Magic of Automation and Everyday Chores.pptx

@Jamie_Lee_C
Jamie L Coleman
Magic of Automation and
Everyday Chores
JCon 2023

@Jamie_Lee_C
Introduction
About me
Name: Jamie Lee Coleman
Current Role: Developer Advocate @ Sonatype
Past experience: Developer in Mainframe Software (CICS), WebSphere & OpenJ9 @ IBM
Twitter: @Jamie_Lee_C
Linked-In: https://www.linkedin.com/in/jamie-coleman/

@Jamie_Lee_C
Not just the Maven Central people

@Jamie_Lee_C
Agenda
1. The Artificial intelligence revolution
2. Current state of AI
3. Advantages of AI (AI Generated
slides)
4. Disadvantages of AI (AI Generated
slides)
5. Should we be worried?
4. Uses for AI and Developers
1. Productivity
2. Static Analysis
3. Software Composition Analysis
4. Security
5. Sonatype and AI
6. My conclusion on AI
7. Links and stuff!

@Jamie_Lee_C
The AI Revolution

@Jamie_Lee_C
Timeline of AI
Turing
Machine/
Test
1950
ELIZA
Chatbot
1966
Logic
Theorist
1955
Eugene
Goostman
2014
IBM
Deep Blue
1997
WABOT-1
1972
Roomba
2002
IBM
Watson
2011
ChatGPT
2022

@Jamie_Lee_C
Originally called the imitation game by
Alan Turing
● A test of a machine's ability to exhibit
intelligent behaviour equivalent to, or
indistinguishable from, that of a
human
● If a human could not distinguish the
difference between human and AI
then the AI would have passed the
test
The Turing Test

@Jamie_Lee_C
● Development started in 1985
● It lost its first attempt at beating Garry Kasparov with 2 to IBM and 4 to Garry
● It was upgraded in 1997 to once again challenge Garry
● It then beat the world chess champion Garry Kasparov
● 6 Matches over several days
● 2 to IBM, 1 to the champion and 3 draws
IBM Deep Blue

@Jamie_Lee_C
● A question answering machine of natural language
● The computer system was initially developed to
answer questions on the quiz show Jeopardy. In 2011
it played against champions Brad Rutter and Ken
Jennings, winning the first-place prize of 1 million
USD.
● In 2013 it has been used in healthcare to diagnose
patients among other things.
IBM Watson

@Jamie_Lee_C
● Possibly the most advanced chatbot of its time
● Developed in Saint Petersburg in 2001 by a group of three programmers,
Vladimir Veselov, Eugene Demchenko, and Sergey Ulasen.
● Goostman is portrayed as a 13-year-old Ukrainian boy—characteristics that are
intended to induce forgiveness in those with whom it interacts for its
grammatical errors and lack of general knowledge.
● In 2005 & 2008 it finished 2nd in Turing test competitions
● In 2014 on the 60th anniversary of Turin death it convinced 33% of the judges it
was human. Some declare this as passing the Turing test.
Eugene Goostman

@Jamie_Lee_C
The Current State of AI

@Jamie_Lee_C
Image/Video Generation with AI
Generative Fill with Adobe

@Jamie_Lee_C
● Released on November 2022 by OpenAI
● In January 2023, it became the fastest growing consumer application in history
● Many other ChatBot systems are based of this technology such as Googles
BARD
● It has a tendency to confidently provide inaccurate information.
The dark side of ChatGPT
● In order to train it against stuff like (sexual above, violence, racism, sexism etc)
OpenAI outsources this training to Kenyan workers for less than $2 an hour.
● The outsourced laborers were exposed to such toxic and dangerous content
that they described the experience as "torture".
ChatGPT

@Jamie_Lee_C
Uses for AI and Developers

@Jamie_Lee_C
Developer Productivity
Codesnippets
● Works with Java, Python, C++…
● Creates error-prone and performance-optimized codes
GitHub Copilot
● Offers intelligent coding suggestions for code snippets, functions, and methods
while coding
● Integrates seamlessly with renowned code editors, including VS Code,
JetBrains, and more.

@Jamie_Lee_C
AutoRegex
● Optimizes regular expression to enhance the performance of the application
● Converts English language to RegEx using Natural Language Processing (NLP)
Mintlify
● Understanding complicated functions and generating documentation.
● Quickly generating comments to understand what someone else’s function is
doing.
Developer Productivity

@Jamie_Lee_C
Let’s see if I should be worried…

@Jamie_Lee_C
Advantages of AI (AI Generated)

@Jamie_Lee_C
Increased Efficiency
● AI technology can automate repetitive and mundane tasks, freeing up human
resources for more complex and creative work.
● With AI, processes can be streamlined and optimized, leading to increased
efficiency and productivity.
● AI-powered systems can work 24/7 without fatigue, ensuring round-the-clock
operations.

@Jamie_Lee_C
Enhanced Decision-Making
● AI algorithms can analyse vast amounts of data quickly and accurately,
enabling informed decision-making.
● Machine learning algorithms can identify patterns and trends that humans
might miss, leading to better insights and predictions.
● AI can help businesses make data-driven decisions, resulting in improved
outcomes and reduced risks.

@Jamie_Lee_C
Improved Customer Experience
● AI-powered chatbots and virtual assistants provide instant and personalized
customer support, enhancing the overall experience.
● Recommendation systems based on AI algorithms can offer tailored product
suggestions, increasing customer satisfaction.
● Natural language processing enables AI to understand and respond to
customer queries, improving communication and engagement.

@Jamie_Lee_C
Cost Savings
● AI can help businesses reduce costs by automating processes, eliminating the
need for manual labour.
● Predictive maintenance powered by AI can prevent equipment failures and
reduce maintenance costs.
● AI-based inventory management systems optimize stock levels, minimizing
waste and reducing inventory costs.

@Jamie_Lee_C
Innovation and Creativity
● AI enables researchers and scientists to tackle complex problems by
leveraging computational power and advanced algorithms.
● AI can generate new ideas, designs, and solutions that push the boundaries of
human creativity.
● Creative industries, such as art and music, can explore new possibilities with
AI, leading to unique and ground-breaking creations.

@Jamie_Lee_C
Improved Safety
● AI can be employed in various industries to enhance safety and reduce risks.
● Autonomous vehicles powered by AI algorithms can reduce human error and
improve road safety.
● AI-based surveillance systems can detect anomalies and potential threats,
enhancing security measures.

@Jamie_Lee_C
Personalized Experiences
● AI can analyze user data and preferences to deliver personalized experiences,
such as customized recommendations and content.
● Virtual assistants can learn individual user preferences and adapt their
responses accordingly, providing tailored interactions.
● AI-powered marketing campaigns can target specific audiences with
personalized messages, increasing engagement and conversion rates.

@Jamie_Lee_C
Conclusion
● Artificial Intelligence offers numerous advantages across various industries.
● From increased efficiency and enhanced decision-making to improved
customer experiences and cost savings, AI is transforming the way we work
and live.
● Embracing AI technologies can unlock new opportunities and drive innovation
in the digital age.

@Jamie_Lee_C
Disadvantages of AI (AI Generated)

@Jamie_Lee_C
Job Displacement
● AI and automation technologies have the potential to replace human workers
in various industries.
● The automation of tasks previously performed by humans could lead to job
losses and unemployment.

@Jamie_Lee_C
Lack of Human Judgment and Intuition
● AI systems lack the ability to exhibit human-level judgment, intuition, and
creativity.
● They are limited to the information and patterns they are trained on, which may
result in biased or incomplete decision-making.

@Jamie_Lee_C
Privacy Concerns
● AI systems often require vast amounts of data to operate effectively.
● Collecting and analyzing personal data raises concerns about privacy, data
security, and potential misuse of information.

@Jamie_Lee_C
Dependence on Technology
● Overreliance on AI technology can make societies vulnerable to system
failures and cyberattacks.
● Relying on AI for critical tasks may lead to significant consequences when
technology fails or malfunctions.

@Jamie_Lee_C
Ethical Considerations
● AI algorithms can perpetuate and amplify existing biases present in the data
they are trained on.
● This bias can lead to unfair or discriminatory outcomes in areas like hiring, loan
approvals, and criminal justice.

@Jamie_Lee_C
Lack of Emotional Intelligence
● AI systems cannot understand or empathize with human emotions and social
cues.
● This limitation makes it challenging for AI to handle sensitive or complex
situations that require emotional intelligence.

@Jamie_Lee_C
Unemployment and Income Inequality
● As AI automates certain jobs, it can exacerbate income inequality and create a
divide between those who benefit from AI and those who do not.
● Displaced workers may struggle to find alternative employment opportunities.

@Jamie_Lee_C
Lack of Accountability
● Determining responsibility and accountability for AI-generated decisions can
be challenging.
● When errors or biases occur, it can be difficult to identify who should be held
responsible for the consequences.

@Jamie_Lee_C
Conclusion
● While AI offers numerous benefits, it is important to be aware of its potential
disadvantages.
● Addressing these challenges requires careful consideration, regulation, and
ethical frameworks.

@Jamie_Lee_C
Maybe I should be a little worried…

@Jamie_Lee_C
Should you be worried?

@Jamie_Lee_C
The bad guys have evolved

@Jamie_Lee_C
Cyber Attacks are rising in number and
sophistication
Nation states are preparing for the next war – and that is all about software
The aim is to infiltrate infrastructure and essential services…

@Jamie_Lee_C
And manipulate or terminate

@Jamie_Lee_C
Maven central has multiple layers of protection.
The first is easy.
Prove you own the domain!

@Jamie_Lee_C
Proof of domain ownership
Helps reduce malware ending up in the repository
org.apache.logging.log4j:999.999.999
org.apache.logging.logj4:2.18
org.apaceh.logging.log4j

@Jamie_Lee_C
org.apaceh.logging.log4j Typo-squatting
Dependency confusion
Typo-squatting

@Jamie_Lee_C
org.apaceh.logging.log4j
Defeated
Defeated
Allowed

@Jamie_Lee_C
Keeps the malware bots away

@Jamie_Lee_C
Everything else is hard
Does the new package contain vulnerabilities?
How do you figure that out?
Do you stop code being published?
Does the new package contain active malware?
How do you figure that out?
Do you stop code being published?
How do you make sure consumers know what they getting?

@Jamie_Lee_C
For Maven Central
Sonatype scans
everything uploaded with
it’s commercial scanners
using AI.
Only malware is rejected

@Jamie_Lee_C
For Maven Central
Finding out about vulnerabilities before you
select a version is straightforward
Accuracy depends on the quality of the
scanning tools, the skills of the research team
and the skills of the bad guys.
All are always getting better

@Jamie_Lee_C
Unfortunately, developers are slow to
change

@Jamie_Lee_C
log4j downloads in May 2022
https://www.sonatype.com/resources/log4j-vulnerability-resource-center

@Jamie_Lee_C
log4j downloads nearly a year later

@Jamie_Lee_C
The field of battle
● Typo-squatting
● Dependency Confusion
● Vulnerability exploitation
● Vulnerability research
● Build System compromised
● Tools compromised
● Open Source project compromise

@Jamie_Lee_C
The field of battle
● Typo-squatting
● Dependency Confusion
● Vulnerability exploitation
● Vulnerability research
● Build System compromised
● Tools compromised
● Open Source project compromise
Maven Central is
evolving to give you
more insight and
better defenses

@Jamie_Lee_C
Open Source is amazing!

@Jamie_Lee_C
Sharing = better!
90% of the applications we create are shared dependencies!

@Jamie_Lee_C
Dependency Managment
150 Dependencies (avg Java project)
10 Releases Per Year (avg per dependency)
1500 Updates To Consider 😱
x

@Jamie_Lee_C
https://xkcd.com/2347/

@Jamie_Lee_C
Direct vs Transitive Dependency
Example: org.springframework.boot:spring-boot-starter-web

@Jamie_Lee_C
Modern Face of Cybercrime
• Perception –
• Difficult Tasks
• Detailed Plots
• High Tech
• Elaborate Schemes
• Reality –
• Simplicity, Effectiveness and user
centered thinking
• MaaS - DuckLogs, Redline Stealer,
Racoon and Z3US
• They have Active Support
Channels!

@Jamie_Lee_C
Script Kiddies
“most of the malicious packages are
not the product of a quirky genius in
a hoodie coding from a dark
basement filled with monitors”
•Young…not always
•Inexperienced…not always
•Hackers…not always ☺

@Jamie_Lee_C
Initially hosted on the GitHub repo “joeldev27” when it was
used by the PyPI packages pycracker and pyobfpremium,
and rendered inactive soon after

@Jamie_Lee_C
• What can be used for good can also be
used for evil
• Prompt kiddies are out there
Prompt Kiddies are here
https://hackernoon.com/bad-actors-are-joining-the-ai-revolution-heres-what-weve-found-in-the-wild

@Jamie_Lee_C
The cost of modern cyber crime

@Jamie_Lee_C
In 2016 Cybercrime surpassed the
drug trade!
$450 Billion a year
$14,000 a second
Equivalent to 50 US Nimitz Class
Aircraft carriers
Cyber Crime Facts

@Jamie_Lee_C
In 2022!
$6 Trillion a year!
$200,000 a second
Equivalent to 620 US Nimitz Class
Aircraft carriers!
Cyber Crime Facts

@Jamie_Lee_C
United States: $20.89 trillion
China: $14.72 trillion
Cyber Crime: $6 trillion
Japan: $5.06 trillion
Germany: $3.85 trillion
India: $2.65 trillion
United Kingdom: $2.63 trillion
France: $2.58 trillion
If Cybercrime was a country by GDP in 2022

@Jamie_Lee_C
Todays Pablo Escobar uses a Laptop

@Jamie_Lee_C
AI is only going to make security
harder!

@Jamie_Lee_C
Devices allowed to contain OS code:
IEC 62304

@Jamie_Lee_C
Fighting AI with AI

@Jamie_Lee_C
✔
✔
✔
Powered by Nexus Intelligence and years of
experience

@Jamie_Lee_C
Suspicious behaviour and malicious protection

@Jamie_Lee_C
Let the Dr
help you
with security
using AI
https://bomdoctor.sonatype.com/

@Jamie_Lee_C
My Conclusion
● AI is not going to take most of our jobs any time soon
● Current AI technology has been around a while
● AI has got popular lately because of how easy it is to use
● AI can make us much more productive
● AI can be used for Evil
● We can use good AI to fight evil AI

@Jamie_Lee_C
History of AI
https://www.javatpoint.com/history-of-artificial-intelligence
History of software supply chain attacks
https://www.sonatype.com/resources/vulnerability-timeline
State of the software supply chain report:
https://www.sonatype.com/state-of-the-software-supply-chain/
LOG4J download data:
5 AI Tools for Developers
https://medium.com/geekculture/5-ai-tools-every-software-developer-
should-be-using-in-2022-afc4fb149c60
Photoshop Generative Fill
https://www.adobe.com/products/photoshop/generative-fill.html
AI tools to build apps faster
https://geekflare.com/ai-tools-for-developers/
Useful Links

@Jamie_Lee_C
Get in touch
Website:
https://www.sonatype.com
Twitter: @sonatype
LinkedIn: /company/sonatype/

@Jamie_Lee_C
Cool stuff to
checkout!
New Maven Central
https://central.sonatype.com/
BOM Dr
DevZone
https://dev.sonatype.com/
Foojay Series
• https://foojay.io/today/sboms-first-steps-in-a-new-
journey-for-developers/
• https://foojay.io/today/sboms-and-software-
composition-analysis/
• https://foojay.io/today/making-sboms-threats-and-
modelling-them-a-piece-of-cake/
Malware Monthly
https://blog.sonatype.com/malware-monthly-march-2023

@Jamie_Lee_C
Don’t forget
to scan your
applications
with the Dr

Magic of Automation and Everyday Chores.pptx

Recommended

Recommended

More Related Content

Similar to Magic of Automation and Everyday Chores.pptx

Similar to Magic of Automation and Everyday Chores.pptx (20)

More from Jamie Coleman

More from Jamie Coleman (20)

Recently uploaded

Recently uploaded (20)

Magic of Automation and Everyday Chores.pptx