28:15

Steve Poole of HeroDevs, a longtime voice on software supply chain security, tells host Olimpiu Pop that the landscape has hit a "watershed moment" in the last few weeks. The long-standing attack methods are simple: typo'd or confusingly named packages, unchecked scripts, inflated version numbers that trick builds into pulling the wrong release, and maintainers who build trust and then turn bad. Developers are among the weakest links because their machines hold so many credentials. The new factor is AI-driven vulnerability discovery, which both attackers and security researchers are using. Steve's concern is that discovery is now industrialized while fixing is not: maintainers who once saw a CVE or two a year may now face batches of them, and he fears more will simply walk away. Unsupported packages are especially exposed, since CVEs against them often never get reported at all. His worst-case scenario is that open source security fixes end up arriving in small commercial enclaves first, as regulation and cyber insurers push companies to pay for maintenance. The practical advice for engineers is concrete. Fixing an open source dependency yourself is fine once, but then CVEs two through six arrive and you are in the maintenance business. Instead, scrutinize and reduce your dependencies, noting that studies suggest AI-generated apps pick roughly three times more of them than people do. Stay as close to HEAD as you can on maintained releases, and build your pipelines into "sleek engines" that can upgrade continuously, because under the EU Cyber Resilience Act "best efforts" to fix a vulnerability will not mean a migration in six months (Steve is clear he is not a lawyer). The two close on responsibility: like a compiler's output, AI-generated code is still your code, as Kubernetes' AI policy makes explicit by ruling out AI co-authorship. The hard part is the non-deterministic output, which means thinking harder about testing and proving quality. Steve's closing hope is that the industry becomes more pragmatic about AI's downsides, though he admits so many forces are converging that it's hard to predict where this ends.