Caleb Sima: [00:00:00] Search engines as they are statically going down they're dying

Ashish Rajan: any

Caleb Sima: website that is protected by a CloudFlare will no longer have bots be allowed to call it. No crawlers are allowed.

Except for the ones that now

Ashish Rajan: pay.

People are aware of what's happening in any corner of the world because it's free, open web

information becomes money, information is currency.

It definitely a fundamental change in how the internet would be looked at for sure.

Caleb Sima: If this succeeds, the open web does no longer quote unquote exist.

Ashish Rajan: Would you ditch your Google Chrome tomorrow because of ai? That's basically what the world is moving towards, at least. Trying to CloudFare that receives a huge amount of the internet Traffic today recently supported a open source browser, which is different to Chromium, yet that same chromium that Google chrome is built on that a lot of people have loved and enjoyed for a long time.

I think 63% of the internet runs on some version of Chromium or Chrome. This is pretty big coming from a big player and specifically now with AI being top of mind, their browser is geared for that [00:01:00] AI world that we are moving towards. Their browsers is shaping the internet for what it could be with AI scrolling the internet.

But there are bigger questions being asked about the open web versus a closed web that this could produce. So Caleb and I shared insights on this particular topic, what it means for the industry, what it means from a cybersecurity perspective, and potentially for your organization moving forward as well.

As always, if you enjoyed this episode of AI Security Podcast, definitely give us a follow subscribe. It means a lot, helps us making a bigger impact in the community by democratizing more of AI security for each one of

you. So I really appreciate support in subscribing and following the work we do, whether it's on audio podcasts like Apple, Spotify, or on video platforms like YouTube, Wellington, I hope you enjoy this episode and I'll talk to you soon.

Peace. Hello and welcome to another episode of AI Security Podcast. Today we're talking about an evolving space in CloudFare Oh, well, with CloudFare. But Caleb, would you mind letting the audience know a bit about what we can talk about today?

Caleb Sima: Yeah. I wanted to particularly produce this episode. Because I think [00:02:00] it's, I'm a little bit more on the cutting edge of what's happening and I feel like, this is something that's gonna be pretty impactful to us in the future.

And this is about CloudFlare? Yeah. And their announcement and their focus around how AI crawlers. I think that being a dependency in foundation and then future, how AI bots are going to work with CloudFlare. So let's, first, let me break down a little bit of what this is. So, CloudFlare made this announcement that basically said, Hey from now on, any website that is protected by a CloudFlare will no longer have bots be allowed to crawl it.

Therefore all bots, no matter who you are, specifically, AI bots is their sort of call out here. You will not allowed to be called, uh, on any website just by default. So you, as an owner of a website by CloudFlare, you have to go in and specifically grant whitelist AI [00:03:00] crawlers to crawl your content.

And of course their purpose in doing this is they're saying that the way the the web used to work, which was the quote unquote open web, you produced content. That content was available to anyone. Search engines like Google, et cetera, would crawl that content and then when people would search, would obviously you would click a link and then get referred back to its original source.

This was the open web. It was a, it was a nice deal between search engines. The content providers so that you could, hey, you as a search engine would be central, easy to find, and then, uh, you would refer that traffic to me so that I could clearly take advantage of it. Obviously, AI comes into the scene.

AI becomes this God of all things, the oracle of knowledge where it just answers your question directly on what you want to know. From the content you produced and never refers you back to the original content. So things like [00:04:00] ads obviously become moot. Things like the source and origin of where this content or information came from becomes moot.

They never go to your actual website becomes moot. This has obviously created a much different world to what is going to happen in the future. And I think it's pretty clear that everyone can agree. That, at least for now, search engines, as they are statically are going down. They're dying. Uh, we are seeing AI being the fundamental way at which you can access this information.

So CloudFlare says, we have a potential solution for this. So what we're gonna do is we're gonna block all AI. So now no matter what your content, AI engines can't do it unless they pay. And if AI pays you as the content provider, then you will allow them to crawl your content. And so they're basically saying, let's put the onus on not the [00:05:00] consumer driving traffic to you and potentially paying you.

We'll put the onus on Cloudflare. To effectively say you, the AI company will pay and then you, that will then allow the consumer to access your information. So how are they going to do this? This is sort of the big question. Well, since they have become the gateway, quote unquote to. I believe the numbers, I've read about 20% of the internet, right?

So 20% of all web is gated by CloudFlare. Then what they're gonna do is they're gonna say, okay, all that 20%, here's what's gonna happen. Open ai. What you're gonna do is you're gonna register an account with us. We'll be the bank. CloudFlare will be the bank. You register an account you'll sign up. We will, you'll sign, you'll extend us.

Basically say, Hey, this is our key. We're gonna sign this for you, and we're gonna say, great. Now we know who you are. This is your authentication as a crawler. Now what's gonna happen is every time OpenAI uses their crawler bot to crawl [00:06:00] websites, they will always issue out. This is who they are, and this is their header signed by their crawler as it crawls content.

When CloudFlare recognizes that this is open AI's Bot, because it's clearly signed by OpenAI, it will see the content and it will automatically say, is the content at which you're crawling? Did the customer, the website creator, want to charge you? And if the creator says, yes, I do want to charge you, then it does a negotiation, a bidding.

Plan between both CloudFlare and OpenAI and the creator. So, for example, let's say you're the creator and you say, every page on my website is worth, I don't know, at least 10 cents each. Every view is worth 10 cents. That's the price that you set. Then when the OpenAI comes and says, I want your content.

CloudFlare will say to the crawler, Hey, this content is worth 10 cents per page. And OpenAI can decide, is that worth it? Should I [00:07:00] spend 10 cents a page to crawl this domain's website or not? And if it agrees, it will say, yes, I agree to that payment. It will then crawl that content will then be allowed, and then it will move on.

If it refuses, if it says, Hey, that's too expensive. Open eyes is not gonna pay that. Then it moves on to other content. Now what happens is at the end of, let's say whatever spending cycle they've discovered, they de decide between OpenAI and CloudFlare. At the end of every quarter, end of every month, a bill gets charged to CloudFlare from OpenAI, and then OpenAI pays it to CloudFlare, and then that proceeds then get distributed to you, the content creator and your account.

So this is now the payment transaction that is going on in this automated fashion. So now what's really interesting about all of this is the content creator sets a price. The OpenAI crawler decides whether that price is relevant. You can, you have a lot of customization as a content. You can say just these pages are only this much.

You could [00:08:00] even say all of my website is .001 cent, but just these five pages are 5 cents, and you could even set it up this way so that this is now the way at which you can then monetize from OpenAI and the AI provider for crawling your content. This is now sort of the fundamental base thing that CloudFlare has implemented that says no crawlers are allowed except for the ones that now pay dependent upon how the content provider has said it.

So obviously now I'm gonna stop here. Uh, Ashish so I can, so we can probably discuss a bit, but this is only, I think, phase one. This is what I would call. The fundamentals of what? Then, how does this affect the next generation? How the web looks. So, uh, but before we get to phase two on that, maybe I'll pause, uh, see, I mean, as, 'cause

Ashish Rajan: I think when you spoke about this and I was doing the research, so for conscious of people, [00:09:00] this is announced like literally seven days before we did this recording, so it's, a lot of information is still developing as well.

A, I love the idea of a challenger for the norm. Like to your point about the open web versus, hey, I can actually get paid for, as someone who's actually creating content. I'm like, it's great that I can get paid more paid for creating content. Right. So I think there's a good to that. But I think where I found it interesting is that, uh, when I was reading about it, uh, the first few thoughts I came to, came to my mind was more around, uh, if you remember the browser duck go brave.

Yes. Yeah, yeah, yeah, of course. And I think there's another one that I came across recently. It's called arc. So I think it's worthwhile seeing where the adoption would come from. It would come, if it come from people who are like, I think it was when I was reading about it, they basically said it's focused on people who are like technical writers, like bloggers and content sites.

So I wonder. Is the, and [00:10:00] as exciting as this I idea sounds, would the success of it would be in adoption from enterprise or would it be where it is starting today? I, I think, where do you see it go? Because I'm at my current phase where when I read it, they talk about the, I think I was reading on the, or marque, which is the latest distribution, and Ladybird is the browser project and the founder or the person who wrote the Archy thing basically said.

It is basically focused on technical writers. No, he didn't specifically call out bloggers. I'm trying to find the place where there was a particular place where I saw it, but I guess my point being, I love the idea, but I wonder. Having things like these rooted add friction and do what Dr. Go or ex others experienced where, hey, the world is going in one direction.

And by the way, I, I'm, I'm just kind of, open thoughts here is where do you see this in terms so is a sentiment at the moment when you talk to other CISOs and other people is a sentiment that there is a need for this as well outta [00:11:00] curiosity.

Caleb Sima: So first I will get to the security impacts of this in just a bit.

Ashish Rajan: Okay. Right.

Caleb Sima: But may maybe, well, maybe I'll start with that. So let's just look at sort of what I explained. Which is this is a fundamental shift in how in Cloudflare's approach of how they're saying the new web should work, right? Mm-hmm. Which is if we think that the majority of open web traffic now becomes AI because the consumer's interface to the internet.

To knowledge becomes through ai, then open web changes drastically, which already it's happening. I think they said 90% of most web traffic is coming through ai. AI crawling right now, right? Like some crazy amount. Like, don't quote me on that. I, I, but I read, I remember reading something like that. Um, but let's just make assumption the future of that is true because a lot of our interactions with the world's knowledge becomes through this filter becoming ai.

Okay. So let's talk about the security impacts of sort of, well, what does this [00:12:00] mean sort of moving forward? So first of all, I think you'll hear a lot in security about authentication identity. Yeah. Authenticity. Right? I even gave presentations at RSA last year. On this exact same topic, which is, Hey, AI changes the way, it's a forcing function for this, right?

Where most of the web is, quote unquote anonymized. How does that change? So now what they're saying is, Hey, we are creating an authentication method. CloudFlare is presenting a method that says you wanna access web content. You have to be authenticated first. You know, number one, you need to sign up.

You need to create a certificate. You need to register yourselves with us and you need to have a financial bank account with us through whatever stripe or payment provider you may choose before you can access any content at which is behind CloudFlare in a crawling form. You need to authenticate, you need to have a financial [00:13:00] accountability for, and then you need to sign every request you send.

As your identity to access any content behind what we've got. Yeah. Okay. So now you've got this sort of fundamentals being played out here around, hey, our belief in the next generation of web is identity and authentication are required. Not only that. So, and again, remember this is only for AI crawlers right now in the sense of what they've sort of provided, but this is going to move into stage two.

So let's talk about stage two. So Ashish, you also saw CloudFlare released open source their own browser, right? They said, Hey, we have, as we know, I think, I don't know the exact numbers on this, but I think. You know, the majority of all browsers today are all based on chromium, right?

Ashish Rajan: Yeah. I think the status, 65% of the internet uses some version of chromium.

Caleb Sima: Yes. So, like, the ones that [00:14:00] you, you said all the privacy browsers. I think minus Firefox all are all based off of chromium. Everyone does their own version of chromium. Yeah. And what CloudFlare has said is they said, Hey, there needs to be some competitiveness to Chromium, because clearly Google owns chromium.

And so what they did is they rewrote or they wrote from scratch an entire browser based new browser called Ladybird, right? Mm-hmm. And then they released that open source and they said, Hey, similar like what chromium is. We are now releasing an entire independent non chromium based browser so that anyone else can now adopt this as a base.

And there's competition in the market between browsers. By the way, we saw this play out earlier way in our tech cycle. Remember when Google did this to Microsoft? Right? Microsoft

Ashish Rajan: Explorer. Yeah.

Caleb Sima: [00:15:00] Yeah, there's Internet Explorer. Google then produced chromium, or no, not chromium, chrome, and as a new browser, uh, that they published to compete with ie.

And look at the power that brought to them. So we're seeing this play out again. History sort of repeats that now, CloudFlare. Is doing this. Okay, well, what, how does that have anything to do with this crawler pay per web thing? You might ask, right? Yeah. Well, okay. Well, let's say for example what Cloudflare's already done is they are partnering with browser companies.

So let's say they, they partner with Firefox or they partner. Arc and they say arc. Anytime you now register an account with CloudFlare and any one of your instances is signed by you, I now know it's your browser. I will then allow you to access web content [00:16:00] behind us because you, as arc as a browser, are now identifying yourself, authenticating yourself to access content behind CloudFlare as the gate.

So now what's happening is they are taking a quote unquote white listing approach to any website behind CloudFlare. You could see where this is going. You can see, oh, ai. You've now authenticated yourself open AI, anthropic, whoever you are. You're allowed to access content. You're authenticated. Oh, ARC browser.

You've also signed up, partnered with us. You now have, you are also signing all of your requests. So I know that anyone who's using ARC browser can now authenticate and access. All of the content behind it. Oh, we are now producing Ladybird, which is gonna have all of the right pipelines to also authenticate itself to behind CloudFlare content.

So it's easy and seamless for the consumer. So you now what's happening is you're seeing this authentication [00:17:00] identity framework start getting integrated into any web content behind CloudFlare. I think. Would you say they, they're becoming an authentication. Gateway behind

Ashish Rajan: the internet.

I, I think I was gonna say, it'll be really interesting as another phase from this is, you know how at the moment, by default, most people either pick. They either, they're mostly two camps in most organizations. Either you're an Internet Explorer person, but the moment you get your first laptop, you download and install Chrome.

Do Google Chrome or Firefox or whatever your favorite browser is. You rarely and no hate against Internet Explorer. They did really well to move from Netscape Navigator to IE. That's a great jump. But then they were not meant for the time when Google Chrome took over and I wonder. This is kind of one, one of those dilemmas.

And maybe, uh, to your point, the next phase of this is that if that becomes a standard that, hey, browser is your identity, and any, any organization that is walking towards a responsible AI would go, Hey, you know what? For our organization, we believe that [00:18:00] we, we only produce responsible AI and a way to prove that to our customers and stakeholders and everyone else.

We are picking browsers like the ones that are from CloudFlare or the other privacy web enabled ones as an organization default because we believe that's how we authentic we, we put our best front forward in the organization. I think May, may, I don't know. I feel like there is some opportunity there as well for them to maybe even change the way.

Organizations look at responsible ai, not just the, Hey, I create, I produce ai, that, that produces safe results, but also authenticates because I mean, there's so many open source versions of, uh, fine tuned elements for, for floating around how do I know one is the right enterprise version versus the other one.

Especially in the future, if more enterprises start releasing their fine tuned LLM models as a paid model.

Caleb Sima: I think that this is going to have more impacts around age agentic, right? [00:19:00] Mm-hmm. And how, like this is gonna be more around how do I differentiate between human and non-human? So if you take cloud, like right now, Cloudflare's current protocol is solving the hair on fire problem for quote unquote content people, which is Oh my God.

Copyright ai, wall Street Journal. Yeah. Like, I like what is the way at which the Wall Street Journal today makes money? You have to pay them a subscription fee. Yep. Right. They lose a ton. Of influence and readership because of their paywall, right? Yeah. Let's just say that's very clear. However that's a consumer problem.

But what they're saying is, Hey, we will remove Wall Street Journals from ai. So AI can't produce any of this stuff, which will more force more paywall to you. However, that this is a B2B problem that CloudFlare is solving right now, right? Yeah. You're a content [00:20:00] creator. You sign up AI pays me. I pay you.

Yeah. The problem of course, with that is that's very low revenue to the content creator. Yeah. Because they're only getting paid, you know, once every one of these AI guys crawl their website, that's not a lot of revenue. Yeah. However, you know, where a lot of revenue absolutely comes is in stage two. Stage two says we move this from enterprise B2B.

To consumer, to business. So if you are using a browser that now supports this payment method, so you as Ashish say, I have a $5 budget in my account in my browser that is now registered to CloudFlare, so that anytime I, I can now go to Wall Street Journal with no paywall, I'll go to Wall Street Journal and read articles and they will charge me per article.

In my browser, which by the way I think ARC tried something similar to this a long time ago. Yeah. Yeah. At the beginning. Right. [00:21:00] It didn't work though. I think from memory it didn't work. Yeah. Because it didn't have the power or the. There's a couple things, obviously. Yeah. There's a forcing function of the shift of change in technology, which we're having with ai.

There is CloudFlare as the beast and behemoth that it is, and the control. And by the way, agents as a pressure now coming into play. So now I will then pay 0 cents for every article I read on Wall Street Journal. I now have a protocol and a standard for being able to authenticate. To this content, negotiate the content, have the payment providers in place with that, now I can also, okay, now, now the consumer, I am now paying for content as I read and do it, so they get their access to it, which also gets into agents, which of course every problem we talk about right now is identity and authorization of agents and how they work.

Yeah. Well now since I'm signing [00:22:00] everything as both myself. Who I'm using in order to do this account agents will work on my behalf, which they'll have the ability, I will give them the ability to probably sign under my organization. I, as a person, become an organization. They now both authenticate themselves as working on behalf of me, have a payment protocol that they can negotiate.

The ability for CloudFlare to recognize that traffic and control that traffic and the abilities of that traffic. So you see where this is sort of like, you know, I don't like you can see the, the road here, where this goes. Yeah.

Ashish Rajan: I think it's, it's in a funny way and I obviously, I don't remember the transition what triggered the IE to Google Chrome.

I just remember always using either Fire Force or Google Chrome. I, I just trying to think as to what was that trigger point and if there were climatic or economical reasons or whatever the situation was that back in the day. When people suddenly decided as an, as an internet, we decided we're gonna go for Chrome.

I wonder, oh, performance. This is also, sorry. [00:23:00]

Caleb Sima: It was performance.

Ashish Rajan: Oh, it was performance. Oh, so the, yeah.

Caleb Sima: IE. Was a, was a memory hog, if you remember. It was slow. It was, yeah. I remember that. Just

Ashish Rajan: opening up with, and plus I think people adding policies onto it made it, made people hate it even more because you could add policies as a corporate environment and now suddenly it's like it was already slow to begin with.

Things would not load. I actually, I remember I, so that was the reason that people moved over. Chrome could handle that better.

Caleb Sima: Chrome. Chrome was like, uh, when you, you switched to Chrome because it was fast. It was low on memory, which by the way is completely opposite today. Chrome is now where IE was.

Yeah,

Ashish Rajan: yeah,

Caleb Sima: yeah. I mean, a number of tabs

Ashish Rajan: people have open on Chrome these days. It's a memory is an evidence of that as well. Yeah, no, I guess when I'm going with this is that I think, I wonder if this is also the right environment for this to happen as well, because a. AI is top of mind for a lot of people, and content is, for lack of a better word, king at the moment for a [00:24:00] lot of people.

Like we all consume content. That's how we know what's happening in the world, whether you like it or not. I mean, people still subscribe to newspapers and everything else as well. I wonder the reason why they pick that is because they realize that's in a way a heart. The heart of the internet is information, and if you are able to a.

Support that ecosystem in a way that it, that internships, they start promoting it as to help your stage two come into fruit tuition, where suddenly the, all the content creators saying, Hey, by the way, we only support Ladybird, uh, as a way to go forward. I know you are consuming this on a regular browser today, but moving forward from, I don't know, October 31st onwards, we would like everyone to go on Lady Bird because then we can provide ease content for free, whatever the reason may be.

And the third is three.

Caleb Sima: Yeah. Like CloudFlare is clearly not approaching this in the sense that they will they're gonna approach it the same way Google approach it, which is, it's not that you have to use, you know, lady [00:25:00] Bird to get something. It's an open standard. And it, and Lady Bird is, is open source.

You know it like, and what CloudFlare has produced as this payment system is an open standard, right? They are producing this as not, Hey, only CloudFlare can do this. Google can do this. Zscaler, Palo Alto, whoever it is, you know, if you're on edge, AWS Google Cloud, you can now use this open standard. For payment and communication of these, you know, this method in order to do this.

Right? Like it would be dumb for them to say only cloud 'cause what they are trying to do is they're, they are open standard, even though they were the creators, originators, and now quote unquote, probably primary maintainers of this open source. Yeah. Similar to Google. Is chromium, right? Yeah. That's what they did.

Yeah. Fair. Yeah. But I guess maybe, but, but you know what that means is they can adopt these open standards in that browser really fast. 'cause it's already there.

Ashish Rajan: Do you, do you reckon people, like outside companies like Akamai would also make a move soon then? [00:26:00] Because you would also think it's like, like we, we did this episode the other day about agents communication, right?

The whole MCP versus a two A thing. They're all open standards, they're all open source. But ev it's like the big companies want to, I own this kind of a open quote unquote, but let me just donate that to a open source community, like Red Hat or CNCF or whatever. But then at the end of the day, people remember me for creating a standard and that, I wonder if there's that coming as well, considering this is obviously very fresh news.

So I wanted to, Akamai makes a Google chromium something in the play that would be interesting to see how, how it kind of, um. Comes into realization. I also, maybe one thing to kind of talk about here now we talk, talk about identity authentication as, uh, as the pillars that are being created. I do also want to talk about another possibility, which I think we kind of touched on, where the company by Steven Ivy and Sam Altman, where they're basically saying browsers are not the foundation [00:27:00] for the world of ai quote unquote agentic ai.

It needs to be the other devices. Which are like more omnipresent rather than Oh, you're talking about

Caleb Sima: the Johnny Ivy, uh oh yeah. The always recording physical form factor.

Ashish Rajan: Yeah, yeah. Kind of things like that. I wonder if this kind of adds to that as well in terms of where this could go, because I imagine that would have, have to have access to the internet as well for it to be able to do things, read things, come back with, hey, some, or even the ChatGPT Pulse that got announced.

Caleb Sima: Well, but you know, the way I think about it is this, you know, what they're talking about is the user's interface towards ai, but AI itself still has to genically go do things for you, right? Yeah. And the problem is yeah, yeah. Okay. So if AI goes and accesses your Gmail. How are they going to authenticate themselves to do that?

How does Gmail, how does Google know the [00:28:00] difference between the agent doing searching email or a you as a human searching email and is it reasonable to expect that Google should provide different ways for either, so if it's an agent accessing on your behalf, I could probably have way more efficient.

Better things to, to serve that agent versus you as a person and how you want to be served. And so like them, knowing the difference between the two is going to change a lot of things. Like, for example, I may have one credit card, right? But my age, my, my AI agent should not be able to charge more than $50 on that card because I could get screwed in the sense of doing this because like, hey, if the agent goes and gets overcharged or buys things that it shouldn't this is not a good thing to have. However, as a human, I just use the credit card at which, which has no limit because obviously I [00:29:00] can make that choice.

So there, there has to be different. There has to be an identity mechanism to know an agent versus a human. It has to know whether it's on your acting, on your behalf, versus not acting on your behalf.

Ashish Rajan: Yeah,

Caleb Sima: these are things, and think about this from a SaaS service. I won't create my own agents on my laptop.

I will sign up for a service that then has agents running on behalf of me to go do the things I wish I needed to do. How do I authorize those particular agents, but not the entire company, right? Like there's these kinds of identities that need to be managed. And so if I'm talking to Johnny Ivy's always on recording.

Yeah. I'm like, Hey, go book that restaurant reservation for me. Yeah. It's gonna go have an agent, which should have some sort of identity, which then can go to the restaurant, which on behalf of me has a maximum limit to book that reservation. And then the ability to go do it. And the restaurant should know this is an agent doing it so that it provides more efficient methods of doing this.

Ashish Rajan: [00:30:00] Ooh. You could just tell it to, uh, pre, pre-order your wife's book as well. You. That's right. Like, hey, uh, my wife's got a, my wife has a book coming up. Can you just go and, I mean, obviously I shout to Kathy as well, so she does have a book coming up if people wanna pre-order that. But I think I also love what you just said right now in terms of I respected the foundation hasn't really changed.

We're still accessing the internet. We're still like for, for whether it's to buy books or to make decisions to find the internet. I kind of feel bad for googling this as well, in a way because. Uh, I don't know if you noticed, but they've started coming out with, uh, services that are competing with the existing AI ecosystem.

There's obviously they did the whole Gemini image creation thing. They did the whole they, uh, there's a com there's a software called N8N Yeah, the low code one. They have a competitor to that as well. Now, I think it's called Opal, I think Google Opal. Yeah. But literally it does exactly the same thing as n and I'm like.

Wait, why are they, and I wonder There's [00:31:00] a lot.

Caleb Sima: Yeah. By the way, there's a lot of these AI orchestration automated, you know, no-code kinds of systems.

Ashish Rajan: Oh, yeah, yeah. I mean, there, there's plenty. But I guess, and it is just one of the examples, but which is probably more popular, uh, at least in my circle, it seems to be quite popular and.

I wonder, this is, I, it's making me feel that, oh, I imagine Google as the company is feeling threatened quite a bit by CloudFlare, another big player coming and challenging its browser space. Perplexity has a comment browser thing as well. I think someone else just released another browser. You almost have these bigger players and I think OpenAI mentioned they coming over with the browser as well.

Of course. So as an ecosystem, all of us will probably be deciding very soon, which camp are we on in this new world of AI that we're moving into.

Caleb Sima: Again, doing a call out to our previous episode where we discussed browsers. Oh, yes. Being the next big thing because it has all the context.

Ashish Rajan: Yeah. Yeah.

People should

Caleb Sima: check out that episode. Yeah, for sure. I mean, we did that before we did a call. Uh, we predicted this. Yeah. Which I'm also seeing in this [00:32:00] episode predict.

Ashish Rajan: Well, actually, funny enough you did something right now as well. You spoke about the identity piece. I don't know if you've seen the messaging around, it's like everyone's talking about NHI as if that's the next fix, best thing for, oh, if you have ai, you definitely have NHI the non-human identity.

So yeah, I, in a way you're predicting that as well, that that's gonna be. Like one of the foundations for what a lot of people will talk about from an agent AI perspective, like the what, what, and how you manage that identity is gonna be a key pillar for what cyber security people would look at. Or even tech people would look at us too.

Yeah. Can I give it do permission, not permission? How do I know if it's Akamai, CloudFlare, or Google or whoever else?

Caleb Sima: Yep. Yep. The the, the one thing I would like to state though, is where some of the debate comes into play here. So I think we should end or at least talk a little bit about. Some of the, there is a little controversy around what CloudFlare is doing.

Mm-hmm. Obviously, the first initial aspect of this is, oh, CloudFlare is doing this. They [00:33:00] wanna be the gateway to the internet. Right.

Yeah, yeah, yeah. So like what, what is like, how's obviously doing this? Is within Cloudflare's interest. And being able to do this interest.

Yeah. Now them making it an open standard, them making it something that is viable. Mm-hmm. I think does not detract against that. So if you look at the protocol, how it works, how they're thinking about the next version of the web. Like, I think it's pretty good, right? Like it's, it I like in my mind like this is sort of what's coming.

CloudFlare obviously has a big part of that. Yeah. But like I think if this continues, Google can get in this game. Microsoft can get in this, anyone can get in this game. The other, the controversy that I'm more worried about, and I think there's other big factors of people talking about this too, is the open web.

If this succeeds, the open web does no longer quote unquote exist, because what happens is [00:34:00] information now becomes siloed, right? Yeah. Information becomes money. Information is currency. Yeah. And so now there's no such thing, like I can't just spin up a crawler and crawl the web anymore. Yeah. Because I just don't have the capital, unless I go raise $50 billion to go crawl the web, it's, I don't have the capital to do so.

Be, and that's, that's something that, you know, look at the innovation that we've been able to have by being able to do things like that because it's open. If this gets in place where every content provider and others start saying, I'm gonna charge. 50 cents a dollar for people who are browsing our stuff.

Yeah. And this becomes, all that information becomes very, very siloed. Yeah. And this really then allocates within only the internet now is only accessible between very few providers who guard these gates, and also to the people who are extraordinarily wealthy, who [00:35:00] have raised a lot of capital to access and pay that price.

Uh, so that that's where the controversy starts coming into play, where people are saying, Hey, you know, you know, obviously there's, you know, people have talked about Web 2.0 or Web3 0.0 has always been referenced to crypto, and the blockchain, but I think this is true Web3 0.0, which is.

Information becomes cost. Um, yeah. And these silos start occurring because Aren there

Ashish Rajan: people who maintain, like in this whole, when we write, type in a website, the whole www dot isn't that like a, like a body or some like a governing body. So I wonder if they were step in, if that happens. 'cause you exactly to what you said, one of the reasons why.

People are aware of what's happening in, I don't know, in any corner of the world, any given moment is because it's free open web, being able to charge money for things like, and I wonder if they would have to make categories for this as well. If they start asking for, Hey, you can't scroll, crawl [00:36:00] my web.

But then maybe people make categories for, is it okay to get news? 'cause that should be free. Yeah, yeah, for sure.

Caleb Sima: Like, but here's the thing is it's, it will be up to the content provider to make that decision. Yeah,

Ashish Rajan: Not the free internet.

Caleb Sima: Yeah. Yeah. And it's also interesting because it's a new set of economics for the internet, which is, the internet only existed this way because of ads, right?

Like ads drove the ability for the content to be free. But I got paid through my ads. Ah, yeah. So for the, you may not

Ashish Rajan: be paying directly, but they're still getting free content, but the, the pro, the creator or the producer of the content is still making money on the background.

Caleb Sima: That's right. Now the producer and creator of the content is now making money directly.

Yeah. Through accessibility of its content. Now, whether that. Does that ever remove ads? Of course. Like there's no way ads have existed forever, but what what I would see is now the providers are [00:37:00] not, are gonna get, are not only gonna get money from ads, but they're also gonna get money from their content.

Yeah.

Ashish Rajan: Yeah. I think it definitely a fundamental change in how the internet would be looked at for sure. And I kind of agree maybe it is a 3.0 that should have been the 3.0 rather than the crypto version of it or the NFT version of it, which but I definitely find myself. At least based on the conversations we have had so far, I will definitely be keeping an eye on where this goes.

And whether it gets traction and to, to your point, maybe the environmental conditions are just apt. Chrome is just that tiny bit slower right now that that is annoying. AI is crawling the internet, so maybe AI

Caleb Sima: should be in the web, should be in the browser.

Ashish Rajan: Yeah. Yeah, yeah. So we, we are in a way create, I mean we are in a, in a situation or an environment, which is very much, you need identity.

Caleb Sima: For agents and agentic actions Yeah. Uh, to take place. You need a way for them to pay and have some sort of [00:38:00] accountability for the actions they take. Yeah. All, all of this sort of aligns very much.

Ashish Rajan: I, the, and, uh, I don't know. We did an, I know we did an episode on identity, but we did the, did we ever cover if the existing open standards cover for identity for.

Authentication authorization, like the O2 0.0 still applies to agent ai. I think there was a whole, we didn't, we never spoke about that part, but I think there's like a, there's an existing identity standard, but this is like, I wonder if this would ask people to have a 3.0 version or for a 4.0 version for OAuth as well.

'cause uh, what's, I mean, this is just browser. What are, what other devices are winning mobile devices? Desktop. I dunno how far we'll go with this, but I think it's a good food for thought for people who are gonna tune in. Uh, let us know what you think in the comments. But thank you so much for tuning in.

We'll be back with another, another episode on this, but keen to know and keep keen to keep an eye on where CloudFlare takes it and maybe by the time we record this again, Akamai ha or ju, Google has another version of this, [00:39:00] as a response to this coming out. Awesome. Thanks everyone. Thank you for watching all listening to that episode of AI Security Podcast.

This was brought to you by Tech riot.io. If you want to hear or watch more episodes of AI security, check that out on ai security podcast.com. And in case you're interested in learning more about cloud security, you should check out a sister podcast called Cloud Security Podcast, which is available on Cloud Security podcast.tv.

Thank you for tuning in and I'll see you in the next episode, episode. Peace.

‍