Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now here are your hosts, Robb Reck and Alex Wood, for episode 203 for the week of March 22nd, 2021. Alex, uh, we went from the blizzard of 2021 to 70-degree weather yesterday, and I couldn't get enough of it. Uh, you know, Robb, I'm not gonna lie, my head is a little sunburned right now. Is it really?

Uh, I was, uh, outside hanging out on the deck for a little while and apparently hung out there just a little bit too long. Nothing major, but, uh, you know, a little tender. Yeah, we went, we went for a walk and it— so number one, like, you know, wearing, uh, shorts and a t-shirt and it's just perfect weather. And then you're, you know, we went to a trail and it's disgusting because all of that snow is now melting. And the High Line Canal, which, you know, anyone who sees it, generally the High Line Canal is completely dry.

There's, there's no water in it. And, and right now it's, it's as big as I've ever seen it, like, you know, 10 feet high and it's just about up to the trail in a lot of places. Obviously a very vibrant water life right now, thanks to our big storm. Yeah, you gotta love mud season. Good times.

Good stuff. Well, hey, let's do some housekeeping and then jump into the, into the news. We do have a Slack channel, a Slack community really, you know, as a part of this Colorado Equal Security Movement, we've, we've got, over 1,800 of the local folks together to share learnings and ask questions and network, help each other find jobs and improve their career. We've got a mentoring channel, we've got career discussions, we've got random, we've got fantasy sports, all kinds of good stuff. If you're not a part of it, I recommend you join in.

You can get the link to join by going to colorado-security.com. Yeah, if you're still having questions about your March Madness pool, you can go to the fantasy sports channel there and not get any additional insight. Still talk to people about it. Um, we also have a mailing list, Robb. If you go to the website, there is a form you can fill out and add your email address to the mailing list, and we will send you one email every week with the show notes.

While you're doing that, it would be great if you went to your favorite podcast app, subscribe to the show, and then also rated us. You know, we'd prefer a 5-star, but you know, if, if we're not doing so great, then let us know too. Uh, we, we'd also, uh, love it if you would help support us in a couple other ways. Uh, we would love it if you tell friends, anyone who you work with who might be interested in getting into security, uh, let them know that the podcast exists. Help us grow the mission of what we're doing.

And if you want to help us even more, we would love your financial support. We have a Patreon campaign. There's a big thank you to the current patrons who, who keep us going. Uh, honestly, you guys, you know, giving us what you do, um, makes a big difference. We appreciate you.

And anyone who wants to get involved, you go out to our website and click on the Patreon link, and you can figure out how to support us financially. Awesome. Let's jump into the news, Robb. Uh, we've got some big news starting the show here. Casa Bonita, uh, has announced that they are reopening soon.

Yeah, when they say they announced, really what that means is there's a little text box on the Casa Bonita website that says they'll be reopening soon. They don't have any more details than that, and I think everyone's very curious what that looks like and when. But, um, you know, considering the fact that it's the, the most fun cliff diving restaurant in Denver, uh, with— honestly, it's the best food of any cliff diving restaurant as well in Denver. I totally agree with that. It means, means that people are really excited to get back in there.

Yeah, uh, I mean, obviously Casa Bonita is— it's not the best food around, but it is an attraction. It's a fun place to go, especially if you have kids. It was interesting in the article how they were talking about the, uh, the actual cliff diving part itself that Even if they have no one there, it takes a lot of care to keep that going. I guess it's like taking care of a pool or something like that. You got to make sure that all the chemicals are right and that everything is still working correctly.

So even without them having people there, they still have work to do. So they've been closed since the pandemic began, and there really hadn't been much word from them. They're owned by a national organization, a private equity that owns a bunch of buffets and restaurants around the country. And so we've really been wondering, are they going to sell? Are they going to close it?

Are they going to open it back up? Now, it looks like good news, they're going to reopen. But Alex, I think there's one important question here. In the year that it's been closed, has the cave stopped smelling like pee? I'm going to go with no.

I think that's a permanent fixture of that cave, but Um, I guess, you know, once they reopen, we can go test it out for ourselves. All right, good stuff. Uh, moving on, there is a company, Astroscale, and I swear, Alex, as I was reading this article, I feel like we've talked about this. Like, it's possible 3 or 4 years ago, uh, but let's pretend we haven't. Uh, there's a Denver company called Astroscale that is, um, looking to become the AAA of space, which their focus is on cleaning junk out of orbit.

Yeah, I don't know if that's the greatest analogy, But I do like the idea and it sounds pretty cool. We've been launching things into space for a long time, and for the most part, they just stay up there after we're done using them. Something breaks, it just stays up in orbit.

If things break off, if there's a crash, then you've got lots of little space junk up there that's moving at 18,000 miles an hour, and it can really cause problems if it runs into other things. So having a company that's going to go up and try and clean up some of that space junk seems like a pretty good idea. Yeah. So I take notes about some of these articles. I had a bunch of notes on this one because there's so many interesting facts.

You say that there's space junk, there's millions of pieces. There are 26,000 pieces that are the size of a softball or larger, and there's more than half a million pieces that are the size of a marble, which doesn't sound that big, but because they're moving, like you said, at almost 18,000 miles an hour, Those things, like even a marble size, can do real damage to a spacecraft. Um, there, there are currently 6,200 satellites in space. Uh, only 3,700 of those are still functioning. So yeah, almost half of them are out of order and, uh, going around there.

And experts are saying that there's going to be— so I said there's 6,200 now, there's going to be an additional 10,000 to 50,000 satellites over the next couple of years due to the increasing demands. Yeah, and that's an awful lot. And there, you know, there is the possibility that, uh, you know, you could have, uh, one of these pieces of space junk hit something that's up there and then cause a cascading effect, uh, which would then essentially, you know, blanket outer space, uh, or orbit, that is, I guess, with, uh, with that space junk and make it even impossible to send more stuff up there. So cleaning this up is really important. Yeah, I, as I, as I read this, I thought, um, These guys sound a lot like security.

Here's a really bad thing that might happen. And I'm shrugging like, eh, that probably won't happen, just like people think about security. So I feel like I'm living in an alternate reality right now. I think also, I mean, the way that they're going to do this was pretty cool too. Many of the newer satellites that were launched have what they call docking plates.

So what they're going to do is launch other craft, I guess you can call them up there, they will magnetically dock to the docking plates on these out-of-order satellites or whatever they might be, and then basically pull it back into Earth's gravity so that it then goes and basically burns up on the way back in. And so there you go, you have it cleaned up. Love it. I have one more note here I wanted to mention.

Most of the company, there are actually a number of companies competing in this space, and just about everyone is focused on this low Earth orbit, which is between 99 miles and 1,200 miles above the Earth's surface. And of course, Astroscale does that, but they're also, they are the only company that sees themselves getting into a geospatial orbit, which is up to 22,000 miles from Earth. So they're going to be the only— literally the only ones out there doing it, uh, further away from the planet. Good for them, doing yeoman's work. Yeoman's work, I love it.

All right, uh, moving on, uh, Victrola, who you may know as a maker of record players since the early 1900s, uh, is technically still around and is moving its headquarters to Denver. Uh, Robb, does that mean that we got a bunch of hipsters here? Uh, it, it very well may mean that. You know, I You know, I knew Victrola as the, like you say, really old gramophone and record player. Um, and, and this article does a good job kind of going through some of that history.

So they started in Camden, New Jersey, which I think is where Thomas Edison was too. Um, so they started in Camden, New Jersey in 1901, and the original name of the company was the Victor Talking Machine Company, making gramophones. Love talking machines. Yeah, they about, about 20 years after that, they shifted over to wind-up cranks, um, or excuse me, from wind-up cranks to electrical devices, which enabled them to get into a lot more houses. They were the largest producer.

And then, um, in 1929, they ended up getting purchased by RCA, which I didn't know RCA was around in 1929. So that's interesting facts for me as well. Uh, and then once television came around in the 1950s, they basically got their butts kicked and they, they got discontinued. However, Uh, you know, as in the last few years, there's been a massive uptake in interest in records, especially driven by millennials, believe that or not. Um, and, and as a part of that, uh, a private equity firm, um, called RAF Industries bought, uh, bought Victorola from this place.

They landed in a couple different places over the years, um, but they bought them basically to get the, to get the name. And apparently, even though they haven't been making anything for 70 years, there's still a really good brand associated with them. And, um, so now they're coming back with some new products. Yeah, it seemed to me like, uh, you know, the headline is a little bit of a red herring in that the, you know, Victrola brand kind of went away, but the name still existed out there. And this, this other company, Innovative Technologies, um, purchased the name so that they could, uh, associate their, uh, record player tech with Victrola.

And so now they're kind of turning it all around, and now Victrola is the main brand again. And they are moving from Long Island, where they'd worked before COVID to the Shift Workspaces office in Denver. I guess that's like a shared, like a WeWork type of a thing. And they are currently at about 2 dozen employees, and they plan to grow to about 40 employees this year. I guess we know when we want to get our vinyl, we know where to go.

Good stuff. All right, next, uh, Angie's List is no longer Angie's List. Uh, so they have gone through a rebranding and they have dropped the E in Angie, so it's now ANGI. And they've also dropped the list, so just Angie. Not only have they changed that, but they've changed the name of HomeAdvisor.

So HomeAdvisor, uh, you know They merged as a company, but they still go to market under both previously Angie's List and HomeAdvisor. And now it's called HomeAdvisor powered by Angie. Very exciting. So why did they change the name, you ask? Well, a direct quote from the CEO, we're no longer a list.

We are so much more than that. And what they are that's more than that, when I saw that quote, I'm like, well, really? What are they? Well, now I can answer that. Instead of just giving a list of home service professionals, they also do pre-priced services, app-based messaging, app-based payment options, and even financing.

Wow. Uh, so now they can join the, the ranks of, uh, KFC and other brands that, uh, now have a name that doesn't actually mean anything even though it once meant something. And is it true, Alex, that KFC is called that because the government said they're no longer allowed to call that what they sell chicken? Uh, you know, Robb, I will not either confirm or deny that. Um, but I will say that that's bunk.

I, I remember seeing that go around on Facebook. It's not true. You know, I bet if you wanted to debate that though, you could come and, uh, hang out on the Slack channel in the random area and talk about that. So good times, good times. Is it my turn?

I think it's my turn. I think it's your turn. We have a, a story here, and I think we've done stories just like this in the past. This one's from WalletHub, and it's a list of the most and least innovative states here in 2021. Uh, and you can imagine we wouldn't be talking about it if Colorado was number 50.

Uh, that's true. We are not number 1, but, uh, Colorado is number 6, which I think is a pretty good number. Uh, it was interesting to me who the people who are above us, um, and, and frankly, like, 3 of them are all very similar. So the number 1 state is, is Massachusetts, um, which I think a lot of education there, a lot of tech companies, makes sense to me. But then you've got the DC, Maryland, and Virginia all in the top 5.

Right. I mean, shouldn't that just be one state? Just put those all together. I'm sure they all could fit inside Colorado. They probably could.

And then you have Washington State, which also Seattle and Microsoft and Amazon and all that stuff, that's not a surprise either. I was actually a little surprised California made number 7. Yeah, I know that we all think of Silicon Valley as being, I mean, it is obviously super innovative, the innovation capital of the world, but it's a small part of California and California is very, very large. Um, so it was interesting that that was enough to get California, um, into number 7. But if you're thinking, where is Austin?

Where's Texas? You're gonna have to keep looking down the list to find that. Yeah, they are. They're a little bit lower down at number 17. So sorry to hear that, Austin.

Yeah, too bad for them. Tough news. Um, they also broke down, uh, not just the, the overall rating, but, uh, you know, some of the smaller ratings. So, uh, Colorado was tied for first in highest projected STEM job demand by 2028, which is cool. Um, Colorado also tied for number 1 for best 8th grade math and science performance.

I have a kid doing 8th grade math right now. That's fantastic. I'm gonna go tell him. Congratulations, Robb, for helping us come up on that list. Yeah, good stuff.

All right, uh, good times. Congrats, Colorado. Let's move on to the next one. Um, we've talked about this in the past, but it is again time for the Colorado InnoTech Madness bracket. So, uh, this is a way that, uh, Colorado Inno, who is now owned by the Business Journal, uh, helps highlight some of the, the tech companies, startups in Colorado.

And so like the basketball March Madness, they put a bracket together, um, of different local tech companies and, you know, we get to vote and have them, uh, head up against each other. And basically what we're voting for is which of these companies we would like to invest our own money in. That's the, that's the premise of the question they're asking. Um, I don't, I don't know if that's how people are thinking of it or they're just all voting for their favorite company, but either way, it is a lot of fun. If you remember last year, uh, our very own Stackhawk, uh, made the semifinals.

They were, uh, they were kind of a sweetheart Cinderella story making it all the way to the semifinals. Yeah, I'm, uh, I'm a little disappointed in the bracket this year in the, in the seeding, um, mostly because, uh, they put StackHawk and JumpCloud in the same region. Not only in the same region, in the same half of the same region. Right. So second round already, they both won, but second round they're going against each other.

I think that's pretty unfair, you know. Yeah, kind of gotta separate those out a little bit more. Yeah, the only two— they are the only two security companies in here, right? There's some other interesting ones though. AMP Robotics made it, Guild Education made it, Pax8.

And Pax8's— now they're not security only, but they are, you know, they do security. Um, uh, I'm going to have to vote for the next round and I'm going to vote for Sheets and Giggles just because of the name. Sheets and Giggles did beat Pax 8 in, in the first round. That was a pretty big upset. Yes.

And, uh, I'm going to keep voting for them all the way to the finals just because it makes me giggle. Uh, good times. All right. Uh, another one that made the list that we've talked about is Climber. Remember Climber is like the Peloton of Yeah, climbing equipment instead of being a, um, a bicycle, right?

You can, uh, you know, uh, climb that infinite ladder. So just expect we'll be giving you updates on this bracket as we go. Of course, get out there and vote and help out, uh, your favorite of the local security companies. I think it will probably give it increased coverage if the, the winner of StackHawk and JumpCloud keeps going on. Good stuff.

All right, uh, speaking of local security company news, Automox here. We haven't— they have some news this week. They have named a new chief revenue officer. Jeff St. Clair has come over there. He previously was at Palo Alto Networks, and he got to Palo Alto through their EvidentIO acquisition, which is, uh, which was like, you know, their Prisma product.

It's one of the foundations for that. Yeah, and so, uh, he's gonna help them come on and, and help grow the revenue of the company, uh, build up the, the sales and go-to-market strategy. And I think that's a great thing. Congratulations to Automox that they're, they're still growing. And yeah, I think once you get that, that CRO in your organization, you know, you're a real startup.

Yeah, you know, just anyone who doesn't remember which one Automox is, they're the ones who do the automated patching remediation of vulnerabilities. You know, obviously with what's happened recently, SolarWinds and Microsoft Exchange vulnerabilities and all the other big stuff happening recently, automated patching is only more important. So this has got to be kind of good news for them, and hopefully they're growing through all these crises. Yeah, and I think, you know, even stepping back into 2020 with, you know, everyone working from home and needing to manage workstations remotely, having that SaaS-based automated solution is, you know, even better for them. Good stuff.

All right, uh, next, speaking of Exchange vulnerabilities, uh, LogRhythm had a blog this week talking about a guide to detecting those Exchange zero-day exploits. This is not a short little blog. There's a lot of good technical information in here. They not only talk about what you should do, you know, hint, patch first, assume compromise second, they also go into, to source sources you'd want to look at in your logs to determine if you were impacted if you did get breached as a part of this. They give you information around the types of events.

They also go into the MITRE ATT&CK framework and tell you where on that framework these attacks would hit. Really a lot of tools that you could use as you're trying to dig through this in your own organization to figure out your impact and of course, you know, respond to it. Yeah, and I think it's great too at the bottom they give a lot of external references as well. You know, we had the Red Canary blog last week about this, the same topic, then they gave some great references and there's some additional ones here with the Logarithm blog. Good stuff.

All right, last news story for this week is a, a blog by Ping Identity. It is a critical analysis of refresh token rotation in single-page applications. And, you know, I've been doing security for 20 years or whatever it is, and this is— it's always humbling to read something where I'm like, I get, I get some of these concepts here, but there's a lot of detail here I just do not understand. And so you were talking about the Logarithm blog being long. Talk about a long blog.

This is, uh, the Ping one is long and deep. And I agree with you, um, I think I got the concepts of what they were talking about, but most of the stuff was a little bit too much for me in there. So, well, if you were written by Dr. Philippe de Ruyck, de Ruyck, de Ruyck, I'm not sure if it's de Ruyck, de Ruyck. Um, he's not a Ping employee. He is a, uh, uh, he's a kind of an industry expert and one of the folks who helps put together these standards.

Yeah, and so if you are somebody that is an identity nerd or an app developer or maybe even an AppSec person, I think that this is super important for you, and I think getting in there and getting deep and figuring out these details will be beneficial. I decided that I could come up with a one-sentence summary. You should read this if you want to understand the security properties of refresh tokens in the browser. That's, that's what this is going to really dive into in depth, the security properties of refresh tokens in the browser. Go get them and maybe send us a 2-paragraph summary so we can be smarter.

Let's do it. I'm waiting for that so I know what this was about. All right, Slack message of the week. Big thank you to Andre Gaeta for, for supporting us. Andre, thanks for what you do.

We in the community do appreciate it. Uh, you know, if you want to, you want to help out Andre, maybe you can talk to him about your, your Mimecast, your email security needs as well. That's an unsolicited pitch for Andre. Each week we get to name one person in the community who keeps the conversation going, who we enjoy getting to interact with in Slack. Alex, who are we picking this week?

Yeah, so this week I picked Douglas Brush. So if you are in our Slack community, you undoubtedly have seen posts by Douglas Brush. He's one of the most prolific posters that we have, a great member of the community, a great person now at Splunk. And specifically, I picked him because he is also a cocktail nerd. And I had asked him a question in our happy hour channel about a drink recipe, and he proceeded to give me a very long and detailed explanation with lots of links and other things that was wonderful.

So I appreciate that. But I also wanted to recognize him for just the general contributions to the community and everything else that he does. You know, Robb, we keep track of the, the people who have won Slack Message of the Week because we you know, try not to duplicate too often. Um, I think we could probably put, uh, you know, Doug or Daniel Ayala or some other people as a winner every week. Um, but, you know, I went and looked back and the last time that, uh, Doug won was a year ago, so I think it's probably time to recognize.

That's great. Good stuff. Well, congratulations. What was the drink recipe though that you, you asked about? Um, so I had asked, uh, about his favorite Manhattan recipe.

Um, and he gave me several, also gave me, uh, links to the, the various components that he uses, equipment, everything else that you, uh, you might need as part of making that drink. I love good stuff. All right, I, I made some yesterday. They were good. Good stuff.

Uh, moving over, we have a calendar of events on the website. You know, even in the midst of a crazy pandemic, people are still getting together virtually, uh, and this is your chance to join that, that crew. Um, so take a look out there if you want to go out further, but we will talk about what's happening over the next couple of weeks right now. First, uh, ACES is doing their Young Professional Happy Hour with Kevin McCannula on the 23rd. On the 24th, we've got 2 events.

First, ISC² down in the Pikes Peak region down in Colorado Springs is doing their March meeting, and also up in Denver, ISSA Denver is doing an event. It's Don't Let Your Incident Become a Forest Fire. Seems like good advice. On the 25th, ISC² Denver is doing their March chapter meeting, and on the 26th, ACES is doing their legislative committee meeting. And that is, that is it for you for the next 2 weeks.

There's, there's actually nothing that very last week of March slash first week of April, um, so, you know, folks can spend all their time watching, uh, basketball. I assume it's still going by then. Yeah, it's still going by then. Or, you know, maybe going on spring break or something else like that. Something like that.

Yeah, anyway, all right, well, let's jump over to jobs. Um, Robb, I noticed there's no Ping jobs this week. I can't imagine why, but, uh, we do have some great jobs in here. Uh, Kaiser Permanente is looking for an executive director deputy chief information security officer. Pretty cool.

Yeah, big job. Um, you know, obviously Kaiser is, is not only one of the, the biggest healthcare providers here in Colorado, they're also one of the biggest in the country. And, and you could be, um, second in command for the security program of such an important, uh, really great program. Alex, I know you worked there in the past and— I did. Great people.

I know they're great, great people. I know you enjoyed that time quite a bit. Yep. All right. Next job, the state of Colorado is hiring a cyber and financial crimes investigator.

Ooh, that sounds cool. Western Union is looking for a senior engineer of cybersecurity. There was a lot of jobs from Western Union open right now. You know, I just picked one, but you know, you could go out, take a look at their website because there's quite a few different options if you're interested in working there. Zoll Medical is hiring a GRC, a governance, risk, and compliance client's lead.

Premier Members Credit Union is looking for an AVP of information security. Yeah, I don't— I didn't know this credit union, but, um, but you know, there's apparently there's a lot of them here in town. You know, it used to be, uh, the IBM Employees Credit Union, um, and then it became Premier Members. All right, well, NREL is hiring a cybersecurity analyst. KPMG is looking for a manager of cybersecurity in zero trust.

And checkout.com. I don't know checkout.com, uh, but they're hiring a VP of compliance here in Denver. Why don't you check them out, Robb, and you can figure it out? Good one. Uh, Direct Defense is looking for a security analyst.

I assume that, that it would be in their SOC. And that is it for jobs here. And that takes us to the end of news. We, we do have a feature interview this week though. And, and not only do we have a new person we're interviewing, we have a new person who's doing the interviewing, uh, this week.

Courtney Chenault, who is a— she actually worked with me at Ping as a sales rep, and she's recently moved over to Snyk as the, I think, the Colorado-focused account executive. She sat down with Matt Yoder, who you may know from the Slack community as ACR0NYM, and really learned a lot. I didn't know much about Matt before listening to this interview, but he's done some pretty cool stuff, including a really interesting— is it DEF CON or Black Hat? I can't remember. One of those hacker summer camp talks that they go into at the beginning of this that I think you'll find pretty interesting.

Awesome. Sounds really cool. Looking forward to it. All right. Well, that is it for this week.

We will look forward to connecting with you guys next week. Everyone stay safe and look out for the snow that's supposed to be coming any hour now. Keep warm. Thanks, Robb. This is Mike Benjamin, a big fan of Colorado security.

This is Colorado Equals Security for Colorado security professionals and VISE. Colorado security professionals. Hello, Colorado Equals Security. My name is Courtney Chenault, and today I have the pleasure of interviewing Matt Yoder. Matt is known to many of you as ACR0NYM on Slack.

Matt, thank you so much for joining us. How you doing? I'm good. How are you, Courtney? I am doing well, thank you.

No complaints. Got some snow clearing up in Denver here, so getting excited for spring. Indeed. So Matt, the, the reason that we started talking was you, you presented on the Death Envelope at DEF CON several years ago, and I loved your presentation. I thought it was really interesting.

So yeah, absolutely. So I'd love to hear from you, you know, how did you select this topic? Talk to me a bit about how you got there. Um, well, It's kind of interesting, and if you watch the presentation, you'll see I mentioned that I was having a conversation with a friend about that topic. And, you know, kind of morbid topic, but like, what, what do your loved ones do when you die?

How do they access certain things after that you're gone? And, um, while there are you know, there are administrative and bureaucratic processes to get control of things. It makes it much, much simpler if the person in question already has access to your passwords for your accounts. And like I also said in that podcast, or in that presentation at DEF CON, I basically told him if I couldn't find a resource, I'd create it. And that's what ended up leading to starting to write the presentation and putting together resources along those lines.

Then I submitted to DEF CON as the idea and was astonished to get accepted and gave the presentation.

I love that. And for those that don't know what a death envelope is, this is a medieval concept. Can you share with the listeners what it is? So the whole idea is basically a physical copy of things like your important account numbers and— or account numbers, like account login information and passwords, like written down on durable paper in archival-type ink and then sealed in a fairly tamper-proof envelope. Awesome.

Yeah, I remember in the Q&A section of your presentation, there were folks asking about, you know, if you have a spouse that no longer loves you and decides to use your death envelope, what are you— what's the plan? And I thought that was kind of funny. What do you think of that? Yeah, I remember that was an interesting question. I mean, and I think what we kind of came up with on the fly was possibly if you were— if you're in a situation where you're not entirely trusting of someone who's got your death envelope, maybe split it up in 2 or 3 different ways, like have parts of the information in one envelope with one friend.

So basically, so that one, you know, it's kind of a multi-key lock sort of thing, whereas if one person has an envelope and compromises it, they can't actually do anything with it. They still need another piece of the envelope or multiple pieces. Right, yeah, so interesting. I also, as you know, I came from an authentication company, and so this sort of thing really interests me. And I think as time progresses, you know, recommendations around passwords and multi-factor authentication and stuff like that, those, those recommendations are changing rapidly.

And so I'd also love— I know this, this presentation was in 2008, so a lot has changed since then. It has.

Yeah, and I think actually even at the time someone asked, does it make sense to have something more like a USB key that has an encrypted file on it? And especially with the current kind of password recommendations in terms of changing them pretty frequently, I almost am starting to think that makes the most sense, is basically that your death envelope is a set of instructions that says, Here's how to access my password locker, or here's, here's a USB key that can unlock my password locker or can unlock some other thing that gives you access to all these other things. Right. Yeah, because otherwise you'd have to update your death envelope, you know, all the time. And if we're doing the every 90 days, if people would— so yeah, that I mean, that's certainly one solution.

I've seen, you know, since this is a topic close to my heart, I've seen multiple services kind of at the fringes come up a little bit, you know, basically like on the event of your death, release this information to people, kind of permanent lockers, but I've never seen any of them gain enough traction to be considered a mainstream service. So I still think people having control of their own information is probably the most important thing right now. Yeah, you also spoke about using wax seals on your death envelope, and I know that in subsequent years you may have changed your stance on that, or it seems like maybe it's not quite so tamper-evident as, as we thought. I've gone, I've gone back and forth. I mean, Jeff, Jeff Moss, uh, Dark Tangent, the founder of DEF CON, um, a few years after my presentation created a contest literally called Tamper Evident that's starting— was starting to test these more physical security devices, things like the locks that you have on your electrical box, wax seals, like tamper-proof tape, like the warranty void tape.

And, um, I've— here again, and since it's close to my heart, I've been watching the results of that pretty closely, and it is starting to look like there is nothing that is tamper that can genuinely reveal tampering if someone's really trying to conceal that they've been inside a box or an envelope or what have you. But I suspect for your average user, a wax seal or even just a good bit of strong tape is probably enough to indicate if someone ripped open your envelope. Yeah, I don't know if I've arrived in life quite to the extent that someone would go to great lengths to break into my death envelope, but you never know. And neither have I. I mean, that's really the thing of it. I mean, how the, the people in the tamper evident contest are bringing some of the most amazing technology they have available to win that contest because there's a black badge involved at DEF CON.

So yeah, I think your average home individual is not going to be making that kind of effort. They're going to use a knife and you're gonna know it got opened. Right, absolutely. What was it like to present at DEF CON? That sounds pretty nerve-wracking.

It was, it was pretty unreal. As you say, it was 13 years ago, I was 13 years younger, and it was, you know, a full-size room at DEF CON. That was the first time speaking in a room that large.

Even Despite the fact that the majority of the audience were my friends, uh, and it wasn't that big a— it wasn't that big a crowd because it was on a Friday afternoon as opposed to like a Sunday afternoon, I was still extremely nervous just because it's DEF CON and it's being recorded for posterity. Yeah, there's what, 5 or 6 different copies of it on, on YouTube at this point. So, right, it's Definitely was an experience. If you got to do it again, would you do anything differently?

I would, absolutely. I would practice the whole presentation multiple times in advance of it. I believed I had written enough to fill a 40-minute time slot, and I got to about 20 minutes successfully. Um, I think it's— it was Steve Jobs who, for his big, uh, Just One More Thing presentations, was known to practice his presentations literally dozens if not hundreds of times with the actual video going behind him, where it got to the point where he didn't even need to control it. His timing was so good that when he hit a beat the video would be in the right place.

And I don't have any intention of getting to that level, but I would certainly practice it more like I were giving it to an actual audience to understand the beats, understand the timing, and understand how long a presentation I actually had. Right, that's certainly something to aspire to, and I've been there before where you think that you've got a 40-minute-long or a 20-minute-long speech, and when you're nervous and you're talking twice as fast the speech goes by twice as quickly. It's exactly correct. Yeah, cool. So do you think that you'll ever present there again?

Are you interested in going back someday? Maybe Death Envelope Part 2? Uh, Death Envelope 2020. I, I'm giving it some thought. I haven't had this conversation kind of come back into the mainstream with you and some other people on the Colorado security Slack.

Uh, I've revived the website and started starting to build that again. Uh, it's not inconceivable that I might try to rewrite a new presentation in light of the sorts of things, uh, the contests have revealed, um, and submit it again. Uh, I'm not sure though. I, I kind of feel like DEF CON's gotten too big. So I'm not sure it would be at DEF CON.

I might submit for a BSides, like either BSides Las Vegas or BSides Denver, but we'll see. If it— if I can get enough of what I think is an interesting collection of information, I might try for a big room at DEF CON again. Yeah, I've heard you talk about podcasts as a posterity effort, which I love, and I think that especially related to technology, that concept is really interesting because when you presented in 2008, the world of technology and security was different than it is today. And so I think that Death Envelope Part 2 could be really intriguing because so much has changed since your last presentation. Yeah, very possibly.

And you're right. And I think a lot of podcasts— I think that's why so many people are podcasting now during the pandemic, is just to capture that kind of slice-of-life, slice-in-time sort of thing. And I, I'm a big believer in that, you know, like the NPR Storytime or the Story Project, where they just have recording booths all over the country where you can go in and tell your story. The whole Moth events where people just tell their story and they get recorded. So yeah, humans are natural storytellers and podcasts are definitely the evolution of that.

So yeah, I agree. I love podcasts. I love— NPR has so many amazing story-oriented podcasts. The Moth is great. This American Life, big fan.

Absolutely, absolutely. You seem like you have a very interesting story of where you kind of— how you came to be where you are today. Tell me a bit about your parents. Well, I think it's pretty safe to say my parents are responsible for both me and my brother ending up in the position we're in— positions we're in today in terms of being pretty skilled in terms of technology. Because my dad was an analyst, computer analyst for the government in the air traffic control system.

And he knew real early on what the value of home computing was going to be and computing in general. So they worked real hard to make computer devices available to us. Like, we were— I think our first computer was the TI-99/4A, which was originally sold at pretty much like Tupperware parties. And it was, you know, a little— it was actually one of the first 16-bit computers, but it, much like an Atari, all it did was output to your screen. You recorded, you loaded games off either a cartridge or off of a tape, that kind of thing.

Then when Apple was offering huge educational discounts for things like the Apple II and the IIe, and they were in all the schools, so they got us one of those. So we were learning from, you know, before the age of 10, we were being exposed and learning really the ins and outs of computing. Back in the day when you, if you wanted a program, you probably were typing it in from a magazine. Right. That's so impressive.

I wish that I had had the same experience growing up. I think, you know, to have a father that was involved in technology in the way that he was, and it sounds like your mom also is into antiques and going antiquing and finding amazing stuff, trinkets for you guys to play around with and so on and so forth. Forth. It just sounds like you had a really cool childhood. This is, this is true.

It was, it was an interesting, interesting home, to be sure. Yeah. So I, I'm very interested in your, your, your career path, really, and how you shared with me that you did not receive a college education, and yet you have taught college-level courses in the past. How on earth did you do that? This is true.

I, I did attend CU Boulder, did not successfully get a degree. But I don't know, somewhere in the mid-'90s, some friends just mentioned to me that places like the community colleges often don't require a degree in a given subject to be able to teach that subject. What they require is a teaching certificate, which literally is just a document that says I've worked in this industry for the past 5 years, which is fairly easy to get. You can literally contact them and say, excuse me, I'd like to teach, what do I need to do? They send you the forms for a teaching certificate, you fill them out, send them back, and say, all right, we verified you, you can teach here.

So I taught one semester of Introduction to Unix on an HP 9000 HP UX machine, literally just for the entertainment to be able to do it, say I taught college as a dropout.

Yeah, I think that's so awesome. And especially this day and age and with COVID I think people are starting to rethink the amount of money that is spent on going to college, going to university, and you know, is it truly that necessary to have a bachelor's degree in order to be a brilliant developer or somebody that's going to have an excellent, you know, career track in technology? Do you feel like there is more opportunity for people that may not have a traditional educational background or that you had a, you know, kind of a special moment where that didn't hinder you? Um, it's, it's hard to say. I know a lot of people my age, a lot, don't have any degree and have just been able, just based on their inherent skills and kind of upbringing, have been able to build a career that, you know, pretty lucrative career in technology.

Uh, my brother, for example, doesn't have a degree either, so, and he's— he and I are pretty much the same level in terms of technological skill and administration and what have you. So is it possible? I don't know. I mean, realistically, we, we did it with 20 or 30 years steeped in the technology and kind of climbed that— climbed the ladder that whole time. It would be, it would be a tough argument for someone who is Um, carpet salesman who says, I now want to be a technologist, to successfully say, okay, well, I've used computers all my life, I can administer them.

But it may be possible for them to find enough free or inexpensive online courses and certifications to do it. But so I, I don't think there's an easy answer to that question. Yeah, I, I feel like with my— looking at my nieces and nephew, they already are more technologically adept than I was when I was twice their age. And in looking at, you know, gamification of coding platforms for little kids and stuff like that, I, I feel like there's something shifting where access to education or experience in technology is becoming more readily available and less of something, you know, of a haves versus have-nots type of conversation. But we'll see.

I would love to see a world where you could choose to get an education if that made sense to you, but if you wanted to skip that and go straight into a job where you learned on the job, that that would be on the table as well. Yeah, I agree. And I— there will sadly probably always be jobs that are going to require some form of advanced degree, um, especially even in this— well, probably especially in the security world in terms of things like forensics. And, you know, in terms of acting as an expert witness in courts, you can't— you probably can't get away with saying, well, I've been doing it for for 30 years and I'm really good at it. Like, you probably have to say, here's the list of my publications that I got from my doctorate.

Right. So yeah, that's a good point. Some roles will be more accessible without education, but others it would, you know, same with finance or anything like that. You got to know what you're doing before you start learning on the job for sure. Exactly correct.

And I mean, like, A CPA is going to require a certain degree of education before you can take the CPA test, as I understand it. Yeah, right. Well, so if there is a young person listening to this interview and looking up to you as someone that's had an incredibly successful run of it without choosing that path or going down that path with college, what advice would you give to younger people that want to enter IT or security, but that don't necessarily have the means or the goals to get that educational track under their belts? I think it's just basically be as curious as possible and indulge that curiosity and find, like you say, the gamification websites, the websites where you can basically attempt, you know, penetration testing if you're going into security or if you want to learn Python, you can. The Raspberry Pi was developed for that.

For a cheap solution in which to learn lots of different kinds of coding. It's not super fast, but you can learn to code on it just fine. And it can be— you can run it as a full computer, keyboard, mouse, and monitor. Um, yeah, but the thing is, be curious, and you have to be ambitious. You can't assume it's going to be handed to you.

Totally. Well, you certainly seem like a very curious person, and when I asked you what your favorite thing in your life was, you said, fountain pens. So talk to me about your love of pens. Um, I think it probably, uh, it really comes down to kind of the tactility and just the endurance of paper and ink versus electrons that can vanish with the power going away. You know, if I have a notebook that's been written in in ink, you know, that's going to last hundreds of years if cared for.

At this point, I already have CDs that I bought in the '90s that have holes that are showing up in them because the media just wasn't designed to last that long, despite any claims from the manufacturer. But we work with, you know, they just today they found Dead Sea Scrolls, the new Dead Sea Scrolls in Israel, that are thousands of years old that survived on papyrus, right? So I think that, that long-term durability really appeals to me. Yeah, I love that too. And I actually recently opened up a memories box that I had at my house, and I had my favorite mixtape, uh, my favorite mix CD in this box, and it was completely wrecked.

It absolutely unplayable, unfortunately. So I, I totally agree with you. You said that you like to create your own pens. What, what all does that entail? Uh, yeah, as it, uh, turns out, there's a whole sub-world of hand-turning wooden pens that I was introduced to by a friend who knew I was into nice pens.

And one day he just said to me, hey, you know you can make your own pens out of wood, right? I'm like, What are you talking about? He said, yeah, there's— you can go take this class at a place called Woodcraft. There's dozens of kinds of different kits for different kinds of pens. And yeah, I took a class and I was hooked.

I have a little tiny little 14-inch— I basically have a tiny woodshop in my garage with a tiny bandsaw and a tiny lathe and a tiny drill press. To just turn kits and pen blanks into fairly nice wood pens. Like I said, that's amazing. Dozens and dozens of different styles of kits and makes it real easy. You just drill the, drill the pen blank, glue the, glue the tube in from the kit, and then turn it to the shape you want and put it together.

Man, I would love to try that. I took one woodshop class in high school and I loved using the lathe. It was very cathartic, and it'd be really cool to make pens. How many— how long does it take beginning to end to make a pen? Um, I had gotten it fairly, um, kind of industrial standardized.

I'm drawing a blank on the name of the process, but basically, you know, I would, I would cut and drill 5 or 6 different pen blanks for the same type kit and get them all ready and let the glue dry, and then probably turning and polishing each one once it's at that point probably only takes about 20 minutes. So I'd say probably once it's in a kind of a, you know, process size like that, I could probably do 2 or 3 an hour. Wow. So how many have you done? Oh, probably 100 at this point.

I've given a lot away, sold some, given lots away. I have lots that I kept. So yeah, I have a bunch. And I haven't done it for a while because I have a messed up disc in my back that doesn't let me stand long enough to work on it. But I'd like to get a a stool that might allow me to get back to it, because I have dozens of kits that are ready to be made, dozens of nice pen blanks, lots of different interesting woods.

So yeah, that's awesome. I have been to many a garage sale where there's a big old bag of pens for 99 cents or $2 or $4, and you can just buy the whole thing. Do you do that? Do you like collecting other people's old pens and trying to find the beautiful needle in the haystack? I have done that, and that is always the collector's dream, is to go find the, like, the Parker Big Red that's worth $500 in the bag of mixed pens at an estate sale.

I've done it plenty of times, although at this point I pretty much avoid estate sales and garage sales because I already have too much stuff. And don't want to bring more stuff home right now. That is fair.

My mom frequently got those because, as you mentioned, she was an antique dealer specifically for her career and went to many estate and garage sales, and she was— she knew a good pen, and she knew I was into pens. So there are— I I'm in possession of many interesting pens that I wouldn't otherwise have been if it weren't for her, because of those kind of little bags of random pens where an estate sale appraiser doesn't have any idea about pens, so they just all end up in one bag. And it— there can be a $2,000 Visconti, there can be, you know, a $10,000 vintage Parker that's extremely rare. Not uncommon that you hear about those, like, on the pen collecting boards, which yes, totally exists like every other collectible, but they're not common, let's be honest. Especially in the age of the internet, those kinds of appraisers are now having a better idea of what they have, and they'll sideline the stuff that's good and put it on their eBay shop.

Right. So if you went to a garage sale and you saw a big old bag of pens, Would you be able to spot the nice ones easily, or would you have to— you know, what are you looking for? Uh, yeah, I have a good idea what sort of thing is going to be in that sort of bag, and I can usually spot it pretty easily through a sandwich bag. Uh, but you just have to know the pens, what, what they look like. Gotcha.

And of course, they're often going to be mixed in with a huge collection of advertising wooden pencils, which I have zero interest in. So it takes some sorting, but yeah, I could spot them pretty quickly, I suspect. Well, the, the next question I have for you, which seems like an obvious follow-on, is how is your handwriting?

Random is the answer. It depends on how hard I'm trying to keep it Legible, which typically if I'm going for legible, I'll drop into kind of the engineer all caps writing. But I grew up in the age of cursive, where cursive handwriting excellence was graded. So when I'm in a hurry, I often will have a mix of kind of standard letters and cursive. It can get pretty illegible for the average person.

I feel like mixing all caps and cursive sounds like a challenge in and of itself, so I'm kind of interested to see this. Well, that, that sort of thing doesn't typically happen. If I start all caps, I tend to stay in it because I'm trying to keep my handwriting legible. But like, if I'm not working all that hard, that's when you'll see a mix of cursive and isolated letters, right? It seems to me like you have a great appreciation for posterity and for deeper time than the immediate moment that we are in right now.

Do you journal? What do you do with all of this amazing love of fountain pens and long-lasting inks and death envelopes? Do you have a lot of stuff that you're keeping for posterity in your own life? I go back and forth. I have a journal, a pretty nice leather-bound journal that I'll occasionally journal in if something significant happens.

I had a journal that was a 10-year journal for a while that literally had each day had 10 years worth of sections on each page, just for like kind of a quick note. And I found that I just wasn't capable of keeping up with keeping something interesting every day. Uh, I might see if there's something still making that and start a new one. I haven't decided that yet. I've been thinking about it, but I, I am a big believer in kind of the long-term projects.

Like, I'm a member of the Long Now Foundation that's building the, the 10,000-year clock down in New Mexico. Um, I don't have any— that's so cool. I, yeah, I read The Clock of the Long Now and thought that that was just the most beautiful, meaningful project. I thought that was so cool. So you're part of the Long Now Foundation?

What does that entail? I'm not, I'm not part. I'm a— I paid for a— I paid like a $100 membership for a challenge coin. Um, okay, love that though. No, I'm, I'm not at the level where I have like a bottle of alcohol at the Interval in San Francisco or anything, but I did send them some money to support their stuff in general, and I get their email, so it's not like I'm a board member or anything.

When you were sharing about your love of, you know, the love of handwriting and fountain pens and the Dead Sea Scrolls, I was thinking actually of The Clock of the Long Now, and reading that book really changed the way that I think about my own place on this planet and what I want to leave behind and kind of the decisions that I want to make with my own life. Did you— how did you get involved with caring about the long now concept? What does it mean to you?

It's kind of funny. I've always had a very mixed relationship with time.

I frequently am very disconnected from it. Like, I won't necessarily know what day or what time it is, especially given that I tend to work in a basement. Because that's my work office is. Um, and that's, for that matter, that's where my— when I actually had an office in a building, it was completely away from any sunlight windows. And, you know, that's how the administrators tend to live, is in the dark without windows.

So, uh, and in fact, there's a, there's a clock that was mission, I think, by Oxford, and I can't remember precisely where it's located, but it's called the Chronophage, which is literally the eater of time. And it's a giant mechanical clock with a grasshopper escapement. But instead of being on the inside like clocks usually are, the Chronophage is a giant grasshopper on the outside of the clock. And it's— I think it's valued at $2.1 million, and it's just an amazing clock. And the inventor of it talks about he created it because he considers time to be the enemy.

And that's so the chronophage is eating up a second of every second, eating up his life. And that's— I— so, but on the flip side, time requires time to give you things like good whiskeys good hot sauces, lots of things require— anything fermented and tasty takes lots of time. So like I say, it's a very mixed relationship I have with time.

That is a fascinating answer, I will grant you that. Yeah, I felt like reading that book just made me start to think about, as a species, all the decisions that we're making and all the things we're doing and all of our toiling you know, at the end of the day, it's kind of, you know, I just imagine a buzzing planet and all of us are living our little lives and running around trying to, you know, succeed in whatever way that means to us. And then we kind of blip out at the end of our lives and it's on to the next. And I don't know, it's just kind of beautiful, maybe a little bit sad. Yeah, I mean, that's kind of the thing, you know.

I have a friend who was going to open a distillery down in Parker who unfortunately didn't, and I really wish she he had, just because of that whole, that time element involved in creating things like that, where, you know, a good Scotch whiskey is considered pretty much irrelevant at any— anything less than 12 years, that kind of thing. Yeah. Tabasco, Tabasco sauce, most people don't know this, that stuff takes 3 years in a barrel. What? Yeah, I didn't know that.

Every bottle of Tabasco sauce has spent 3 years aging in oak barrels that, that were formerly used for bourbon. That is something I did not know. I love Tabasco, so this makes me like it even more. There you go. But yeah, the concept of something getting— requiring time in order to be good is, is beautiful and wonderful.

I, I don't collect wine or anything like that, but went to Napa about a year ago and gained an appreciation for spending money on something that you are not going to be able to enjoy. You can enjoy it now, but it's only going to get better if you wait 10 years to drink it or 5 years to drink it. It's pretty cool. Yeah, exactly.

So this, you know, I've asked you all the questions I have for you. Do you have any things that you would like to share with me that we haven't talked about? I don't think so. Like I say, the big message I think people should take away is— it's funny, there was a recent discussion about the value of a specialist versus a generalist on one of the mailing lists I'm on recently. And while the argument can be made for a specialist, I think As an inherently curious individual, I would definitely argue on the side of a generalist, and I think that's gotten me where I am, is the fact that I— when I run into a project or a problem, I don't stop and say, well, I don't know how to do this.

What I do— what I say is, I can probably learn how to do this, especially now in the age of Google. It's so much easier than it used to be, than going to the library Like a good example is like when— remember when paracord survival bracelets became all the rage and they were being sold all over eBay and Etsy and Amazon? I looked at those and said, there has got to be an Instructable for that. I bet I can make that for about, you know, a buck as opposed to $7 like they're selling on Amazon. And it turned out to be multiple versions of it on Instructables.

And I was right. I was able to make it much, much cheaper. And I've adapted it all kinds of interesting ways. My, my watch band is a version of the paracord bracelets, that kind of thing. That's awesome.

Did you make that watch band? Oh yeah, of course. Wow. What's the most recent thing that you figured out how to do on your own that most people would have paid someone to do or paid for?

Most recent or most exciting? I don't know, you know, that's even hard to break down.

If I can do it without hurting myself, I'd rather do it myself than pay someone else. Things like minor plumbing, I'd rather do that myself. So I've replaced multiple things in my toilet that I would probably that a lot of people would pay a plumber for. I don't, I don't buy pre-built computers ever because part of, part of my coming up through the career was working in a computer shop early on in the PC age where there wasn't any place like Dell or, you know, Gateway selling pre-built computers. You literally came in, you ordered your computer, and then I built it in the back that day or the next day, and they came in, and then we installed the software and tested it for a couple days, and they came back and got it a week later.

So I've, I've hand-built probably hundreds of computers at various jobs. So, you know, I'm never going to buy a pre-built computer unless there's a really, really good reason in terms of— well, a laptop. I'm not prepared to go down the kit laptops road currently, although they're getting interesting too. But any, any desktop computer, I built it myself. Wow, that, that is really cool.

I have not ever built a computer myself, so maybe you'll have to teach me how to do that sometime. I could. It's astonishing to me there's actually a PC assembly simulation game. I'm like, that seems dumb to me. I know how to do that so well, but apparently there are people who don't and find the idea amusing of doing it in simulation.

Hmm, this is another thing that makes me feel like the next generation maybe doesn't necessarily have to go through all the same schooling. Who knows? Yeah, that's— I guess that's possible. But the question is, I mean, I haven't played it, of course, because it costs money, and I know how to do it in real life, so I don't know how accurate it is. And maybe things people are learning in Minecraft apply to when they go to college Like maybe they do want to go to college after playing Minecraft for their whole youth and become an architect and become— do some really amazing things with the new materials that are coming out.

I mean, that would be awesome. Absolutely. That's awesome. I can tell that you are a very agile learner and that you have a growth mindset, and that's definitely something I strive to have in my own life. So this has been an absolute delight to, to talk with you today, and I appreciate it.

You as well. Absolutely. Thanks for having me.

Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado Equals Security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado equals security.