Embedded Insiders

The episode contains several useful concepts - secure-by-design, firmware diet strategies, A/B update optimization, and the 10x increase in vulnerability discovery via AI - but significant portions consist of conversational filler, tangents about Waymo and personal anecdotes, and repetitive affirming responses. The Infineon segment delivers more practical density than the Kudelski Labs segment, which relies heavily on abstract framing without concrete implementation detail.

“software just seems to get fatter and fatter. And, uh, even if you're not adding new features, you're fixing bugs and security vulnerabilities”

“you have to put your firmware on a diet. It's not easy, it's painful, like dieting always is.”

The episode rehashes well-established embedded security maxims (secure-by-design, lifecycle management, code optimization) without offering contrarian insight or first-principles reframing. The firmware diet concept is practical but incremental; the A/B update optimization is a known engineering pattern. Neither guest challenges industry consensus or proposes fundamentally new approaches.

“the old rules remain so secure by design”

“You can look for ways to shrink your code size. Now, you probably did some of this before you shipped the product originally, but there are always opportunities.”

Christoph Nichols brings 30+ years at Kudelski, including media security, cybersecurity launch, and CIO responsibility, giving him legitimate senior practitioner credibility. Steve Hanna as a distinguished engineer at Infineon with hands-on firmware expertise is also solid. Both have shipped real products and understand implementation constraints, though neither provides granular case studies of recent failures or successes.

“I'm a software engineer by background, uh studying my careers about 30 years ago in Kudelski already”

“I'm a distinguished engineer from Infineon”

Evidence is sparse on concrete numbers and examples. The '10x increase in vulnerabilities' is mentioned but unsourced. Specific tools mentioned (PSOC Edge, Optiga Trust M) lack context or results. No real case studies, failure metrics, or customer impact data are provided. The firmware optimization techniques are generic categories rather than specific implementation examples with outcomes.

“we're seeing, uh, 10x increase in open source projects, uh, having to patch vulnerabilities”

“like the PSOC Edge, or a security chip like the Optiga Trust M”

The host asks reasonable setup questions but rarely pushes back or demand rigor. Christoph's LLM concern is acknowledged but not deeply probed; Steve's answers are accepted at face value without pressure for metrics, timelines, or customer examples. The Waymo tangent derails focus entirely. Few follow-ups challenge vagueness or request specifics; the conversation flows agreeably but lacks intellectual tension.

“Um, I gotta say there's two reasons why you keep coming back”

“What's the answer? I don't think there's an easy button you push to fix here.”