Latest / WGKM / Podcasting 2.0 - Episode 276: "Jackleg leechers"

Transcript

Podcasting 2.0 - Episode 276: "Jackleg leechers" · WGKM

0:00
Podcasting 2.0 for October 23rd, 2026, episode 276, Jack Leg
0:06
Leachers. Hello everybody, welcome once again to Podcasting 2.0 where
0:12
we talk about all things podcasting. And yeah, that includes
0:16
some... We'll be right back. friend on the other end,
0:40
the one, the only, Mr. Dan! During that intro, you
0:51
got so far into the can... Into the can? You
0:54
are deep in the can. What do you mean the
0:56
can? What can? In a can. It sounds like you're
0:59
in a can. I'm not. I'm not in a can.
1:02
Or a foxhole or something. You're listening on the wrong
1:05
device somehow. You're listening. I just got my headphones on.
1:09
No, no, there's no way. There's no way. Something is
1:13
wrong with your setup. So in the can like echo,
1:17
we can like, no, no, no, no, no, no, no,
1:22
no, no, no, it's just not possible. No, I'm telling
1:27
you, I wish I could record it. I wish you
1:30
could, too, because I don't know how to, though. I
1:34
guess I could put my phone up to my ear
1:38
can. It is the wildest thing. I have no idea
1:41
what you're witnessing. Very in a can. I'm not in
1:45
a can, though. I'm here. And the stream sounds fine.
1:51
So if the stream sounds fine... Okay, I just recorded
1:55
it. Okay, all right. I just recorded it for my
1:58
own sanity. Okay, all right. Let's play it back. I'm
2:01
listening. I'm ready. Oh, you're going to share it? You're
2:04
going to share it with me? I'm going to send
2:05
it to you. Okay, all right. Send it to me.
2:08
And then I will play it directly from here, and
2:11
we'll see if that's how I sound. Share. Now, this
2:15
is going to be a perfect reproduction because I held
2:20
my cell phone up to the can of my headphone.
2:23
So whatever you're about to hear is going to be
2:26
absolutely perfect. Okay. High Fideliti. Oh, yeah. Yeah. Are you
2:31
sending it through signal? Okay, here we go. No, it's
2:34
just not possible. I'm telling you, I wish I could
2:37
record it. I wish you could, too. I don't know
2:41
how to, though. I guess I could put my phone
2:45
up to my ear can. It is the wildest thing.
2:50
Do you hear it? No, no. It's very hard to...
2:56
hear you didn't you didn't hear from that high quality
2:59
recording well it sounded like crap so it did it
3:03
sounded horrible oh i'm sorry i don't know the only
3:06
thing i can think is that something is going wrong
3:10
with the with the return through uh my uh clean
3:15
feed clone I mean, I just say we just blame
3:22
the Rodecaster firmware. Oh, you know, oh, I did just
3:26
update the Rodecaster firmware. That is a possibility. It would
3:35
be bad if that's what it was. Let me just
3:38
check. Well, but the boardroom says that they don't hear
3:41
anything wrong. But maybe it's only my channel. Let me
3:46
just check. Outputs. Let me just check. It's due. Yes,
3:51
it is due. We haven't had a good road caster
3:54
firmware diarrhea in a while. Well, that is entirely possible,
3:59
and that makes me sad if that's what happened. uh
4:04
running php yeah definitely absolutely it is 100 it is
4:11
well let's talk about that for a second because holy
4:15
guacamole what a what a week you've had brother what
4:20
a week and and What a week all CIS administrators
4:24
have had around the world, and they do not get
4:27
enough respect. They do not. They need prayer. They need...
4:31
Chocolates, little presents, little back rubs, all kinds. No emails.
4:38
Don't send an email thanking your C7. They don't want
4:41
to hear your email. They just want just a like,
4:43
hey, thank you for what you do. Thank you for
4:46
your service. Thank you for your courage. And I thank
4:49
you, Dave Jones, because I. I had my own servers
4:52
to deal with, and that was minimal stuff. And you
4:55
maintaining the podcast index, amongst other things like, I don't
5:00
know, a whole accounting office, Godcaster's backend, you really hustled,
5:04
brother. Yeah, so I do – I do sysadmin. I
5:13
mean, obviously, it's my day job, but then also I
5:15
have Godcaster Podcast Index and then also have just –
5:21
As all IT people do, you get sucked into supporting
5:24
some stuff for other people, friends, family, things like that.
5:30
Oh, that's the worst. Oh, yeah. I know. I know.
5:34
I know. I know. I know. I have like –
5:36
so I've ended up with like nine, roughly nine production
5:40
PHP websites. Oh. Just kind of spread out all over
5:44
the place that I manage. Most of the websites, most
5:47
of the stuff, the servers that I manage, they're not
5:50
Internet-facing. They don't face the public, but there's nine of
5:55
them that do. Two of them were pretty – Well,
6:01
I didn't know anything was going on until Stephen Crater
6:06
posted on podcastindex.social. He's like – he just reposted the
6:14
PHP like – Alert. Alert. Yeah. CVE. Uh-huh. And I
6:20
was like, because I had gotten up early, I think
6:23
I'd gotten up, you know, pretty early that day. And
6:25
I was like, well, I mean, I'm going to get
6:27
started on some stuff because I was in the middle
6:29
of some stuff with the Index. And no, no, I
6:32
was working on the Godcaster MCP. That's what it was.
6:36
And so... I start working on that, and then I
6:39
just glance over at Stephen Crater. His thing says PHP
6:42
9.2 CVE. I'm like, oh, God. Yeah. Oh, no. Yeah.
6:48
And then that was what that ended up. So... Let
6:55
me make an observation before you move on. So my
7:00
observation was that... This was either a moment where every
7:07
systems administrator went, holy crap, this is really, really bad,
7:12
and just ripped everything offline because government websites, I mean,
7:17
there was all kinds of stuff was down, or it
7:20
was – systems administrators going, oh man, I get to
7:24
do something else this morning. Let me rip all this
7:26
stuff off. Suffer! Suffer, you creep! Suffer! No, it was
7:31
not that. That was not the way. It was the
7:33
first one, not the second one. Because like... I mean,
7:38
the NSA, the FBI, they were all just putting out
7:41
like Twitter posts saying, yeah, take your stuff down. Just
7:44
turn your sites off. If you've got a website that
7:46
runs PHP, just turn it off. And was that a
7:48
valid response from them? That's... That's an interesting question. In
8:00
some circumstances, yes. Mm-hmm. Yeah, not across the board, but
8:08
yes to some of that, because the issue here was
8:12
that or the overarching issue with this PHP catastrophe was
8:19
– Let me just let me frame it like this.
8:23
It starts this whole the whole PHP story with this
8:29
issue starts with some jack leg releasing the details of
8:37
the exploit ahead of. The responsible disclosure deadline. So when
8:42
you say Jack Leg, is that a person's name or
8:45
is that a slur? It is a more kind version
8:49
of Jackass. Oh, okay. Jack Leg. I'm going to –
8:54
that's show title. There we go. Jack Leg. Yes. I
8:57
mean there – There are many jack legs in the
9:01
security influencer community, and this is like – because the
9:08
way responsible disclosure is supposed to work is that you
9:12
privately report the problem, the vulnerability, and show – with
9:18
proof of exploit – And then you use the time
9:22
when it's under privacy to responsibly go to all the
9:30
vendors involved, the Linux distros, the software packages, software maintainers.
9:38
You go through the whole, you notify everyone, give everyone
9:43
a timeline for how long it's going to take to
9:46
fix the bug and distribute it to all the systems
9:50
that are going to push those fixes downstream. So in
9:54
this case, it would be things like WordPress, WordPress. Yeah,
9:59
I'd say that was the biggest WordPress. Yeah, who's the
10:02
other one? Who's the big WordPress reseller? That had a
10:07
falling out with them. I forgot. But anyway, like them,
10:13
you know, all the Linux distro. What is your –
10:16
isn't your Jamie telling you? Your Jamie bot? I'm not
10:20
even looking at that. I think it's useless. But the
10:24
– so you're supposed to do all that and then
10:28
you – Go public once all the patches are poised
10:32
and ready to drop, ready to go in their repository.
10:35
But this was some jack leg going, oh, cool, I've
10:38
got an exclusive. Breaking! One of those guys? Yes. Yes.
10:42
And this happens all the time. I think I said
10:45
this on the other day. Security... Influencers are like unbearable.
10:51
These people are so annoying because they not only disclose
10:55
early because they just want some attention. They just want
11:00
to get clicks and reposts on Twitter. But they also
11:06
pile on. So anytime there's a big vulnerable, a big,
11:10
horrible vulnerability, they're also going to be like, oh, yeah,
11:15
check out these other seven, you know, I know. I
11:19
know. I sent you I sent you a link. You're
11:21
like, these people are insufferable. I'm like, OK, I'll just
11:24
step away from Dave for a little while. I'm not
11:26
going to be posting anything. Well, and so the other
11:30
part of that was Node had big expenses. Node.js, yeah.
11:36
Yeah. And so our website, the Podcast Index website runs
11:39
Node. And up until yesterday, it ran a version of
11:44
Node that was woefully out of date. uh, node 16.
11:51
And it's on like a 24 LTS right now. So
11:54
it was like a way out of date and I
11:56
knew it was out of date, but we, you know,
11:58
we've, you're slow to update. And I agree with that
12:01
policy. Yeah, and I tend to – okay, here's the
12:07
thing about patching when it comes to this kind of
12:10
stuff. My... philosophy on how to And I'm going to
12:20
admit up front that this philosophy – It's flawed. It's
12:25
flaw philosophy. Flaw philosophy. Yeah. Philosophy. Philosophy. Yes. Philosophy. Yes.
12:35
This flaw philosophy is – Uh, now I think out
12:40
of date. So, up until recently, and this is going
12:44
to be part of – I'm going to explain what
12:47
all that I did behind the scenes this week. But
12:52
up until recently, patching and migrating systems from one version
12:58
of a framework to another or one OS to another
13:02
was – A chore. And it always involved breakage most
13:07
of the time. Yeah. And that's why anytime you had
13:10
to say, let's say you go from Laura, Laura, Laura,
13:13
Laura framework 12 to Laura framework 13. That's a bad
13:16
example. Let's say Laura framework 10 to 11. That had
13:21
a big document that went with it showing all of
13:25
the breaking changes. And there was actually entire services that
13:30
I'm sure they're still around. There's entire services where you
13:33
can hire them. And their only job, their contractors, their
13:38
only job was to come in and do your job.
13:42
Laravel framework upgrade. They would comb through your – of
13:48
course, they had scripts that would look for all these
13:50
things, and they would make this process easier. Well, and
13:54
so for those reasons, upgrades in the past have always
13:59
come with a lot of risk. And when you're a
14:02
small team or a single solo person, what my philosophy
14:06
has always been is that – you look at what
14:12
the potential problem is, you look at the vulnerability or
14:14
the issue, and, And then... You look at your ability
14:20
to mitigate it. And if your ability to mitigate it
14:25
Um, is sufficient, then do the mitigation, don't do the
14:32
patch or don't do the migration. And the reason is
14:35
because most vulnerabilities fall into the category of something that's
14:41
very easy to spot. So you can – or there's
14:45
a flaw. It's like PHP. It's been years and years
14:48
and years since there has been a flaw of this
14:50
magnitude or anything close to it in PHP core. Most
14:54
PHP flaws end up being in the modules or the
14:58
extensions that go along with it.
15:00
or in particular libraries, or in non-default configurations. And so
15:05
those are easy to mitigate. You just upgrade the library,
15:10
or you make sure that you're not using that Non-standard
15:14
configuration. It's sort of like NGINX. You know, they had
15:17
this big, huge NGINX vulnerability this past year. But most
15:21
of that fell down to – because you had –
15:24
this is actually a perfect example. So the NGINX vulnerability
15:29
came down to using – positional parameters in a regular
15:33
expression as a redirect. I always stay away from that.
15:37
You should never do it. No, it's the stupidest thing
15:39
ever. Positional parameters in a non-conditional redirect. Are you kidding
15:43
me now? Show title. No, Jack Leg is still leading.
15:51
So... That was the vulnerability. Well, that vulnerability got fixed
15:55
and then update to NGINX. Okay, so now you –
15:58
so you have two options to fix this issue. You
16:01
can either change away from and use named parameters and
16:05
not positional, which is like it takes 30 seconds to
16:10
make this change. Or you can schedule a downtime window
16:14
to upgrade your version of Nginx. Why would you do
16:17
the downtime? Right. You just get in there and just
16:21
fix the statement. And so this is the sort of
16:24
thing that most problems fall into that situation. category and
16:30
you can mitigate them by all sorts of other things
16:34
and you don't ever touch production in a destructive way.
16:41
I... The AI agent stuff has changed this game completely.
16:49
Yeah. Yeah. And so now this is not – I've
16:54
really changed my mind over the last few days about
16:58
this because what I was presented with was – I
17:04
just went through – first of all, I went through
17:08
and just turned all the – internet facing PHP sites
17:11
that I ran. I just turned them all off. Yeah.
17:15
and said, all right, we're going to do this one
17:17
at a time. Do we know if anyone got popped
17:20
on this? I haven't heard anything about it. I know
17:24
there – I've heard tons of people saying they're seeing
17:28
exploits, like Cloudflare and Amazon Web Services have both said
17:33
they're seeing exploit attempts. Mm-hmm. So I just turned everything
17:39
off according to what was being recommended because we didn't
17:43
have any details yet. Right. And the details were being
17:46
released at, what, 9 a.m. Central or something. And… So
17:52
I turned them all off and I was like, okay,
17:53
we're just going to fix this. As soon as the
17:55
patches drop, we're going to fix this easiest to most
17:57
difficult. And... The easiest ones were the Godcaster staging and
18:06
Godcaster production. because those were very recent launches. They were
18:12
only, you know, those servers were only like a couple
18:14
years old. And so they were still on, everything was
18:17
supported. There was no end of life anything. So as
18:20
soon as the patches hit, actually the hardest part was
18:23
just waiting for it. Ubuntu's mirrors to get the updated
18:28
package. Everyone was waiting for that. Yeah. Yeah. Yeah. So
18:30
as soon as those things hit our mirror, you know,
18:33
I just installed it, you know, cycled the server, done.
18:39
Then... The next hardest one was Podcast Index. Podcast Index
18:47
had three... internet-facing PHP sites. The two API front-end servers.
18:59
and podcasterwallet.com. But PodcasterWallet.com is still off. That virtual machine
19:08
is still powered down because I think we need to
19:11
have a discussion about whether it's still even needed. But
19:15
that's a different discussion. The two API front-end servers... Those
19:22
were running Ubuntu 20 LTS, which is end of life
19:27
now. And they were running PHP 7.4, I believe. So,
19:41
The... The most straightforward way to get up to date
19:45
on those was to – upgrade was to do a
19:51
release upgrade to Ubuntu 22, which is still in support,
19:55
and that would have a backported patch for PHP 8.2.
20:01
So I just put in a UFW firewall rule to
20:07
block all HTTP traffic. That way it could still boot
20:10
those machines up and SSH into them. And I just
20:14
did the regular Ubuntu release, do release upgrade script. Let
20:20
those – Did the first one, let it rebuild, as
20:25
is typical with Ubuntu when it comes up. And there's
20:31
a lot of things are – release upgrades are hard.
20:34
They don't – they break a lot of stuff. So
20:36
I had to go through and clean up a lot
20:37
of things. In the process, I lost the PHP FPM
20:42
configuration file. So I had to actually go into –
20:46
it had all the fine-tuning that we use, you know?
20:49
Yeah. Yeah. So I went into Linode and restored the
20:54
previous day's backup to a separate machine so I could
20:58
pull those config files off. Restored those. into saved a
21:07
copy of that, restored it into the first front-end server,
21:11
then powercycled that, then did the second one, updated everything,
21:15
removed the UFW firewall rule, opened back traffic up, and
21:19
good to go. Um, And so then those were good.
21:27
I turned, I decided to just leave podcaster wallet off
21:30
and, I had another server that I... um, that I
21:35
worked on, or excuse me, that I support for a
21:38
family member for their business, a backup and a backup
21:40
to that backup and a backup to the backup to
21:42
the backup. Exactly. Yes, exactly. I was like, um, you
21:48
know, this one's just going to stay off for a
21:49
couple of days. Uh, so I moved on. I did,
21:53
then I did, uh, Then I went on to my
21:59
– a couple of other servers that I manage. And
22:05
I will say in this, these were all, I was
22:08
bouncing back and forth. I had, I had agents going
22:11
all over the place. Yeah, I'll bet. And this is
22:15
all just side work while, you know, I'm also having
22:18
to handle my day job. That's the primary thing that
22:21
I'm, that I'm actually focused on. So I'm just this,
22:24
while that thing is working, I'm, I'm just sprinkling in
22:28
these other things at the same time as I can.
22:32
So I'll say that – One of the servers that
22:37
I manage... ended up It is a very complex configuration.
22:46
Um... And I'll be deliberately vague about it. It was
22:49
a very complex configuration and... It ended up being the
22:55
best way to get this thing patched was to move
22:58
it From one hosting company to I was going to
23:02
move this from one hosting company to another anyway. So
23:05
I'm like, I was going to have to build a
23:07
new VM regardless. So I was like, OK, I'm going
23:12
to go ahead and move. I'm just going to take
23:15
this opportunity to move this box from one host to
23:18
another. So I spun – I had the other ones
23:21
– the existing one was spun up with a UFW
23:24
firewall rule blocking all web traffic. Spun up the new
23:27
one in the new hosting environment. And I said, all
23:32
right, Claude Code, give me an SSH key that I
23:36
can put on both of these boxes. And It's going
23:41
to be a temporary key. I'm going to put it
23:43
in the authorized keys file on both sides. I'm going
23:46
to give you... Um, I'm going to give you the
23:52
IP addresses and the usernames of both of these boxes.
23:56
And I want you to get into the current box
23:59
that's going to be decommissioned, and I want you to
24:03
just do an extensive profile of this machine and tell
24:07
me everything in it that is going to have to
24:10
move to the new machine. And it chug, chug, chug,
24:14
chug, chug. It just did its thing for a while,
24:18
for an uncomfortably long period of time. And then it
24:20
came back and it was like, all right, I got
24:22
it. I know everything, and it listed every single thing
24:26
out. I did a review, looked at all the stuff.
24:31
Now this thing has got integration points with microservices in
24:34
different places. Microservices architecture. Yes. Yes, yes. It is a
24:40
complicated configuration. It's one of those snowflake servers that have
24:44
built up over – seven or eight years that you
24:47
make little tweaks to and then you never document you
24:49
know that kind of thing and you become very afraid
24:53
to touch it yeah yeah so it profiled all that
24:57
stuff out and it was like all right you ready
24:59
for me to go and i'm going to put all
25:00
this stuff on the new box i was like yes
25:03
go starts doing his thing, chugga, chugga, chugga, chugga. And
25:08
then – After about 45 minutes, it's like... All right,
25:14
you're up and running. And I was like, okay, so
25:17
I go and check it. It looked good. Things were
25:20
running. And then I start going through the checklist of
25:23
like, you know, what did what did you miss? And
25:25
of course, it missed a lot of stuff. But I'm
25:27
start going through the checklist and I'm like, you know,
25:30
you missed you know, you missed this service. You missed
25:32
this service. And it's like, OK, got it. Boom. Flip
25:37
it over. Yeah. And then I'm like, OK, you missed
25:40
you missed this one. It's over there. And I'm like,
25:45
okay, we split DNS. Okay, you need to change this
25:47
on this side, this on this side. And I'm like,
25:50
here, here's an API key for our web application firewall.
25:56
Make sure that it's properly load balanced. Done. So all
26:01
in all, this took about two and a half hours.
26:07
But it did it perfectly. Yeah. And now in the
26:13
process of doing this, it's now on everything is current,
26:18
on the most current release of Ubuntu, current release of
26:22
PHP. Everything has been updated. And I think this is
26:26
the gift in general. I had my own small version
26:29
of that because Freedom Controller was still running on a
26:32
relatively expensive box. then there was, you know, it's a
26:37
aggregator, which I really don't use anymore, but the aggregator
26:40
is still running, getting blocked everywhere because it's on a
26:43
Linode address. And, but it's still an integral part of
26:47
my publishing process. And, It's Dave Jones' PHP special under
26:54
the hood. Don't look. Don't look. With blowers coming through
26:58
the hood. And like, you know, it's time. And so
27:03
I wound up taking it offline and rebuilding it. The
27:07
functionality of the publishing in the OPML editor, I actually
27:11
wound up creating my own standalone OPML editor. Please tell
27:16
me that you have completely decommissioned Freedom Controller. Yes, completely
27:21
decommissioned. Hallelujah. Thank you, Jesus. Yes. God is good, brother.
27:27
And I'm serious about that because don't look at the
27:30
code. Nobody ever look at the code. The robot looked
27:33
at the code and went, why don't I just rebuild
27:36
all this? Yeah. Hey, Adam, I have a suggestion. I
27:43
know it's load-bearing for your systems, but why don't I
27:47
just rebuild all of this? Can we talk about this
27:51
for one minute? I had a little OPML editor that
27:55
I was using for my shows, and so I wound
27:59
up. Rebuilding it with the publishing process, the HTML rendering,
28:05
it's going to the object storage bucket, the redirector, all
28:10
of that stuff, all of that rebuilt. And the redirector
28:15
is now in AWS CloudFront. I mean, everything the way
28:18
it should be done properly. And it's I think it
28:23
gets shut down. I mean, it's off basically, but I
28:26
don't want to delete it because once you delete it
28:30
on Linode, it's gone. So, you know, let's just save
28:34
this for a bit and see if anything breaks, which
28:36
it hasn't so far. So it really was a wonderful
28:39
opportunity to just go and fix stuff that had been
28:42
on my list for a long time. You know, like
28:45
you with your – I needed to rebuild that thing.
28:48
So I think in a way it was also good.
28:50
You know, it's like I think everybody had a version
28:52
of that. Like, oh, you know, this crap I've been
28:54
looking at for so long. Let me just fix it
28:56
right this time instead of – if it was just
28:58
a patch, we all would have done patches. And now
29:01
it's like, yeah, we got to update, got to get
29:03
the right stuff. Yeah. And so to me, it was
29:07
super advantageous. So I'm kind of happy about that. But
29:10
I was praying for you, brother. And I mean that.
29:14
I'm like, ah. Well, yeah, there's another. There's a second.
29:18
So I ended up doing Grand Total ended up doing.
29:22
For... Of that. Yeah. For migrations, essentially, of a search
29:29
to just – because the server I was dealing with
29:34
was so end of life. Yeah. That it just wasn't
29:37
worth trying to patch that thing. And just once I
29:39
had that first experience with one of our mission critical
29:43
systems, I was like, okay, okay. This is doable. I
29:47
can do this. It's going to – each one of
29:49
these is going to take a couple of hours, but
29:52
pre-agentic, it would have – I mean this would have
29:55
taken me a couple of days.
30:00
customer who has video enclosures and we wanted to migrate
30:04
it over to RSS.com. And Alberto, bless him, man. He's
30:08
like, you know, this is good because we actually wanted
30:11
to do all this stuff. And he comes up with
30:13
this whole HLS video audio, which is exactly the way
30:16
it should be done. But we had a clock running
30:18
out. because this customer wanted to really migrate off of
30:22
pod beam and and now i knew you were because
30:26
you looked at the email alberto sent and you're like
30:28
uh okay this is not something i'm gonna be able
30:31
to do today and and so and and you know
30:35
the And all of a sudden, I went like, well,
30:38
why am I so stupid? I'm just going to spin
30:41
up a $5 Linode, little mini host, set in a
30:44
301 redirect, made a whole upload page, everything. So we're
30:49
safe. No clock running. And it took me, I don't
30:52
know, maybe an hour total. And I didn't do the
30:56
DNS. I didn't do the Linode setup. The agent did
31:00
all of that. I just directed it and said, you
31:03
know, why don't you connect that to op3.dev? So we
31:06
got some stats, put a stats button on there. And
31:09
it's like lifesaver, lifesaver. And it looks like magic. This
31:14
is the problem. It is sort of a problem, yeah.
31:19
We used to call guys that could do that, like,
31:21
wow, you're a code ninja. Ninja, warrior. Wizard. Wizard. And
31:26
so now it's like... You just do something. Then you
31:29
should go have a hot dog, walk around the block,
31:32
and then come back. And then, you know, stand over
31:34
the radiator for five minutes and look all sweaty like,
31:37
oh, I got it done for you. I got it
31:39
done, boss. It was hard, but I got it done
31:41
for you. Yeah. I pulled an all-nighter. I got it
31:44
done. Yeah. But that – the – The problem with
31:49
– one of the problems with my situation is this
31:53
hit – At a time in a day job when
31:56
I was already rolling out some servers. And so I
31:59
was middle. I was in the middle. I had hardware
32:02
strewn everywhere. Fiber channel switches half configured. And I just
32:07
had to drop all of that and, like, go all
32:11
in on this thing. And I finally got... I've only
32:17
got one. Well, Podcaster Wallet is the only one that's
32:20
left. Right. That's not been dealt with. But I, That...
32:28
That whole mindset – of don't patch mitigate, I just
32:36
don't really, I don't think it applies anymore. And it's
32:40
a little bit of a learning curve for me too
32:43
because I'm always let, I mean, I've got, I mean,
32:47
I mean, I've had – I have had up until
32:52
recently – servers running in production running Ubuntu 12. Yeah,
32:58
baby. I don't even know how old that is. How
33:01
old is Ubuntu 12? No. I'm pretty old. Let's see.
33:05
Ubuntu 12 LTS. When was that released? It was released
33:12
in April of 2012, 14 years old. Hmm. And you
33:18
just... You know, you just mitigate and you wrap it.
33:25
And, you know, my security sort of strategy is you
33:28
you wrap things in obfuscation first and then you firewall
33:33
off the obfuscated stuff to where you only have this
33:37
tiny exposure. Yeah. Basically, just the minimal attack surface necessary
33:42
to run this thing. And then you layer on top
33:46
of that all kinds of other stuff. Fail to ban.
33:49
Yeah. Cloud flare. Yeah. Yeah. Where if you add one
33:54
little act up and you're done, you're banned. Yeah. That's
33:58
my favorite. Fail to ban. Yeah. Boom. Bye. Bye. Eric
34:03
PP is right, though. The mitigation didn't work in this
34:06
case because this was exploitable with just a simple post
34:09
request. And that happens before your application even sees it.
34:17
Right. This all happens within – because it was –
34:20
the worst part of this was it was mod PHP
34:24
and PHP FPM, which actually inject themselves into – well,
34:31
PHP FPM does not, but – ModPHP injects itself into
34:33
the Apache process, so you don't even get a chance
34:36
to see it until you're already popped. And so that's
34:42
– and you can't block posts. You can block it
34:46
on some paths, but you can't block it because you
34:48
can't say, well, I'll put it behind authentication because –
34:52
You have post requests on login forms. So you can't
34:55
look at it. Yeah. This was unmitigatable. Yeah. And this
34:59
concludes this week's episode of Security Now with Dave Jones.
35:06
This. Yeah. I don't know. Not fun. I don't know
35:10
if you had a. A chance to see the video
35:12
I put on the Mastodon? of my vibe coded app?
35:19
No, it was two days ago. No, you didn't have
35:23
time. It's okay. So the so sorry, don't apologize. So
35:32
I told you that I vibe coded my own podcast
35:35
app, right? We went through that. Didn't we talk? Oh,
35:39
no, that's right. We didn't. So he didn't tell me
35:42
that. Oh, okay. So last week we talked about Google
35:46
Play now coming so you can share your vibe-coded apps
35:52
with your buddies without going through a full Play Store
35:56
process. Yes. And I think – you know, actually, I
36:01
think it was – Yeah, I think it was during
36:04
just before we started last week's boardroom. I I told
36:07
my robot, I said, OK, vibe code. I give it
36:11
one prompt vibe code. I didn't say vibe. Build an
36:13
app for me from I have Android. And here's what
36:17
I wanted to do. And it did it. And the
36:21
main requirement was. You need to connect to my Muse
36:26
robot because Muse has – I use that right now
36:30
exclusively for just my life stuff, you know, calendar, reminders,
36:34
to-do lists, you know, tracking bills, that kind of stuff.
36:40
And so, of course, there's, you know, a real –
36:44
You know, a connection between an app, a podcast app
36:49
running as, you know, sideloaded onto Android can't directly communicate
36:54
with Muse. So I did have to put a little
36:57
bridge server in between the two. Because, you know, Muse
37:00
does have restrictions. You think you could do everything, but
37:03
it's like, no, I can't create an API for you.
37:06
Oh, okay. Well, that's too bad. So, you know, it's
37:09
a server, and it, you know, it pings it and
37:11
sees what's going on. So I just want to be
37:14
able to talk to it, find me stuff. And so...
37:18
And I think I did at this point, I've probably
37:20
done 40 follow-up prompts for changes for new features, et
37:24
cetera. And so this for the so for a week
37:27
now, I've been living with this app, which tracks the
37:30
following calendar, free time, next event, location, home, car, church
37:34
made near you. What I listen to this week's no
37:37
agenda topics, my agents, show prep, stringers, track shows. What
37:42
news knows about my taste. And then there's different notifications,
37:47
15 minutes before a live show I follow. There's also
37:51
exceptions like I don't want to be notified of any
37:55
Joe Rogan episodes with MMA in it. But also I
37:59
don't. I'm not interested. But also there's certain podcasts that
38:04
only if something in the show is of interest to
38:07
me, it does transcripts on the phone itself. The full
38:12
thing, value for value, the funding tag, everything all built
38:18
in. And I mean, it has been so delightful. So
38:24
just today I've got Discovery, Bitcoin maximalist, the Rollo and
38:29
Slappy show. And it says, write in your Bitcoin lane.
38:33
Then I have, is socialism more Christian than capitalism? It's
38:36
a faith commentary show right at your faith plus economics
38:40
lane. Yeah. Here's another one. Halloween secular treat or spiritual
38:46
trap from stand firm and dark. I never heard these
38:49
podcasts. Indie Christian apologetics with real teeth and Halloween episode
38:53
lands eight days before. And then says podcast podcast weekly
38:59
review. Which I already subscribed to, but it says you
39:03
were mentioned several times in this one. So all to
39:09
say, and I know you have a couple of clips
39:12
from Pod News Weekly Review, as do I. Interestingly enough,
39:16
we both brought two clips from the same power show.
39:21
I wonder which one you got. You want to go
39:23
first? Or shall I go first? Uh, you can, why
39:29
don't you just play mine back to back? Cause mine
39:32
is just a simple commentary on what their guests said.
39:35
Okay. The video one first or the funnel. the video
39:39
then funnel don't do this gee it's not working we
39:42
tried it and look at where we are today so
39:44
there's no question i think it's 73 percent of podcasts
39:49
now have video yeah i heard this and i'm like
39:53
nah i don't think so well where is it play
39:57
the second one I don't think, I think Tom is
40:01
right. 73% are using this as a funnel, but that's
40:04
not exactly where they end up. Did he just glitch
40:10
out or something and just go 73s everywhere? 73s, good
40:15
buddy. I've never heard a statistic that says – 73%
40:27
of podcasts have video. That is not true. No, and
40:30
he's a professor, I believe, right? The Stephen Goldstein. Yeah,
40:34
where did he get these numbers from? Well, he's very
40:37
much a podcast industrial complex professor. So P-I-C-P-H-D. He was
40:46
very knowledgeable. I found to be extremely knowledgeable about amp
40:50
accords and download numbers and all the issues. And so
40:55
he was very knowledgeable about all of that. Very knowledgeable.
40:59
But then he and Sam took the... my favorite slur,
41:05
normal people, normies, to a whole new level of insanity.
41:13
And, of course, it's my own fault, but, you know,
41:17
Sam started talking about the podcast. He didn't even talk
41:23
about the podcast index robot, just about vibe coding things.
41:26
And so he obviously used the atom hat and took
41:30
out advertising as the example, whereas the example I'm trying
41:34
to show is look at all these new podcasts I'm
41:37
discovering. My robot is tracking what I have listened to,
41:41
literally what I have listened to, how much I have
41:44
listened to it because I feed that back into the
41:47
robot. And it's giving me great recommendations based upon that.
41:51
This is what, you know, when he talks about video
41:53
being used as a funnel. Yeah, I think that's probably
41:56
true. And it's also destroying podcasts because people wind up.
42:02
He says it himself. We have liquid content and people
42:05
will watch three clips of a podcast. OK, I've seen
42:09
the podcast. I don't need to watch it or listen
42:11
to it, which I think is very destructive. and maybe
42:16
not stoppable, but that's what I don't like about YouTube,
42:20
etc., is people clipping your stuff. So here's Sam with
42:23
the setup. Moving on a little bit then, Stephen, one
42:27
of the other guests on this week's show, along with
42:29
yourself, is Adam Curry, the podfather himself, and Adam's been
42:33
talking about vibe coding and agentic ai and he's been
42:37
talking about how fundamentally the the model of podcasting is
42:42
going to change in the future now he did say
42:44
it and you know being an app developer it was
42:47
like whoa but he did say that in the future
42:49
he sees personalized apps where he doesn't need a podcast
42:54
app from a company he will create his own version
42:57
to customize and tailor to his own needs but again
43:01
in the demo that he gave on podcasting to the
43:04
own with Dave Jantish he took an episode that did
43:07
have ads he got his muse ai to strip out
43:11
the ads to create clips of the best parts and
43:14
create a playlist. So he's doing the clip economy without
43:18
advertising, without apps, all in one. Is that the future?
43:24
Okay. So I don't know about I'm doing the clip
43:27
economy. I'm just trying to tailor my own experience, which
43:30
has just been wonderful with... You know, the way it's
43:33
doing chapters the way I want it, it's doing transcripts
43:36
the way I want it, everything the way I want
43:38
it. And, you know, someone else might look at this
43:40
app and go, boy, that's a mess, but it's the
43:41
way I want it. So that's up to me. You
43:44
know, the algorithm that I'm being presented with is not
43:47
developed by YouTube or by Apple editorial. It's me. It's
43:51
me. It's the stuff I'm doing. And so I like
43:53
it. But here's where the professor, I mean, what in
43:57
the world? Is that really the future we want? So,
44:00
first of all, he's super smart. Yeah, yeah, yeah. Bingo.
44:07
Just wanted to make sure we all heard that. Well,
44:09
he's super smart, and there needs to be people who
44:12
are thinking ahead. I have a very consumer-based feel on
44:17
things. I'm always starting with the consumer on. I am
44:20
the consumer. This is what kills me. I am literally
44:24
the consumer. I'm a consumer who wanted a different podcast
44:28
app experience. Always starting with the consumer on back. And
44:33
the consumer does not like friction. Everything that puts something
44:36
in front of them that's either a paywall or difficulty.
44:40
Or how about Microsoft Ribbon or things in a place
44:43
that I don't like them or features that developers out
44:48
of necessity have to implement in a certain way so
44:51
that everybody kind of gets what they like. That is
44:54
what I'm talking about. That is... is friction, he's only
44:58
thinking about paywalls
45:00
advertising is friction. No, friction is my own discovery journey.
45:05
And selection doesn't work all that well. And I think
45:09
about this thing. My wife, who is... Here we go.
45:14
This is the thing that kills me. I can't believe
45:16
he did this. This drives you crazy. It does. My
45:19
wife, my mom, my sister, my church friends, my this,
45:25
my that, they're clearly not like us. They are just
45:29
normies. Work all that well. And I think about this
45:32
thing. My wife... who is a Yale graduate in law
45:37
school. Oh, okay. It has nothing to do with education.
45:41
No, you don't have to have a law degree or
45:44
go to Yale. You're just dumb. You have no intuition,
45:48
you. Everything else. She does not want to mess around
45:52
with the settings on that iPhone. What settings? I just
45:55
spoke. I said, robot, make this for me. This is
46:00
not of interest to her. And so the notion that...
46:03
She's going to sit there and start curating her own
46:06
lists. No, you missed the point. I'm not curating my
46:10
own list at all. The robot is doing it for
46:13
me. So forth. It's just crazy. What she wants is
46:16
the stuff to be readily available when she wants it.
46:21
And certainly there are people who are... cognizant of that
46:26
all over the media so i don't know i do
46:28
i do know that the robot's getting smarter and that
46:32
the robot can do lots of things for us okay
46:35
now for a second i'm like oh he uses the
46:38
term robot this is good i do know that but
46:41
the professor is way check the calendar dude and i
46:46
am deep in in my own consumer way with chat
46:50
gpt and claude but i am not a coder i'm
46:54
not vibe coding i'm not doing anything like that because
46:57
you don't have to be a coder professor i understand
47:01
that the tools get smarter and we can start asking
47:04
for things And when we can make that all vocal
47:07
or just a simple command, I think, yeah, I think
47:10
that's possible. Okay, so what if that was possible already
47:14
and children and people around the world are already discovering
47:19
this? How long would it take before your wife and
47:24
Sam's wife and Sam's mom died? And your church people
47:28
will be smart enough to be able to figure it
47:30
out. But who knows? Yeah, I think it's 10 years
47:33
out. 10 years! Yeah! It's a decade away. It's a
47:36
little bit of a concept idea and somebody smart as
47:40
Adam Curry can do it, but... I don't think, as
47:42
you said, your wife, my wife, who used to run
47:45
MSN, is going to want to waste her time doing
47:47
that. Ah! This is what gets me nuts. Because that
47:54
is exactly where we are. Um, I'm going to disappoint
48:02
you in my partial agreement with this. Okay, okay. This
48:11
is the Gene's mom argument. Mm-hmm. And – So –
48:23
It takes – this irked you last show or the
48:27
show before when I mentioned my dad. Mm-hmm. And you're
48:32
like, oh, you're ageist. I don't know. Did I say
48:35
that specifically? No, well, no, you didn't say that. You're
48:38
the old guy. The old guy can't do it. So
48:42
I'm like, well, but see, the thing, this doesn't come
48:46
from just – This doesn't come from a stereotype. This
48:50
comes from actual experience. I know. Because there are people
48:55
in your life when you're like – Hey, I want
48:59
you to – hey, can you test the new Godcaster
49:02
mobile app for me? Yeah, sure. How do I do
49:05
that? Well, here, let me send you a test flight
49:07
link. Yeah, what's that? And you're like, oh, whoa, whoa.
49:11
Yeah, yeah. It's like, where do I put – do
49:14
I put in my – What password do I put
49:16
in? Well, you put in your Apple account. What do
49:18
I have an Apple account? Well, yeah, you do. I
49:20
got you. I got you. It's like an hour long
49:23
ordeal, you know, and then you and then you're like,
49:26
OK, this person's going to this person's going to somehow
49:29
vibe code their own podcast. No, my here's my point.
49:34
My point is you're absolutely right. My point is we
49:37
are now in the era of where Gene's mom rests
49:43
in peace. Gene's mom... We'll be able to do this
49:49
because there is a robot on the other end that
49:53
is helping Jean's mom through this. And saying, no, no,
49:58
no, here's what you do. Or it may open it
50:00
for her or do all these different things. We are
50:04
in the place. Where this conversation is about to be
50:08
outdated, not 10 years, 10 months, because I'm seeing people
50:14
around me all because of my incessant banging of the
50:17
drum. People are emailing me 30, 30 emails a day.
50:21
I thought you were crazy, but I've listened to you
50:24
for 20 years. I'm going to give it a shot.
50:28
Holy crap. I can't believe what I'm able to do.
50:32
And they've list these just incredible things they're doing. And
50:36
it was... We're so used to waiting for a development
50:43
team to add a feature or we get excited. Oh,
50:47
my gosh. The new version of XX is out. I
50:52
can't wait to see what they've done. This is the
50:55
change that is here. That's what I'm saying. And. I
51:01
am personally excited for podcasting because the most important thing
51:07
right now in this new world that we're going into
51:11
is the RSS feed. That is going to be of
51:15
super importance. Because you're going to watch everybody's numbers go
51:21
down. Apple, Spotify, everybody's numbers are going to go. Why
51:24
would I even deal with YouTube's algorithm? Why don't I
51:30
just, in fact, just before I started the show, I'm
51:33
like, I'm going to build an X app. That only
51:35
shows me stuff that I care about, that I'm interested
51:38
in, that I've been thinking about, that I've been talking
51:40
to my friends about. This is the change. We are
51:44
going to – the data source will be important always.
51:48
But the algorithms and the layout and the user experience,
51:53
we're going to be in full control of that. And
51:56
I really believe, yes, Gene's mom, rest in peace, will
51:59
figure this out much sooner than we realize. And I
52:07
also think that the whole deprecation of XSLT had something
52:11
to do with it. Oh, bring that around. I don't
52:16
know how. Well, XSLT is a beautiful machine readable format.
52:22
So let's get rid of that so that we can
52:25
protect our data sources in different ways. We don't want
52:29
you to be able to scrape our web pages. We
52:32
want you to go to our API or MCP server
52:35
or whatever. We want to have control over the data.
52:42
I'm more and more convinced of that. Bye. The we've
52:49
we've been through a version of this. Is the thing,
52:55
though, of trying to get people onboarded with, like, lightning
52:59
wallets and such. Very different. Very complicated. Okay, so let
53:05
me tell you about my journey with Bitcoin. with podcasting
53:15
agentically. So I told you over the past couple of
53:20
weeks I've been on this – mission however long it
53:25
takes to come up with a rock solid 100% foolproof
53:28
ad stripper. Mm-hmm. An ad stripper. That even sounds great,
53:37
doesn't it? Mm-hmm. We need to resurrect the Dvorak for
53:43
that. Ooh. Straight from Reseda, here she is, Raven. Give
53:49
it up. The ad stripper. Stage five. So this –
54:00
and so I can say that at this point –
54:04
It's about 95% accurate. And it got – so it
54:08
got to the point where it was just missing a
54:12
few things every now and then. And what I did
54:14
was – I'll tell you the process. I exported my
54:17
entire subscription list of which there's a mix of –
54:20
and I'm telling this story for a reason. There's a
54:24
mix of – Just regular old run-of-the-mill podcasts and then
54:30
private members-only podcasts that I pay for. So there's a
54:34
mix of both. I export them out into an OPML
54:38
file using handy dandy Cast-O-Matic. I throw it into the
54:42
agent, and I'm like, all right, look – All the
54:47
stuff I've been throwing at you now for this –
54:50
up until this point, it's really good. It's really solid.
54:54
Now I need to live with this thing on a
54:57
daily basis. And so that I can start finding the
55:03
edge cases. So that means what I want you to
55:06
do is I want you to here's a here's an
55:09
S3 bucket. Object storage bucket, I want you to make
55:13
a feed, and I want you to start looking for
55:16
new episodes. Anytime a new episode comes in, run it
55:19
through your new pipeline that we've got. So strip all
55:24
the ads out, put a chapters file in that denotes
55:29
the ad markers, and then I'm going to remove all
55:35
the podcasts out of Cast-O-Matic and only subscribe to this
55:39
one feed. So I'm essentially proxying my feed through the
55:43
ad stripper now, all my feeds through the ad stripper.
55:46
Okay. And then Castomatic has this awesome feature where you
55:52
can put keywords or key phrases into it. A chap
55:57
into a list, and if any of the chapters contain
56:01
that word or phrase, it will auto-skip the chapter. So
56:05
in that way, I can just have – I can
56:08
see just by looking at the chapters list what the
56:12
tool thought the ad markers were. And I can and
56:17
I can just play it. And if I ever hear
56:19
an ad leak through, I'll I'll be like, ah, you
56:22
missed one. That makes total sense. Yeah. So this is
56:25
now my process. And I've been living with it for
56:27
a few days. This thing has effed up. so much.
56:34
Like, I'm not talking about the ad stripping part. That
56:37
part was already fairly robust. No, it's stripping bits you
56:41
actually want to hear, likely. No, no, no. It just
56:44
can't get the feed stuff right. It keeps messing up.
56:48
The processes are crashing. FFmpeg is crashing. Hmm. Runaway processes.
56:54
It's putting weird things into the RSS feed. They're invalid.
56:58
The last three days, I've had to go back to
57:01
it four or five times and say, look, you know,
57:05
I'm not getting new episodes. And it'll, you know, chug
57:10
along and say, oh, yeah, you know, yeah, here's –
57:13
There's error in my script. I've updated it. I've fixed
57:16
it. Are you running this on Quinn, or what's the
57:19
model you're using for this? No, it's Oculus 5.5. Huh,
57:22
okay. We've got very different results. That's interesting. Well, this
57:26
is also a different result than I've had in the
57:29
past with doing stuff like this. And it's also not
57:34
– consistent with the results I just had using Claude
57:38
to do these server migrations. So, The reason I laid
57:44
all that out is because – If even one –
57:49
all it takes is one of these points of friction.
57:56
And you lose a person entirely because they just don't
58:00
even know what could possibly be wrong because they don't
58:04
understand any of this stuff already. And if it all
58:07
goes well and you one-shot everything, it's magic. If one
58:13
thing drops… And they're completely lost, and they've got better
58:19
things to do with their time. And I think that
58:22
is the sense in which I agree with what they're
58:26
saying. But I don't think it's an either or. I
58:32
think they are – I think there's – I think
58:37
they're expressing an understanding of human nature that makes sense.
58:43
But I also think that what you're saying – If
58:49
the trend continues in the way that it is going,
58:53
It's not going to be 10 years before stuff like
58:55
this might be possible, but it's not – I don't
58:58
know that it will necessarily be in 10 months either.
59:00
I mean I think the timeframe may be a little
59:02
bit longer. Well, why don't you send me your OPML
59:05
list and let's see if I can give that a
59:07
shot. Let's see. You may be overthinking it, actually, to
59:13
be honest. I don't think so. I mean, I'm pretty
59:18
good with this stuff. You're no good, Dave Jones. I
59:22
guess not. Is this it? Subscriptions.opml. Yeah. Let's see. So
59:29
you also want in-show sponsorship messages skipped? Oh, now are
59:37
you – what are you trying to do? Cut the
59:40
ads out or are you trying to – Well, that's
59:41
what you're building. Is that what you're building? Yeah, but
59:45
all that stuff – see, that's the thing. That part
59:47
of it works. Oh, just the regular mechanics that you
59:51
have problems with. It's the stuff that this thing has
59:55
struggled with. Huh, that's interesting. Is the –
1:00:00
is the basics of podcasting. Wow. How to... And it's
1:00:07
like – because one thing I said was like keep
1:00:09
the show art so I can tell the episodes apart.
1:00:12
I had to go two or three times to get
1:00:14
it right. It may be because my own – Corpus
1:00:18
of information is so filled with this stuff that I've
1:00:22
just trained it over two years time and it knows
1:00:25
enough. It's possible. I don't know. Yeah, I guess. Yeah.
1:00:31
Interesting. Okay, so the disagreement here is on the actual,
1:00:38
so even though it can patch servers and do everything
1:00:41
great, it's like some real basic RSS functionality it's struggling
1:00:45
with in your instance. And so that's why it may
1:00:48
not happen that fast. Yeah, and I think this sort
1:00:56
of mirrors my experience with this stuff in general is
1:01:05
that – And you get from time to time, you
1:01:09
can just get wildly different results. And I don't know
1:01:14
if it's because – The model providers end up sort
1:01:20
of like – Having a stupid model problem for a
1:01:23
while because I have – they do redirect inference to
1:01:26
training sometimes, and the models get stupider for a period
1:01:30
of time. So things like that do happen, and I
1:01:33
don't know if this is just like an example of
1:01:36
that. Could be. It could be. Well, that's a very
1:01:40
different experience than I have. Yeah, like I said, it's
1:01:44
a different experience than I've had. Yeah. I can go
1:01:47
from – that's the thing. The inconsistency is a real
1:01:51
problem because you can go from – you can have
1:01:54
one day this thing just blows your mind, and the
1:01:57
next day you're like, man, how did you miss that?
1:02:01
Yeah. Yeah. Yeah, no, I, okay, fair, fair point. I
1:02:06
just haven't had that experience. My experience is, first of
1:02:11
all, help me fix my start nine server. Okay, hook
1:02:15
it up to tail scale. Let me root around. Okay.
1:02:20
I got it. Here's what you got to do. You
1:02:22
definitely want to back these things up because that could
1:02:24
break. And so we went to a big release 4.0,
1:02:27
which has a wire mesh and all kinds of stuff
1:02:31
in it. But I'm just going to use tail scale.
1:02:34
And I said, you know, I'm so tired of... You
1:02:37
know, on my phone, like opening up through Tor, start
1:02:40
nine and then going to Albi Hub. Just give me
1:02:44
an app that has Albi Hub, Helipad, you know, these
1:02:47
five apps. And it did it. And, you know, out
1:02:51
of the box, worked perfectly. uh, you know, exactly what
1:02:54
I want. I can check my Albi wallet. I can
1:02:57
check my helipad at any time within seconds on my
1:03:00
phone. It's just, you know, so that, okay. Yeah. I'm
1:03:06
not Jean's mom. Cause she's dead, but, um, I know
1:03:10
Jean's laughing. Um, um, But we are so close to
1:03:14
this. And then you know that Gemini is going to
1:03:18
be completely integrated throughout the phone. Throughout the phone. It
1:03:22
already is. With the Play Store for Buddies, you know,
1:03:26
your Barbie Play Store that you can share your little
1:03:30
vibe-coded apps with. What will be interesting is... What will
1:03:33
Apple's response be? Because those guys like to control the
1:03:38
experience. What will anyone's response be? What will our own
1:03:42
app developer's response be? I mean, there is so much
1:03:45
going on. My mind is boggled. I get this. You
1:03:50
seem boggled. Yeah. With excitement, really. Yeah. So once he
1:03:58
talked about friction, he said that consumers – that word
1:04:06
bothers me. People who buy stuff? Yeah. Consumers don't like
1:04:12
friction. Yeah. I don't necessarily disagree. But we've forgotten what
1:04:20
friction we actually go through. The friction we have with
1:04:24
interfaces. This is why Omarchi was interesting. I'm getting everything
1:04:30
out of the way. All the stuff that was friction
1:04:32
in your life, but I'm now removing. And you don't
1:04:35
like it? Tell your robot to fix it for you
1:04:38
right here in the operating system. You know what friction
1:04:42
is? 50% ad load. Yeah, well, yeah. But that's not
1:04:47
the biggest friction. But, yeah, I think the friction is
1:04:51
look at this inbox. Look at all these unlistened to
1:04:54
episodes. Oh, my Lord. You know, my robot's like, hey,
1:04:57
Adam, you're driving to Austin. Hey, here's a couple of
1:04:59
podcasts that will fit that hour and 20 minutes perfectly.
1:05:03
You want to listen to this, this and this or
1:05:04
this, this and this? Well, James in the most recent
1:05:08
episode said he did not cover a podcast app because
1:05:11
it was an ad skipper. It's virtue signaling. Maybe. I
1:05:16
don't know. You've been cricklered. But the – You know,
1:05:23
the thing about it is the – We all understand,
1:05:30
and he said in that episode, and that's his prerogative.
1:05:34
Of course. It belongs to him. Of course. It belongs
1:05:36
to him. He can do it every one. I'm fine
1:05:37
with that. But he said in that episode that we
1:05:41
all – he said that we all know that the
1:05:45
podcast advertising – The agencies and the advertising complex doesn't
1:05:52
give a shit about independent podcast apps. They don't. They
1:05:57
don't. And he said he went one step further and
1:05:59
said, as a matter of fact, they don't just they
1:06:02
don't just not care. They would like it to just
1:06:06
be. Apple, Google, excuse me, Apple, Spotify, and YouTube. They
1:06:11
would love that because that simplifies the stuff they have
1:06:14
to do. But this is the beauty. This is what
1:06:17
– and I'm sorry for app developers. I love all
1:06:19
of you. You know that. Everyone complained, well, the app
1:06:22
developers get no money. Guess who also gets no money?
1:06:26
Dave Jones gets no money. Dave Jones gets no money.
1:06:28
You know, we are so I heard I had to
1:06:30
hear on on power that we're celebrating our sixth anniversary.
1:06:34
I didn't even know it. Happy anniversary. Happy anniversary. Yeah.
1:06:37
Happy anniversary. So the index. We only have the money
1:06:41
to keep the index running if the biggest hosting company
1:06:45
stops supporting us. And we could probably eek by, but
1:06:51
I don't think we make $800 a month from the
1:06:55
smaller donations. We might have to – what? I'm sorry?
1:07:02
No. No. So, you know, we'd have to kind of
1:07:04
throttle stuff. So we don't make any money either, you
1:07:06
know. So – and 22,000 accounts are using the API.
1:07:13
Apple, Microsoft, Google, do they support us? No. No. Free
1:07:17
loaders. Free loaders. You know, so – So I'm speaking
1:07:24
on behalf of Podcast Index, and I am delighted, delighted
1:07:30
that the power is going to leak like green sludge
1:07:35
away from Apple and away from Spotify because people will
1:07:42
start to figure this out. I don't need to. And
1:07:45
this is why RSS is so open. Open RSS. It
1:07:49
is fantastic. You know, this guy was talking about liquid
1:07:53
content, this professor. Yeah, we're doing it all wrong. Yeah,
1:07:58
your content should be everywhere. So I'm going to use
1:08:01
everybody's API and upload to every stupid platform everywhere where
1:08:06
the inverse is the right way. One feed, I control
1:08:11
it. Anybody can ingest that. That's the system. That's the
1:08:16
system that is coming back to us now. This is
1:08:19
why I'm excited. Well, if... I agree with you. It's
1:08:29
RSS – RSS is the backbone of everything in the
1:08:37
podcast, in the independent app world. And anything that bolsters
1:08:44
that strengthens apps just by default. But, you know... I
1:08:52
guess maybe from the outside I seem like irrationally hung
1:08:57
up on this advertising thing. Like – but I feel
1:09:01
like – If the advertising industry does not care anything
1:09:09
about independent podcast apps, and I can tell you from
1:09:12
firsthand experience, they do not. And if that's the case,
1:09:19
Then why does it matter? Why does it matter if
1:09:23
you strip ads or not? If they don't give a
1:09:25
crap about doing anything to help independent podcast apps flourish,
1:09:31
and all they care about is YouTube, Apple, and Spotify,
1:09:36
then they're not going to do it. Then get rid
1:09:38
of all the ads. And the argument could be –
1:09:42
the argument from the other side is, well, if you
1:09:45
get rid of the ads, you're hurting creators. The advertising
1:09:49
industry doesn't give a shit about creators either. And welcome
1:09:53
to the new world. A minimum of 10,000 downloads to
1:09:56
even qualify? Welcome to the doom loop. This is the
1:10:00
entire problem with agents in general. Agents are giving you
1:10:04
news that they are pulling from the literal sources –
1:10:08
That give them the news in the first place. They've
1:10:10
admitted this privately in emails that came out like, hey,
1:10:14
we're sucking all this stuff out of the New York
1:10:16
Times. They're going to go broken. We won't have any
1:10:18
news. It's unavoidable. It is. It is completely unavoidable. Because
1:10:25
we have the power. We have to come up with
1:10:28
entirely new ways of news gathering, news distribution. Everything has
1:10:32
to be rethought. Everything. And this is what I find
1:10:35
exciting because in chaos, there's always opportunity. I was... I
1:10:44
was struck by one of the things that they were
1:10:47
talking about on Power, which is the funding tag. And
1:10:50
how Spotify's recent announcement, they just showed off opening up
1:10:56
a web view in the app and paying attention. And
1:11:01
so I think that they're right. That should be a
1:11:04
signal to everybody. Don't be afraid to put this in
1:11:07
your apps. Open the funding tag. That's your solution. The
1:11:14
solution is not to clutch to advertising into dynamic ad
1:11:19
insertion with your fingernails as it's pulled away from you.
1:11:26
The solution is put the funding tag in your app
1:11:29
and tell your audience in the episode, please go and
1:11:33
donate. And please support us because if you don't, we
1:11:36
won't be able to eat and we won't be able
1:11:37
to do this show anymore. That's just the way that
1:11:40
it always works. Well, you know, the ultimate solution, funny
1:11:45
enough, is for the apps to start selling ads. There
1:11:49
you go. They get blamed anyway. Well, Overcast does. He
1:11:54
sells ads right in the app. Yeah, but not in
1:11:56
the content. There's not like a pre-roll or a post-roll.
1:12:01
Like a banner on the thing or whatever. Yeah. Yep.
1:12:06
I mean, I don't really have an answer. I just
1:12:10
want to get it out there. I remember when podcasting
1:12:13
first started, I had the same excitement. I didn't know
1:12:16
exactly what was going to happen. And the professor, by
1:12:20
the way, is pretty funny. You know, when podcasting first
1:12:22
started, it was deep thoughts. People were doing deep dives,
1:12:26
deep thinking. Like, no, we weren't. We had Don and
1:12:28
Drew talking about their life in a farmhouse, you klutz.
1:12:32
We had Michael Butler, the rock and roll geek, drinking
1:12:35
a six-pack, talking about how shitty the gig was. That's
1:12:39
what made it awesome. Not the deep thinkers. You've always,
1:12:43
you've made, I heard this the other day. I heard
1:12:47
a perfect example and I was telling a friend of
1:12:49
mine, I was like, I was like, Adam always says,
1:12:53
has always said that people say things on podcasts that
1:12:58
they would never say in mainstream media. For sure. Because
1:13:01
they think that it's somehow like a secret club. Not
1:13:05
very many people listen to it. But when in reality,
1:13:09
the listenership of podcasts way outstrips broadcast media now. Sure
1:13:13
does. But they still think that it's some sort of
1:13:16
like kind of off the record. And it's hilarious. And
1:13:21
that's kind of what podcasts – but I think it's
1:13:24
because it goes back to the early days of podcasting
1:13:26
when it kind of was off the record because it
1:13:28
was so small. And people could say – they could
1:13:30
get away with saying something on a podcast. They wouldn't
1:13:32
say it everywhere else. So everybody wanted to go listen
1:13:35
to podcasts to get the real dope. Yes. Our worlds
1:13:43
are about to be rocked. And so everything has to
1:13:47
be rethought, everything. And I could not be more delighted.
1:13:53
It is, you know how they were like, we got
1:13:56
to slow it down. We got to slow down development.
1:13:59
We can kill the whole world. 10% will be white.
1:14:02
No, they realized a little bit before I did that
1:14:05
they are in trouble. Nobody needs them anymore. The horse
1:14:10
is out of the barn. The train has left the
1:14:13
station. The revolution. Viva la revolution! It's here. It's here.
1:14:21
Huh. We can't use BitChat in our burning down buildings
1:14:25
protests in France. No problem. I'll just vibe code or
1:14:28
give it to my buddies. We'll use Bluetooth. You can
1:14:32
go ahead and take it off. Who needs Venmo? You
1:14:36
watch This is going to be an amazing time. I
1:14:40
wish I was 20 years younger. See, I just... I
1:14:48
can't. I can't. I can't. I can't. I can't go
1:14:50
there. I can't go there. I can't go there because
1:14:53
I just go there. There's the cynic inside of me.
1:14:58
What is this? I mean, I'm.
1:15:00
I'm interested in the cynic inside of you. It's why
1:15:01
we're such a great, we have such a great partnership.
1:15:05
Yeah. My cynical side just looks at every – It
1:15:11
looks at all the other times I've gotten excited about
1:15:13
the future that a technology promises and how every time
1:15:17
my hopes have been crushed. Yeah. Remember when, quote, programmable
1:15:26
money was going to free the world? Yeah. No. It
1:15:29
was – No. Well, the jury's still out on that.
1:15:33
I mean, the forces behind money are vast. There's a
1:15:38
clip that I played on this show – of Obama
1:15:42
from 2012 When he said something to the effect of
1:15:48
it was like a commencement speech and he said the
1:15:52
idea that you can regulate speech on the internet is
1:15:57
crazy or something like that. And... And then just a
1:16:03
few years later, what are we doing? Regulating speech on
1:16:07
the internet. I mean, like, it was – that was
1:16:10
– he said that during the time of like Aaron
1:16:13
Schwartz and all that stuff going on. And then everybody's
1:16:18
like, yeah, yeah, I'm going to change my Twitter avatar
1:16:21
to be black. Yeah. you know to protest there you
1:16:29
go 2012 I think this is it I know that
1:16:32
not all countries in this body share this particular understanding
1:16:36
of the protection of free speech we recognize that but
1:16:39
in 2012 at a time when anyone with a cell
1:16:44
phone can spread offensive views around the world with a
1:16:48
click of a button. The notion that we can control
1:16:51
the flow of information is obsolete. Yeah, and what did
1:16:56
they try to do immediately is control the flow of
1:17:00
information, and they're doing it. Well, but they're going to,
1:17:03
that's okay. Yeah. But I, I still believe in the
1:17:06
core network protocol. I mean, I think some things. DHT.
1:17:15
There's so many different ways to get around. We just,
1:17:18
this is my job. My job is to be early.
1:17:21
My job is to see the possibilities, to stick it
1:17:24
together with Scotch tape and Elmer's glue. and see if
1:17:30
it takes off. And a lot of things just say
1:17:32
balls of scotch tape and Elmer's glue. But this time,
1:17:36
I think there's something here. And it's all about what
1:17:40
people are trained to think. And we've been very trained
1:17:46
to... use the systems devices applications etc the way they've
1:17:53
been handed down to us whoa that's my daughter hold
1:17:57
on a second hold on yeah you need to get
1:18:01
it yeah hey babe can i call you right back
1:18:04
Uh, sure. Yeah, I'm doing the podcast with Dave. Oh.
1:18:10
Yeah. Yeah. Well, 10 minutes. And that's good. Okay. Love
1:18:18
you. All right. Bye. Bye. Love you, too. It's grandbaby
1:18:23
time. Let's show off the grandbaby. Yeah. Fire up the
1:18:27
screen. Hold her up. Exactly right. All right. We can
1:18:31
thank some people so you can get out and see
1:18:32
your grandbaby. Well, thank you. Let's see. We have –
1:18:36
and everything's working again. I got the Start9 working. It's
1:18:40
beautiful. Thank you very much. I think Eric PP has
1:18:42
a monster channel open to me. I love it. Thank
1:18:46
you, brother. 777 sats from Sam over there at TrueFans.
1:18:52
He says, I don't disagree with Adam. Maybe the future
1:18:54
is personalized apps that tailor the experience to you, but
1:18:57
we have all seen the initial hype around new technology.
1:19:00
Oh, geez. I need your camp. And the subsequent time
1:19:02
lapse before mass adoption. This is Jeffrey Moores crossing the
1:19:06
chasm. Yes. I like that. This is a book. Is
1:19:10
that a book? Crossing the Cousin? Yeah. Yeah. Okay. Three
1:19:13
threes from Eric PP. Hashtag release the code. What code
1:19:19
do you want me to release? I'm happy to release
1:19:22
it. All of it. Release the code. Release the code.
1:19:25
Okay. 1701 from Martin Lindeskog. Adam, here's a new word
1:19:28
to pronounce. pronounced in Danish and Swedish. Orisund, Orisund, Orisund
1:19:32
and Orisund. It is our new hyperlocal podcast, Orisund 360.
1:19:36
Hosted on TrueFans.fm. Dave, thanks for the help with Podcast
1:19:40
Index. Starship Boostergram, 1701 Satoshis. 3,333 from Eric PP. From
1:19:47
Boost Me Bitch, it works. 1276 from Salty Crayon. In
1:19:52
the boardroom, Adam, talk about podcasts. An idea for Dana,
1:19:54
Dana Brunetti, after the 29th. A podcast where he just
1:19:57
talks about... talks, and leaves all the bathroom breaks in.
1:20:00
Call it gummies and dog farts. All fun, of course.
1:20:03
I don't know about that name, but that would be
1:20:05
a fun podcast. Very relevant to the show we did
1:20:07
yesterday. Salty Crayon, again, with Triple Threes. Is this thing
1:20:12
working? Why are you roughing? And there's Comics Your Blogger
1:20:15
with a delimiter. So you're up, my brother. Why you
1:20:19
are laughing? I fixed my AIFF problem. Don't laugh. Why
1:20:27
you are laughing? Shut up. Shut up. Yes. Shut up.
1:20:35
I fixed it. I fixed it. Nice. The consensus is
1:20:40
the Currycaster 2 is what they want released. Yeah, I
1:20:43
shall release the Currycaster 2. I will release it, of
1:20:45
course. Call it the Kraken. Although I already had... I
1:20:51
forget who it was. Buddy, buddy, buddy, buddy. He says,
1:20:54
hey, man, I took inspiration from you and vibe-coded a
1:20:58
curry caster for video based on what you built. It
1:21:02
looked the same. It's the same thing with video. He
1:21:06
just took a picture and built this for me with
1:21:08
video. Okay. Yeah, but we can't do an RSS feed.
1:21:16
Here's some PayPals. Cohen Glatzbach, $5. Thank you. Appreciate you,
1:21:21
brother. Christopher Reamer, $10. Thank you, Christopher. James Sullivan. Hey,
1:21:26
James, $10. Jorge Hernandez, $5. Jorge Hernandez, been around forever.
1:21:32
Yep, Michael Goggin, $5. Thank you, Michael. And just a
1:21:35
little bit of something extra from Buzzsprout, $1,000. Baller, shot
1:21:40
caller, 20-inch blades on the Impala. Thank you, thank you,
1:21:45
thank you. Thank you, thank you, thank you. Tom. Tom
1:21:49
Rossi texted me last night. He's like, you okay? You
1:21:52
alive? Oh, sure. Well, he knows. He understands. He gets
1:21:55
it. The, yeah, let's see. PHpocalypse. Yes. What was that?
1:22:03
What was that? Flawlosophy? Yes. Yeah. It doesn't roll off
1:22:07
the tongue very easily. No, it's some reason I can.
1:22:10
Jack leg is better. Jack leg. Jack leg. Jack leg
1:22:13
is good. I got some true fans. Anonymous is flowing
1:22:18
in. 39 sats, 406 sats, 13, 220 sats. 7, 4,
1:22:23
0, 6, 13. Oh, we got a Dreb Scott. 774
1:22:28
sats. He says, anyone else? Wait. Why is this? Is
1:22:33
this old? What are you looking at? Uh... Maybe this
1:22:40
is old. I thought it just produced it. I don't
1:22:43
know. Let me check. Let's see here. Refresh. Am I
1:22:49
getting a cash? Uh-oh, uh-oh, we're in the cash. We're
1:22:53
in the cash, everybody. Sorry, I just... No, it's okay.
1:23:01
I just barfed. You do you, boo. 1023. 1023. Oh,
1:23:09
yeah. Okay. Here it is. Here it is. Yeah. Yeah.
1:23:11
I was I was looking at the wrong thing. Sorry.
1:23:13
Oh, there's Boobery. Okay. So Boobery. had a message lost
1:23:20
last week. Oh, no. It must have just been slow
1:23:23
coming in or something because it was not on my
1:23:25
list last week. But we did have some anonymous true
1:23:28
fans of 406 and 33. Then we got Blueberry. Blueberry.
1:23:33
Blueberry. The Fountain is $35,127. Woo! Bola! Yeah, baby! Chicago!
1:23:40
20-inch blades on the Impala. Yeah, we'll take it. We'll
1:23:43
take it. Thank you. That's why he wanted you to
1:23:45
make sure he got it because it was real money.
1:23:47
Yeah. Eric PP has given the split kit some major
1:23:50
upgrades this Saturday at 7 p.m. Central. We've been working
1:23:54
on bringing OSC and NDI to the table, and it
1:23:57
works now. What is OSC and NDI? I have no
1:24:01
idea. OSC and NDI. I don't know. Well, they put
1:24:05
them on the table and it works. Excellent. When we
1:24:08
stream live at www.pixelpalace.party, there are camera scenes that the
1:24:14
producer will be able to select and change live and
1:24:17
did not require a boost to trigger. Ooh. There's also
1:24:20
lighting cue stacks and triggered video content from SplitKit via
1:24:25
OSC. OSC and NDI have joined the battle. Nice. Okay.
1:24:31
Those must be some sort of like lighting and camera
1:24:33
things because Boobery, that's his – he was like a
1:24:39
– A lighting stage lighting guy. That was his job.
1:24:43
Yes, indeed. Yeah. I don't know what any of that
1:24:47
is, but it's awesome. anonymous from true fans 578 48
1:24:51
551 oh brian from podcast guru 551 says it's for
1:24:56
dave's buzz brian in fresno take your buzz get get
1:25:02
this though I have not touched that cable. It is
1:25:06
still routed the exact same way. Not a single buzz.
1:25:08
Not a single buzz. Now, I have an Echo, but
1:25:09
otherwise, great. Do I still have the Echo? Yeah. Yeah,
1:25:17
you do. Maybe it's the cable. Maybe it's manifesting itself
1:25:21
this week as an echo. Could be. User 940 blah,
1:25:25
blah, blah, blah at fountain.fm, 1,673 sats. Thank you, user
1:25:30
940 blah, blah, blah. And comment's your blogger, 10,556 sats.
1:25:34
There he is. Howdy, Dave and Adam. Despite knowing that
1:25:38
I am agnostic, Adam's pastor has followed me on x.com,
1:25:42
so I have reciprocated his follow. And as thank you,
1:25:45
I would like to recommend, please follow at Jimmy Pruitt
1:25:49
on x. And by the way, Adam, tell your robots
1:25:52
to add Podcasting 2.0 chapters to your podcast with the
1:25:56
pastor. Yo, CSB, Disgram. was $15.50. 19,000 sats went sent
1:26:04
on 23rd October. Beautiful. Thank you, comics or blogger. And
1:26:08
thank you, everybody who supports podcastindex.org. It's value for value.
1:26:13
Whatever you get out of it, you 22,000 leechers, consider
1:26:18
supporting us. Five bucks. Imagine if all those 22,000 people
1:26:24
gave us five bucks a month. Just imagine. We'd be
1:26:28
quitting our day jobs. Only imagine. Okay. The musical stylings
1:26:36
of Dave Jones, backup for Mercy Me. Yeah, beautiful. I
1:26:40
think it's mostly lack of sleep. Yeah, I know. And
1:26:43
you know what? We'll... You'll get into a better vibe.
1:26:49
How early are you waking up these days? 6.30 every
1:26:52
day, 6.30. Okay. I don't know. My body is in
1:26:56
this weird thing. This is pre-PH-Polocalypse. I'm like 4, 4.30.
1:27:04
Yeah. Ooh. Yeah, I know. It's in a rut. I'm
1:27:08
in some kind of rut. I got to get out
1:27:10
of that rut. And what time do you go to
1:27:12
bed? Like 10. Yeah. 10, 10. Yeah, we go to
1:27:17
bed at 10, 10. 10. Yeah, you just – it's
1:27:20
like you – six hours is okay, but it's like
1:27:23
as it rolls on day after day, you start to
1:27:25
kind of like – you drag, you know, like one
1:27:30
and then one day hits and you sleep like 10
1:27:32
hours. Mm. Yeah. Yeah, do I know the feeling, brother?
1:27:37
I know the feeling. Go FaceTime with your grandbaby. Well,
1:27:40
she just said, oh, she's sleepy. Might have to do
1:27:43
it later. Like, here I am, cutting off the board
1:27:45
meeting. Cutting off the board meeting. I have no idea.
1:27:50
I feel guilty. It's my response. It's my response. fault.
1:27:53
No, no, no. That took too long trying to find
1:27:55
the booster grass. This is our contribution to society. This
1:28:00
is my volunteer work that you and I do. This
1:28:05
is volunteer. We do it. Leachers, 22,000 leachers. We see
1:28:09
you at Apple and Microsoft. Jack-leg leachers. Jack-leg leachers. chairs.
1:28:14
There it is, everybody. Okay, thank you so much. Dave,
1:28:17
have a great weekend, brother. See you, bro. All right,
1:28:19
everybody. Thank you, board room. We'll see you next week
1:28:22
here on Podcasting 2.0. Music You have been listening to
1:28:41
Podcasting 2.0. Visit podcastindex.org for more information. Go podcasting! And
1:28:51
it chug, chug, chug, chug, chug. It just did its
1:28:53
thing.