac, you know, Windows has all this malware

00:43:16 ◼   ► problems, all these issues and all this, you know,

00:43:20 ◼   ► and I don't even think it was snake oil.

00:43:22 ◼   ► I think it was a reasonable thing that, you know,

00:43:24 ◼   ► informed users would agree with,

00:43:26 ◼   ► was that it was considered a standard practice

00:43:31 ◼   ► to install antivirus on your Windows PC.

00:43:35 ◼   ► That if you didn't, you were a fool

00:43:37 ◼   ► and you were probably gonna get exploited.

00:43:38 ◼   ► - Oh yeah, remember when you'd install

00:43:40 ◼   ► a virtual Windows machine on your Mac in Parallels

00:43:42 ◼   ► and then you'd launch it and it would get infected

00:43:44 ◼   ► before you could install the antivirus software?

00:43:46 ◼   ► That happened to me.

00:43:47 ◼   ► - It's no exaggeration.

00:43:50 ◼   ► And then Mac users, informed Mac users like myself

00:43:55 ◼   ► would say, "Well, I don't run any antivirus on my Mac."

00:44:00 ◼   ► And in fact, I don't recommend, my family members do,

00:44:04 ◼   ► and I don't think you should either.

00:44:05 ◼   ► And I don't think you need to.

00:44:08 ◼   ► And then they would say, well, you're an idiot,

00:44:09 ◼   ► because the only reason the Mac doesn't get exploited

00:44:12 ◼   ► is that it's every bit as vulnerable as Windows,

00:44:14 ◼   ► but it's too small for the malware people to care about.

00:44:18 ◼   ► And it's like, you can't disprove that.

00:44:20 ◼   ► That's one of those, it's like,

00:44:21 ◼   ► I don't know what the rhetorical description of that is,

00:44:24 ◼   ► but it's sort of like a straw man argument.

00:44:26 ◼   ► You can't knock it down.

00:44:27 ◼   ► You can't disprove a hypothetical like that, right?

00:44:32 ◼   ► There's no way to prove it otherwise,

00:44:33 ◼   ► except if the Mac got as popular as Windows.

00:44:37 ◼   ► And that sort of happened with iOS, right?

00:44:42 ◼   ► iOS has hundreds of millions,

00:44:45 ◼   ► or I guess a billion active devices.

00:44:47 ◼   ► There might be, now that I think about it,

00:44:50 ◼   ► there might be more iOS devices in use than Windows devices.

00:44:53 ◼   ► I don't know, that might be ridiculous.

00:44:55 ◼   ► - I think there's more Windows,

00:44:55 ◼   ► because Windows things are never,

00:44:57 ◼   ► there's like people running Windows 95 stuff someplace.

00:45:00 ◼   ► - It's in the ballpark though.

00:45:01 ◼   ► probably running air traffic control or something.

00:45:04 ◼   ► - It is in the ballpark.

00:45:05 ◼   ► - Yeah, oh yeah.

00:45:07 ◼   ► - And it didn't happen.

00:45:09 ◼   ► I mean, now there is malware for Mac.

00:45:11 ◼   ► There is malware that attacks iOS,

00:45:13 ◼   ► but it's never been as rampant a problem

00:45:15 ◼   ► as it has been on other platforms.

00:45:18 ◼   ► - Yeah, it's, I've always said,

00:45:21 ◼   ► shouldn't say always, but I've said increasingly,

00:45:23 ◼   ► let's say this time is going by,

00:45:24 ◼   ► I said increasingly like Apple was a weird target

00:45:26 ◼   ► and we had, we were the first viruses

00:45:28 ◼   ► come to the computers, the first widespread worms and things

00:45:31 ◼   ► was through Macs, right?

00:45:32 ◼   ► We had the one that you stuck a disc in,

00:45:34 ◼   ► it would write it to the floppy disk, I think.

00:45:35 ◼   ► - Yes, I have in my notes here,

00:45:38 ◼   ► do you remember what, do you remember?

00:45:40 ◼   ► There was a time. - It's not gonna be.

00:45:41 ◼   ► - There was a time when I did run antivirus on my Mac

00:45:45 ◼   ► and I did recommend everybody do it.

00:45:47 ◼   ► It was called Disinfectant.

00:45:48 ◼   ► - Yeah, oh, I love that.

00:45:49 ◼   ► Yeah, those guys, yes. - Awesome.

00:45:51 ◼   ► Oh no, it was one guy.

00:45:52 ◼   ► It was like a guy up in Seattle, right?

00:45:54 ◼   ► - Oh, you're so right, 'cause did he charge for it?

00:45:57 ◼   ► - No, it was free. - It was free.

00:45:58 ◼   ► - What was his name? - It was great.

00:45:59 ◼   ► It was as good as the commercial solutions for a long time.

00:46:01 ◼   ► - John Norstead.

00:46:04 ◼   ► - Oh, wow, that's good memory.

00:46:05 ◼   ► I think that's right.

00:46:06 ◼   ► A very nice guy, if I recall, too.

00:46:08 ◼   ► - Really nice guy.

00:46:09 ◼   ► I mean, like, just amazing that it was just,

00:46:14 ◼   ► and it was this free utility you did,

00:46:17 ◼   ► like an init, you would, Norstead, John Norstead.

00:46:21 ◼   ► - I miss inits, sort of.

00:46:23 ◼   ► - Here's his homepage, John Norstead's homepage.

00:46:26 ◼   ► There he is.

00:46:27 ◼   ► - Yay.

00:46:27 ◼   ► - I will put this in the show notes.

00:46:29 ◼   ► John Norstead's homepage.

00:46:30 ◼   ► It was amazing.

00:46:31 ◼   ► It was an init, you ran it,

00:46:34 ◼   ► it seemingly didn't slow your Mac down at all.

00:46:38 ◼   ► It had no adverse effects,

00:46:40 ◼   ► and it was updated on a regular basis

00:46:43 ◼   ► with all the new viruses that were spread around,

00:46:47 ◼   ► and it would identify them and block them.

00:46:49 ◼   ► But yeah, that was like an insidious one.

00:46:50 ◼   ► I remember Drexel was absolutely hit by it.

00:46:53 ◼   ► It was so insidious.

00:46:57 ◼   ► it was a virus that would spread just by inserting a floppy disk into an already infected machine.

00:47:01 ◼   ► Great piece of engineering for the day.

00:47:03 ◼   ► Yeah.

00:47:04 ◼   ► But yeah, so here's my thing.

00:47:05 ◼   ► So Apple didn't necessarily, they're not a,

00:47:08 ◼   ► Apple was never necessarily ahead on any innovation like address space layout randomization, ALSR,

00:47:13 ◼   ► which is a great technique used so that you can't predictably as a malware developer

00:47:18 ◼   ► know where part of the system is going to be located in memory necessarily.

00:47:22 ◼   ► And the more ASLR you do across everything,

00:47:25 ◼   ► target a memory location and have something happen.

00:47:27 ◼   ► And so that, you know, that Windows, I want to say

00:47:30 ◼   ► Microsoft introduced that years before and they

00:47:32 ◼   ► needed to before OS X.

00:47:34 ◼   ► It was much more necessary.

00:47:35 ◼   ► But Apple wasn't necessarily an innovator in that.

00:47:37 ◼   ► What they were an innovator in was accidental things

00:47:40 ◼   ► that worked, right?

00:47:41 ◼   ► So, Apple going to free updates for its operating

00:47:45 ◼   ► system, you know, first super cheap and then

00:47:48 ◼   ► completely free and all the free incremental ones.

00:47:50 ◼   ► And the way in which you could do an incremental

00:47:52 ◼   ► You could do an incremental update in OS X without typically destroying your system.

00:47:56 ◼   ► I know there were some bad releases and I had problems over the years,

00:47:59 ◼   ► but they created an environment in which people were expected to run updates and typically stay up to date.

00:48:04 ◼   ► You might have been, you know, using 10.6.8, not 10.7 for a while, but then you'd switch over.

00:48:09 ◼   ► And when you looked at over the years, as you looked at the adoption curve,

00:48:13 ◼   ► it's ridiculous compared to any other operating system.

00:48:16 ◼   ► These people move up so fast, and software developers, of course, have the issue of compatibility and all that.

00:48:21 ◼   ► So there are, uh, the, the long tail of older versions by number of people, uh,

00:48:27 ◼   ► running, uh, a number of computers rather of older versions of OS X is very small

00:48:31 ◼   ► compared to most other things.

00:48:33 ◼   ► You look at Android, too, Android, and there's this incredible distribution

00:48:36 ◼   ► because Android devices, when they were sold originally, the first

00:48:40 ◼   ► generations, as opposed to iOS, uh, it was very difficult or impossible

00:48:45 ◼   ► to get beyond the version, even the subversion, like 2.2 that you had

00:48:49 ◼   ► that you had installed.

00:48:50 ◼   ► That gives you a great target,

00:48:52 ◼   ► 'cause you know there's going to be 100 million devices

00:48:54 ◼   ► out there running Android 2.2

00:48:56 ◼   ► for as long as the devices work.

00:48:58 ◼   ► So you have that target to attack forever.

00:49:01 ◼   ► Android, as opposed to OS X or iOS,

00:49:04 ◼   ► didn't have a good pathway directly to users.

00:49:06 ◼   ► I mean, Windows has this, of course,

00:49:08 ◼   ► as a direct pathway,

00:49:09 ◼   ► and eventually it helped to provide security updates.

00:49:11 ◼   ► So Android users are sort of abandoned,

00:49:14 ◼   ► and Google's been working on this for years

00:49:15 ◼   ► to create an effective way to have a rapid turnaround

00:49:18 ◼   ► for certain kinds of security issues.

00:49:20 ◼   ► Switching to apps is one way.

00:49:22 ◼   ► One of my colleagues over at Greenbot

00:49:24 ◼   ► in the IDG family there, Flo I was telling the other day

00:49:27 ◼   ► that like Google having a messaging app,

00:49:30 ◼   ► Hangouts and messenger, I forgot they call it messenger.

00:49:33 ◼   ► They can update the app.

00:49:34 ◼   ► If there's a security problem in the app,

00:49:35 ◼   ► the app can take care of it,

00:49:37 ◼   ► but they can't update the entire system

00:49:38 ◼   ► 'cause someone's running an outdated or unpatchable phone.

00:49:41 ◼   ► So Apple, I think the upgrade cycle

00:49:44 ◼   ► can always reduces the target of potential infections,

00:49:47 ◼   ► whether it's with iOS, which is a monolithic,

00:49:49 ◼   ► you know, ecosystem as opposed to Android,

00:49:52 ◼   ► or it's with OS 10 where they push stuff out.

00:49:55 ◼   ► And I think it seems like a pretty fast way

00:49:58 ◼   ► and get people up to the next version.

00:49:59 ◼   ► So there's never a lot of people

00:50:01 ◼   ► that you can easily target.

00:50:02 ◼   ► And with Windows, you have people running,

00:50:04 ◼   ► hundreds of millions of people

00:50:05 ◼   ► running pre Windows 10 versions.

00:50:07 ◼   ► You have hundreds of millions of Android users,

00:50:09 ◼   ► maybe several hundred million

00:50:11 ◼   ► running pre Marshmallow six point X versions, right?

00:50:14 ◼   ► So those targets are so lovely that as a,

00:50:17 ◼   ► If you're a malware developer and you're a criminal and you're trying to hit the biggest target, why would you do it for iOS or OS 10?

00:50:24 ◼   ► If it's going to be hard or there aren't enough people, it's, it's again,

00:50:28 ◼   ► if you're doing that shotgun approach of I want to do the least, I want to do the least amount of work and get my scummy little piece of malware on as many devices as possible.

00:50:38 ◼   ► I'm going to send it a billion phishing messages. And I know that I'm going to catch of that, like a hundred million Android 2.2 users.

00:50:44 ◼   ► users, it's their owners.

00:50:45 ◼   ► It's easy, relatively easy.

00:50:46 ◼   ► Whereas if you want it, if you're in the business of targeting specific

00:50:51 ◼   ► individuals at the behest of a government agency, you

00:50:54 ◼   ► totally different.

00:50:54 ◼   ► Yeah.

00:50:55 ◼   ► I mean, look at the threat, you know, the hacking team that revealed how many

00:50:57 ◼   ► different kinds of attacks that were against, uh, max and iOS.

00:51:00 ◼   ► So, and it's a different category.

00:51:02 ◼   ► It's something to be concerned about, but it's also things like Apple, uh,

00:51:05 ◼   ► didn't have a native mail program for the longest time.

00:51:07 ◼   ► Remember, and then they come out with mail and mail's kind of crappy, but it

00:51:10 ◼   ► Apple came out with own mail program for OS 10.

00:51:12 ◼   ► Um, there was already diversity, so you

00:51:14 ◼   ► couldn't as a malware author, target a

00:51:16 ◼   ► specific popular mail programs problems.

00:51:20 ◼   ► The mail programs weren't deeply integrated,

00:51:22 ◼   ► like they were in windows.

00:51:23 ◼   ► So you couldn't cause like JavaScript to run

00:51:25 ◼   ► an attached message without someone clicking

00:51:27 ◼   ► on it in Eudora or whatever.

00:51:29 ◼   ► Right.

00:51:29 ◼   ► And then when mail came out, Apple already

00:51:31 ◼   ► knew this was a problem.

00:51:32 ◼   ► So they engineered something that was less

00:51:34 ◼   ► embedded in more separate.

00:51:36 ◼   ► So you could still have stuff that would go

00:51:37 ◼   ► wrong, but it was, it was a problem.

00:51:40 ◼   ► a more limited set of activities that happened

00:51:42 ◼   ► with Outlook and integration.

00:51:44 ◼   ► I mean, Microsoft's basically spent the last 20 years

00:51:46 ◼   ► pulling out the hooks it built deeply into its systems

00:51:49 ◼   ► that allowed things to happen

00:51:50 ◼   ► when they should have been sandboxed.

00:51:52 ◼   ► - We're so old that I specifically, you say that

00:51:55 ◼   ► and it sounds so old.

00:51:58 ◼   ► - That's right, you remember when they did.

00:51:59 ◼   ► - Max shipped without an email app.

00:52:02 ◼   ► And I had to double check.

00:52:04 ◼   ► I knew that Apple didn't make one, but I was like, wait,

00:52:06 ◼   ► Did they maybe ship like Netscape's weirdo email

00:52:10 ◼   ► or something?

00:52:11 ◼   ► I was like, no, they didn't ship any of them.

00:52:12 ◼   ► I didn't even ship the one.

00:52:13 ◼   ► I was a Eudora user.

00:52:16 ◼   ► - What came after that?

00:52:17 ◼   ► I mean, it was Outlook.

00:52:18 ◼   ► I think I used Outlook for a while in the Office Suite.

00:52:21 ◼   ► I don't know if that was part of, was that part of the deal?

00:52:23 ◼   ► Did Jobs and Gates agree as part of the Microsoft investment

00:52:28 ◼   ► that Apple wasn't going to release its own mail software?

00:52:31 ◼   ► - No, no.

00:52:32 ◼   ► - Okay, because Outlook existed.

00:52:34 ◼   ► So we put Office or they didn't install Eudora

00:52:35 ◼   ► And there were a bunch of other mail programs.

00:52:37 ◼   ► There's still a remarkable number of email programs

00:52:40 ◼   ► available and new ones being developed all the time.

00:52:42 ◼   ► - I don't wanna resort to Google here.

00:52:45 ◼   ► I want either me or you to remember it.

00:52:47 ◼   ► What was the one Jed Spencer's team created?

00:52:51 ◼   ► And they went on to Microsoft

00:52:53 ◼   ► and created the good version of Outlook.

00:52:56 ◼   ► - And it wasn't Note, what was it called?

00:52:58 ◼   ► I don't think I ever used that.

00:53:01 ◼   ► - Guy Kawasaki was a big--

00:53:03 ◼   ► - Mail mate?

00:53:04 ◼   ► - No, no.

00:53:05 ◼   ► It was beloved by some people.

00:53:09 ◼   ► - I don't, I don't know.

00:53:10 ◼   ► - Was it a Claris product at one point even?

00:53:12 ◼   ► - Claris had an email product, didn't it?

00:53:14 ◼   ► I don't, you know, I'll tell you, I use Mailsmith today.

00:53:18 ◼   ► I actually wrote a--

00:53:19 ◼   ► - You still do?

00:53:20 ◼   ► - I wrote a pro, I wrote an article for Macworld

00:53:22 ◼   ► recently called Old Software That We All Still Use,

00:53:24 ◼   ► and I got so many lovely comments from people

00:53:26 ◼   ► chipping in with these.

00:53:27 ◼   ► I used Quicken 2007.

00:53:29 ◼   ► I used Mailsmith, which is updated for compatibility.

00:53:32 ◼   ► I use CSS Edit from Mac Rabbit,

00:53:34 ◼   ► which doesn't develop anymore

00:53:35 ◼   ► for doing CSS tweaking on live sites.

00:53:38 ◼   ► I have this whole set of old software

00:53:40 ◼   ► that's still either getting tiny compatibility updates

00:53:44 ◼   ► or manages to work under the current environment,

00:53:46 ◼   ► and I'll cry when it stops.

00:53:48 ◼   ► And people chimed in with all this software that they use

00:53:50 ◼   ► that's sometimes like 10 plus years old

00:53:53 ◼   ► that they've just been, you know, a level later.

00:53:55 ◼   ► Level later, they upgraded it very nice

00:53:58 ◼   ► to the people involved and to be compatible with El Capitan.

00:54:02 ◼   ► but Levelator I don't think was really changed

00:54:04 ◼   ► for several years.

00:54:05 ◼   ► It's a vital piece of podcast,

00:54:07 ◼   ► audio normalization, equalization software.

00:54:10 ◼   ► - All right, we hold the thought.

00:54:12 ◼   ► I did cheat, I Googled

00:54:14 ◼   ► and I went to Judge Benser's LinkedIn page.

00:54:18 ◼   ► It was Fog City Software.

00:54:20 ◼   ► - Fog, yes.

00:54:21 ◼   ► - And the product was called E-mailer.

00:54:24 ◼   ► And then it was purchased by Apple in March, 1996

00:54:27 ◼   ► and became Claris E-mailer.

00:54:29 ◼   ► So Apple owned it 'cause Apple owns,

00:54:31 ◼   ► or I guess Claris doesn't exist anymore.

00:54:33 ◼   ► And I guess it's FileMaker.

00:54:34 ◼   ► - It was like spun out and Summit was spun in.

00:54:37 ◼   ► - Apple owned an email client,

00:54:38 ◼   ► but didn't pre-install it on Mac.

00:54:40 ◼   ► - Oh my God.

00:54:41 ◼   ► - Because, and the whole point was that until the,

00:54:46 ◼   ► again, I've long said that to me,

00:54:50 ◼   ► there's really only two eras at Apple.

00:54:53 ◼   ► There was the original era up

00:54:56 ◼   ► and then starting with the next reunification,

00:54:59 ◼   ► that's like modern Apple.

00:55:00 ◼   ► Modern Apple started with the next reunification

00:55:04 ◼   ► and jobs coming back.

00:55:06 ◼   ► And there's so many things that were different,

00:55:08 ◼   ► but in the original Apple, it was explicit.

00:55:12 ◼   ► It wasn't even implicit.

00:55:14 ◼   ► I think Apple was explicit about it at times

00:55:17 ◼   ► that they didn't want to compete with third party developers.

00:55:22 ◼   ► And so the Mac, it would have,

00:55:26 ◼   ► it had like, what was it called back then?

00:55:28 ◼   ► Simple Text, Teach Text, which was the--

00:55:31 ◼   ► - Ah, I can't remember now.

00:55:33 ◼   ► I think it's, I remember Simple Text,

00:55:34 ◼   ► but I think that was later, I think you're right.

00:55:36 ◼   ► - Teach Text was like the built-in read me reader,

00:55:39 ◼   ► but super minimal.

00:55:41 ◼   ► I mean, way less, way more minimal,

00:55:44 ◼   ► minimally featured even than TextEdit today.

00:55:46 ◼   ► - I'm sorry, just think about TextEdit,

00:55:48 ◼   ► 'cause TextEdit actually has its roots, right, in Next.

00:55:51 ◼   ► - Yes, oh, deeply, yeah. - I mean, that is basically,

00:55:53 ◼   ► and TextEdit is a great piece of software no one uses,

00:55:55 ◼   ► and I wrote a Macworld piece about how great

00:55:58 ◼   ► There's some features in it that are invaluable

00:56:00 ◼   ► that you can basically cannot easily get

00:56:01 ◼   ► in any other piece of software.

00:56:02 ◼   ► - People do use it.

00:56:04 ◼   ► There are, it's sort of like a secret cult of people

00:56:06 ◼   ► who love, and rightly so,

00:56:07 ◼   ► text edit, including people at Apple.

00:56:11 ◼   ► I remember I had a meeting at Apple over a decade ago

00:56:14 ◼   ► when I was at Joyent.

00:56:15 ◼   ► It had nothing to do with during Fireball.

00:56:16 ◼   ► It was, you know, Apple wanted to meet with us

00:56:19 ◼   ► and talk about Joyent's technology and blah, blah, blah.

00:56:22 ◼   ► And I noticed that it was the first time, actually,

00:56:26 ◼   ► I met Michael Lop in person.

00:56:28 ◼   ► - Oh yeah, yeah. - At Ranson Repose.

00:56:29 ◼   ► He was there, he was an Apple software manager at the time.

00:56:33 ◼   ► And so we didn't know each other, we weren't friends yet,

00:56:36 ◼   ► but we were online, had a little bit of back and forth

00:56:39 ◼   ► simply as he knew Darren Fireball, I knew Ranson Repose.

00:56:43 ◼   ► He comes into the meeting and of course,

00:56:45 ◼   ► he's a very, he's such a minimalist.

00:56:48 ◼   ► He opens up his, I don't know if it was,

00:56:50 ◼   ► it might even have been a PowerBook at the time,

00:56:51 ◼   ► but whatever, MacBook, PowerBook.

00:56:53 ◼   ► Of course there's nothing on screen,

00:56:55 ◼   ► It's just a beautiful desktop picture.

00:56:57 ◼   ► He launches TextEdit and he's got one window on screen

00:57:00 ◼   ► and it's TextEdit and that's the app he used

00:57:02 ◼   ► to take notes for the meeting.

00:57:03 ◼   ► And I was like kind of blown away,

00:57:05 ◼   ► but also not surprised at all.

00:57:07 ◼   ► And he was like, oh, of course.

00:57:08 ◼   ► 'Cause he said, you know why I use this app?

00:57:10 ◼   ► I use this app because it is super simple

00:57:12 ◼   ► and it has never once crashed on me.

00:57:14 ◼   ► I've never lost a single letter of anything I've ever typed

00:57:18 ◼   ► in TextEdit.

00:57:19 ◼   ► But anyway, Apple--

00:57:21 ◼   ► - I think this is still the case in Japan, I don't know.

00:57:23 ◼   ► But in Japan, it used to be the less on your business card,

00:57:25 ◼   ► the more important you were.

00:57:26 ◼   ► And then, at least in the '80s,

00:57:27 ◼   ► I remember seeing a cartoon about this

00:57:28 ◼   ► and reading about this, and you know,

00:57:30 ◼   ► when you hand someone a business card to Japan,

00:57:31 ◼   ► you hold it with two hands, and you hand it to them.

00:57:33 ◼   ► It's just, you know, it's got a little bit

00:57:34 ◼   ► of a ceremony about it, used to.

00:57:35 ◼   ► I have no idea what people do today.

00:57:37 ◼   ► And there was a comic strip at the time

00:57:38 ◼   ► by an alt cartoonist who was about these two people

00:57:41 ◼   ► competing for a job in Japan and striving to be whatever,

00:57:44 ◼   ► and one of them has a dream, he says,

00:57:45 ◼   ► "I dreamt I met God, and he handed me his business card,

00:57:48 ◼   ► "and it was completely blank."

00:57:49 ◼   ► That's what I'm thinking about

00:57:50 ◼   ► when you're talking about Michael Law on the street.

00:57:53 ◼   ► - So Apple had an email product,

00:57:54 ◼   ► and they didn't even pre-install it, I don't think.

00:57:56 ◼   ► Maybe they did at some point.

00:57:58 ◼   ► - Yeah, so nothing bundled.

00:58:00 ◼   ► They kept their hands off.

00:58:01 ◼   ► And Microsoft integration, bundling,

00:58:03 ◼   ► tying monopoly-ish tendencies,

00:58:06 ◼   ► always keeping this market locked in for themselves,

00:58:09 ◼   ► whether it's business software, productivity issues,

00:58:12 ◼   ► email, browser, that was their security downfall.

00:58:15 ◼   ► And I think they spent a lot of time backing away from that.

00:58:18 ◼   ► And okay, oh, so I just did this story.

00:58:20 ◼   ► I don't know if this is a sidebar.

00:58:21 ◼   ► We're still talking viruses.

00:58:22 ◼   ► I just did a piece that should be out

00:58:24 ◼   ► by the time this airs, for MIT Technology Review

00:58:26 ◼   ► about some new research, it's been public for months,

00:58:29 ◼   ► a couple research teams at different universities

00:58:32 ◼   ► came up with strategies for fighting ransomware on Windows.

00:58:34 ◼   ► And it was very interesting, and I talked to a bunch,

00:58:36 ◼   ► I talked to McAfee and other folks, and the researchers,

00:58:40 ◼   ► and the thing that's hilarious,

00:58:41 ◼   ► they say, "Well, how do you stop ransomware?

00:58:42 ◼   ► "What do you do?"

00:58:43 ◼   ► And they're like, "Well, you keep your software up to date,

00:58:45 ◼   ► "you install, you run the latest patches,

00:58:47 ◼   ► "you don't run Java, you don't run Flash."

00:58:49 ◼   ► I'm like, "Wait, what about virus software?"

00:58:50 ◼   ► They're like, "That's sort of the last stage.

00:58:52 ◼   ► Like ransomware and most malware now just targets this incredibly low hanging fruit

00:58:57 ◼   ► of which there still remains so much.

00:58:59 ◼   ► Like, so one of the people I spoke to said something like 50% of machines you can

00:59:03 ◼   ► just get into because they're just not protected in any way.

00:59:07 ◼   ► Forget antivirus software.

00:59:09 ◼   ► Um, what the ransomware, what's interesting is the developers of these, uh, these

00:59:13 ◼   ► academics, rather the two different groups took different approaches, but the fact

00:59:16 ◼   ► is ransomware, it works on user space files.

00:59:19 ◼   ► So it's actually insidious.

00:59:21 ◼   ► You don't have to gain deep permissions.

00:59:22 ◼   ► Once the payload is dropped and it runs, you know, a lot of ransomware is like scripts,

00:59:26 ◼   ► like PHP or JavaScript, and you double click a Trojan horse that's delivered via email,

00:59:32 ◼   ► and it just starts encrypting files because it doesn't need extra permission.

00:59:35 ◼   ► It can, it's, they're your files, so they're only doing documents, but there's a lot of

00:59:39 ◼   ► tell tales, there's entropy and all kinds of other stuff that can monitor.

00:59:42 ◼   ► So the approaches are really cool, but I was like, oh, that's one reason ransomware has

00:59:46 ◼   ► a money thing at the end, which is very straightforward.

00:59:50 ◼   ► And there's like 6 million unique variants of ransomware out there now,

00:59:54 ◼   ► because the modifications of a bunch of like base families of ransomware,

00:59:58 ◼   ► so many different people are doing it because the money is so easy.

01:00:01 ◼   ► But fundamentally, it has that great advantage.

01:00:04 ◼   ► It's not trying to get into your kernel and do something.

01:00:06 ◼   ► It's not trying to hijack your networking.

01:00:08 ◼   ► It's just trying to take your Word documents and make them unreadable.

01:00:11 ◼   ► Right. It's not really fighting the system.

01:00:13 ◼   ► It's actually going with the flow of the system.

01:00:15 ◼   ► Oh, you're something the user double-click,

01:00:17 ◼   ► you have access to all of the user's files.

01:00:19 ◼   ► Yeah, exactly. It's in your doc, you know, my documents, boom, you're done.

01:00:21 ◼   ► Well, and it's exactly the sort of thing, it's exactly the sort of reason that Apple is, you know,

01:00:26 ◼   ► sandboxed iOS from the start and is so, for all the technical problems it causes for honest apps,

01:00:35 ◼   ► why they're so bent towards sandboxing on Mac as well.

01:00:41 ◼   ► Yeah, yeah. And I hear that. There's a technique I learned that I didn't know about. There's a

01:00:45 ◼   ► micro virtualization is coming. It's a step beyond sandboxing.

01:00:48 ◼   ► Every app runs essentially in its own tiny virtual machine,

01:00:52 ◼   ► which sounds crazy, but bromium,

01:00:54 ◼   ► a B R O M I E M is one of the companies in the space. I think, uh, was it, uh,

01:00:59 ◼   ► F secure may has a product. Um,

01:01:01 ◼   ► it's the new thing because a lot of business users are basically only running a

01:01:05 ◼   ► handful of apps.

01:01:06 ◼   ► So running them in the virtual environments are transparent to you as a user,

01:01:09 ◼   ► but essentially it's like super sandboxing. Right. It's wild.

01:01:15 ◼   ► Did you see the story I linked to it?

01:01:17 ◼   ► I guess I'll put it in the show notes.

01:01:19 ◼   ► I linked to it earlier this week, or maybe last week,

01:01:21 ◼   ► where there was a variant of ransomware that doesn't actually--

01:01:29 ◼   ► after you pay them, it doesn't give you your file.

01:01:32 ◼   ► So for anybody who doesn't know, the way ransomware works,

01:01:35 ◼   ► your machine gets hit by ransomware.

01:01:37 ◼   ► The ransomware malware starts running,

01:01:39 ◼   ► and it starts encrypting your files.

01:01:41 ◼   ► And then all of a sudden, you notice it

01:01:43 ◼   ► when you go to open one of your documents and it gives you a dialogue and it says you've been,

01:01:49 ◼   ► you know, you've been hit by ransomware, all of your files are encrypted and they really are

01:01:54 ◼   ► encrypted. And so like if you like go try to open it and you know a text editor or something,

01:01:59 ◼   ► it's just going to be, you know, garbled binary stuff because it's encrypted. Right. And the key

01:02:04 ◼   ► is sent via command and control system. That's the one. It does need a little network access. So

01:02:07 ◼   ► the key is not stored on the device. So you can't just extract the keys. Yeah.

01:02:11 ◼   ► So there's some clever use of encryption there.

01:02:15 ◼   ► And then if you give them money by following steps X, Y, and Z,

01:02:19 ◼   ► who knows, maybe they want Bitcoin.

01:02:21 ◼   ► You have to go buy Bitcoin and then give them the Bitcoin,

01:02:23 ◼   ► or they just want your credit card number or whatever.

01:02:27 ◼   ► Somehow you've got to get the money.

01:02:28 ◼   ► And then you give them money, and then they really do decrypt.

01:02:31 ◼   ► They give you the key and you get your files back.

01:02:34 ◼   ► And there have been cases, high profile cases.

01:02:36 ◼   ► I remember there was a hospital, I think in Los Angeles,

01:02:39 ◼   ► a hospital that got hit by a ransomware.

01:02:40 ◼   ► they spent 17 000 i think yeah unencrypted they had to but you know that you know and and there's

01:02:47 ◼   ► sort of a uh you know it's it's like an old almost like a political thing that you know like the

01:02:52 ◼   ► united states government doesn't negotiate with terrorists and if that's your poll if you just

01:02:56 ◼   ► state that as your policy up front we don't negotiate with with terrorists it hopefully acts

01:03:01 ◼   ► as a deterrent to terrorists who would you know uh take people take us you know take people hostage

01:03:08 ◼   ► because now it's not really true that we don't negotiate with them, but it's the policy. And you

01:03:12 ◼   ► can see the logic of that. And you can see the logic of, "Well, you should never pay these people

01:03:16 ◼   ► for this." But at a certain point, it might have been worth it for if it was critical enough

01:03:20 ◼   ► information, it might be worth it for you to pay whatever the price that the price they're asking,

01:03:25 ◼   ► however distasteful it is to actually give in and give these literal criminals money, it might be

01:03:31 ◼   ► more valuable to you than the actual data that's been encrypted is more valuable.

01:03:37 ◼   ► Now, the funny thing is that there's a group,

01:03:42 ◼   ► there's a group that you give them the money

01:03:46 ◼   ► and I'm laughing, but it's terrible

01:03:48 ◼   ► because it's even worse, obviously.

01:03:50 ◼   ► But the thing that makes me laugh about it

01:03:54 ◼   ► is that all of the honest ransomware,

01:03:58 ◼   ► and it's so funny to say that, the honest crooks,

01:04:02 ◼   ► have gotta be furious about this

01:04:04 ◼   ► because if word spreads that even if you pay,

01:04:07 ◼   ► don't get your files back, it's going to make people less likely to pay.

01:04:09 ◼   ► I have so many things to say about this.

01:04:11 ◼   ► Can I say a few things?

01:04:12 ◼   ► I have so many, I spent several days working on this recently.

01:04:15 ◼   ► So, okay.

01:04:16 ◼   ► So you know how ship ransoming works like piracy, Somali pirates, right?

01:04:20 ◼   ► Money, Planet Money did a great piece about this that talked to one of the

01:04:23 ◼   ► people who does negotiation with pirates to pay their ransom, right?

01:04:28 ◼   ► If you start killing the hostages, piracy stops working.

01:04:32 ◼   ► So it's actually typically not dangerous to be taken captive by pirates, Somalian or whomever,

01:04:40 ◼   ► because it is entirely in the interest of the economic system to negotiate a reasonable fee,

01:04:46 ◼   ► make sure all the hostages are unharmed. They will even sometimes release people for medical

01:04:49 ◼   ► or compassionate reasons. Like it's handled like a business. Then you have the situation where,

01:04:54 ◼   ► I can't remember how long ago this was now, a couple years, where some pirates started killing

01:04:57 ◼   ► people. And then it was like, okay, and all the navies in the world went, screw this. And they

01:05:01 ◼   ► They start steaming Navy ships in and sort of clean up the problem, which has been a

01:05:05 ◼   ► commercial problem and is now, you know, a human rights one, right?

01:05:09 ◼   ► And I'm thinking the idiots who think it's funny to delete the files or they're too incompetent,

01:05:15 ◼   ► whatever it is, they have so many, I mean, there are so many angry organized criminals

01:05:19 ◼   ► in the world.

01:05:20 ◼   ► They're, these guys could get killed, honestly, if they're tracked down.

01:05:23 ◼   ► That's for sure.

01:05:24 ◼   ► So that's not funny, but it's also like, it actually does exactly that.

01:05:27 ◼   ► almost like a disruptive technique that would,

01:05:29 ◼   ► that destroys the value of ransomware.

01:05:31 ◼   ► So in researching this story, I came across

01:05:35 ◼   ► just a few days ago, F-Secure released this

01:05:37 ◼   ► hilarious white paper.

01:05:38 ◼   ► They tested the customer service of major

01:05:41 ◼   ► ransomware packages.

01:05:42 ◼   ► They're like, it has a customer service burden.

01:05:46 ◼   ► I talked to this guy named Sean Sullivan at

01:05:48 ◼   ► F-Secure labs about some background stuff

01:05:50 ◼   ► about ransomware.

01:05:51 ◼   ► And he said, the reason it's gotten so popular

01:05:53 ◼   ► is it's Tor, you know, the routing network that

01:05:56 ◼   ► That's how the ransomware people post websites,

01:05:59 ◼   ► basically, and Bitcoin is all Bitcoin.

01:06:01 ◼   ► There's no credit card anymore.

01:06:02 ◼   ► That's the big change.

01:06:03 ◼   ► The ransomware dates back literally decades,

01:06:05 ◼   ► but this is the Bitcoin just makes it, it

01:06:08 ◼   ► facilitates it so much.

01:06:09 ◼   ► The average ransomware demand now has gone up

01:06:13 ◼   ► from a few hundred dollars worth of Bitcoin to

01:06:14 ◼   ► like 600 something dollars, but F-Secure

01:06:17 ◼   ► found you could negotiate with some of them.

01:06:18 ◼   ► They'll, you'll, they'll run the fee down.

01:06:20 ◼   ► They created like a naive user who then she,

01:06:23 ◼   ► they hired somebody who was not technically

01:06:24 ◼   ► They hired somebody who was not technical to do the communication so they wouldn't give anything

01:06:28 ◼   ► away about, you know, what they ate about more sophisticated details. And they tested all these,

01:06:33 ◼   ► you can extend the deadlines, customer service people, the ransomware companies are very

01:06:36 ◼   ► sensitive. In one case, they're like, this was as good as like real customer service. It's like

01:06:40 ◼   ► what you'd get from a software company. They talked you through it. They'll often teach you

01:06:44 ◼   ► how to buy Bitcoin so that you can pay. They treat it like a real customer service burden,

01:06:48 ◼   ► like it's a business and we're here to help you get your files back. So

01:06:51 ◼   ► - Yeah, well, if you think about it,

01:06:53 ◼   ► when do you typically get the best customer service?

01:06:57 ◼   ► Typically, you get better customer service

01:07:00 ◼   ► before you've given them your money.

01:07:02 ◼   ► - Yeah, yeah. - Right?

01:07:03 ◼   ► You get, you know, it's easier and you wait less time

01:07:08 ◼   ► to talk to a salesperson before you've bought something

01:07:10 ◼   ► than when you come back with a problem.

01:07:13 ◼   ► - Yeah, it's just, the whole thing is hilarious.

01:07:15 ◼   ► I mean, it's hilarious and awful.

01:07:16 ◼   ► So Mac users, you know,

01:07:17 ◼   ► there's been a couple ransomware attempt,

01:07:18 ◼   ► software attempts against Mac users.

01:07:20 ◼   ► And again, because the user space file issue,

01:07:24 ◼   ► it's possible we will see,

01:07:25 ◼   ► phishing style ransomware

01:07:28 ◼   ► or things that will be minimally capable

01:07:30 ◼   ► because OS X will execute certain kinds of things.

01:07:34 ◼   ► The question is your network access

01:07:36 ◼   ► and some privilege it may need would be harder.

01:07:38 ◼   ► There might need to be an exploit pathway

01:07:39 ◼   ► for a little bit of it,

01:07:40 ◼   ► but it is so much less of a burden

01:07:42 ◼   ► to get to have some effect.

01:07:45 ◼   ► So we'll see.

01:07:46 ◼   ► So hopefully it won't affect most of us,

01:07:48 ◼   ► but it is, and again,

01:07:50 ◼   ► everything they're saying, it's like,

01:07:51 ◼   ► update your software, use patches, make backups,

01:07:53 ◼   ► having good backups.

01:07:55 ◼   ► You know, I use Backblaze and CrashPlan and local clones.

01:07:59 ◼   ► And I have a deep archive.

01:08:01 ◼   ► So if all my files were encrypted today,

01:08:04 ◼   ► I have 100% of those on,

01:08:06 ◼   ► most of them on Dropbox also,

01:08:08 ◼   ► and in two other, like at least one other place,

01:08:10 ◼   ► I should say, where I have a deep archive

01:08:12 ◼   ► and I could go back to a pre-encrypted release.

01:08:14 ◼   ► - Let me take a break here.

01:08:16 ◼   ► Thank our next sponsor.

01:08:18 ◼   ► This is a long time friend of the show,

01:08:20 ◼   ► long time sponsor, Fracture.

01:08:23 ◼   ► Fracture is a photo decor company

01:08:25 ◼   ► that is out to rescue your favorite images

01:08:27 ◼   ► from the digital ether.

01:08:29 ◼   ► They print your photos directly onto glass

01:08:32 ◼   ► and add a laser cut rigid backing

01:08:35 ◼   ► so they are ready to display right out of the box.

01:08:38 ◼   ► It's not like a piece of paper glued to a piece of glass.

01:08:41 ◼   ► They print the photo right on the glass.

01:08:44 ◼   ► They've been a sponsor for years.

01:08:45 ◼   ► I still haven't seen anybody else that does this.

01:08:47 ◼   ► Maybe it's somebody else.

01:08:48 ◼   ► I think the Fracture's got all this

01:08:49 ◼   ► proprietary stuff down there.

01:08:50 ◼   ► It is an amazing display.

01:08:53 ◼   ► I've always said it is very much like

01:08:55 ◼   ► the way that the retina displays.

01:08:58 ◼   ► Once Apple started fusing the screens to the glass

01:09:01 ◼   ► where it looks like the pixels are on the glass

01:09:02 ◼   ► instead of behind a layer of glass,

01:09:04 ◼   ► that's what Fracture photos look like

01:09:06 ◼   ► except they're completely analog.

01:09:08 ◼   ► It is a great thing to do with your digital photos.

01:09:11 ◼   ► I have thousands, I shoot thousands of photos every year.

01:09:14 ◼   ► The ones that I like best I get get them printed on these fractures hang them up around the house

01:09:18 ◼   ► That's what people used to do because your photos were printed you'd go you'd shoot photos

01:09:23 ◼   ► You'd get them back from the photo lab

01:09:25 ◼   ► You'd take the ones you like out, you know

01:09:27 ◼   ► The real keepers you'd instead of just putting them back in the envelope you'd put them in a frame hang them up

01:09:32 ◼   ► We don't do that anymore

01:09:34 ◼   ► Because there's like this extra step where you got to get them from your digital archive to being on

01:09:38 ◼   ► This is the way to do it. If you're gonna print your photos take the keepers and send them to fracture

01:09:42 ◼   ► They're so good. They have so many sizes, amazing sizes. They have a 60-day happiness guarantee

01:09:50 ◼   ► so that you're sure to love your order. Each fracture is handmade in Gainesville, Florida,

01:09:55 ◼   ► from U.S.-sourced materials in their carbon-neutral factory. All happens in the U.S.

01:10:01 ◼   ► So for more information and 10% off your first order, visit fractureme.com/podcast.

01:10:10 ◼   ► There's even a special note in here that says, "Note, the URL really ends in 'podcast,' not the name of your podcast."

01:10:18 ◼   ► Because I'll tell you, if they did put that note in here, I would have said,

01:10:21 ◼   ► "FractureMe.com/TheTalkShow," but that's not it. Remember this. It's "FractureMe.com/Podcast."

01:10:27 ◼   ► And then what they want you to do when you place your order, they're going to say, "Where did you

01:10:31 ◼   ► hear about this?" Just mention that you heard it from the talk show, and they'll know that you came from here.

01:10:35 ◼   ► It's literally, it is a one question survey.

01:10:40 ◼   ► Where did you hear about Fracture?

01:10:42 ◼   ► So it is the easiest survey you will ever take.

01:10:44 ◼   ► Just remember to tell them.

01:10:45 ◼   ► That helps support the show and it's fractureme.com/podcast.

01:10:50 ◼   ► - Can I talk about-- - You can do whatever you want.

01:10:56 ◼   ► - Well, a brief another, this is like, this isn't a sidebar.

01:10:59 ◼   ► You were writing recently about Amazon

01:11:01 ◼   ► and its inventory of the Birkenstock story.

01:11:03 ◼   ► - That's on my list of topics.

01:11:05 ◼   ► Oh, good. Well, I have something to say about that,

01:11:06 ◼   ► but we can go take your direction.

01:11:08 ◼   ► - I think we were done with security,

01:11:10 ◼   ► so we can totally go on to Amazon fraud.

01:11:12 ◼   ► I've linked just to a couple of recent stories about-

01:11:15 ◼   ► - Oh my God, it's so terrible.

01:11:17 ◼   ► - So there's a couple of aspects to it.

01:11:19 ◼   ► One is the main one that I've been reading,

01:11:23 ◼   ► 'cause it seems like it's a little bit new,

01:11:25 ◼   ► is big brands being ripped off

01:11:30 ◼   ► by mostly Chinese counterfeiters,

01:11:33 ◼   ► and then they sell these things through Amazon.

01:11:36 ◼   ► Well, the first one I heard,

01:11:38 ◼   ► this is maybe two years ago,

01:11:39 ◼   ► is that Mophie products, Mophie the battery maker,

01:11:43 ◼   ► they make a whole bunch of battery,

01:11:46 ◼   ► external battery packs and battery cases for phones.

01:11:49 ◼   ► Really interesting company.

01:11:52 ◼   ► I have a couple of their things

01:11:53 ◼   ► and I really, I have to say I like them a lot.

01:11:57 ◼   ► I have a battery, I like them instead of a case,

01:12:00 ◼   ► I like to just have the battery pack

01:12:02 ◼   ► and they make one that has built-in lightning and USB cables,

01:12:06 ◼   ► so you don't need to take cables.

01:12:08 ◼   ► You don't need to have an extra cable.

01:12:09 ◼   ► I really like that product a lot.

01:12:11 ◼   ► It's my favorite external battery thing ever.

01:12:13 ◼   ► But I heard years ago, just like at least two years ago,

01:12:16 ◼   ► don't buy Mophie stuff on Amazon

01:12:18 ◼   ► because there's so much Chinese knockoff crap

01:12:21 ◼   ► that looks like a Mophie product,

01:12:23 ◼   ► but it's really substandard electronics.

01:12:25 ◼   ► The batteries are no good.

01:12:26 ◼   ► They're just crummy products.

01:12:29 ◼   ► If you Google like Mophie Amazon,

01:12:31 ◼   ► you'll find lots of hits about it.

01:12:32 ◼   ► So now just recently this week,

01:12:34 ◼   ► Birkenstock, the sandals, what else do they make?

01:12:37 ◼   ► Just sandals and flip-flops, I guess.

01:12:39 ◼   ► - Yeah, a bunch of stuff.

01:12:39 ◼   ► I was called, by the way,

01:12:40 ◼   ► I was called socks and sandals in college

01:12:42 ◼   ► 'cause of my Birkenstock habits, just so you know.

01:12:45 ◼   ► I went to school in the East, grew up in the West,

01:12:47 ◼   ► that's how it goes. (laughs)

01:12:50 ◼   ► - Is pulling out of Amazon on January,

01:12:52 ◼   ► I guess they can't do it immediately

01:12:53 ◼   ► 'cause they might have contracts or inventory or something,

01:12:56 ◼   ► but they're so overrun by counterfeiters on Amazon

01:12:59 ◼   ► that they're pulling out.

01:13:00 ◼   ► - Oh yeah, and you love them.

01:13:01 ◼   ► They're like, Amazon basically told them,

01:13:03 ◼   ► if you wanna be, sell every single thing you sell,

01:13:06 ◼   ► then we will fight counterfeiting.

01:13:07 ◼   ► I mean, I'm paraphrasing.

01:13:09 ◼   ► And if you wanna just sell the way you're doing,

01:13:10 ◼   ► then screw you.

01:13:11 ◼   ► I mean, they didn't say it that way, but that's the effect.

01:13:13 ◼   ► That's, you know, that's what Birkenstock claims at least.

01:13:15 ◼   ► - I think I could be wrong on this.

01:13:18 ◼   ► I wrote that, it's sort of like when you search for stuff

01:13:22 ◼   ► on Amazon, it tells you who you're buying it from.

01:13:25 ◼   ► And you know, with a lot of the smaller things,

01:13:28 ◼   ► like when you just go there and buy copy paper,

01:13:33 ◼   ► printer paper, you know, it's like full,

01:13:35 ◼   ► you know, it's just, you're not really buying it

01:13:37 ◼   ► from Amazon, you're buying it from some vendor

01:13:39 ◼   ► that sells through Amazon.

01:13:41 ◼   ► But I was under the impression that even if you wanted

01:13:44 ◼   ► to buy like a Mophie battery pack,

01:13:46 ◼   ► if you buy it directly from Amazon and you're not buying it

01:13:49 ◼   ► from, you know, Joe's battery shop,

01:13:52 ◼   ► that you're, you know, you could be, you know,

01:13:55 ◼   ► you could feel safe that you're getting

01:13:57 ◼   ► the actual Mophie product, but you kind of have to be--

01:14:00 ◼   ► - Oh my God.

01:14:01 ◼   ► - You have to be like a close reader.

01:14:03 ◼   ► How many people who shop at Amazon actually look at

01:14:05 ◼   ► who it's, who's this fulfillment is?

01:14:09 ◼   ► I don't think most people, most reasonable,

01:14:11 ◼   ► most regular people even know that that's how Amazon works.

01:14:14 ◼   ► I think they just think you're buying it from Amazon

01:14:17 ◼   ► and they don't even look, they just look at prices

01:14:19 ◼   ► and they might be curious about the fact

01:14:21 ◼   ► that the same product is available

01:14:23 ◼   ► at three different prices from Amazon

01:14:25 ◼   ► because it's from three different, you know,

01:14:29 ◼   ► whatever you wanna call them, fulfillment partners.

01:14:32 ◼   ► - Yeah, or maybe through Marketplace

01:14:36 ◼   ► or maybe through their, they've,

01:14:36 ◼   ► Fulfillment by Amazon also,

01:14:38 ◼   ► you can send your stuff to Amazon

01:14:40 ◼   ► and they will sell it to their own customers.

01:14:43 ◼   ► - Right.

01:14:44 ◼   ► - So, you know, I think you mentioned this

01:14:45 ◼   ► in one of the pieces that you linked to, the commingling.

01:14:48 ◼   ► So there's like two kinds of,

01:14:49 ◼   ► there's actually like four kinds of fraud.

01:14:51 ◼   ► There are two kinds of major fraud.

01:14:52 ◼   ► One is, oh God, there's so many kinds of fraud.

01:14:55 ◼   ► So co-mingling is company X ships a product to Amazon and they say, this is exactly the same.

01:15:02 ◼   ► Here's the skew number.

01:15:03 ◼   ► This is product Y that you already sell like a Cuisinart electric kettle, which I'll explain why I bring that up.

01:15:08 ◼   ► Right.

01:15:08 ◼   ► Amazon does co-mingling where they take this inventory.

01:15:12 ◼   ► I don't even know how many inspected or whatever, and they put it on their shelves as, and they don't care.

01:15:17 ◼   ► Uh, they treat it as a fungible thing.

01:15:20 ◼   ► This thing that came from company X that claims its product Y we're putting on the shelves in our warehouse.

01:15:25 ◼   ► house next to this thing that came from the manufacturer that claims its product Y right

01:15:29 ◼   ► I have heard stories from multiple places and you can read them publicly to in a lot of these articles about

01:15:34 ◼   ► Companies like Birkenstock and Birkenstock has a different problem which I get to but that you buy a product you go to Amazon you order product

01:15:41 ◼   ► Y and it comes and you're like this is not product Y you complain to Amazon and they're like, oh send it back

01:15:46 ◼   ► We'll ship you a new one or you complain the company. I bought product Y from Amazon

01:15:50 ◼   ► They like we didn't make that does it have this and this? No, that's a counterfeit

01:15:53 ◼   ► fit that was put into Amazon stream and we cannot prevent them from

01:15:56 ◼   ► selling them basically, that's the commingling problem.

01:15:58 ◼   ► Birkenstock has the undercutting problem where people are listing things

01:16:02 ◼   ► basically as the same kind of thing.

01:16:04 ◼   ► They're undercutting Birkenstocks prices and they may or may not

01:16:07 ◼   ► be shipping a Birkenstock.

01:16:08 ◼   ► They're probably shipping that thing as it could be there buying

01:16:11 ◼   ► them from some other source, or it could be they are manufacturing

01:16:13 ◼   ► something that is completely counterfeit and selling it.

01:16:16 ◼   ► And, um, when they're both huge problems, because in the one case

01:16:20 ◼   ► you have this thing where people are buying, I mean, actually

01:16:21 ◼   ► Birkenstock has the same problem, whether it's a commingled problem or counterfeit

01:16:24 ◼   ► and cheaper, someone buys it says Birkenstock screwed me.

01:16:28 ◼   ► They're ready.

01:16:28 ◼   ► The company said we didn't make that.

01:16:29 ◼   ► What'd you buy from Amazon?

01:16:30 ◼   ► That's not ours.

01:16:31 ◼   ► You bought the $80 one, not the a hundred dollar one.

01:16:34 ◼   ► We don't sell it for $80.

01:16:35 ◼   ► You bought the sucky one.

01:16:36 ◼   ► Right.

01:16:37 ◼   ► So this just happened to me last night.

01:16:39 ◼   ► Really?

01:16:40 ◼   ► Yeah.

01:16:40 ◼   ► So what was the product?

01:16:42 ◼   ► So, uh, uh, electric kettle love electric kettle.

01:16:45 ◼   ► I've had two, uh, Brown model ones or Braun, I guess we say in America.

01:16:48 ◼   ► Uh, my wife got one for a birthday, like 15 years ago.

01:16:51 ◼   ► It worked fine for several years and then it just died.

01:16:54 ◼   ► So we bought the identical thing.

01:16:56 ◼   ► It's like a $20 one.

01:16:57 ◼   ► It's worked great.

01:16:58 ◼   ► It just dies of the day.

01:16:59 ◼   ► Same thing.

01:16:59 ◼   ► Some kind of, you know, it's got all these contacts breaks.

01:17:02 ◼   ► So I'm like, okay, I will find out what Wirecutter recommends.

01:17:05 ◼   ► My old friends at Wirecutter and Sweet Home was a contractor there for a bit.

01:17:08 ◼   ► I love the people there.

01:17:09 ◼   ► I love the process.

01:17:10 ◼   ► I'm like, all right, well, what one do they recommend?

01:17:11 ◼   ► I'm like, oh God, it's $80.

01:17:13 ◼   ► Am I going to spend $80 on an electric?

01:17:14 ◼   ► I'm like, ah, I don't know.

01:17:15 ◼   ► I'm not made of money.

01:17:16 ◼   ► Uh, Jason Snell has a Breville T robot.

01:17:20 ◼   ► which is $250, which I've been eyeing for a year now.

01:17:25 ◼   ► I'm not, I can't get it.

01:17:27 ◼   ► Can't get it. - Robot that makes tea?

01:17:29 ◼   ► - It has a basket that lowers robotically and raises.

01:17:32 ◼   ► So it steeps it for the right amount of time.

01:17:35 ◼   ► - I just wanted to clarify that it was tea, the beverage,

01:17:38 ◼   ► and not like some kind of, you know, like a t-shirt,

01:17:41 ◼   ► like the letter, something I wasn't familiar with.

01:17:44 ◼   ► I just wanted to clarify.

01:17:45 ◼   ► - It's a tea brewing robot pot.

01:17:47 ◼   ► It's awesome.

01:17:48 ◼   ► And people love the Breville.

01:17:49 ◼   ► but I'm not ready to spend, I'd love to be able,

01:17:51 ◼   ► if I ever got some great contract or something,

01:17:53 ◼   ► I might say, this is my treat to myself.

01:17:55 ◼   ► I will get a robot that makes tea for me.

01:17:58 ◼   ► You still have to put stuff in the basket,

01:17:59 ◼   ► but it moves it, lose it up and down, doesn't oversteep.

01:18:01 ◼   ► So anyway, 80 bucks, I'm like, that seems, I don't know.

01:18:03 ◼   ► So I start doing research and I go to Amazon,

01:18:05 ◼   ► 'cause it's usually my first stop.

01:18:07 ◼   ► And there are like 700 electric pedals now.

01:18:10 ◼   ► And many of them have one review,

01:18:11 ◼   ► which makes no sense, right?

01:18:13 ◼   ► Like, what's something with one review and a brand name

01:18:16 ◼   ► I've never heard of in my 48 years on this planet.

01:18:19 ◼   ► And then a bunch of others, I find one, I'm like, this is like 300 reviews.

01:18:22 ◼   ► I've never heard of this thing.

01:18:23 ◼   ► And 97% of them are five stars.

01:18:26 ◼   ► You know how the app store works, same thing on Amazon.

01:18:29 ◼   ► So I'm reading the reviews and it's like, Marty says, this is a great kettle.

01:18:32 ◼   ► This kettle does everything I want it to.

01:18:33 ◼   ► It's great.

01:18:34 ◼   ► Jill says, this kettle is great.

01:18:36 ◼   ► It does everything I want it to.

01:18:37 ◼   ► This kettle is great.

01:18:38 ◼   ► It goes on and on.

01:18:39 ◼   ► And there's a few real five star reviews and then a distribution of other ones.

01:18:43 ◼   ► I'm like, I'm not going to buy that because that's some piece of crap

01:18:46 ◼   ► manufacturer, God knows where that they're, you know, for a finite amount of time,

01:18:50 ◼   ► they're going to push through Amazon and make some hundreds of thousands of

01:18:52 ◼   ► dollars. So I'm like, where are the 20 or $30 good kettles? I can't find Browns anymore.

01:18:57 ◼   ► Everyone's gone upscale kettles now costs 50, 60, $80 just to do basic stuff.

01:19:01 ◼   ► So I'm like, all right, I'm going to bite the bullet. I,

01:19:03 ◼   ► I use the kettle two, three times a day. My wife uses it two times a day.

01:19:07 ◼   ► This is a high use thing. I can, I'm going to, I'm going to spend $80. I'm,

01:19:10 ◼   ► I hate it, but I'm going to spend $80. I go to Amazon site and I'm like, all right,

01:19:14 ◼   ► Well, it's 80 bucks.

01:19:15 ◼   ► Okay.

01:19:15 ◼   ► I'm looking through reviews, but this looks pretty good.

01:19:17 ◼   ► And then I look at the seller, it's a Cuisinart, but it doesn't say sold by

01:19:21 ◼   ► Cuisinart says sold by, uh, everything lucky, not making this up, everything

01:19:29 ◼   ► lucky to selling the Cuisinart.

01:19:31 ◼   ► And I thinking this, this isn't right.

01:19:33 ◼   ► So I search an Amazon site for the model number.

01:19:35 ◼   ► It's like CPK 12, 112 or something.

01:19:38 ◼   ► And I'm like, all right, so where is this?

01:19:41 ◼   ► And then I find another listing for a hundred dollars with, okay.

01:19:44 ◼   ► So the $80 unit, everyday lucky, which I find

01:19:47 ◼   ► out later, so he points out to me, it says

01:19:48 ◼   ► ever day lucky, it's not even spelled right.

01:19:51 ◼   ► Whatever the make, you know, they're mostly

01:19:52 ◼   ► said an everyday lucky is mostly selling iPhone

01:19:55 ◼   ► cases and this Cuisinart alleged Cuisinart.

01:19:57 ◼   ► So the $80 everyday lucky listing has 2,500

01:20:03 ◼   ► clearly legitimate reviews.

01:20:04 ◼   ► They have managed somehow to

01:20:06 ◼   ► hijack the main listing.

01:20:08 ◼   ► There's a hundred dollar version.

01:20:10 ◼   ► And if you look at all the other people selling

01:20:12 ◼   ► Walmart, Best Buy, they're all selling this model for a hundred dollars.

01:20:15 ◼   ► So I'm like, that's the list price clearly.

01:20:17 ◼   ► And the hundred dollar one on Amazon says, buy sold by, you know, buy Cuisinart.

01:20:21 ◼   ► It's being fulfilled by a third party, but it's clearly the legitimate product,

01:20:24 ◼   ► but it has like seven reviews.

01:20:25 ◼   ► So I asked my friends at Sweet Home, like what's going on here?

01:20:28 ◼   ► They're like, Oh, what happened is I got a response this morning

01:20:31 ◼   ► from Tony over there.

01:20:31 ◼   ► Who's great.

01:20:32 ◼   ► You know, they have all these deals, people and everything.

01:20:33 ◼   ► It says, what happened is, um, the, uh, Amazon ran out of a

01:20:39 ◼   ► stock that it sells directly.

01:20:40 ◼   ► And so they pulled a listing for someone selling it new, not, you know, used or new refurbished, whatever, and they drop that in so they don't drop the listing off.

01:20:50 ◼   ► And so in this case, Everday Lucky was the backup provider in their listing of third-party sellers for this particular model.

01:20:57 ◼   ► It's, it's, I'm looking at it as we speak, it's Everthing Lucky.

01:21:01 ◼   ► Oh, Everthing Lucky, sorry.

01:21:03 ◼   ► Everthing Lucky.

01:21:04 ◼   ► I know, isn't that, and so that, that is my story.

01:21:06 ◼   ► So, I'm like,

01:21:07 ◼   ► It's still there!

01:21:08 ◼   ► Yeah, so well, no, so I wake up this morning and Tony has responded at

01:21:11 ◼   ► Sweet Home via Twitter because great God, he's like, oh, here's, what's going on.

01:21:13 ◼   ► Check it's back.

01:21:14 ◼   ► And I go, I'm like, oh, there's the Amazon listing at $67.

01:21:17 ◼   ► Now.

01:21:17 ◼   ► Now I feel justified.

01:21:19 ◼   ► I've waited, right?

01:21:19 ◼   ► Do you think that this is the real product though?

01:21:21 ◼   ► Well, well, so here's, so, uh, it may be, but there's no way to know.

01:21:26 ◼   ► Like I'm buying it from a third party seller who has clearly done some magic.

01:21:30 ◼   ► So this morning I placed an order, I paid $67.

01:21:33 ◼   ► Everyone can criticize me for my profligate spending.

01:21:36 ◼   ► And, uh, if you like, please feel free anyway.

01:21:39 ◼   ► So I buy it and I write back to Tony.

01:21:42 ◼   ► I'm like, Hey, the thing you're right.

01:21:43 ◼   ► Swapped back.

01:21:43 ◼   ► And he's like, I just went back and it's there.

01:21:45 ◼   ► Apparently I bought the one model Amazon had in a warehouse that it fulfilled

01:21:49 ◼   ► itself and it's back to everything lucky.

01:21:50 ◼   ► So anyway, that's the problem they have.

01:21:52 ◼   ► So I don't know.

01:21:53 ◼   ► So everything lucky could be selling me a legitimate object and still $20 less than

01:21:58 ◼   ► the retail price at target, Walmart, et cetera.

01:22:00 ◼   ► However, um, they're getting the advantage of 2,500 positive reviews

01:22:05 ◼   ► And Amazon doesn't vet that that product is actually a new from Cuisinart item.

01:22:10 ◼   ► Yeah. So part of the, part of the problem, the way that, I mean,

01:22:15 ◼   ► this is so insidious, but part of this problem now is if, if it starts to,

01:22:19 ◼   ► if awareness starts to spread that you can't trust stuff through third party

01:22:24 ◼   ► resellers on Amazon,

01:22:25 ◼   ► it hurts all of the honest ones that the system was set up for in the first

01:22:29 ◼   ► place.

01:22:29 ◼   ► Exactly. It's terrible all around. There's also like even yet another variant on

01:22:34 ◼   ► is that, um, so those are like the almost legitimate cases, right?

01:22:38 ◼   ► Like this could absolutely be a fell off the truck or, you know, bought like, you

01:22:43 ◼   ► know, one of the things in China is that, and I've heard this, I hope, I don't mean

01:22:46 ◼   ► to tell lies about China.

01:22:47 ◼   ► So let's say this isn't, I don't know if this is true, but I've read it in

01:22:50 ◼   ► other number of accounts.

01:22:51 ◼   ► I've talked to people that admit stuff made in China.

01:22:53 ◼   ► It's a complaint made by a number of companies about things with China is

01:22:57 ◼   ► come.

01:22:58 ◼   ► Some factories will gear up products for a given maker.

01:23:01 ◼   ► And during the day they're being supervised or being made for Maker, you know, whatever company is, you know Reebok or whatever. It could be shoes, it could be

01:23:08 ◼   ► Cuisinart kettles. At night they fire up the lines, they make stuff and they sell that themselves. And they're essentially identical.

01:23:15 ◼   ► Sometimes there's labeling changes. So they're the identical unit with it not labeled so they avoid some intellectual property issues.

01:23:20 ◼   ► So the Birkenstock thing, when you're go to try to buy a Birkenstock thing and their list price is $100 for whatever and

01:23:27 ◼   ► and there's people selling it for $80, you might be getting the legitimate thing.

01:23:30 ◼   ► It might be made as a factory nighttime job or who knows what, or they're just

01:23:34 ◼   ► doing deeper discounts because however they're acquiring it, they're not

01:23:37 ◼   ► honoring the list price.

01:23:38 ◼   ► The same thing that a Cuisinart kettle bought from everything lucky could have

01:23:43 ◼   ► been absolutely the same as anything purchased directly from an Amazon

01:23:46 ◼   ► warehouse or from a third party, you know, uh, authorized Cuisinart thing.

01:23:51 ◼   ► But you don't know the, the other problem though, like the other thing is that,

01:23:54 ◼   ► Uh, what you were saying before is it's the, um, the counterfeit stuff.

01:23:58 ◼   ► That's just knockoffs that are crap and they appear to be listed the same.

01:24:02 ◼   ► So it's, I see this all the time for, you know, all these different products.

01:24:05 ◼   ► I'm looking for, for reviews and things.

01:24:07 ◼   ► You find stuff that is clearly the pictures are something off.

01:24:11 ◼   ► You buy it, something's not right.

01:24:13 ◼   ► And you're not, you know, sometimes it's listed under a slightly different name.

01:24:16 ◼   ► Sometimes it's listed as exactly the same thing and it's trying

01:24:18 ◼   ► to take advantage of the reputation.

01:24:19 ◼   ► But all of these problems persist because Amazon wants to sell more.

01:24:24 ◼   ► it doesn't want to do tighter inventory control

01:24:26 ◼   ► 'cause it costs a lot of money.

01:24:27 ◼   ► It shaves the margins off.

01:24:28 ◼   ► - So I just sent you a link.

01:24:29 ◼   ► This is the 1.8 quart cordless electric tea cuddle.

01:24:33 ◼   ► I think this is the product you're talking about.

01:24:36 ◼   ► - Yes, that's right.

01:24:37 ◼   ► - I kind of hate the interface to tell you.

01:24:39 ◼   ► - I know, it's the best, cheapest thing.

01:24:42 ◼   ► Like if you want something better,

01:24:44 ◼   ► you have to spend more.

01:24:45 ◼   ► I know it looks horrible.

01:24:46 ◼   ► The queries are like, "CPK 17 sold by Everything Lucky."

01:24:51 ◼   ► - Now, if you look, I think it's the same product.

01:24:53 ◼   ► there's a thing that says size seven cup.

01:24:56 ◼   ► And the two sizes that are offered is seven cup,

01:25:00 ◼   ► which is $100.

01:25:02 ◼   ► And then the other one, instead of measuring in cups,

01:25:04 ◼   ► it just gives you the dimensions of the box,

01:25:06 ◼   ► 9.7 inches by six inches by eight.

01:25:10 ◼   ► And so it- - Oh, they may have managed

01:25:12 ◼   ► to sneak, oh, interesting.

01:25:14 ◼   ► - They've made it look like there's two options

01:25:16 ◼   ► of the same product, but one is measuring by the cup

01:25:20 ◼   ► capacity of how much water you can put in,

01:25:22 ◼   ► and the other one is measured in inches.

01:25:24 ◼   ► - Yeah, and the one-point-eight-quart one,

01:25:25 ◼   ► the seven-cup one, is sold by Card Machine Outlet, Inc.

01:25:29 ◼   ► - Oh, the one, you know, mine says,

01:25:31 ◼   ► oh, it says, mine says it's by Cuisinart.

01:25:34 ◼   ► - Yeah, you scroll down under in stock,

01:25:36 ◼   ► it says, "Sips and Sold By." - Oh, I see.

01:25:39 ◼   ► - I know, isn't it, but so--

01:25:40 ◼   ► - No, mine is sold by Kitchen Capers.

01:25:42 ◼   ► - Oh my God, what happens when I reload?

01:25:43 ◼   ► That's hilarious.

01:25:44 ◼   ► - Mine is from Kitchen Capers.

01:25:46 ◼   ► - Every time I reload,

01:25:47 ◼   ► I'm getting a different answer, I think.

01:25:48 ◼   ► - Oh.

01:25:49 ◼   ► So this one is $100 and Prime is available,

01:25:53 ◼   ► but that $80 one, to me, is suspicious.

01:25:56 ◼   ► The $80 one, and I guess Amazon defaults to it

01:25:58 ◼   ► 'cause it's cheapest.

01:26:00 ◼   ► - Yeah, that's exactly it.

01:26:01 ◼   ► - The fact that that's the one by everything lucky,

01:26:03 ◼   ► the fact that it's cheaper makes me think

01:26:05 ◼   ► that it might be fake.

01:26:06 ◼   ► I would actually, if I were gonna buy this right now,

01:26:08 ◼   ► I would actually spend the extra $20

01:26:10 ◼   ► to get the one that says it's by Cuisinart.

01:26:13 ◼   ► - Yeah, except here's the funny thing.

01:26:14 ◼   ► So when I logged in this morning,

01:26:15 ◼   ► Amazon apparently had gotten one on their shelves

01:26:17 ◼   ► that they fulfilled directly,

01:26:18 ◼   ► so it's supposed to be sold by Amazon, 67 bucks.

01:26:21 ◼   ► So I got the deal, I guess I got the one that was $67.

01:26:25 ◼   ► I'm very happy about that.

01:26:25 ◼   ► I'm gonna be able to boil my tea

01:26:26 ◼   ► at all kinds of temperatures.

01:26:27 ◼   ► It's gonna be great. - Now there's another,

01:26:28 ◼   ► there's another type of fraud going on on Amazon,

01:26:31 ◼   ► and this is just comical. - Oh my God, no, come on.