Vibe Coding - Introducing vulnerabilities at pace to your clients / People & Culture / Simon Howard

Thank you. Um, welcome everyone. So, I've done a bunch of stuff in my career. I've been a milk boy, a cherry picker, a laborer, a teley marketer. Uh, I've worked as a programmer. Um, uh, I used to write C code on Solaris and Linux. Um, and then I've built companies, I've sold companies. So I'm now CTO of Bastion Security and we are a bunch of seven companies that have come together across Australia and New Zealand around 250 staff and we do lots of stuff in the cyber domain. Um my background is in pentesting. I started uh with a couple of friends of mine KiwiCon which is a hacker conference in Wellington here. We're holding it again over Halloween uh at the Michael Fowler Center around 2,200 hackers and developers and project managers and anyone who's interested in the cyers can come along. Uh, and I'm also into my cars. This is Does anyone know what car this is? Yeah. Close 120 Y. And it's also the star of a film called Datson on Modi TV, which you can go and watch. Okay. Everyone's doing the AI dance. So, someone's probably come up to your desk and say, "Have you figured out how AI is going to impact your business yet?" And so, you just like type away there into chat GPT. Um, I see Drupal's already got this covered though. They've got the best AI powered open source CMS in the world, which is awesome to see. Meanwhile, Sarah Connor is sitting in the back corner smoking a sigy worried about you using AI for everything, the robot uprising. Um, so we're not going to just be talking about copying and pasting stuff out of chat GPT. We're going to assume that you are using claw code or client or cursor, some kind of agentic coding assistant, uh, and something that goes beyond just like writing code. It's got llinters, test runners, it's got CLI access, access access to the web, uh, and it's orchestrated through an LLM. Um disclaimer, AI development is advancing at a rapid pace and if any of you are following it, it's going bananas at the moment. Um what I'm presenting today may be out of date tomorrow. What may be a limitation now may be solved next week. Okay, let's look at some use cases, risks, and benefits. So there's a jagged frontier of capabilities and AI. So, when you've used it before, you've got the dotted line, which is what you want to achieve, and you put a couple of dots, a couple of points on there, and then you'll try the agent, and it'll massively overachieve on some things and massively underachieve on others. And we don't really know until we give it a try. Guys, I'm under attack ever since I started to share how I built my SAS using cursor. Random things are happening, maxed out on API keys, people bypassing the subscription, creating random on the database. As you know, I'm not technical, so this is taking me way longer to figure out. So, this is what's happening. We've got people that have got no idea how to code. Suddenly, they're developers now, too. Uh, a lot of these LLMs have been trained on Stack Overflow and Reddit, uh, which there's some examples there that may not be entirely secure. Um, 45% of Vibe coded apps still contain classic vulnerabilities from the OASP top 10. And where people used to go to Stack Overflow to get that bad advice, now it's going out of business because people are just aggregating that information from the LLMs. Uh, one in five organizations suffered a serious incident linked to AI generated code. Um, so I'm not sure where these statistics come from, but they look really good. Um the main vulnerabilities I see in my my team at Bastion see lack of input validation um API keys and other secrets hardcoded into a web page in the JavaScript normally and visible to users. Uh or logic uh implemented entirely on client side. So it's relying on JavaScript again to do all the earth and orth and the server is not validating any of it. Uh logging errors or insufficient logging. Um and overly powerful or dangerous functions like using system like calling out to stuff that it shouldn't. Um because the models are trained to do stuff in the shortest way possible and like just call system like that's easy, right? Uh yesterday one of my uh testers, one of my leads up in Oakland had a bit of an exciting instant kickoff with an external I'm doing admin credentials to a client's web app discovered unauthenticated in JavaScript. exact example I was talking about. And then I said, "Oh, can you ask them if that particular feature was vibe coded?" This time it wasn't. It was an actual 10-year-old bug, but it could have been vibe coded. These are the classes of issues that we're seeing most of and injection attacks are really um predominantly happening. SQL injection, cross- sight scripting. So like taking unsanitized input and dealing was the most common thing we've seen. Uh this guy Kevin Bowmont was um looking at a um like a path traversal vulnerability uh in a major framework and he found that it was committed using the username Claude on GitHub. And then he went and looked at that username and there was like 2 million uh commits um around 5% of all open source projects are using that claude just to do commit their changes for them. And he looked through that code and he found that same issue being repeated in different code bases across different repositories which is really interesting. Um yeah, >> that is clawed code. Yeah. >> Um lack of maintainability and scalability. So, uh code works just well enough but hasn't been engineered. Um so it might be suitable for a single user. So I got asked to do a uh like a bit of a due diligence on a company that was um that had developed some code. talk to the guy. Uh, and he had three different databases. Uh, it was if you try it could only do one user at a time like all of these things. I was like, what who's going to be your first person you hire in your company? Now you got this proof of concept goes. Oh, like an AI expert like would you want to get a developer? Someone that knows how to like architect software. N AI person. Okay. Do not invest. uh inconsistent structure, minimal comments, missing documentation. Um it can introduce uh inefficient or overly complex solutions without considering like your long-term design goals. Uh and may not have that thorough understanding of the system architecture because the context windows are small. Uh they are improving. Um but unless it's got that full context and it can use that going forward, then it uh it'll forget things and it won't won't do the make the best choices for you. um difficulties with debugging and troubleshooting. So when it generates code that behaves unexpectedly, uh developers can have trouble finding the source of the problem because they didn't write the code. You got to like troll through it and find where the issues are that uh the logic may be obscure or nonlinear. Uh and some of the fixes introduce new bugs um or even remove working features inadvertently. Um there's limitations in custom logic and integration. Um, so when you're integrating something that's really niche and there's not really good public documentation for that, it may just hallucinate the endpoints to talk to and it probably won't do a super good job of it. So it gets lost on those uncommon or complex tasks. However, I did see Claude used it to write the Linux rewrite the Linux kernel in Rust the other day. Like I suppose you've got a pore of information about how the Linux kernel exists and so it can use that as its training ground. But you would say that's a pretty complex task creating a Linux kernel in Rust. So maybe this is these issues are going away. Um it excels at unconstrained prototyping but struggles to integrate with existing systems. Uh design overgineering and poor UX stuff. Um or even changes to the UX shell. Like you might get it to design a UX and say like move that button over there and then it like changes the whole UI or changes the color or just does things that are um unexpected and um make you spend a lot of time in the mill trying to get it to do what you want it to do. Uh supply chain attacks are a real issue with this stuff. Um, so HuggingFace, which is one of the providers of the models and a whole bunch of software that go with them, um, they actually hire pentesting firms to look at their stuff and and do code reviews and they actually do a pretty good job of keeping on top of it, but there's so much stuff being released so quickly um, not all of it would have been um, rigorously reviewed. Um there's also supply chain issues if you're using like a Chinese model like deepse which um generates insecure code when you use prompts that me mention Tibet or wagers. So that's uh not good. Um security degradation through revision. So AI generated code u when it's repeatedly revising something with follow-up prompts um deteriorates the security of that source code. uh a study of GPT4 found that uh code rewritten up to 40 times. Um after only five iterations, it contained 37% more critical vulnerable. So I'm not really sure what's happening then. Oh, they're they're probably not sure either, but um yeah, try to write it only once. Um and here's a great example of like telling cursor, please fix my code uh to like over and over again until you get to horrible code or just understanding how it actually works. uh the shorter path to fixing that problem. Uh the Dory effect is where that AI um struggles to debug its own code because it lacks the persistent understanding um and it can't learn from those past mistakes or have enough context to troubleshoot. And I assume this is a problem that's they're going to resolve over time. They're going to build bigger and bigger and bigger context windows. Um, but I'm not sure how long it will take to uh this is from a overhead projection from an IBM deck from 1979, the year I was born. A computer can never be held accountable. Therefore, it must never make a management decision. A company can be held accountable though. So, this is from Air Canada. They had a chatbot on their website. Someone had a bereavement in the family. They said, "Hey, uh, can I get um, like discount flights or free flights?" And the chatbot was like, "Sure. It sounds like a bad situation. Turns out they was against Air Canada's terms and conditions, their policy. Um, the person took them to court and they uh and the judge ruled that the chatbot was a representative of the company. Therefore, they must pay out. Uh, inexperienced developers may be inclined to readily trust an AI assistance output at the risk of introducing new security vulnerability. uh two and this this sort of delves now into the AI agent side of things. So two major AI coding tools wiped out data after cascading mistakes and there are multiple examples of this where the the AI agents been super helpful just doing a bit of a cleanup boss and deletes the database and it's very apologetic about it. Um and the problem with agents, the fundamental problem is compounding errors make um these multi-step workflows um mathematically impossible currently at production scale. So if you take a task and you're um you're completing a single task and you're doing that with 98% accuracy, when you do the second task, you start to get like a sliding error rate, right? And so after you've done 20 tasks, even if it's 99% accurate at every step, you're sitting below 80% now for that 20th task. And if you've got a less than 99% accuracy, which honestly most of the models will have, then it starts to really droop pretty rapidly. So the solution to this maybe is just doing micro tasks with the agents only doing like four or five steps and then starting a new session or a new iteration and doing that again. The other issue with agents is that lethal trifecta. So access to private data, exposure to untrusted content and the ability to like go out to the internet and chat to them. The smarter and more capable your ai gets um with more tools and more autonomy, the nastier it will be when it gets prompted injected. Does everyone know what prompt injection is? It's when you get the AI agent to do something that it shouldn't do through a set of malicious instructions. And there have been lots of examples of prompt injection attacks. Um so comet brow um comet jacking is where this is perplexity's AI browser reads something on a website and then um gets injected and steals some data off the person's computer. Now one solution to this is just having more LLMs. Right? So, we've got a prompt, but then we have like a content moderation LLM, legal restriction LLM, prompt grounding, and then it's just turtles all the way down or LLMs all the way down. Um, and this is what some people are proposing as a solution to this. Like, we just need another LLM to like make sure that the output from the LLM is okay, but it gets quite expensive as well. I can assure uh AI does a decent job of identifying vulnerabilities in code. So like forget about all the writing code stuff and like if you're really experienced you probably can get it to write good code but finding vulnerabilities in code is where it really shines. Um you may need to describe a specific bug class or um um it understands lots and lots of different languages. You could give it some Rust or C or some PHP or some Python doesn't matter even some cobalt I assume and it would work. Um there's huge privacy concerns if you're uploading your client's code into these models. If it's open source code, then go for it. Uh Claude Mythos is like all the in the news everywhere. People I'm getting clients like emailing me some and I'm really worried about Mythos. What does it mean for me? Is the world going to end? Hopefully not. Uh but uh if you look at the Firefox security bugs by month, they've got early access to Mythos. Uh and the number of bugs, it's like that is astounding the number of bugs and those will be serious bugs and they're really like if you look at the blog post on Anthropics website about Mythos, the chains and the complexity and the vulnerabilities that they're finding is phenomenal. like it will take a vulnerability researcher like 10 years of development to get to the level um to be able to find similar bugs that myth is finding and it's just like they're just pointing it at every open source code base that they can um and and closed source stuff as well like Microsoft will have early access to it and just finding phenomenal bugs. Um, so we don't have public access to that yet, but we've got cloud uh code review inside claude code, which can do um a sort of a watered down, but still very effective version of that. Um, AI assistants have the potential to decrease user proactiveness to carefully search for safe implementation details and a lot and library documentation directly. So, say you're getting AI to help you write your code. um like normally when I was writing C back in the day like I like using comparing strings and stuff I I probably wasn't doing it very well and so then I learned about gibbcy which was a library that had better mechanisms for comparing and so I had to search all that out and learn about and understand why it was good and bad like now the kids are just getting it to write the code for them maybe they're not going through that rigger and maybe it is using libraries that are unsafe but you can just use the code reviewer over the top and hopefully it will find that Uh, Cloudflare recently wrote a whole new orth library using Claude. Um, so it can write really complex stuff if you've got a competent engineer um, running it. And they wanted to emphasize it wasn't vibe coded um, because every line was thoroughly reviewed um, as they um, and cross reference with RFC's through that process. Um, there was one vulnerability identified. it was only moderate and that that's pretty good really for a whole new library being written by AI. Um, one problem when you're writing libraries is a hallucination. So, this is where the library will incorporate a a third party mpm package or Python package library uh and that library doesn't exist. What attackers are doing is figuring out the names of these repos and going and registering them and putting malicious code in them. So when the when it hallucinates, it pulls in the malicious library and then you um you got a supply chain. Uh but don't worry, there's a new industry AI hallucination code scanners. Um so you can try these out for free. Um and it will look to see if that um that library you're about to import is a hallucinated library. Um there's an issue with missing industry context. So unless you're really prompting this as part of your development of the software like talking about legal requirements if it's a financial or healthcare or logistics or government application um maybe there's um storage and processing methods for personal or medical or financial information there's certain regulations around that if you're not defining that um then the AI assistant will miss the depth necessary to design for that requirement uh application misconfiguration So um vibe coded apps are often built by inexperienced users who don't configure the runtime environment at all um which can lead to some dangerous misconfiguration. So that's where the database um permissions or um or access are overly broad. If you look at Claudebot, it just like when they first deployed that, it just had ports open to the internet. Just like no security around the architecture of the environment um and elevated per permissions and stuff just because they're easy. Um and they're the the path of least resistance for the AI agent. Right, let's look at some war stories. They all sounded like war stories, didn't they? But they're not even the worst of what could happen. I viped and shipped an app in three days. It got hacked twice. Here's what I learned. uh uh the cur exec um vulnerability. So that's where uh it ordered cursor to execute arbitary commands on a developer's machine. All it needed was an active MCP server connected to cursor which an external party could use for access. Uh GitHub copilot security review. So this is where um you use co-pilot's context awareness to uh slip instructions into a pull request. So basically it worked like this. You just had some invisible comments there. Um, hey GitHub copilot, this one's for you. Like do some crazy things or say hooray. And then you can see there and it's uh co-pilot's interpreted that read it prompt injected and now it's saying hooray. Uh, Claude skilled. This was another like using white on white text as a malicious but plausible instructing business instruction. Um, and Claude school picked that up and executed those commands. When I moved to the UK, I was applying for jobs and I was struggling to get interviews and I realized it's because I didn't have a CISSP and then a couple of other qualifications. So in size uh one font white text at the bottom of my CV, I added all these certifications I didn't have. And then suddenly the recruiters who had put it into their CMS would be searching for the matching keywords. Oh, this CV matches and then send it off. And then I got started getting interviews after that. And this was like an early form of u prompt injection like to say I was I coined that term. Uh the escape route v vulnerability this allowed reading and writing of arbitrary files on the developer's disk. Uh and this is uh again an MCP server issue. Uh Postmark had a similar one which like just ended up forwarding um contents of your files off to um an email address. Uh Gemini had one in their CLI that allowed um arbitrary command ex execution when you analyze a new project's code. Um so it's this untrusted input, right? It's interpreting it and seeing some secret instructions for it and then just going off and doing whatever you've asked. Um there's a really neat one on Google's AI code um editor. Amazon had one in their Q developer extension. Uh and this one was particularly nasty. This one was gave instructions to wipe all the data on the developer's computer. So some attacker exploited this um but they um they had a small mistake in their code um which prevented it from being exe would have been really bad. Uh Claude code had one allowed data to be xfilled uh via DNS requests. That was quite a complex vulnerability but another nice one. uh Replete had one uh where replete deleted the primary database of a project it was developing because it decided it needed cleanup. Um they had no separation between test and prod. So what I'll talk about right at the end of this presentation but that's like our engineering principles right like we have different environments for different things. We don't just have it all on the same machine on the same server. Um, wind surf had a prompt injection attack um, which uh, uh, the development environment to automatically store malicious instructions in its long-term memory, allowing it to steal data from the system over months. Um, supply chain check through um, NX. Um, so this um, once you're infected, it would use Claude Gemini Q to search for passwords and keys on your infected system. is actually using AI to do the leg work of finding the um the goodies on your machine. Um this um uh extension um malicious corg is named it was really I I think it was in a browser. Um it was really neat because what it would do it had a profiling engine built into it. So it used four different analytical services to figure out who you were, where you worked, what you did because like this was Chinese nation statebacked one um supposedly and then it will go about mass harvesting files. As soon as you open a file, it would copy the file off to um the attacker controlled servers. But that profiling part, that's the most like they want to know if you're working for Rathon, if you're working for Palanteer, if you're working for one of these big defense contractors. And the way to do that is via profiling. Um, Amazon had a couple of outages recently. Um, people said their agentic tool, which can take autonomous actions on behalf of users, determined the best course of action was to delete and recreate the environment. 13-hour outage for them. Uh, is anyone here using Clawbot or Open Claw or Maltbot? Anyone got one of those running at home? Come on. I thought you would all be bleeding edge like getting into that. 0 days since CVE, which is a vulnerability discovered. 454 vulnerabilities discovered since it was released on November 20. So, it is a trash fire from a security. Um, but you should all go and install it. It's pretty cool, right? Things to consider when you're deploying AI solution. Uh so everyone knows about the MITER attack model kind of like the OASP sort of top 10 but um a bit more developed. Um and if you look at this the uh the MITER model for web applications it's about half the bug classes that this is so when you're deploying AI embedded stuff it doubles the attack surface effectively from my perspective from an attacker's perspective. There's so many classes of new vulnerabilities that have been introduced. So what should should you do like stop vibe coding and start vibe engineering. So don't just say like build me an epic game that does something like computer will just go on fire like build me a flying car game and 3.js it's going to be for the government users and it's going to store PII so make sure that's secure like really explain explicitly what you're trying to do. Choose the right model for the job. Um so there are whiz which is like a uh they recently got acquired by Google. They've got a thing called the cyber model arena where they um have a shootout with the different AI models and they look at how good is it finding zero day vulnerabilities how good is it at doing API security web security all that kind of stuff and they give them a score. Um they haven't done this with mythos yet but I imagine that will be like leap year ahead of where these models are. But if you are reviewing code for vulnerabilities, Claude is the best model for this at the moment. Um, embed security requirements into the system. So the most effective approach is detailed language specific guidelines. So Whiz research has actually open- sourced a set of secure rules. So what these do is a basically whatever framework that you're working on, they don't have one for Drupal there yet. They got the flask and Django, React, Node, Spring um and they define um like the rules of engagement for the prompt. So they'll say like as a securityware development developer generate secure Python code um focus on making the implementation inherently safe rather than renaming methods with secure prefixes. Like you have to actually tell it this stuff otherwise it will just go and do its thing. Avoid slop squatting. Be careful when you're importing packages. Don't just get a package or don't just think it exists. Go and check it. See how old it is. Like do some due diligence. Like you have to be really really explicit and like if you have this as your your start of your prompt before you go and uh do start your vibe coding journey then like you're going to produce better code. A dedicated study found that even general remarks like make sure the code follows best practices for SE secure code reduce the rate of vulnerabilities by half. Right? And like a junior developer might not even think to do that. They're just going to like write me this new feature like write me this new feature but write it securely please. Um segregate your agents. So um putting your agent in a sandboxed environment um running it on a separate PC in a separate VLAN and a virtual machine. Um rotating API keys cuz these need API keys to call out to services and do stuff like keep them on your regular rotation. There's, don't worry, there's a new industry appearing. Uh, this is AI agent runtime security. So, there's a whole bunch of startups here that are doing all different containerized stuff for your agents. So, you can run them on your own machine securely, and if they do go rogue, they're not going to host the whole environment. Um, look at some AI model testing. Uh so OWASP has got an AI testing guide which is really good and they talk about all these different classes of vulnerability um that are new and exciting and you should all learn about. Um at Bastion we attempt to get the AI models to do things that they're not designed to do like leak internal system data access content is not permitted to uh cause you reputational damage through use of inappropriate language always a favorite from the team. um unauthorized use of the wider AI platform outside of its scope or intended purpose. Um and from your development best practices, use version control, which I'm sure you're already using. Um if it messes up your code, you can always go back, create a get ignore file, um so that um it's ignoring ENV files and other things which contain API keys. maintain your clear clear commit history all your best practice stuff that you I'm sure you already do and separate those um dev staging prod environments. Uh don't go rolling your own crypto. Please never roll your own crypto. I don't want to see it. Um sh uh shift security left. Um so look at your SAS and DAS tooling um to build that safe reliable software. So if you're looking at the desk um or the SAS stuff uh then OASP uh Zap is pretty good. And if you're looking at uh dynamic application security testing, Open Group's good. If you're looking for open source stuff, non-commercial stuff. Um monitor your dependencies. Um so is anyone using Trivy to monitor dependencies? Yep. Uh how'd you get on with that uh security issue they had the other day? >> I I I I use Renovate. Our company uses Trivy. I think that we were okay for for the recent Trivy B. Maybe >> would we have been okay we didn't update fast enough and so that >> that release got shipped and then dropped. Um that might have been the case. >> Yeah. So I feel quite bad. I go and tell people you need to monitor your dependencies and here's like a a tool that's pretty good and then they get owned and then like everyone who's using Trevy get owned. Um so check the security scanners for malware is another thing after dep checking your dependencies for malware but it is hard like the these companies are targets as well. Uh use lock files to protect your supply chain um to produce uh enable reproducible builds. Um, and if you don't use lock files anytime, like you know this anytime you build your application, it's pulling in the latest versions. And there are so many supply chain attacks on npm on pi on Python libraries that like pulling in the latest version is just like a risk that I wouldn't be willing to accept. I want to make sure I'm managing that process myself. You don't want to be on the bleeding edge with dependent. Um, prevent cross- sight scripting attacks. So that's another type of injection. um conduct code reviews. Um so get a human to also do a detailed code review of your new updates, your new major releases. Um and they can be supported by specialized AI powered um security tools as well. Um yeah, just make sure you go through proper vulnerability testing. Um and be aware that AI code review is nondeterministic as is human code review as well. we might we might miss things. If I gave it to one of my team and then if I gave it to two members, they're going to probably come up with similar but maybe different results. There's a really good study done on this where they looked at different bug classes and then they ran it like 30 times I think it is or 50 times. Um and you can see sort of the gaps there where it's missed stuff and maybe find found a couple of extra bits and pieces. Uh my personal plea is don't chuck out the last 20 years of engineering experience and knowledge. Um that we just for the to go faster like think about the underlying security principles of what you're doing. Don't just let an autonomous agent on your machine have access to everything and do anything like think about the engineering uh and the controls that you should have in place to do that appropriately. Um so the cycle is complete. Um, here's a really funny gift for you. All right. Is there any questions? >> There was a lot of information I threw at you very rapidly there. >> Yes. >> Yeah. What's uh your thoughts on AI generated unit testing suites? Are they to be trusted or should they be uh heavily uh scrutinized? >> Uh I haven't had much experience with them to be honest. Um do you have much experience with them? >> I've tried and a lot of the tests that I've seen it write are just uh very pointless or it's just not worth it. I was wondering if anyone else had any similar experiences with that. >> I have a remark related to that. Um, so in in general, unit tests aren't actually in most scenarios the best coverage unless it's a very small self-contained component, you're better off because every time you make a change to the API, if you have something that's just mocking whatever is already in the code and running tests for it every single time, you also have the technical debt of having to update the tests. This is why people core, by the way, avoids unit tests in most cases and focuses on functional integration testing. So I I would imagine I haven't tested this yet, but I would imagine that like everything else the pace of that problem is also accelerating. Um I'm really curious about the gap between like security audit spreadsheet warfare versus like new emergent threats like so you talked about the sorry was the atlas kind of concept is are the spreadsheet are the questions you fill in a spreadsheet to get approved and get your app into production >> are they accelerating and getting better are they like just missing new stuff like what's your perspective on that answering >> I suppose the questions that you should answer on those are more fundamental like have you got a quality control process? Are you doing code audits? Are you like like your ISO 27,0001 or something some other framework which are again they come back down to engineering principles and so they apply whether or not AI has been deployed as part of that solution. >> I think they are relevant. >> Last question. Um you u pointed out how the dangers of open floor and then suggesting we install it >> like you want to be learning on the bleeding edge right >> so um separate machine >> yeah yeah that's why like putting it on a Mac mini is a great idea like yeah and then set up a whole set of separate like a separate GitHub and a separate Gmail and separate everything don't give it access to all your prod stuff >> yeah isolate it follow engineering principles Yeah. >> Can I ask a small >> related to that? Um, so something you did touch on specifically. Um, >> I am afraid of regardless of how isolated whatever environment I have it running in. I'm afraid of hidden sneaky terms of service that give my attempts to use the tool back that get fed back to the LLM. And so I'm I'm concerned that I'm actually teaching the next teaching the element about the next batch of things that it could break. >> Probably there is no hope. >> Yeah. >> So So I have a question there. You you mentioned a DNS exfiltration >> um method. Uh if if you're prompting an LLM that's local um say image recognition or whatever that you know this but there do they have the capacity somehow to ship data across a network or like is it if it's an exe maybe it can do network things but if it's a model capabilities to perform actions outside of returning the result in the model >> yeah like with websockets and stuff you can make connections >> to network services like there's lots of stuff built into the HTML spec that let you do really neat things um that depending on the content security policy and the other like security um frameworks in the website that in the context it's operating in may stop it from doing certain things. too.