Why are we still using RegEx?

Samuel Hill
Hello and welcome to Mind What Matters, the show where data security meets real talk. We're here to unpack the big stories, the hidden risks and the curious moments from the world of cybersecurity, all with a little dash of fun. Whether you're protecting data in the boardroom, the cloud or just your phone, we're here to help you mind what matters.

My name is Samuel Hill, and with me as always is Landen Brown. Landen, how are you this week? What is on your mind?

Landen Brown
I'm fantastic, Samuel. I appreciate you making the time again this week to host Mind What Matters.

On my mind this week, we as a team had a really big travel week last week for our QBR up in Bozeman, which is where you live, Samuel. So you were probably preparing for this more than most. But we got to do a lot of really fun things. We got to get together as a team. We got to eat good food. We got to hang out at our fellow team members' houses, which is always a little more intimate and a team-growing experience.

We also got to go fly fishing. We got to ride some motorcycles. It was probably one of the most adventurous QBRs that I've seen to date.

Samuel Hill
You know, I was going to say the same thing. That's what's on my mind this week as well.

I have been to a lot of quarterly business reviews, QBRs. I'm sure you have, and I'm sure many of our listeners have attended their fair share. Some of them are memorable for all the wrong reasons. The business performance is not quite where you want it to be, so there's just an extra level of stress. Or the happy hour is less than happy for someone at the end of the night who may have overconsumed. Or maybe the accommodations and the food are not exactly what you would want to remember.

But no, it was a wonderful time. It was great having everybody here in my hometown, where I live, and getting to experience a lot of the fun and the best things that Bozeman has to offer. It speaks a lot to the people who came as well, who were just willing to roll with it and get random rides and pickups from the airport instead of getting Ubers and things like that. A good time was had by us.

So you said it was your first time fly fishing. You live in the Rockies too. You live in one of the fly fishing capitals of the world. Why was this the first time?

Landen Brown
Yeah, you know, I think when you have an active family that does a lot of hunting, and hunting itself is a big pie chart of all the different types of hunting you could do, from deer hunting to elk hunting to bear hunting and coyote to ducks and pheasants and grouse and all the different things, and then you have fishing, which is its own realm and its own massive pie chart of things to do and things to master.

I can say that I've never, one, been a fan of lots of seafood myself. And I think if we're going to hunt and something is going to grace us with its life for food, then we should definitely eat it and honor it in that way.

So one, there were just a lot of different focuses in hunting land animals. And I think the other is, if I'm not going to eat it, I'm not going to catch it.

At the QBR, we got to do a lot of catch and release. We had a guide there helping us with a lot of the setup and the netting and a lot of the things that bring down the barrier to entry for a first-time fly fisher. And it was amazing. We floated the Yellowstone River for, man, I have got to say five or six hours. It was nothing but absolute peace.

A storm came in about three-quarters of the way through, so we got to experience rain and wind and a tiny bit of choppy water on the Yellowstone River. But man, it was a blast.

I can say, though I've never been a big fly fisher, I think it's something I would do again for sure. Maybe we'll have to come up to Bozeman more often for it.

Samuel Hill
You know, and it's just something else that you could spend your hard-earned money on. There are plenty of stores that'll take hundreds and hundreds, if not thousands, of dollars from you on gear that you may or may not need. None of it will help your casting and getting the fly in the right spot. That's up to you. That's technique.

Landen Brown
That's right. Well, my wife will love to hear that there's another activity we get to spend our money on. So I'll pass it along.

Samuel Hill
There you go.

Hey, Landen, let's jump into some of the hot topics from this week that we want to talk about. We're going to Mind the Headlines here as we get going.

And the first one, I'm really curious about your take on this. It was some big news that hit across the wires today. It was about Nvidia making a very large investment in something I did not see coming, to be honest with you. Nvidia investing a cool five billion, Landen, I know, with a B, five billion dollars into one of their direct rivals, Intel.

What does this tell us about the AI arms race in our world today?

Landen Brown
Yeah, you know, I think depending on who you are, this either caught you like a left hook or you saw it coming from a mile away, and I can't really decide which one of those people I am.

But it is absolutely breaking news to see that Nvidia, who has been competing with Intel over the years, along with the other players, is now starting to form somewhat of a strategic partnership.

And I think, geopolitics aside, it does make a lot of sense in our country when we look at the lack of chip development and the areas of the world that we're really siloed to in terms of where we get those chips. It does make a little bit of sense why Nvidia, who would require a separate architecture for some AI systems during the AI arms race and for some computer architectures, would do this. Even for Nvidia to excel, they have to have some backbone and infrastructure to run off of as well.

So it does make sense strategically for Nvidia to do this, especially with the moves that we've seen with the US investing some dollars in Intel as well. It seems like what we can tell is that the US is taking this seriously. The US is saying, hey, there are too many single points of failure in the world where not just America, but the entirety of the Western and some of the Eastern portions of the world, may be cut off from chips should something go tragically wrong.

I find it really interesting. I also think there is an increasing need for CPU architecture. We've spent a lot of time as an industry talking about parallel operations that GPUs provide. That's really the spawning and the birthplace of machine learning and artificial intelligence chips and chip design.

But there is still a world where linear computation is best driven, and I think that is potentially one of the areas where the US and maybe Nvidia are seeing the writing on the wall, that parallel chip architecture is really important, but there is still a world and a need for these linear operations that are more CPU-driven, where Intel plays a serious critical role.

Samuel Hill
Yeah, just the raw horsepower sometimes that you have to apply to a really complex linear process. And obviously Intel has excelled in that. Their x86 architecture, I think it's a stay of execution, if you will. The rumors of its demise are now greatly overstated.

Intel is now sitting with 15 billion dollars of recent investment, both from the US government and now from Nvidia. It's fascinating. And I think this really shows the AI innovation arms race is not over yet. This is a pretty interesting development. So I'll be curious to see how that goes and how Intel does.

The clear point, though, is the big loser is AMD. What are they going to do now? How do you compete in that space? But I'm sure they'll find a way. I'm sure there are some smart people there who will try to figure it out.

The next one on the docket here today, and you sent this over to me, Landen. I'm curious about your thoughts around it. It's this idea of rogue communication devices found in Chinese solar power inverters.

The geopolitics aside of this, any foreign nation that has the ability for devices installed in critical infrastructure across the United States to phone home to a foreign power, probably not great. But what do you make of all this?

Landen Brown
Yeah, I think it flows well with what we were just talking about, which is why I sent it over to you so quickly as I was kind of iterating my thoughts around some of the things we were going to talk about today.

I think the precursor to this is that there are kind of two areas of focus when it comes to chip manufacturing. There is the advanced AI arms race that we are trying to stay ahead of, and we see Nvidia and the US government and Intel starting to cooperate on this for, quote unquote, the greater good, depending on your perspective.

And on the other side of the fence, you have what we should probably think about as commercial-scale manufacturing for low-complexity chips and architectures, which is kind of what we're seeing as a big area where we're getting exports from China. That includes things like solar panel power inverters, the chips in our children's toys and even some of the chips in some smartphones. Even though some smartphone companies are starting to try to be a little more aligned with the US, we're still seeing that the majority of commercial manufacturing for chip design, chip architecture and distribution in the market is coming from China.

And one of the things, again trying to keep geopolitics out of this a little bit, is that maybe part of those investments into Intel is to try to boost that commercial manufacturing in the United States because of things like this.

I think it's no secret that all countries have some kind of backdoor that could shut down everybody's grid in the case of a war, and it kind of falls along the lines of mutually assured destruction. But this is a really good example of whether there are areas where we could boost manufacturing from a chip design and chip manufacturing perspective in a way that helps avoid these things.

These kinds of headlines are becoming more important.

Samuel Hill
Yeah, the politics are not really the scope of our conversation, but at the end of the day, catastrophic failure in critical infrastructure would be devastating to our world and our people.

And you're right, it's no secret that there are lots of backdoors. So I guess it really highlights the criticality of security for those cyber-physical systems and the things that really provide our modern way of life.

Fascinating to see. And it's an interesting take about chip manufacturing shifting onshore here in the United States to perhaps help with some of the cybersecurity issues here.

All right, last one on the news for us today, and I just got an absolute kick out of this one. This is a Meta story.

Mark Zuckerberg, the famous Mark Zuckerberg, founder of Facebook, now Meta, is doing a live demo in front of thousands of developers there in the room. You can kind of see them in his little POV camera. And he's trying to demo the new features of their Meta AI with the Ray-Ban glasses. The glasses look sharp, and you'll see that.

But any of us in technology feel this pain directly. All of us have had demos that go exactly wrong. And this is an example of all of that.

Well, the first "uh-oh," you never, you know it's bad when the first "uh-oh" happens. That's not a good sign.

I mean, all of us have lived this moment in a live demo environment, trying to showcase something that a customer is asking about or a key piece. And as he says, it happens. Landen?

Landen Brown
It certainly does. And I think a good example of that just happening is my son walking in the room as we're covering this exact topic, which is ironic and coincidental and all the funny things.

You know, I think it's always funny watching the moment of reckoning when the first "uh-oh" comes out and the upper lip starts to sweat, and you've realized that everything you prepared for and thought you were very confident about suddenly no longer works. And then the final statement of, I guess I have nothing to show you, we'll just move on.

I've been there way too many times, both in person and virtual. So I can't throw too much shade at Mark Zuckerberg here. Tech is hard and live demos are even harder.

Samuel Hill
Yeah. And I think even later on in the event, they tried to do a cooking demonstration or something like that, and they couldn't get the AI to do the ingredient steps right. So condolences to Mark, to Meta and to the whole thing.

I don't think I'm going to be rushing out to buy that product, probably more because I don't wear glasses and I don't know that I would need an AI interface to the physical world personally. But that's just me.

All right, let's dive into something. This is a topic that we're going to do this week. We're not going to do this every week because it might get us in some trouble. I think the overlords here at MIND might have an issue if we always did this.

But this topic is called Speak Your Mind. It's just really the truth that sometimes has to be said. You know what, darn the torpedoes, say it anyway and we'll see what happens.

The topic I want to talk about in this section is how many times have you run into a problem and gone about solving it and thought to yourself, well, there's got to be a better way, but there isn't.

I gave an example to somebody recently about, I don't know if you did this when you were growing up, but we had to split wood to heat the house that I grew up in. So I spent my teenage years exercising all of the angst that I felt with a splitting maul in my hands and a wood pile in the backyard. It taught me a lot about hard work and all that kind of stuff.

But if you had told me that there is such a thing as a hydraulic splitting apparatus, or whatever you call those things, it would have been mind-blowing. All I have to do is pull a lever and it splits the wood for me into all the pieces that I'm going to need to stack.

How many of those things happen in our world and in our life where we just do something because it's the way we've always done it, because it's going to take me longer to learn the new thing than it would be just to do the old thing, and all that kind of stuff?

Landen, are there any examples you can think of where people do the same thing just because that's the way it's always been done? It drives me crazy, especially when there might be some better ways.

Landen Brown
Yeah, I think when we look at cybersecurity, this is a rampant thing. I think for some good reason and some not. Some of it is regulatory compliance, some of it is very strict process, and auditability is a big one too. Moving away from an established process that we can audit is sometimes hard in the enterprise.

But I think there are things outside of that where we absolutely do things just because we've always done them. And it's especially hard with mysterious terms like AI and ML and all of these different SLMs and LLMs and all the keywords we could throw around. Sometimes we don't even want to consider an alternative because of the mystery and the gravitas that the market has thrown into that.

I think one of those things pertains to data classification and the way the market is doing this and the way customers expect data classification to function, even though we know there are shortcomings with certain ways that we do that today.

Samuel Hill
Yeah. I mean, one example I think of is how many times have you gone somewhere and they say, well, you've got to plug in to make sure you have a really good, strong connection. Modern Wi-Fi has been great for many years. In fact, it could even be argued that it's more secure in some ways. But still, if you want to make sure you have a robust connection, you've got to plug the wire into your computer.

I think about that in cybersecurity too. There are so many things that people do just because the only answer we know is to throw more bodies at the problem, or just double down on a bad process and maybe try to do it faster. It reminds me of the joke, right? AI now allows us just to do the dumb thing faster instead of getting it right.

Landen Brown
And it reminds me, Samuel, as an aside, I did spend a lot of time chopping wood as a young boy as well. We had a wood stove in the house and that was what we used to heat our house every winter.

I actually did bring up the topic of a hydraulic press. Honest to God, I spent my allowance money renting a hydraulic press knowing that a big wood chopping season was coming up. And on my first pull of that lever to chop the wood, the hydraulics broke and it sprayed hydraulic fluid all over my face.

And I said, huh, I tried to be innovative and I tried to do something new. I think this also speaks to what happens when you're not properly trained or expecting the right things, and why some people try something new and then revert back to the old idea they once had as well.

Samuel Hill
Yeah. It's that adoption curve, right?

Well, that brings us to this next section, which is the Deep Dive, where we're going to go a little bit deeper below the surface to try and understand something.

And I think, Landen, you and I were prepping for this a little bit. This is an area of cybersecurity that is one of those where people are kind of doing the same thing because that's what they know to do. This is the idea of regular expression matching, or RegEx as it would be called across the industry, probably not with fondness. I bet people usually say it as an epitaph of some kind followed by curse words.

But RegEx is the idea that we're going to look for a regular expression that occurs across our data to be able to mark something as sensitive and give it an appropriate classification of some kind.

Why don't you explain it to us, Landen, and help us go a little deeper on this topic?

Landen Brown
Yeah, you know what, I would say any data security professional out there that hears the words RegEx is probably shivering. Our ancestors probably roll in their graves for how hard we've made our lives with RegEx.

I just kid there. RegEx did serve a purpose for a long time. I think technology has outpaced what RegEx is capable of. But again, to your point, we're still stuck doing some of the same things.

What is RegEx? RegEx is, as you said, a regular expression. If we had to put it in layman's terms, it's a very unique built expression that is looking for specific keywords, oriented sometimes in a specific way, with a specific case and a specific format within a string, and then being able to say, is there any of this very, very unique and unchangeable thing within a document, an email, a text message or something of the sort, wherever we may be deploying RegEx?

So when we think of RegEx, we think of, I have a very specific thing I want to find. And what that also leads to is a lot of other things that may look like that thing. Hence, one of the reasons I think we're seeing a lot of frustration with it today.

Samuel Hill
Well, that's the thing, right? It's looking for a specific pattern and it says, social security numbers in the United States are nine digits, often with a dash in the middle, but you have to build them in a certain way to be able to catch all the different variations of that. And I think that's where the complexity arises, right?

Landen Brown
Yeah, it is, right? And I think the follow-on outcome of that complexity is, if we build something very, very specific to find a very, very specific thing, what happens when that very, very specific thing changes ever so slightly?

And this is again, I think, core to the problem of why people have lost a lot of trust in data security solutions over the years. If that thing does change very slightly, either two things are going to happen. We're going to have a false negative where we miss something entirely, or we're going to have a lot of false positives.

And what we've seen is there hasn't necessarily been a shift away from RegEx in some ways, but there has been more emphasis on creating more RegEx or more regular expressions in the market. And again, it goes back to your point, Samuel, where you say, this thing isn't working, so we're going to do more of this thing in hopes that this thing finally works. At what point do we look for something a little bit more effective or change the way we're doing things?

Samuel Hill
I just picture Mark Zuckerberg looking at a RegEx list, the whole line of it, right, and trying to get it to work properly to catch that one thing that's sensitive at Meta, and maybe it not going as well as the AI Ray-Ban demo. I don't know.

So Landen, here's what I've learned this week as we wrap up. I've learned that it's probably good for our kids to go split wood in the backyard. That's something that built a lot of character for me. It also built shoulders that can carry a lot of weight, and it was formative.

And sometimes, if it's a character-forming exercise, it's good to do things the old way and build some strength and grit and endurance and things that we want our kids to aspire to and hopefully live up to one day.

But Landen, what have you learned this week?

Landen Brown
Yeah, you know, I think one of the things I learned this week is just the value of people in our society. I think there is a lot going on in the world, something I didn't necessarily want to touch on today.

But love your family, love your kids. And if anything, what I learned this week is I have a lot of room to grow in where I put my attention and where I put my passions. And those two things are definitely the right areas, work and enabling people and loving people where we work, and also loving and taking care of my family.

I think we've had a lot of emphasis and a lot of time to think on that recently. And you can expect to see me doing more of those things.

Samuel Hill
All good stuff.

Like I said, if it's loving your sons to make them go split wood, you have my blessing, Landen.

Landen Brown
Thank you, Sam.

Samuel Hill
Hey, for Landen Brown, my name is Samuel Hill. Thank you for joining us on this week's Mind What Matters, and that's all for now.