IoT Security Podcast

There are a handful of genuinely interesting observations - the shift from knowledge-sharing to monetization of exploits, the agentic AI paradigm for bug hunting, and the design-flaw framing of future vulnerabilities - but the episode is heavily padded with conference logistics, Covid small-talk, and nostalgic rambling that dilutes the signal-to-noise ratio significantly for a B2B operator audience.

“if I found a zero click vulnerability, iOS that's a $10 million exploit, basically, am I going to drop that knowledge on the Internet just for everybody else to enjoy? No”

“Hacker One number one leaderboard is now AI”

The reframing of bug hunters as AI orchestrators who must manage token costs and agent tuning is a moderately fresh angle, and the observation that researchers now hoard methodology rather than just findings is a nuanced point; however, most of the episode trades in familiar hacker-culture nostalgia and broad 'AI is changing everything' takes without a genuinely contrarian or first-principles argument.

“you are an orchestrator and you're not actually going to be hunting the bugs by yourselves like literally on the command line. That shit, those days are over”

“it's not just about the solution, but it's the thinking process behind it, the methodology...What made you look in that direction to begin with?”

Dylan Kanaburan is a legitimate 20-year practitioner who built one of Asia's most respected independent security conferences, with real access to elite researchers and firsthand knowledge of how the offensive research community operates; however, he is primarily a conference organizer and community figure rather than a hands-on operator or executive who has scaled a security product or team, which limits his direct B2B operator relevance.

“we run this small little conference called HackInTheBox. Uh, we've been around for like 20 something years”

“HD More was one of our first speakers that came to our first quote unquote international hang the box that we had in Malaysia. Uh, and he presented the metasploit framework as an idea”

The episode includes several named data points - HD Moore presenting proto-Metasploit at HITB Malaysia 2003, a live zero-day found against Server 2003, the $10M valuation of an iOS zero-click exploit, and Hacker One's AI leaderboard claim - but most anecdotes are unverified recall from memory and the conference-ratio numbers are hedged; there are no documents, studies, or verifiable metrics cited.

“if I found a, uh, zero click vulnerability, iOS that's a $10 million exploit, basically”

“HD More was one of our first speakers...he presented the metasploit framework as an idea...he found a zero day in it, like live”

The host asks topically sensible questions and surfaces useful threads like vibe coding risk and the evolution of security research, but the questions are largely predictable scene-setters with no meaningful pushback, no probing of unverified claims (e.g., the AI leaderboard assertion), and several exchanges devolve into mutual affirmation rather than productive tension.

“Do you think using like AI to vibe code, do you think it's really going to drastically increase like the bugs and the insecurity out there?”

“Yeah, that's pretty interesting”