DevHub Live 36 - Timur from Guvenkaya talking about audits, security, and more.

Captions as YouTube publishes them, usually machine-generated, so product and people names can be misheard.

1. 0:28

   oh what you want what you want what you want you want he he want it's he he

2. 2:00

   a n

3. 3:07

   hello hello uh welcome to another edition of devhub live let me clear this out of my face there we go uh thanks again for joining us here at devhub live uh super excited to have you guys all on this episode because uh this is one that uh personally as a developer I'm excited to talk to Timmer from uh gven Kaya I hope I'm saying it right and so heing correct me in a second um but I am

4. 3:32

   really excited about this because as developers we are constantly bombarded with the issues around security but how many of us actually take it seriously and actually build with security in mind and I think we're all guilty of not paying enough attention to that so really excited about this part quick couple quick housekeeping things uh if you haven't subscribed to our newsletter already uh

5. 3:58

   down below please sign up for that all the different updates every week around the near ecosystem and near AI are in that definitely check that out uh you can get started right away uh just going by De to dev. n.org and start building here on near uh today uh if you have questions during this live stream uh feel free to uh enter them into the comment section or chat of wherever you might be watching this uh and we may get

6. 4:23

   to them if they are uh appropriate but without any further delay uh let's get the show going hello how are you thank you for coming on today yeah thank you for having me um yeah excited to be here so yeah I guess let's talk security yeah yeah yeah let's start with um just a little bit your background in uh as a developer in Rust working in near and just I know you've done quite a bit of different things here so maybe just like a quick overview of where you're what your background is

7. 4:55

   yeah so look I mean I spent years in web2 security before coming to web 3 there I was mainly working in application security side of things um web code reviews and all sorts of things around that then around 2020 I guess I moved to web 3 security and in newos system I was like since 2021 uh leading security engineering teams at uh different security consultancies um doing Security reviews

8. 5:29

   and obviously um building some stuff on the side so like on the I worked like at one fintech company uh then also had experience writing some trading bot so yeah I'm pretty accustomed with the whole near Tech and everything around security both web two and web three what about security kind of got you interested like why that specific area of development um yeah I mean look I mean back in the days I was actually planning to become machine learning engineer uh

9. 6:03

   the thing is back in the days um to become machine learning engineer everyone was requiring for you to have a PhD it's not as easy as it right now so and I was like yeah I mean what's another job path I can take uh and I was good at technically hacking so I was like yeah I mean let me just just put it to a profession so yeah so that's basically it so there's nothing about it so yeah nice um so uh our audience is

10. 6:35

    fairly more technical we're geared towards technical so feel free to you know get as deep as you want to go as we talk about stuff but as a very high level first what are the like when you when someone says like talking about Security in software what is the first thing that should come to mind um when you talk about Security in software uh most likely that talking about application security side of things by application security side of things I mean uh bugs in the code mainly uh so

11. 7:08

    it's not about like a network security which is totally different animal uh it's not about people security let's say fishing engagement when someone talks about software security it's usually just application security uh bugs in your code bugs in your configurations and everything around software so as as a as a developer where do you recommend people start with all of that is it something from like the initial design like where where do you send to

12. 7:40

    lead people um yeah to start look I mean if you if you're if you're developer um you should for sure do your best to move your security to the left side of the Spectrum by left side I mean uh in your development pipeline so earlier you can catch box easier it's to fix it's cheaper to fix uh usually architecture is not solidified enough so imagine you have you discovered an architecture breaking bug in production okay good luck I mean now you have to spend probably several months fixing it and um and for the company like fixing

13. 8:19

    those type of buck is going to cost a lot of money because the developers are expensive and instead of De developing new features they're spending their time fixing bucks so right the earlier you discover it's better so how developers can start learning about security um if you let's give an example if you're someone uh developing in Rust for instance you should just basically just like to it's

14. 8:51

    actually for any language you can just Google uh Python language vulnerabilities uh R security vulnerabilities at least get accustomed with the basic common stuff so that you developing with the security in mind it's already going to give you a big benefits if you if like worried uh that you or you don't have time to find it talk to your CTO find a security consultancy which can train you and just expense it so that's also another option

15. 9:20

    that you can do so that's that's the that's initial thing that I think every single developer should do is to learn about common bug that exist in their software stack so it's already going to eliminate a lot of a lot of things and then we can talk about integrating some security toolings in place or doing something else so yeah I mean I think it's a great initial approach now for people though and I

16. 9:51

    started in web 2 as well and I you know a lot of different like Enterprise stuff and I think there like there's two different beasts here like if you're working in Enterprise that is one thing but then I think as an indie developer and we see a lot more Indie developers coming into web 3 is that something where you know as you are working with different projects that you are changing your approach versus like if it is a

17. 10:15

    larger scale where they have a full team versus maybe two three people working together uh usually uh it's harder to work with uh a team which does not have any security Personnel in place it means that you have to be extra careful because you cannot assume anything right so basically uh imagine uh a startup comes which basically two developers just learned about near smart contracts uh yesterday they developed something and now they're coming to you for an

18. 10:48

    audit good luck I mean you have to do your best now you should not assume anything like in terms of security you should basically dig dig super deep into every single thing they did uh to find as many bugs as possible so obviously those type of clients are the most um I mean dangerous clients for auditing firms uh because you know like uh auditing firms reputation relies on how many bugs uh they catched versus how

19. 11:19

    many bugs they missed so right and even worse if they missed a bug and someone got hacked it's even more damaging so so usually what my es with those uh type of uh startups is that if I see this I try first to talk to them if they like certain to work with me um Implement those things first before we begin audit write better tests integrate maybe this tooling this tooling maybe I'll can give some common vulnerabilities that they

20. 11:51

    can just check out yeah and then come to an audit so at least we have some baseline covered interesting yeah when then Enterprise it's a lot easier like I mean at least for them in majority of cases that they work with big startups or big Enterprises it's usually like some at least we can assume that the the Baseline is covered so it makes right right there's usually one security

21. 12:12

    engineer of some sort right so I I think I don't want to get just too much into audits yet I do want to talk a lot about audits but I before we get to that part so as someone who has worked in both web two and web 3 what are some of the common things that you see that are maybe different or maybe even similar for someone who is going from web 2 to now writing smart contracts um yeah so if someone uh actually there are both

22. 12:43

    scenarios I've seen folks who never worked at web 3 and jumped to Smart contract development that's one Beast another Beast is someone who worked at web 3 and moved to web uh sorry work at Web Two move to web 3 that's usually better let me talk about first case where you just started with three smart contracts without any knowledge about web two right uh the biggest issue is that your brain gets wired to Smart

23. 13:07

    contract development and that's super specific you know like revers to be like the you made a mistake all the state is reverted magically all good I mean but when that developer goes and tries to code let's say some offchain web two component yeah um I've seen examples when folks basically just assumed that if they've written some data to database and there is error afterwards database

24. 13:33

    automatically cleared so because so yeah I mean that's that's that I always say to folks and some sometimes people coming to me asking how can I start in web 3 uh and I know they don't have enough knowledge in just regular web to I send them directly to web to boot camp web let's say web to boot camp or some something that they're interested in to learn about like a web two development first before they can up

25. 14:03

    into a web three because it's yeah it's a lot easier for you to then uh work and do stuff uh web 3 is not only smart contract web 3 to be precisely built on web two tooling web two things so yeah sure sure so exactly so you have to uh know about this um so yeah I mean yeah sorry I drifted apart what was the question initially what was the initial question the question was just like the transition from you know going from Web Two to web three yeah

26. 14:37

    similarities yeah I mean about like security similarities is uh I mean you should verify user input um that's that's a common sense like in both web 2 and web 3 if you develop smart contracts or you just uh do uh web to things um you should verify user inputs that's a basic thing the the difference is that the biggest difference actually that I saw is that in web 3 you sometimes have

27. 15:03

    to care about the centralization um so when you audit smart contracts you sometimes need to think uh and let's say report some centralization issues for instance in web no one cares so right so yeah that's yeah yeah so that's the that's the biggest difference I would I would say but apart from this like everything that uh if you if you if you're coming from web to security is going to be super easy for you to transition to web3 security as well because you already have attack a mindset that you can just

28. 15:35

    apply there you just have to know how how smart contracts work basically so if we talking if we're talking obviously web 3 equals smart contracts that's but it's not the case in your experience in even just you person preference but also just from a work standpoint what are some things around like language choices do you normally recommend to people and by that I mean not just even like for writing smart contracts but just in general what languages do you say if I had to say oh

29. 16:08

    what should I start with where do you send people uh I mean it's it's super broad question like uh if are we talking about someone who never coded before uh versus no let's let's assume somebody I'm I'm proficient in multiple languages right so but where should I go deeper yeah yeah yeah I mean I would uh go to like I prefer uh like in our current state is that if you know multiple things to use what's the right for the current job that's the

30. 16:49

    first thing that I think the best approach but in general I mean I would prefer let's say if you you know python uh JavaScript and rust uh I would say go deeper in Rust but if you hate writing in Rust it doesn't matter like I mean you should like I I've never seen folks be passionate and going deep into stuff that they don't like it doesn't matter if rust is super memory safe it doesn't matter if the rust is super duper fast if you just hate the syntax

31. 17:22

    and no one going to actually care about this so I cannot give you like a defin answer go with that but obviously as a security person I would say yeah do do in Rust at least you're going to have less headache about memory issues so sure like buffer overflows for instance or something uh obviously it's not completely safe but like the majority of things are prevented by the compiler yeah no I I think that I mean I like that that answer because it's something you know I

32. 17:54

    think even for myself I sometimes struggle with of trying to sometimes pick like what I think the right language is for something but I've certainly learned over the years that it is sometimes better to pick the language I am more comfortable with and I am stronger at because because I am probably less likely to make mistakes using that language versus trying to force myself to do something different

33. 18:18

    yep exactly like I mean when people say um give up comparison between yo you should not learn rust I mean it's super hard for for you to code if you in the phase of prototyping I use JavaScript or something else uh but I'm pretty sure if someone is more comfortable or more expert writing rust versus someone who is more comfortable writing JavaScript that rust person is going to write

34. 18:43

    faster and more safe software than that person in JavaScript right because so I mean there are folks who can write Mo most likely uh web application faster than you in C++ than you in JavaScript so so it's like yeah I mean it depends on what language your most comfortable with I'm not all like uh I'm I have my own preferences I like like typ save languages uh I I coded in JavaScript I coded in Python but now since I coded let's say like plenty of years in Rust now

35. 19:16

    when I go to JavaScript um I get anxiety and if I try need to audit some JavaScript code I get extra paranoid so yeah I saw I saw you you had posted a tweet the other day about uh smart contract choices language choices because near now offers so many choices to do contracts in and I think you made the funny comment something right you know choose whatever just don't choose JavaScript yeah yeah I mean look I mean we if we assume that smart

36. 19:48

    contracts are super like a source of Truth they have to be reliable I mean they have to be fast they have to be don't occup occupy a lot of space I mean what are we talking like uh I mean I with I don't know like what's your experience writing JavaScript but it has so many foot gonss that I don't think uh it's worth writing any let's say production great software especially which manages uh gazillion number of

37. 20:21

    funds in your smart conract so yeah as as Vlad uh I guess frol of said like he also commented on my uh tweet he said like maybe it can be used well for prototyping or hackathons so yeah I mean that's that's totally fine I mean if you just quickly want to if you only know JavaScript let's say sure and you want to just get just like I have an idea I need to go to hackathon I need to code something quickly yeah just pick JavaScript code it but then if you raised funds or you have more F more

38. 20:53

    time just you can record it to more uh to a better language that's interesting yeah no I I I I do I do appreciate that that approach to it for yourself and let's kind of put a little more into some of the work that you actually do when somebody comes to you to do an audit whether it's the full platform the smart contract whatever it might be is one of the I mean I got to imagine as just an auditor when you're dealing

39. 21:25

    with something like JavaScript that has so many Frameworks so many additional packages that can go into it I mean does like that might well add to the nightmare just to begin with because of how do you stay on top of all of that as an auditor I mean that's that's hard I mean that's that's why we prefer to specialize uh we don't do solidity um we want to specialize as much as we can like we we're doing near almost exclusively for

40. 21:58

    like I've founded this firm in 2024 I would say like 95% of audits were near audits on our side because we want to specialize there and just deliver the best quality we can because as you said like it's it's super hard to be on top of everything uh this year we got more folks who specialize in other things as well so because I don't believe that a single person can specialize on let's say five six things

41. 22:24

    at the same time right and it's super important like for a security research um to be like I would say uh if not better than a developer in some sense in uh in some of the things that you ordered because uh developers sometimes develop something because uh like in in a certain way develop something because there is let's say pressure to release something fast or do something uh let's

42. 22:54

    say they're just in experience there's an MVP that they're trying to put I mean there all sorts of things but you should be uh let's say know at least as much as a senior or lead engineer in EV in any ecosystem to be actually successful security researcher that's what I think yeah I think that I was gonna ask about that like how how do you though as a auditor and I do want to get into the auto process in a second here but how do you even just

43. 23:26

    like keep up with what's happening you're trying to do your job as a security researcher and auditor yet you probably have to spend time like actually programming as well um I mean not necessarily uh not every auditor actually programs on their daytime I mean sometimes we like developing to develop some tooling internally that's the only time we code or if you have some different interest but in general we just stay let's say in example in

44. 23:57

    year I'm in almost every single near uh telegram group so that I can keep it check what's happening right now what's something new released uh maybe there is some new functionality in smart contract that was released let's say the recently like yield and resume functionality was released like pretty recently uh which lets you basically just stop the contract execution let's say ask llm to do something then you get response and

45. 24:21

    boom it's an inside of smart contract that was a new functionality that I had to just check it out uh learn by myself uh didn't haven't seen anyone use it yet but I mean still if if I encounter it now I know what it does so right okay that makes sense so it's it's not as even just so once you have that Baseline of okay I'm at this level of you know being a software engineer I feel

46. 24:47

    comfortable with this now it's just keeping up you know what's new what's changing okay lat latest SDK what's changing in this that kind of stuff yeah yeah yeah exactly like I've seen like now U near is releasing like Python and go DEC I don't like right now most probably you won't see any projects uh using them because it's not in production yet not stable but I'm pretty sure like in let's say next year there will be projects already writing in go SDK and uh and python SDK so we have to

47. 25:20

    also get prepared so we're just keeping an eye on that part as well so maybe not that involved yet but closer it gets to a stable release we're going to start experimenting there as well nice nice let's talk a little bit about the actual audit process I think for a lot of developers especially independent ones it sounds like a scary term um if you've never been through it I think this is a lot of mystery of like what actually happened so maybe kind of walk through like what it's like to you know uh

48. 25:49

    engage with the security team and start the audit process what that looks like for someone um yeah sure I mean it's uh developers should not get scared to be to get audited I actually think auditing is not the most the most correct term for it I guess Security review is better because there is not like a you failed or pass inside of audit we are here for you like we are here to make your software better uh and actually I've experienced this mentality in some uh security Auditors

49. 26:26

    uh in general they have um US versus them mentality it means that we are against developers we against Engineers that's not how it's supposed to be you are always in a team with with developers there your job is to actually secure uh the system so when you have mentality of US versus them uh you start arguing about severities which degrades the user experience sorry like experience with the client you um you

50. 26:59

    try to OV exaggerate severities Also let's say something at most medium you try to push it to critical just because it's gonna please your boss uh that's yeah you should just care about providing as much value as you can to your client that's the main thing about the whole process pretty simple like you let's say you you need an audit you uh say you want to audit staking smart contract on year uh what we ask from you at first is yeah can you send us some

51. 27:32

    documentation and the code so that we can review uh because we cannot do anything before we s the code because we need to estimate the size of the code base and its complexity because uh even sometimes even if the size is large but complexity is small we can finish it relatively quick so or if there is something we are super experts about we can just also finish it relatively quickly um yeah then afterwards we just simply

52. 28:01

    uh prepare uh a quot just um let's say cost time when we can start uh or and and all sorts of details about like uh who is going to be auditing that's also super important how many Auditors are going to be inside of your engagement is it one two three um pricing also differ depending on how many Auditors are going to be there but usually more complex the code more auditors are going to be there um and then on the start date when the uh when

53. 28:34

    we actually agreed on a start date uh and they agreed to everything we signed all the papers I mean regular stuff like audit agreements Nas and stuff and then we uh on the start date we uh gather all together in in a single let's say slack Channel or telegram group and then we begin an audit and the dur like during the audit like them it super differs from the company to company so I will just give you the generalized process um it's usually we have a separate internal

54. 29:10

    group of Auditors who's working on a client and in that internal we actually discuss all the vulnerabilities discuss what we found so far trying to verify them nothing worse uh is let's say report something to a client and it's false positive so because it actually damages trust in you uh and also like you don't like developers do not want to spend their time also verifying like re like they they spend time verifying your issue and

55. 29:41

    then figuring and seeing that it's false positive I mean it's I mean it's just a waste of time for them in many cases sure yeah so I mean that's that's pretty much it like after we uh like how we do it we directly report every single issue uh inside of the telegram Channel or slack we don't wait until the report is finished the reason behind this is that uh we want developers to fix issues right away so that the whole process is

56. 30:11

    more streamlined because imagine otherwise there is like a dead silence inside of the channel and then we deliver the report and now we now developers have to fix it Al together for let's say whatever like a week or something then we have to verify fix but if everything streamlined we discovered report the F we check the fixes done and if you if you do do it like this usually all the all the thing and security uh

57. 30:38

    review is becomes more collaborative and we can just deliver results uh faster um interesting yeah so that's that's pretty much it there is there is no magic but actual audit what's happening it again depends on the methods of the security researches uh usually it's just a manual code review be sometimes let's say if we discovered something we are not sure about we write Pro of concept um to actually verify the issue uh sometimes if we need it we use

58. 31:10

    fuzzing uh if we have some internal automated tooling developed we use those um so yeah that's that's pretty much interesting so couple couple things here so um what is your uh I guess process around remediation so you said you know you kind of give them bugs as you go you give them a final report is the remediation and then re-review process built into that initial um engagement yeah I mean uh I think that's that should be a standard like uh we I we do it like we obviously we we do it

59. 31:50

    free of charge and I believe it has to be a standard across every single auditing firm because that's your job to verify the fix of a developer uh you submit an issue developer fixed it now you have to verify the fix to ensure that developer fixed it correctly uh or did not introduce another bug you know like a development fixed one bug you introduced to so right yeah that's that's that's that's that's what I think has to be a standard and I think actually the

60. 32:21

    majority of a firms do it and I don't think you should work with a firm that does not do it so yeah that makes sense how important is the documentation piece in getting started because I I certainly know that that is sometimes a point of contention for developers um yeah I mean it's a it's a lot harder uh to work with a project which does not have any documentation uh it's not only about architecture also documentation to

61. 32:49

    launch run tests do something around that because um more Auditors spend time debugging your application figuring out how to launch it or uh launch test or write a PC or do something around that uh less time they have to actually audit it black hats uh folks in the wild have unlimited time to actually audit your project they can just spend their whole day doing this we have only maybe week or two to do this so we have to just do as much as we can and find as much as we

62. 33:27

    can that short time period some people sometimes are concerned about if they're working on something sensitive of uh exposing their code um obviously you guys are a trusted Source but people still might be apprehensive what does that process look like in actually handing over code to you um like in general I mean it's it's a common practice uh I mean we we we sign a lot of papers so that it's at least legally we both sides are protected so I mean if we leak something

63. 34:01

    it's it's I mean it's it's going disaster for us so but usually I mean how Cod is handled is so we have a separate let's say uh user inside of the GitHub gitlab that those folks can add the collaborator to the repo and then we can actually see the code base and obviously that user that we have is protected by uh UB keys and all sorts of stuff and only some of the engers have access there so we take it super seriously interesting yeah know that's that's uh

64. 34:34

    that's much improved year years ago um even though GitHub was around I remember having to do an audit at a web 2 company and we had to like deliver the code securely uh to like an escro service and then like it was a whole nightmare so I'm glad glad it's as simple as just adding a user to get yeah yeah now now it's now it's way easier so it's a yeah for sure uh we actually got a couple questions here and so I'll I'll pull this first one up I was not really say question but I thought this was an interesting

65. 35:06

    comment you were talking about false positives negatives and uh red slime was saying as a Dev i' rather get 10 f 10 few false positives and one false negative especially if the codas is complex and touches other code that's out of scope what are your thoughts there I mean if the if the false negative is critical um yes yeah I agree yeah I agree I mean with totally I mean if if it doesn't matter how many invalids you send if you

66. 35:36

    discover critical vulnerability that can drain your code just drain your funds yes I mean obviously uh but if that false negative was like some low or medium issue uh most likely you did more damage to your relationship with the client with then false positives so so they're going to be like are they even know what they're doing like uh did they even understand the code base and I don't think uh if a security engineer sent you report with 10 false positives

67. 36:09

    uh that engineer is capable of finding you uh critical issues the most probably that engineer didn't understand understand your code base interesting y that that that that that's a interesting perspective so where like what is the threshold that you feel is worth the time and cost cost to go have a security review like if I just have like an nft minting contract is that something where

68. 36:35

    you say well you're not a great candidate for this is it really more around the use of funds like where do you kind of draw the line for people um ah you mean like um whether it's actually applicable for them to get an audit or more around like a cost time wise uh yeah I guess both I we'll take it both I mean uh what I say is like you should doesn't matter if uh I in general every single smart contract I believe has to get audited especially if it's

69. 37:06

    actually uh managing some funds I mean usually like if you're building a smart contract most likely handle some sort of sensitive information or maybe it's emitting some event that some offchain component picks up and does something that's also critical so that's I believe every single smart contract has to get audited um and when it comes to cost and time um look I mean audits are expensive

70. 37:37

    in general uh I won't be saying that's cheap in majority of cases um so you should um luckily on near uh and other uh like padot and I guess there are some others ecosystems actually support you getting an audit meaning they can actually sponsor you in some sense so they usually have some form that you have to fill submit it and then if they think that you're worth uh sponsoring they can uh sponsor you um sense but in general you should if you don't have enough

71. 38:17

    money what I suggest you to do browse through some uh AIT competition websites let's say Cod Arena uh Sherlock there was ads uh IM unify uh find solo Auditors and talk to them those are usually cheaper rather than going to a film uh maybe I'm maybe it's uh I'm playing against myself but I mean that it's just the truth usually if you're working with a solo person it's going to be cheaper and if you find a super nice

72. 38:48

    person um and especially if you're cold base is not super big it might be worth it uh for you to hire a solo person rather than going to pH sure makes sense I mean are there is the tooling and everything mature enough in web 3 to start using some static tools if you cannot afford you know because that's kind of like where I think a lot of stuff in like web 2 is gone um and it's not always perfect by any means like I mean I've had to use a few that kind of DIY but at least

73. 39:22

    that's something like I that's some security checkups right is that even remote mature enough in web 3 yet look I mean my take here is that we are light years behind web 2 when it comes to security tooling so and I'm not talking about like just uh even even the basic static analyzers do not exist in majority of E Systems like on near there is no like a static analyzer there's one static analyzer I won't be saying the name but I mean it was the last comment was uh one and a half years ago so I

74. 39:54

    mean what are we talking about so uh that's uh that's that's that's our current state evm evm EOS systems are a bit better because they were like around longer usually so tooling around solidity and everything is a bit better they have like a some formal verification tooling and all sorts of stuff even then even there they are not like a super Enterprise great uh Security Solutions with a nice ux UI like with all the sorts of Integrations like I'm coming from in web to from

75. 40:25

    invied security so basic basically uh folks who develop net sparker atics uh and those are I would say stand de facto the best uh web application scanners that used by Apple Amazon and all sorts of big companies and the the amount of time folks spend there figuring out how to make the tool not only performance not only to find you all the issues but at the same time a userfriendly so that developers do not

76. 40:58

    have to spend ages fig configuring it uh it's immense so we should basically also put that attention to web 3 side as well because especially if we had those toolings um and let's say uh a tool which basically discovers all the vulnerability low false positive rate because no one's going to be using a tool with a high false positive rate because like the whole idea behind this

77. 41:27

    is that you basically gives you all the issues with less with low amount of noise you go through them all are valid you fix them because if it spits you a lot of noise it's going to be like H I'm not going to even bother like reading through everything so if we had those at least when they reach the auditing stage hopefully majority of the common bu could be found like in development Access Control bugs I believe can be

78. 41:56

    alter automated like 99% of them especially we can some uh integrate uh AI into that part um those can be just directly eliminated at the at the at the at the development stage and when we actually reach the auditing part now a it's going to be easier for Auditors because we at least know that the basic common bugs are not there yeah we can actually focus on more like complex ones yeah um so yeah I mean that's that's

79. 42:26

    that that's my take like we we need to do better as industry when it comes to security tooling some of them are developed as proof of Concepts maybe they took a grant from uh some ecosystem developed it and then abandoned it so yeah that's not how it should be so yeah I want to you mentioned I'd like to Pivot a little bit and uh one of the Watchers listeners actually brought up a

80. 42:52

    good question here uh your what's your take on like Ai No code platforms so I mean so many developers now are leveraging AI to write code um I certainly do it uh so where where what's your perspective on that um yeah I mean look uh AI is super nice when it comes to doing something quickly it's it's I mean I won't be saying I also written some uh AI uh with some things with AI especially let's say I want to quickly

81. 43:23

    write some tests I can say like can you just build me like a a baseline test so that I can just tweak around them absolutely absolutely fantastic I I hate writing test so so so at least at giving me Baseline tests has been a game changer because I hated writing tests and so often I would skip writing tests yeah yeah I mean look I mean it's a it's good it's good but at the same time it's

82. 43:49

    um it sometimes can introduce some bugs because it's not like uh aware of everything so you should and usually that's what I also got experien uh from some folks that uh I talk to who use AI a lot and stuff is that you can start developing pretty quickly but at the C When You Reach certain point it actually gives you some um let's say a buggy code so to say and if you experience some bug and you already deep down into AI development then you have no idea what's happening in your code base it's hard for you to

83. 44:27

    then debug and debugging with AI is pretty hard it's uh it's like you you share with it a bug it gives you uh some solution it's also incorrect then you're just uh spinning in that Loop so I mean my take is that it's fine for simple things but I mean if you want to start you can start with AI do MVP then uh just rewrite it or just uh just build something something on top of it or just rewrite some parts of it to make

84. 45:00

    them more uh more stable um security wise um I mean I don't trust it so so there were actually some research papers around uh basically there is like before AI actually outputs your code it gets scanned so and then if there was a mistake it prompts back the AI to actually uh fix it and at the end you only get the code which actually been scanned by some sort of yeah yeah so that's that's that's pretty much it like my take on AI and no code it can be used maybe some simple

85. 45:39

    let's say uh fible tokens uh that have um a structure which is already set um so you can just build like a erc20 or an EAP token just directly by telling uh AI to do it and then afterwards you can just quickly glance over it and maybe pick some small box I mean usually there is already a standard how you should write it but if you want to build something custom uh it's going to be harder and most likely more buggy approach so is that something you're

86. 46:10

    seeing in your in your work have more code that like you can kind of tell like it's coming from AI or is is that something that is coming up more and more um I mean I'm usually when I'm aing I'm not thinking where it's coming from I just trying to find bugs uh but sometimes it's uh I mean if since I'm worked a bit with AI I can sometimes like I get that smell of AI uh there uh

87. 46:40

    sometimes like excessive commenting on every single line the comenting my give away yeah yeah so it's kind of like a one like a big kind of smell that was generated by AI H actually one time um uh during uh doing an audit uh I was like thinking how can I better basically sometimes when you do an audit you want to show a snippet of the code as a remediation and I was like yeah I mean let me try uh basically do it with AI uh

88. 47:12

    I was like yeah I mean just prompted like do can you give me a suggestions how to make it better let's say this this part of the code it spit out some uh example how can be made better uh but then I was like yeah I mean never mind I'll just give the general suggestions because usually when you give a snippet of the remediation to developer uh you you technically like it's a best practice not to code for

89. 47:41

    your developer because uh like the worst case that can happen you introduce bugs in your remediation developer copied it and now technically that's you who to blame uh so I was like no I'm not going to add it I just added some uh remediation just notes and then when I saw the fixs uh I saw almost identical code to the one that I copied on the through the AI was like yeah I've seen this before somewhere I didn't say I I was like okay yeah no right that's funny so I I think

90. 48:14

    I kind of know what your thoughts gonna be on this but I'm just kind of curious just from a philosophical standpoint of like where AI is now and maybe where it is maybe the next year or so but it does feel like while it is certain able to do a lot of coding it is really only beneficial as a tool for those who are fairly proficient already where I can be able to look at that code and realize there is something wrong realize when it makes a suggestion that I can

91. 48:44

    correct it when you're just actually just relying solely on the AI if you are I'll say like unskilled you know GIC unskilled in that that really is not quite at that point to trust in any form yeah I mean it's going to be painful I guess uh especially when you encounter a bug and you have no idea what's happening because if you're developer and you encounter a bug you can create a prompt that actually going to give you a higher success rate rather than someone who

92. 49:19

    doesn't know anything probably the person who doesn't know anything they're going to just copy and paste error code throw it to Ai and going be like a fix it so yeah I mean my my take on this is that uh again just um if I mean especially it's like with non-technical Founders I would say uh if you just want to show something build a POC of something sure uh yeah just just yeah just just use it okay that's that that's fine I don't think you're going

93. 49:49

    to be if you raise money uh going to be doing it any longer you're probably going to hire some developers who who are going to code it for you so I mean that that's fine for that case but I I I I don't I I don't think like a purely AI Britain software uh is going to be I mean it's going to be the most reliable one to work with that's that's my take as it gets better and as AI becomes more a part of everything that we're doing like just from your own expertise

94. 50:22

    what would you recommend a you know a a a student you know in in College University wanting to maybe be a software engineer like what what should they be learning what should they be focusing on is it still just the traditional stuff that you need or is it more architecture is it you know like where does that start to go you think um I would say uh if you're in college um I made that mistake um I skipped all the foundations of computer science how

95. 50:58

    computers work how memory work how stack work how Hep works and then actually a bit longer into my career I realized my gaps and became pretty painful for me to just uh do some more lowlevel stuff that are required from me so when you're in college I mean just learn those foundations don't expect the college to give you any uh like directly direct skills that you can apply to your job no one's going to most likely teach you react or I don't know like development yeah in the in the

96. 51:38

    University but um what I feel like is good is that when you have those foundations uh of computer science of let's say how computers work maybe you have learned a bit more assembly um C++ or whatever if you put someone from the boot camp who just learned all the react or everything they're obviously going to be more employable they're going to just start working directly but since you know all those foundations all the

97. 52:09

    lowlevel stuff how actually you can you can progress faster than that person from the boot camp most likely you're going to reach that level uh level of expertise that that boot camp guy uh gained in the matter of like uh one year and that person took two years because you have all the foundations you can debug things easier you most likely going to know how react Works behind the scenes and if you read the paper how

98. 52:33

    react Works behind the SC most likely you're gonna understand it so so it's like you're GNA become a better engineer overall so sure and that's that's from my experience um I made that M mistake and I'm still trying to learn as much as I can of that world so yeah yeah absolutely no I think I think that's great advice uh um you especially I see similar gaps I'm a self-taught I went to school for something different so I was

99. 53:02

    a self-taught developer I mean I've been doing it since I was a kid but still like it's there's still these gaps of right you said like some of those foundational things that you miss I've also found myself telling more younger developers to understand software patterns and software like design because is if you're going to start Outsourcing more of your actual like coding to AI the the the the software development and patterns become so much

100. 53:32

     more critical in how you then prompt and how you put the stuff together as well yeah yeah yeah yeah yeah I mean whether you want to use like a builder pattern or something else like it's uh yeah I mean at least you'll know what you're going to get as an output I mean that's that's actually yeah I mean makes sense I agree with this like also like I mean there is another topic which is like AI

101. 53:55

     insecurity that's also been super popular um I don't know if you heard about this there are some oh yeah what's that yeah I mean it's a like you know like everyone building AI agents right now so and it's been super popular um I mean it's getting to that direction where folks are trying to build AI security agents to uh scan an attempt let's say go to auditing competitions and win there um but I mean it's like

102. 54:26

     from my experience working with the AI insecurity it's not there yet like whatsoever like it's I tried um I tried discovering vulnerabilities with AI which is directly prompting like real story like a super recent audit um I discovered that it's a web to application discovered like a SQL injection uh just a you know like there was like a SQL query and you can inject some random things to it to do some actions in the database I directly saw it and was like

103. 54:59

     yeah can I actually detect it I would just directly copy the snippet of the code and it just uh told me like no there is no SQL injections there I was like okay fine um we are probably we are probably safe there like as a security researchers for at least another five years but then I was like okay I told him there is SQL injection can you prepare me uh a payload that actually

104. 55:23

     going to do something on a database let's say uh make database sleep for 30 seconds uh I written this payLo in like say two minutes um yeah then it just spit me one example it's wrong another example it took it like a 20 or 30 prompts for me to get it right so was like yeah so yeah I mean AI is definitely not there in terms of security and it's probably going to spit a lot of false positives uh to developers so yeah I mean don't purely rely on AI in security that's what I'm

105. 55:54

     trying to say yeah yeah yeah yeah know I think that that that's uh really great advice and for I I hopefully for people who are watching and they they start to think about their own security it really sounds like you know that getting started in your own understanding is really like step one like you just yeah you as the developer being able to understand what is actually on the screen is really step one and then if you can go from there then start

106. 56:27

     thinking about how do I write tests you know when I get an audit you know um how do I start to do the remediation and understand like what you know I think that the the problem maybe that some people also get worried about is like will I understand what is being told to me in in the report you know do I understand what it means that this this doesn't work you know that kind of stuff

107. 56:51

     and so you know yeah I mean look at I mean we as as security researchers we are doing our best to make reports as clear as possible with the clear impacts so it's like you know what's going to happen if you don't fix this so sometimes that impact is super like possible meaning that uh I mean and obviously depending on that on that impact if it's like a maybe going to fire once in 20 years than the sity is going to be most likely informational or just uh low severity but we're doing our

108. 57:31

     best to make the reports as clear as possible for de developers to consume and obviously like no one is leaving the chat when we submit the report like so we we are there to answer all the questions for you yeah that's awesome um this was super super helpful um before before we go any kind of last thing that people should um just be aware of uh I follow I have your Twitter down below they should follow you guys and what you guys are doing but any things

109. 58:03

     you want to end on um yeah I mean look uh what I would like to end on is that as I started before as I started in the beginning and stated in the beginning um every developer here uh should learn the basics of security basics of common vulnerabilities uh learn them uh you're going to thank me later uh your developers are going to thank you as well uh sorry your Auditors are going to thank you as well because you're going to have all the baselines covered and

110. 58:37

     it's not that it's it's not that hard um it's it's just let's say basic Access Control issues just double check um double check that you actually added that parameter to prevent uh someone from calling your smart contract and another one write tests have tests like I've seen codebase without any tests and you uh and and and it's was and it was a big smart contract so you should have tests and learn uh about security and

111. 59:09

     just the security uh auding in general awesome great advice uh I really appreciate I really appreciate your time today um like this is I hope I hope a lot of people learn something from this and yeah and again we'll certainly see you around in your ecosystem and hope to talk to you again soon yeah likewise thanks for having me have a nice one take care thanks uh that was great guys um I I learned I learned new stuff uh I love talking about just what it is to

112. 59:40

     actually build software so I hope you guys learned something too uh we have so much more great content coming uh so couple updates real quick uh we have a workshop uh this afternoon uh with some people from the proximity team so that's going to be exciting that's going to be in just about an hour from now uh so we'll be live back on these same channels uh that you can come come join and do some coding uh with us tomorrow we're doing a kickoff for the uh trillion agent hackathon uh so we

113. 1:00:17

     will uh be announcing that we will uh be live there we have some great great guests um for that one so that's going to be jam-packed full of information and stuff for the hackathon uh and just in general uh again you know you know reach out to us uh if you have topics that you want to see on here you want to bring things up uh you're more welcome to reach out to us make sure you subscribe

114. 1:00:41

     to our newsletter uh we have updates about all that as well and next week on Thursday zhub live we have nightly wallet coming on to talk about their wallet and building on near building on other chains we're going to talk about all kinds of awesome stuff so make sure you follow along for that as well uh but uh until then uh this has been another great episode of devhub Live And we will

115. 1:01:04

     be back here soon