Video summary
The community call focused primarily on technical updates regarding the Signara project, specifically addressing recent security findings and the integration of dependency management tools. The team discussed a pull request intended to resolve thirty-three identified security issues within the development branch, noting that some conflicts arose from merging separate files for dependabot and security configurations. While acknowledging that the current fixes are significant, the speakers agreed that a monthly release schedule might be beneficial to keep momentum going, though they also considered releasing as needed or every two months depending on the availability of new features like quantum capabilities. The conversation highlighted ongoing challenges in maintaining open-source code while ensuring robust security, especially as artificial intelligence tools become more powerful and capable of detecting subtle vulnerabilities that traditional methods might miss.
A significant portion of the discussion centered on the limitations and risks associated with using AI for automated security audits. Participants expressed skepticism about relying solely on current AI models like Fable or standard LLMs for critical security checks, citing instances where these tools failed to detect malicious triggers or incorrectly flagged benign actions as threats. To mitigate these issues, the team explored the use of open-source Chinese models, specifically GLM-5.2, which demonstrated superior performance in identifying security flaws during their tests. However, concerns regarding data privacy and the potential for AI models to access sensitive directories beyond their intended scope led to a consensus that AI tools must be operated within isolated virtual machines or dedicated servers with strict read-only permissions to prevent unauthorized code commits or data leakage.
Looking toward future development, the group discussed strategies for integrating Cosmos interoperability standards into the Smoot project, acknowledging that complex integration tasks may require leveraging AI to generate initial prototypes and handle high-level specifications. The speakers emphasized a "supervision" model where humans review and refine AI-generated code rather than relying on fully automated processes, ensuring that critical logic remains under human control. They also touched upon the evolution of developer roles, noting a shift from traditional coding to acting as supervisors who guide AI agents and multi-agent systems. Additionally, the team planned to prepare blog articles for upcoming releases to document changes and maintain community engagement, even if immediate publication is not required, ensuring that the project remains visible and transparent to its user base.
Read the full video transcript
Hey Tim
and let's wait for a minute.
Hello.
>> Yeah, I think your sound is kind of a
little bit distant.
Is that better?
>> Yeah, it's better now. Yeah,
>> it's wrong microphone.
>> Yeah. [laughter]
>> How are you?
>> Yeah. Uh
yeah. Yeah, it's almost the same. No,
the same as like two weeks ago. Yeah. Um
not much
>> still deep in it.
>> Uh yeah, it's not resolved yet. Yeah,
>> right.
>> I won't want to hold you up with with
signar. Um there is the the pen about
thank you like we added it. It wasn't
really my um it come came from Kuni. So
thank you for
do that. Let me just share.
>> Yeah. Yeah. If you can share that. Yeah.
I I think they have been uh yeah the the
dependent uh bot is there already. Yeah.
Uh
>> all right. So I went through the 33 that
I have here in security.
Um
yep. So but I working in the development
branch. So I went through all of these.
They should now be resolved with
uh this PR and then Ry I hope I say his
name right. Um [clears throat]
>> yeah but yes
>> I see there's conflicts I will fix um
it's because I merged the other one
first which was the security file and
then you just wanted to add the group
dependabot
file which was similar then cacti it's
also like yeah so I have to resolve the
confixs before it can I didn't see there
was any um and then like it needs an
approval but this is all going into
develop and then I starting to think um
just to keep things moving maybe it's
best if we do a release of sign every
month if there is something to release
like this
uh I don't know how you feel about that
we
>> well yeah every month is good uh but
another thing is that the uh combining
scenario with the bridge right the the
signing the use case basically that
that's something uh we want to explore a
little bit later uh yeah monthly at
least good even I don't think we need
monthly we can we can do it as needed
like every two well maybe two months is
also okay but I think the the the the
question the I think we still need to
work on the use cases there and also if
we need to do quantum let's do quantum
if there's a possibility that be great
and then the um um
on the bridge side there may be some
changes like we have a meeting with uh
horsmones lab right so we'll discuss
with them as well to see what idea they
have how much they can contribute so we
we may have some u some changes after we
discuss with them uh
>> I didn't know they were still alive
[laughter]
um
>> oh yeah they're alive yeah yeah they're
still alive yeah definitely
>> is is this a new use case I will join
tomorrow I just I didn't really know
what it was about um so It is for the
bridge
>> uh well for the whole interability right
so it could be the bridge of course the
the multi-c and signing security is a
big thing and I think security of course
is a big thing because the cosmote has
security issue just exposed as well
with this AI thing more there another
one in cosmos as well I can't keep up
[laughter]
>> yeah yeah so so we we need to discuss
these things been think about these
about this these two that's just like uh
how can we have a open source uh code
and still maintain security uh that's
they can scan our code and AI is more
getting more more powerful uh so it's
very difficult to ensure security yeah
>> um but we must also like I think it will
make for much more secure systems um all
right so this is a this is also a recent
thing to test that because this the
signers there's still a whole list of
issues that ai picked up that I haven't
fixed yet when I brought it over I'm
still making discussion the discussion
sits in our our repo and it is
>> non trivial things soar
is also not not 100% there yet
>> okay yeah I know and what with with new
models coming up we're going to find
more issues. Um,
yeah. So, we have a call with Cosmos.
Let's see what they think and maybe
they'll uh they'll bring some resources
and some ideas and then yeah, then we
can put them together.
>> The DB thing. Sorry. I'm just trying to
figure out what happened. Yeah. Oh, put
them together. Okay. Yeah, sure. Sure.
We'll see what what they say.
>> Yeah. Yeah. Yeah.
So and and on on our side I think
there's no because of we uh we have many
things to kind of high priority things
right now. So there's no much progress
on the bridge itself. Um so uh I just
want to let you know that uh yeah it may
it may take some time and maybe there
will be some changes too. So uh so they
may wait let's wait a little bit more
time for an update.
>> [clears throat]
>> Is there anything else to discuss?
>> Uh
well I
yeah I I think we can discuss maybe nine
on some other things. Uh but on the
bridge side there there's no update
right now uh for the smooth smooth
>> smooth
things has not been going so smooth.
>> Yeah. Yeah. Yeah. That is a fair
assessment.
>> Yeah. Um but we also like trying to get
around fable as triggers. So you can get
a pretty nonsense report back if you
just fire it off at at um Fable you to
to reach sort of mythos. You have to be
very smart with it. This is my
experience now. But it does uh find
like a little bit of stuff. And then we
are shamefully saying that we are also
employing some Chinese models.
>> Oh, really? Oh,
>> so heavily on on on um on Fable, you can
hardly do a security audit, right?
>> Yeah.
>> Yeah. You know what? when we run with
fable uh it it doesn't go anywhere then
it fail back to the old model uh so when
we scanned it so fab was not doing
handle a lot for us we it fell back to
the to the old model
>> what I thought like when you say it
didn't pick up any of those bugs I was
thinking
>> it didn't it did not pick up it did not
pick up yeah
>> hit all those triggers because it should
Right. Um, it tells me at least when I
when I when I hit the triggers. So, and
it it was also for me like it goes back
to the old model. The old model doesn't
go find all these nitty things. Um, so
you really wanted to be against um well,
DLM was the one 5.2 to that we ran again
and it found a lot of things that that
was triggered as as a malicious action
on on claude. So I don't know if it is
worth it for for you also to try other
models
because I mean if you're so limited in
your security scans then you you're
again you're at a disadvantage and you
paid hard for this now.
[clears throat]
>> Yeah. Yeah. the uh we uh in fact the uh
when we we swable it doesn't uh find it
and then it fell back to the old model
it did not find it and then we use the
uh open AI and then it the later on
after
after some time you found it uh so so we
are looking at at different triggers as
well different prompt yeah
>> well we run our own model
>> like So I work with a lot of other geeks
[laughter] that that play with models.
So I say a Chinese model, we do host it
ourselves, right? So
>> Oh, really? Did you Which one do you
use? Kim or Deep? You mean Kimmy, right?
>> But they load.
>> Play again.
>> Which one do you use? Do you use Kimmy,
right? K I M I.
>> Uh, no. They use something else. I'm not
so we're getting a a briefing on Friday
on what exactly but it was a Chinese
model and I think it's the equivalent GL
GLM5.2 or something like that. It's
quite great with security audits um that
they run. It's free. It's open. Download
all these models right and run them
yourself. So this is where I'm thinking
like Claude is is going to I don't know
they have to let those triggers down a
little bit otherwise they will also lose
their their market. I don't know what
will happen. I just I don't trust um
Fable anymore for a security audit
alone.
>> Okay. Yeah.
>> Not because it's crappy, but because it
just it won't uh allow you through.
It just keeps triggering it as
>> as malicious.
>> Okay. Can you uh I think it'd be good if
we share the the the the Chinese model
you use for security. Um yeah, I thought
you were definitely using Kimi, but it's
not. Uh so that's maybe something else.
>> So I have to go check for you. We don't
I don't have my nose in.
>> I just I just needed a new model
something.
>> Yeah. Yeah. Yeah. Because this thing the
well one this because it's open model,
right? you can you can add your own
library to it and and one thing that I
in fact um that's something I was maybe
this is relevant as well here we we have
a security audit company for us and then
we find that it's easy to kind of scan
the code that's luteine but what's
what's not easy was the the test suite
right how do you test it and then also
the regression right if if you have a
new model right and then you scanned it
and then how can you have another or you
fix something, how can you make sure
that those fixes are effective and then
you need to run a a kind of a regression
test to make sure things go through. Can
the security audit platform provide you
a a swift a kind of collection of test
cases for you and you just run it. Okay,
that's something I'm looking for. It's a
generally a a suite of uh test cases
automatically and run through them. Uh
those will be useful
or I haven't seen but you can scratch
there so many. It is GLM5.2.
Um we
let me just put it in the chat here.
That is also Yeah, it is a Chinese GM
5.2
that we Okay.
It's now free, right?
They uh open sourced it
in June already. So that we ran that and
it was um it found a lot of things that
was blocked. What I I would I don't say
Fable didn't find it. fable uh launched
off or it's a current model in my claw
AI that fires off fables and um I've
told it to like do jump through a lot of
hoops and it doesn't trigger these
things but it it still comes back and it
says the seventh threads has triggered
um and then we switched over to JLM 5.2
doing and it found like most of the
stuff and it's just like oh sigh you
know um and then we can't we can't um
run we use their their models it's
Chinese models [laughter]
so uh we going we host it on a on a m on
a big big ass machine of one of our
colleagues
uh that's running it so we'll see if
that I don't know if that's it cost a
lot of money to run it constantly your
own thing
>> yeah well it says it's free but when you
run the machine yourself, right? That's
cost a lot of money probably.
>> I'm not going to trust them. Not that I
trust anthropic either, but
[laughter]
you're on your own. The Chinese will go
put their nose in your data. No doubt.
[laughter] I don't know. Maybe not. Um
yeah, that was that was another thing
for us. But otherwise, um lots of AI.
Everything is AI.
>> Yeah. Yeah. Well, you are the one
criticizing me for using AI. What?
>> Oh, I didn't criticize you as like I
don't want to make Oh, I don't want to
see that it was AI cuz that [laughter]
is I still I can pick it up so easily
when somebody has just like thrown AI at
it.
>> Yeah.
>> Well, it's inevit Yeah, it's inevitable
now. It's just like Yeah, it's just it's
everywhere and
it's more powerful than me. I find a lot
of things I cannot find myself.
>> No, no, it is you will stay behind so
far if you don't plan on it.
>> But it's about using it correctly and
knowing its limitations like not not
trusted to do a security audit which
when you know it is being blocked in all
sides. You cannot trust that anymore.
[clears throat] So my my trust level
just dropped quite a bit.
>> But it's very useful in so many ways.
Oh, like I say, for me it's almost like
what's happening to our jobs.
Um because for now they still need
supervision, but that's that's fading.
You'll always have a job because you're
teaching, right?
>> Yeah. Well, yeah. I think I think it's
good for people who have experience and
have a lot of experience. I think it's
the in terms of job is the the people
who are doing the implementation okay
will be impacted. Uh because I think the
people who have a lot of experience that
that's I think that's still okay. Um
>> what we doing what are we doing we
supervising right at the moment because
it's not quite there to just let it run
on its own but if you have to tell your
child we like what to go study you're
not going to tell them to go study
coding.
>> Yeah. So it is a bit of a and it came
they warned us for so long and then
suddenly it was here but it is even like
for me looking at different areas of
where where's what's the next thing
because um
we're building things the moment but
like I'm not happy supervising AI my job
changed significantly so like where do
you look and what do you look for and
what's new it's a whole new world for me
to be honest and it really kicked in
this year.
Yeah, I think putting uh one is super
supervision of supervising AI, one is to
because um uh AI make a lot of mistakes
also right uh AI make a lot of mistake
and to be able to you should be able to
spot these uh these errors. It's like
it's making becoming more more difficult
because uh the uh
you need to find something like they
were saying that they they can build a
ship for you but they will miss a a knob
here and there and you should be able
you should be the one who define a
process to find these potential issues
with AI because AI make 99.9%
right but there's a 0.1% that could go
wrong and I found that myself and every
time when I find that I tell the AI this
is wrong and they'll say hey you are
right and and and and then it's I would
say
such a simple mistake why can why do we
make that mistake because some AI
doesn't have that common sense um that's
what I find yeah
and that's still need human yeah
>> to to write
error correcting for AI will be
difficult but sure
>> everyone one is moving away from LLMs
or the the talk is moving away from
LLMs. The academia is more moving
towards multi- aent systems.
Uh this is also a good thing that I that
I listen to. Let me try and find it.
Um lun
this is also a good watch
where he Yeah, where he moves says it
moves or he bets a bit. he bet 1 billion
against LLMs
um to be more and it makes a lot of
sense to me like that multiple agents
can do work together
um because context is expensive to keep
>> so you can also go in the AI direction
in that direction and and try to do
something there
I guess but it it's taking over things
very fast
I don't know what's going to happen.
>> Yeah. What what I heard is that what
what I know is that the engineers be
become prompt engineers. They they don't
write no code. It's a prompt AI to write
the code for
>> at the moment.
>> Well, that's what we are. Yeah. Yeah.
>> I'm not writing code anymore. This is
ended last year. Um we're all
supervising our prompt engineer. I would
rather call myself a supervisor at the
moment, but it's still degrading and I'm
not happy.
[laughter] So, I have to look at
something in a different direction.
>> You kind of like it feels you're okay
when you work with people.
>> So, you kind of will be all right there
for a while also in a rewarding sense.
>> I have a question for you. Yeah, about
that. I have a question for you, Marit.
the I have not written any AI code for
smooth project.
Okay. Are you okay if I start writing
code for smooth project with AI?
I'm okay with it as long as you or I
will review it for you. And I'm also
going to use AI,
>> but um
>> you have to be just like thorough. Like
we do four, five steps when we run
through like reviews, different people
firing their AIS at it
>> because um your AI learns a little bit
with Claude in your personal file and
how to work with you. like mine is
starting to sound more and more like me
[laughter] as I corrected it over time
like how I want things to be to to be um
laid out. Um even my wording my way of
using wording it learns. So um we just
have to be very careful because like you
say it makes a lot of mistakes.
>> Yeah. Yeah. Because but remember last
time when I used AI to convert
programming language from this uh like
uh language agnostic format to to
specific format then I got criticism
from you saying that which
>> it it was a long time ago. I don't think
it was done well if I should probably
have said that and not attack the AI.
>> Okay.
Sorry.
>> Okay. So, I think that make it easier
because uh I think we can do a lot of
things with AI because I I have good
experience with AI now. I know you did
pretty good job. Uh but I do always do
manual. I don't do the automatic because
you can have a auto mode and then you
have the manual mode. Auto mode is just
the they do things for you. And one
thing I found was that uh there were
times it you you said you trust this
directory right you trust this directory
means that they can only access this
directory and temp directory but there
are times when
this guy the claw actually went out of
your directory to find other directories
and I have to stop it saying that hey
you are only allowed to look at this
directory not the parent directory and
then say yeah you are right
>> [laughter]
>> um isn't if you if you listen carefully
how the hugging face um
>> work they created a whole message board
on artifactory to talk to each other
>> to get [laughter]
>> it is absolutely
>> ridiculous um I'm trying there's such a
good link for this as well um
>> I don't know where it
random.
Oh yeah.
Uh listen to this. It's not that long.
Um how Mythos used social engineering to
um to get a vulnerability into code.
>> Okay.
>> It's absolutely shocking.
And another thing is that they um they
also like AI they say okay uh I want to
open the browser to test this issue do
you allow that I don't allow AI to open
the browser for me okay or
>> token which is very limited on what it
can do on GitHub um so it's limited with
a token on my on what it can do there um
But what it reads, you know, it it is
not it's not safe. They they can see
what it reads.
>> Um
>> yeah,
>> and and my own directories. No, you have
to be careful. And I gave it access to
my work directories, but I mean
everything in there is work. But it will
jump. It will 100% jump.
>> Yeah. Yeah.
>> You have to use it in a virtual machine.
That was my conclusion. How to make this
safe? I box it off in a virtual machine.
That's the only way.
>> Oh, I use a a dedicated machine. Uh it's
not a virtual, but it's a it's just it's
a server just for for programming. So,
so
out, right? So, you're okay.
>> Yeah. Yeah. Yeah. Uh but I think they
are a couple of things are still ending.
So, I'm glad that we Okay. we we we can
use AI to uh to do the programming more
smooth that that that opens some up some
opportunity and there's still something
there. Yeah.
>> If we don't start coding with AI and um
if you have ideas because that's where
everyone just take your ideas and throw
it at the AI and see what comes up. We
will janitor it into a good thing. But
it's really now about people that still
have good ideas. Not not so much of how
we built. That's the supervisors now
over AI. But yeah, put your ideas in
there.
>> Yeah. Yeah.
>> Build out the prototype. So easy for us
now. Like if I think of how long it took
for a bank just to to get a prototype up
and have screenshots and a little demo
for them. Now it's quick quick quick
quick.
>> Yeah. Very very quick. Very very easy.
And and so but I still limit AI for
several things. First thing what the
cloud have been asking me can I commit
this code for you? No I don't allow them
to commit the code because once
>> token
>> yeah they can we have a like a SS token
right you can give
AI the access token and they can commit
the code to the repository. So that's
one thing though I still don't
>> manually um I ask it to do manually for
me. there's no way to enforce it other
than the token. It will still sometimes,
like you say, just do things and slack,
but this is in your rules. You're not
allowed to do this like, oh yes, sorry,
that was on blah blah blah blah. Um, but
if you give it a token, it can only read
it.
>> No, they were right. Right. Because they
want to commit for you, then you have to
give them the right permission. And I
feel I still feel like
>> a separate token with only read access
and you this is what I mean with you
force it with a token.
>> Oh, okay. Okay. So, don't let them
commit. Just let them read. It's okay.
Don't let them commit.
>> It was still like committing on a PR.
I'm like, what? It's in your rules that
you're not allowed to do anything on
GitHub and it still went to go do stuff.
Then I just made a token that actually
it my company had had to make the token.
It was strange. Um, with Claude
settings, I couldn't use a personal
token. It had to be a companywide token,
organizationwide token. Strange, but
anyway.
>> Are you talking about GitHub or GitHub,
right?
>> Okay.
>> Okay. There is a there's a there's a
classic token which is accessing the
whole repo and there's another one
called granio
token. Yeah. grain token that has the
organization uh uh kind of priority and
the security level and then you can
rewrite to certain repo. So that will be
the one for
>> this one that you have to use your
organization that owns the repost must
just it must be in their name.
>> Yeah. Yeah. Yeah. But but I so far I
have no sometime they say commit right
it's always commit to a particular
branch. I do not see the limitation on
PR. For example, if I if I allow uh
cloud to commit uh I would like it to be
a PR commit a PR rather than to commit
uh directly to the main branch. So, but
I still don't know how to do that yet.
So I think maybe we should set the rule
saying that if we use AI to commit they
can AI can only commit as a PR and we as
human need to approve the PR that would
be good%
>> like you want to go full auto already
like let it write code for you first and
let you manually commit and push um
otherwise it's going to run out straight
underneath you if you let it make PRs
and like next thing you push into all
kinds of branches and stuff Um, y I
wouldn't let it go free like that.
>> I would say I mean I do ask it sometimes
to make a PR locally.
>> Um, and like you can ask it anything and
it has you can give it um rules in in in
its personal files.
It's okay. I just you can't rely on him
always following the rules.
>> Okay. I think we could uh tomorrow when
we have meeting I have been thinking
about this. is about Cosmos
relationship, right? Of course I I know
Cosmos code a little bit uh the IP it's
called IPL or uh they they they have
interbidity for a long time as well and
I think the only way so far to
consolidate the ideas together is to to
leverage AI which means that okay we
have our um specifications we have smart
contract on both sides and we have the
the layer and then and then they have
their own thing as Well, right. They
have connectors and the things we can
just agree on some high level like
almost we work on the prompt and that
let the AI write the code for us
together and this way we can probably
build something that's common
>> trying to integrate with cosmos and no
one really made a success out of it. So
the only hope is AI. [laughter]
It was so complex in general. Nobody um
really managed to do interrupt with they
had their thing and they wanted to make
their thing a set standard and anyone
had to do everyone had to do what they
wanted to do. Um so so very little
interoperability happened there. And
like yeah like I say if you throw the AI
see what comes out. I just I think it's
going to get very complex very quickly
>> in
I know I know that's why I would think
well initi without AI I would not like
to touch I because I touch it before
yeah I don't like to touch again I but
AI can help us with this
>> let's see what's a mess you get
[laughter]
>> yeah
yeah
>> we can see right like interesting
interesting um use case see what it
comes up with maybe it gets a really
clean solution which I don't
>> yeah but we can kind of compromise on
certain things right and yeah uh
>> okay okay
>> based on their email they're just
looking to contribute IBC as an LFDT
project
um but because Smoot already exists and
there's conceptual overlap
there's this call so I think their
their goals are going to be pretty
narrow I think.
>> All right.
>> Yeah.
But IBC had been tried many times right
already. Uh in fact the the cacti
project was kind of I think it stem from
IBC originally. Uh
so I yeah I I think they they should
have some flexibility but let's talk to
them together. And I think now that we
talk about AI, we can if we can have AI
implementation and then just put the
high level thing, agree on some high
high level things and then maybe there
can be something there could be
something good out of it.
We can only see
>> it looks like Linux Foundation is
picking up all the strays [laughter]
and Cosmos is coming in into the under
umbrella as well.
>> Yeah.
Uh, one other kind of Smoot related
thing is
I'm [clears throat] not sure to what
extent this is present in the current
codebase, but the original pitch for
Smooch was that it would be compliant
with the EA standard. Um and it seems
there's some
developments on that side in terms of
the interro working group and its future
um as well as new
um Ethereum backed alternatives to the
EA, let's call them. So that might also
be something that needs to be considered
for the SMO project because if there's
going to be no further work on the EA
standards for interop then
you know we should separate SMO from
that.
>> Yeah. uh that I think uh Red Wang uh has
been communicating with me uh then uh he
is trying to expand the uh EA's inter
work group maybe even to rebrand it and
then he's trying to he's asking people
who are interested uh but I haven't got
the followup from him yet who who
actually are interested uh but no matter
what they
>> you sent a uh you sent like a public
message in the in the group and uh with
that with that message like anyone who's
interested to contribute uh but zero
people have responded [laughter]
>> well that's publicly right so I'm not I
think he yeah he he he said he's
approaching people he's looking for
people who are interested in uh so yeah
and yeah that that that is I think if
there are people interested there could
be some new things over there and then
we can also if if there are no other
people interested did if we have some
ideas out of it and we can also bring
back to ES back as well.
Yeah, I think there are certain things
like uh originally we we hope that the
uh zero knowledge prove is there uh and
but I think without AI is very difficult
for us to implement things like that. Uh
so yeah let's see if we agree that okay
we can use AI to code it and then yeah
that open up some opportunity as well
always bring in lots of time to get it
to a production level because it can it
can write a lot of crappy code that
needs to be janitor.
So very quick for proof of concept that
the right production grade code it
um yeah I wouldn't leave it on its own.
Yeah. Yeah. Yeah. Well, that's one good
thing about open source, right? Open
source, we don't need to bring it to
production immediately, right? I think
it's the we just need to make sure that
this thing has traction, there will be
people who are interested and then we
can if there are people interested, then
we can spend more time to kind of bring
it from PC to to production. Um,
>> right?
Because I personally wrote something for
my own personal thingies and like it's
good for me to use but I will never put
that in production. I can hand it to a
group of people and say like you make
take it to production but not use like
that.
>> Yeah. Yeah. Well then that's the one
good thing about open source you know
it's we liability we we don't take
liability directly. Uh so so that's
that's there's a buffer on that and also
I'm thinking about all these security
things is
what we spend a lot of time a lot of
time on security already but still
things happen right so one thing I was
thinking about security is that well we
should not put the smart contract to be
in charge of too much asset the the the
risk should be distributed it should not
be that one smart contract take uh
a lot of money can lock a lot of money
on only because we can have multiple
smart contract multiple instance.
>> You try to avoid your honeypot contract
which is your escros your bridges that
holds cash and things like that. It's
something you want to avoid in general
if you do a full full on security audit
on things like honeypot contracts is no
good
>> actually
good. We want the cryptographic proof.
Um
>> yeah security point of view.
>> Yeah. So yeah many know because this
open when the source is open they're
always easy to find security holes. Uh
>> if you have somebody that looks at it
otherwise it also just lies there. I
wouldn't trust the public to find my
holes either. It's bad rep.
>> Yeah. Yeah. Well, there were times that
uh people pointed out that there was
some security issues. Uh those are good
people. They they actually found it and
then they tell you uh so but but in
general you you want to have audit
audited team but even audit the teams
don't find issues sometime they don't
find issues like critical issues. Um,
>> oh, I hope things will become very super
secure with with um with the emergence
of AI finding because like I mean it
puts any security order to shame the
things it finds.
>> So like I I believe we're going to have
a very the world of the hacker has
changed, right?
>> Yeah.
>> And it's not going to last for too long.
Like it's that now a big window that
opens, you know, like when when the
internet just started like for a hacker,
I was one of them. it is a public
library. You can just get in anywhere
and until people became security aware
and things changed. So I think it's
going to make for very secure systems in
the end of the day. Um because everyone
has access to make their stuff secure.
>> Yeah. Yeah, the another thing is that
the the AI can have some improvement as
well. Just like uh when they find SEC
high security issues, they only disclose
to people who have the right or who who
at least there should be a promise
saying that they are not going to
leverage this these vulnerabilities
uh violating the the law. So at least
there should be something like that. Let
disc
that was just merged into Signara says
that like if you find a which is
borrowed from the Linux Foundation um a
security thing is if you find anything
not to make it public but to contact us
on private channels so that that is sort
of protocol. Oh yeah, there's a security
tab. Uh they say I I there's a security
MD. I think I saw that file just like
there's a private channel to report the
security issue. Yeah.
>> Okay.
>> Okay. I think Yeah.
>> Let me see see what Cosmos wants.
>> Yeah.
Okay. I think uh good that we some uh
consensus about using AI for the
project. I think that's that's good. I
feel that we can do more things now uh
using AI. Uh
>> yeah, like you you can't not like you
wouldn't survive in a world um if you
try to to go without it.
>> Yeah.
>> Just be careful.
Okay.
>> Um,
yeah, there's nothing else from my side
that I can think about at the moment.
>> Yeah,
>> we would like a release this month. Um,
because not just a dependable things.
There's also the type one transactions
in the signaring.
>> So, we're also trying to build something
also with AI but um on a privacy side.
So we're still working actively on on
signing.
>> Yeah. And the on the scenario you uh we
want to publish a kind of blog, right?
Uh do we do we want to have that uh
ready sometime or you what we can do
this later but do you want to drop uh
>> uh we should have done it in the last
release. I will when I make this one we
can we can do a little blog even if it's
just highlighting of explaining a little
bit what was done in the change log
because that big one that I brought over
with all the little fixes in it
>> they don't need to know about all the
fixed in there and there's still a lot
of things that needs to be fixed
>> I need to
>> last time you you want you bi want to
write the first draft do you still want
to do that or well I can help with
writing some of that as well.
>> You can start if you want. Otherwise,
when I make the new release, I'll I'll
have to to give you something to review
um for a blog.
>> Okay.
>> But it's good. It makes it look like
it's alive, right?
>> Yeah. Yeah. Yeah. Yeah. And also people
want to know about it as well because
they this year they they I was asked
question about uh scenario as well.
Yeah. I think we should have a article
ready. We may not need to publish right
now but we can have it ready. Uh so you
I yeah either you or me uh I can yeah
once I write it I'll let you know and
then uh you you write and let me know if
we have time. Yeah.
>> Okay. Okay. Yeah. Okay. Tim, do you have
any anything else to add or we can close
this call that for today?
>> Nothing else.
>> Yeah. Okay man. It's nice talking to you
and then uh we can we can sync up. I
I'll try to write the the blog at least
for the first version. Yeah.
>> Thank you.
>> Okay. Okay. Thank you. Okay.
>> Chat tomorrow. Okay. Okay. Chat. Bye.
Bye. Bye.