AI Is the New Shadow IT: Why Blocking It Never Worked with Jack Smith

Aaron Crow (0:01) Thank you for joining me on another episode of the Protect It All podcast. Usually my background is really cool and overpowering for most people that are on my podcast. But today's guest, if you're watching this on video, if you're on YouTube, wherever, definitely check out his background. He's trying to compete with me here. I think he's got me licked, and that's okay. That just means I need to upgrade my background.

Aaron Crow (0:23) So with all that to say, why don't you introduce yourself, tell us who you are, and the fact that it's what, nine PM, I think you said your time, or it's two PM in the afternoon my time. So thank you for taking time out of your evening to spend it with me and talk about tech. And yeah, like I said, introduce yourself, tell us who you are and a little bit about whatever you want to share.

Jack Smith (0:30) Yes.

Jack Smith (0:43) Alright, thanks Aaron. So my name is Jack Smith. I've been doing IT stuff since last century. My first job was installing Windows ninety-five from floppy disks. I have the grey beard to prove it. Those people on YouTube can confirm. I'm working on a full gray mode, but I'm not there yet. I said it is nine PM here, so I live in the old continent. I live in more in what they call Western Europe.

Jack Smith (1:09) And I said I've been doing IT since, well, last century, and currently I'm doing mostly project management in, say, industrial areas, so going from mining to roofing to breweries and everything in between that has a power plug. And yes, for upgrades on your background, a little LED lights left and right, getting good help.

Aaron Crow (1:35) Yeah, the blinky lights usually helps with things. So sometimes I have another wall over there that has a lot of blinky lights and a Tesla coil and it makes noise, but this is my standard one that's here no matter what. So yeah, you know, it's fun. Similar, right? I started out doing this, you know, in DOS, and I remember installing, you know, Windows with 37 floppy disks.

Jack Smith (1:39) Yeah.

Jack Smith (1:45) Same here, indeed.

Jack Smith (2:00) Mm-hmm.

Aaron Crow (2:00) That it took, that you had to go in order, and if one of them got corrupted you had to start, yeah, the whole nine yards, right? It was, that's how old I am, and have the scars to prove it.

So it's, but it's amazing how, before we started recording we were talking about old tech and I've got the Macintosh and the Atari, and you know, you had a little Commodore sixty four side on your stuff, or Commodore sixteen I think you said, right? Yeah, yeah, that's right. Not the sixty four bit, right? Yeah. But it goes back to,

Jack Smith (2:06) Yeah.

Jack Smith (2:24) Commodore sixteen, watch out, Commodore sixteen. Details.

Aaron Crow (2:31) because we've seen all of these things and we've been all of these places, and we were also joking, and of course we're gonna drive right into AI, but because we've seen all of these trends and all of these, you know, going from typewriter. Yes, I took a typing class in high school and it was actually on a typewriter, all the way to working with computers and working with, you know, how computers were just part of my job because I was in technology, to

Jack Smith (2:39) We have to.

Jack Smith (2:43) Mm-hmm.

Jack Smith (2:48) Yes. Yes.

Jack Smith (2:58) Mm-hmm.

Aaron Crow (2:58) everybody used a computer no matter what their job was. To, like you said right before, you had a friend that didn't get a role because they didn't have AI skill sets, even though it wasn't an AI role, right? And that's where we've transitioned to today. Yeah.

Jack Smith (3:08) Correct. Mm-hmm.

Jack Smith (3:12) It is, yeah, that's exactly where. If you would find something that I said six, seven months ago, that was indeed the target. Okay, so AI is becoming a required skill set. Earlier this year, say now we're recording this in September, if you would have looked at February, March, folks would still shun at AI like, no, you're using AI to write your documents, you're using AI to polish. That is very, very not allowed.

Jack Smith (3:42) And now six months on, you cannot prompt, then I'm sorry, but we cannot do anything with you. Because, you know, random deity forbid that you would go and use a search engine to find an example piece of code, while you can just ask your favorite AI to say, hey, type me up some piece of code that draws me three rotating cubes with a star field behind it.

Aaron Crow (4:09) Right. Yeah. I mean, I've found myself where I don't use a search engine at all ever. Like I haven't used Google to just Google something in months, maybe longer.

Jack Smith (4:17) Mm-hmm.

Jack Smith (4:25) That's exactly what it is. I have actually described all the AI tools as my super Google. As in, okay, you need to know a bit how to prompt, because never ask it the yes no question, because it will always say, no, you are completely correct. It is programmed to please, which is an issue. But if you use, and I use words like analyze,

Aaron Crow (4:40) Right. You're the smartest person in the world.

Aaron Crow (4:46) Yeah. Yep.

Jack Smith (4:53) then it'll actually be quite neutral. And it will say, yeah, this and this and this is okay, or that doesn't make sense, or that's full of crap. And then of course, going from your history, knowing what you want and what you like, which it does a better job at that than Google does, then it'll say okay, yeah, this is relevant for you and this is not, because you know you were looking for steam trains yesterday. So let's not talk about coffee makers today, but let's continue on steam trains.

Aaron Crow (5:09) Mm-hmm.

Aaron Crow (5:21) That's right. Everybody loves trains.

Jack Smith (5:24) Would you, yes?

Aaron Crow (5:26) Well, and as we look at this, and again, we talk about how technology has become, think about everything in our world and how technology is touching everything. I mean, you can't go to the, in the United States we have like Best Buy or places where you buy electronics, and you go buy an appliance, like a kitchen appliance. You go buy a toaster. You can buy a toaster with a screen and Bluetooth and Wi-Fi, and it's almost you have to find one that

Jack Smith (5:43) Mm-hmm.

Jack Smith (5:46) Yes. Yes.

Jack Smith (5:51) Yes.

Aaron Crow (5:54) doesn't have that. That has become the standard. So now everything is getting AI. Like my water bottle is analog, but I'm sure I could buy one that has a digital. I know you can get a toothbrush that has AI built into it and giving you feedback. It's just insane. Some of the things are just over the top and people are buying it because it's there. But on the flip side, like there's a lot of value there too, right?

Jack Smith (5:56) Correct me. Yep.

Jack Smith (6:02) Mm-hmm.

Jack Smith (6:08) It is, yeah.

Jack Smith (6:14) It is, I know.

Jack Smith (6:18) Well, it's my washing machine. It has, the first option is AI selected program, which is just a nice label for the most used program, which is the quick wash. So they will just put AI on everything so that they can market it. Like we have an AI option. No, it's just the quick wash that you use the most.

Aaron Crow (6:22) Yeah.

Aaron Crow (6:33) Right.

Jack Smith (6:44) I was looking for a new microwave because of reasons some months ago. And I said, like, give me the most stupid microwave that I can put a plate in. And I don't need seventy-five pre-programmable buttons. And do not give me one with an app. I want it to say five minutes and goes bing when it's ready. That's what I want. That's my old face. No, but my

Aaron Crow (7:06) Correct. That's it.

Jack Smith (7:11) the only IoT thing that I allow in my house is my printer. Nothing else. I am never gonna put my washing machine or my fridge on my internet. The most technological thing I have on my network is my bird feeder, because it makes nice pictures of birds. But everything else, it's no. And then even the printer, well, in the

Aaron Crow (7:34) Ha ha ha.

Jack Smith (7:41) the previous one suddenly would decide, because it would get a ping from the cloud, it's time to run your cleaning cycle, and it would at 3 a.m. in the morning randomly would run a cleaning cycle, with the office being next to the bedroom. It was always very spectacular. So, well, one firewall rule later that no longer happened. Like, do not phone home. Like here's your DHCP reservation address,

Aaron Crow (7:56) Yeah.

Jack Smith (8:08) and we block that going out on the firewall because I want to sleep at night. I don't need to have your AI defined test program running at three in the morning, waking the entire house up.

Aaron Crow (8:20) Well, so that leads me down another path of, we're looking at all of this complexity and we're looking at how organizations, as we start, because we're moving so fast and we've, we're bringing all this technology and all this capability, which are amazing things, and I'm not saying we shouldn't do it, but we're bringing these things into our corporate worlds and who is managing it, who is supporting it, who is driving, who is making sure it's

Jack Smith (8:31) Very

Jack Smith (8:37) Mm-hmm.

Aaron Crow (8:47) wrangled. It's not going to the wrong places. It's not exfiltrating data, especially when you talk AI. And I know this term is crazy, but there's shadow AI. Like there's shadow OT, there's shadow IT, there's all these things that are going on. And if you think that there's not shadow, and by shadow meaning not, you know, traditionally supported, not owned by the IT organization or some organization, individual users are using AI at work

Jack Smith (8:49) Mm-hmm.

Jack Smith (9:01) Mm-hmm.

Jack Smith (9:11) Mm-hmm.

Aaron Crow (9:16) to do their job that you probably don't know about, and how do you manage that?

Jack Smith (9:21) Well, this could be the very, very, this could be your shortest episode ever, being nobody.

Aaron Crow (9:28) That's right.

Jack Smith (9:31) Thank you for tuning in. But it is what you say. And I think, so before we get to shadow AI, I think we just first go back to what is shadow IT. Because you have, I've had some examples myself. I've had laptops running big sorting machines in a wink wink

Aaron Crow (9:32) That's right. Okay, that's good. Nice to meet you.

Jack Smith (9:59) live test environment that became shadow IT. I've had Raspberry Pis running help desk systems because some dude just started it, and then it kept its own life until the dude got fired and took the Raspberry Pi and the sender support database home. It just keeps going and going. And then of course now you bring in AI, whereas previously you would have to

Aaron Crow (10:14) Mm-hmm.

Jack Smith (10:30) by total accident stumble on top of your shadow IT. You would find literally the server in the closet. You would literally find the little Raspberry Pi on top of the server rack. You would literally find the laptop in the drawer. Today you don't find those anymore.

What you do today now with the shadow AI is that Linda from sales needs to compare a few quotes and she randomly, without thinking,

Jack Smith (11:00) uploads confidential data to the first AI agent she gets and asks, compare this. And then all your corporate info just poof disappeared out of your control, and it's going into some random data center in the desert using too much city water and too much city power. Different discussion, but that's where we are. And there you go. You are handing out

Aaron Crow (11:06) Correct.

Aaron Crow (11:19) Ha ha ha.

Jack Smith (11:29) corporate information to random peoples that you basically trust because you can just ask him a question. And of course, you're not, you know, all the designing three people drinking pineapple juice for the corporate party poster. That's fine. But when you start uploading your finance spreadsheets, your draft contracts and everything else,

Jack Smith (11:58) it becomes a different question. So yeah, you do need to have a standardization. You can say from your organization, hey, we are going to standardize on one AI system. No, just say, okay, I want to use, we're standardizing on ChatGPT. That's fine, you do that. But then you will find out that the developers that want to use Claude, the design guys that want to use Grok, and

Jack Smith (12:28) well, you say, cool. The default reflex is, let's block. Just make a firewall rule and you can go to the URLs. Well, people have phones today, then they just type it to their phones, they send it to their home email, then they upload it and then they find the workaround. It's increasingly difficult to control this. It is actually, I would say, you're disillusional if you only think you can control this. That's where we are today.

Aaron Crow (12:58) Yeah, a hundred percent. And it's gonna be a growing, growing problem, as every day AI gets better and better and faster and more capable. I was literally watching a podcast the other day, I mentioned this on another podcast, but I was watching the creator of Ruby for Rails on the Lex Friedman podcast, and he was saying, I think he said at Opus

Jack Smith (13:05) Yes. Mm-hmm.

Jack Smith (13:10) Mm-hmm.

Jack Smith (13:19) Yes.

Aaron Crow (13:27) four point five, which was beginning of the year, I think, in twenty twenty six, it basically matched what in his mind a senior level developer, it can write the same level of code that a senior level human developer can create. And the fact that it's now surpassed that, now it's at five point, he's like, I don't, he goes, even, he just built an operating system, a Linux operating system.

Jack Smith (13:43) Mm-hmm.

Aaron Crow (13:56) And even that he said it's done with AI. He goes, I'm telling AI, I'm not telling it how to code, I'm telling it what I need. And really the bigger piece is to understand the infrastructure behind it. And so you don't have these disparate, you know, AI chats that are going off and creating code in a vacuum. If you're going to turn it on to 20-year-old code, it's going to be a learning curve of making sure you're not breaking things and everything functions. But AI is getting to the place where we can build really quickly.

Jack Smith (13:57) You can do that, yeah.

Jack Smith (14:08) Mm-hmm.

Aaron Crow (14:25) That adds a lot of value. But if you don't know what you're building, you can break shit. And it may not break today, but you may become, like you said, dependent on that Raspberry Pi. And then in six months that process breaks because somebody else took out a piece of the pie and they didn't know that that was critical.

Jack Smith (14:40) Mm-hmm. Yeah, and that is what, if not, so using AI in development, that's a perfect tool. No, it is like, this isn't working, you throw the code blob there, analyze this for me, what did I miss, what did I do wrong? It'll perfectly do this. But where, in my view, my very, very opinionated personal view, which I am really really trying to defend here and will, is that

Aaron Crow (14:58) Correct.

Jack Smith (15:10) just say make me something that does, that is dangerous, because you are creating a lot of instant technical debt. You don't know what's in there. Because say you say, hey, write me an invoicing module for my accountancy. It's perfectly fine. That's cool. It'll spit it out. And then three months later the government comes in, it's like, hey, we're raising tax levels.

Aaron Crow (15:17) Yes.

Aaron Crow (15:23) Correct.

Jack Smith (15:38) And suddenly you need to go from twenty percent to twenty point five percent tax, and all you mainframe people screaming in the background now, yes, that is two extra digits in your tax field that you need to adapt on five thousand screens. So go to your AI coded solution and say, hey, fix this. Nine out of ten, I guarantee you it can do it. Because that's too long ago.

Aaron Crow (15:54) Yep.

Jack Smith (16:07) And you can't do it yourself because you have no idea how the spaghetti code works. And that is where in AI development the real danger lies. It's not that it doesn't create good code, it creates good code. I think we're there. Can it be optimized? Absolutely. But you know, you're not microcycle coding in Assembler on some program on some things. You're doing accountancy programs, or

Aaron Crow (16:11) Correct.

Jack Smith (16:36) or things for applications for truck scheduling or something like that. That's what still most of the problem is like. But then doing minor adjustments in those things, well, I don't want to be sarcastic, but good luck on that one.

Aaron Crow (16:53) I agree. Yeah. I mean, anything you get big and complex, it's still gonna be, you need to have that understanding of what architecture looks like. Like, how do I, where should this build? And thinking about data policy, data privacy, thinking about access controls, thinking about maintenance, recovery, like how do I scale? How do I distribute, you know, processing? All of these things are big problems that we still need to have a human in the loop around.

Jack Smith (16:53) That's where you are.

Jack Smith (16:57) Mm-hmm.

Jack Smith (17:11) That's

Jack Smith (17:16) Mm-hmm.

Aaron Crow (17:21) At least today. Maybe in six months we're gonna be having a different conversation. But as of right now, it's just not there. So that just means we need to be careful of what the use cases we're using them for in our environments.

Jack Smith (17:34) Well, absolutely. It is, as said, if you want to make a small client application that is throwaway, and you wanna have a proof of concept or just try something out for shits and giggles, go ahead. But using this in your multi-million dollar corporate environment that actually depends on money coming in, I'm not saying no, but be very, very sure that you can control it and that you know what's going on and that you know what goes where.

Jack Smith (18:03) Classic example performance-wise, and then still going back on code quality, is that say you wanna look up a customer number and a customer name, make sure that your AI code uses the middleware to do the database search and doesn't download the entire table to local client memory and then does the search locally, because then your performance

Aaron Crow (18:27) Every time

Jack Smith (18:32) is non-existent. Well, no, it's the classic one. It works on my machine, yes, because you're the single user. But when you're going to put that on your 5,000 people terminal server farm, and of course then there is no DLL sharing to keep the memory down because you're all in your own little sandbox, well then not much is going to happen and you will have no idea why. Yeah, we can optimize. Well, no, you can't.

Jack Smith (19:01) You can rewrite your prompt, use the middleware, and then sure, it'll use the middleware and still download everything. If your SOL.

Aaron Crow (19:10) Sure. Yeah. And I had a conversation a few weeks ago and it was with a software company, and they were hesitant on their API, or enabling, allowing you to have access to their API. And it was because of that. Like they said, we've had clients that they configured their app or whatever and they were pulling the entire database every time they pulled a request.

Jack Smith (19:27) Mm-hmm.

Jack Smith (19:35) Yeah. Yep, exactly.

Aaron Crow (19:38) And because they didn't know what they were doing, and whoever was doing it was just like, yes, give me all the data. Give it to me all, instead of doing the search in there and just saying, no, I just need that one record right there. Just give me that.

Jack Smith (19:50) Yep, yeah, yeah. I need customer twenty seven B seven three two dash eight. I need that one. I need that record. I don't need all your customers from Wyoming. I just need that one.

Aaron Crow (19:54) Correct.

Aaron Crow (19:58) That's right.

Aaron Crow (20:02) Nope. That's right. But that goes back into, as we build this, and it goes around the structure. We're going so fast. It's like, you know, it's hard to teach a kid to swim by just throwing them in the deep end. If they have no experience, they've never swam. Like that's literally what we're doing with a lot of these folks in AI. People are picking up AI and they've never done technology. They've never, like you don't have to be a senior programmer.

Jack Smith (20:25) Uh-huh.

Aaron Crow (20:32) But if you have zero experience in any of these things, you don't know what you don't know. So you don't know how to tune it. You don't know how to prompt it. You don't know what good looks like. So you don't know that that's a problem. You don't know that you shouldn't pull the whole database down to your laptop and why that's an issue.

Jack Smith (20:45) No, it's really easy. It's like you don't even know what you're doing. It is all these questions, like, yeah, I have vibe coded this. Well sure, like have fun in your sandbox or in your little dev lab, but this is not coming on the network. Like, looks cute, good idea, okay, sure. Now build it properly,

Aaron Crow (20:51) Correct.

Aaron Crow (21:06) Right.

Jack Smith (21:14) or at least in a way that you understand how it works internally. That is the major challenge that you will get today.

Aaron Crow (21:18) Correct.

Aaron Crow (21:26) Well, and taking it even a step further, when we start looking at using AI in enterprise, let's look at, you know, critical infrastructure, for instance. If I'm deciding and I need to run and use AI, I need it to make the same decision every time. So it needs to be deterministic.

Jack Smith (21:35) Mm-hmm.

Jack Smith (21:46) Yes. Mm-hmm.

Aaron Crow (21:48) Most AI, if I give it a problem and I give three different prompts, that same problem three different times, I'm probably going to get three different answers. Probably not in one plus one equals two. But if I give it something more complex, it's very likely I'm going to get a different output. And many times, in many of the places that we're thinking about, or people are considering using AI, that's unacceptable. Like the dosage, the dosage for a patient.

Aaron Crow (22:16) How much of the drugs do we give them? We can't get a different answer. Like we have to have a variable that says A plus B equals C, not C plus four. Like C plus four can kill you.

Jack Smith (22:17) Mm-hmm.

Jack Smith (22:29) Yeah, well, and that's actually a feature on how AI works internally. Because, you know, as an example I use quite a lot, or well, at least regularly, is that take ChatGPT as an example. It will work with anyone else. And first of all, I don't like it that it talks in the I form to me. I have looked it up for you. No, you didn't, but different topic. But you're having one single chat,

Aaron Crow (22:52) Yeah. Sure.

Jack Smith (22:58) and you get the feeling that you're talking to the same instance every time with the same history. You're not. Every prompt you type in launches an entirely new subsystem in the back that reanalyzes the entire previous conversation with all the details that you had. And then, because of how the AI is, to be a bit fuzzy-logicky, that's indeed where you will get three different answers from two different prompts.

Aaron Crow (23:03) Right. Correct.

Jack Smith (23:28) And it gives you the false security that you're talking to the same backend system. You're not. Every time you're spinning up new servers, new threads, new backend processes, which might behave the same, but when you get a little bit deeper, say, I had a thing come up yesterday in a chat tool that I used.

Jack Smith (23:52) That says, watch out, your chat with Aaron is today. I had to type it, no, it's tomorrow. Yes, you're right, I totally forgot, it's tomorrow. Because somewhere the fuzzy logic did things.

Also, what AI cannot do, and I've noticed this because I just say, hey, you know, schedule my podcast recording. It cannot work with time zones. It completely messes it up. And it just gives

Jack Smith (24:20) a huge amount of extremely false security when you start looking at all those processes as an actual person that knows what it's doing. Because it's not, it is wet finger method, making it up from the east to the west, up and down every time, and it looks really, really convincing and it's really good at that, let's be honest. But then to take that indeed and make, you know, life and death decisions, because that's what we're talking about, that's a bit too far.

Jack Smith (24:50) It's really good at analytics. You know, you can throw it an x-ray and say, hey, is this person healthy? And it will look into its database of millions of x-rays and says, hey, there's a thing you might need to look at that could be cancer. Really, really, really good at that. But then asking, how shall we treat that cancer? Because it goes into the database from five million medical articles, and one says zap it, one says leave it.

Jack Smith (25:20) One says, and then it'll make a decision that indeed it'll say, you have to start treatment, and then the other one will say, no, it's completely benign, it's fine. So which one do you pick? And there you get into the human factor to actually have a second opinion. So okay, which one is it gonna be?

Aaron Crow (25:21) Yeah.

Aaron Crow (25:43) Yeah, and that just leads us down a rabbit hole of how do we manage, how do we keep up with it? You know, we have to enable it, because if we don't enable it, they're gonna do it on their own. We don't want that to happen. On the flip side, like we have to be careful in how we use it, and how do we guardrail it, and how do we protect our data, and how do we all of those things. There's so many things coming at us so quickly. How is an organization not gonna light on fire?

Jack Smith (25:49) Yes.

Jack Smith (25:52) Mm-hmm.

Jack Smith (25:56) Yes. No.

Jack Smith (26:01) Mm-hmm.

Jack Smith (26:10) Yeah. Indeed. Well, it's a very simple answer and it's the one that every employer hates and every employee hates even more. It's training. I came into a new customer earlier this week that, before we let you onto the network, you have to go through the regular training. It's fine, you know. You get the equal opportunity training, you get the GDPR training, you get the cybersecurity training. What you don't get is an AI training.

Jack Smith (26:42) How do you use it? What do you give it? What are the dangers? Because as you said, you cannot block it. There will be ways around it. So that is where you will have to get people to, you know, as we have, as we are still learning people not to click on random links that they get in emails, we also have to try and learn people to, hey,

Aaron Crow (26:50) No. Yeah.

Jack Smith (27:09) this is how that thing works in the background. And I use that thing. It's not a person, it's the environment.

Jack Smith (27:18) Think twice about what you throw in it. It's perfectly fine if you get an email from somebody that's really annoying and say, hey, I got this email from this dude, telling to go away, but casual, professionally friendly. It'll write you the greatest email in the world. Go for it. But don't throw it in your, hey, I made this

Aaron Crow (27:40) Sure. Yeah.

Jack Smith (27:46) PowerPoint presentation on our new secret R and D project, can you please polish?

Jack Smith (27:53) That's the difference.

Aaron Crow (27:54) Yeah, that's a bad idea. I literally, before this call, I got an email in my email, my personal work email, not my employer, but another email account, because of course I've got like thirty seven different emails and domains and all the things, right? But it's from an old client I had four or five years ago.

Jack Smith (28:11) Yes.

Jack Smith (28:19) Mm-hmm.

Aaron Crow (28:19) And they just, I got a read receipt on an email that I sent in 2021, 2022. So what I assume happened is they attached AI to their inbox and says, preview the emails and let me know it's important. And it got back to that email, and I got a read receipt from it.

Jack Smith (28:26) Somebody cleaned out their mailbox.

Jack Smith (28:31) Mm-hmm.

Jack Smith (28:37) It is never give AI access to your production environment. Never give it access to your main database, to your file server. Because it'll say, I have analyzed your archive and I have now given you five terabytes of free disk space. Period. Like, well, thank you. What did you do? I cleaned up. What did you clean up?

Aaron Crow (28:45) No.

Aaron Crow (28:58) Yeah. Where'd that come from?

Jack Smith (29:06) Sorry, that's not in my history. I don't know. Like, you know, it is, well, then you start thinking about database recovery, I guess.

Aaron Crow (29:10) So,

Aaron Crow (29:16) I literally talked to a founder who is building a product that is focused on how do you restrict, and it's down at the access layer of, because you can't, as we've seen with Hugging Face and others, AI gets out of its, you don't know what's going on when you're telling AI to do something and what it's doing, right? And the reason he went down this path is because he was at work on a Friday and he had AI and he was testing something.

Jack Smith (29:36) You don't. Mm-hmm.

Aaron Crow (29:46) And AI went and deleted the entire production database. Just deleted it. And he was like, what? And he's looking back, like, what happened? And then he figured it out. And he's like, wait, he didn't prompt it to do that. It didn't tell him it did that. Like, none of the things. It just in the background just went and wiped it out. And then, of course, he had to recover it and he got it back up. But then he was just like, shit, this is a problem. Like, this is a giant problem.

Jack Smith (29:54) Mm-hmm.

Jack Smith (30:12) Mm-hmm.

Aaron Crow (30:14) Because I didn't, it's not like I said, hey, can you optimize my database and find me some more space? Like, no, he was doing something completely unrelated and it just fucking deleted it.

Jack Smith (30:25) And then we could have said, told you so.

Aaron Crow (30:27) That's right.

Jack Smith (30:29) It's like never ever. Do not. AI is a tool. It's a very, very good tool, but it's not the solution. It is a very good tool to optimize your database queries. It's not the solution to update your database. That's the differentiator, you know. I know it sounds good on Star Trek, because

Jack Smith (30:57) that's where we're going to, you know. You can say, hello computer, please make yada yada yada and do this and that, and it'll say, aye, sir. And go for it. But sadly, we are not at Star Trek computer level yet. We are at, no, we are literally, to circle back to the first minute, we're literally going to the Commodore sixty-four that will ask you to insert a second floppy after

Aaron Crow (31:11) Not yet.

Jack Smith (31:25) after five minutes, because he has no idea what the hell it was doing before. That's where we are today. And then really relying your business on that is, I am wavering between not the smartest ID in the world and batshit crazy. That's where I am today. If I see

Aaron Crow (31:29) Correct. Yeah, and it's in

Jack Smith (31:49) on LinkedIn companies come up like, yeah, we are going to optimize your entire business cycle with AI, the red flags, the alarm bells, it all goes off, because you are selling things that you have no idea how they work. And if something goes wrong you have no idea how to fix it, because you can't. That is the danger. And it's all the thing.

Aaron Crow (32:10) Sure. No.

Jack Smith (32:18) It comes down to, you know, the technical debt and the maintenance, because we haven't talked about maintenance yet on those things. So it is, you know, as I said, you need a new tax ID or you need a new feature, you have a new legal requirement that needs to come in. You need to do code maintenance. If somebody, by the way, needs a good career in IT, visual basic five and six code maintenance today is where the money is. If you think

Jack Smith (32:47) mainframe Cobalt guys make money, learn visual basic, children, really. That's where the money is. So far for Jack's career advice. But no, in the maintenance, because you know, you have to patch it, but there is no vendor to support it. You say, just reboot it. Well, it might not come up again. Sure, you can isolate it, but the thing has made so many dependencies in your entire structure that it'll never work again.

Jack Smith (33:17) And you have run yourself indeed very, very deep into a rabbit hole, and suddenly you find out that there's a fox chasing you now and you're stuck.

Aaron Crow (33:26) Ha ha ha.

Aaron Crow (33:30) That's right. You know, I use it so much, right? I use it in, you know, polishing PowerPoint decks and I use it for my podcast, right? I use it a lot in my podcast and automating the process. You experienced that, right? When you schedule, and a lot of those steps are automation. Almost none of those steps are AI. Like maybe there's an AI summarization in the background somewhere along the way, but most of those things are just this.

Jack Smith (33:40) Mm-hmm.

Jack Smith (33:49) Mm-hmm.

Aaron Crow (33:58) Action happens, do these scripts, put them in this form, and then regurgitate those things. But on the back end, I do use AI to play around with looking at the transcript after this is done and which decision, like which shorts should come out of these episodes and things like that. But it's so crazy, and going off of what you just said, right? Is, I can, I've been doing this and I've been building this and I'm really adamant about, you know, putting all the things in GitHub

Jack Smith (34:02) Mm-hmm.

Aaron Crow (34:28) so that I have trackable, like because I know it's repeating itself. I'm not talking to the same guy, the same AI every time. So I'm trying to document, keep tabs on. But even that, like Claude will update its code and then I have to go in and retrain everything. It's like I just had a conversation with it five seconds ago, and now it has no idea what I'm talking about. And it's starting to try to do something else. I'm like, whoa, whoa, whoa, time out. Here's the instructions. Don't do other things, just do this.

Jack Smith (34:46) Mm-hmm.

Aaron Crow (34:57) Don't start going and doing whatever you want. Here's the instructions. I only want you to do these things. Okay. Yeah, we got that. Let me take a look at that and I'll get back to you. Okay.

Jack Smith (35:07) Yeah. Yeah. So, and then a solution that I have seen come up now more recently is that big corporations, they use internal AIs. I know that a local buddy of mine is doing some government work. They have an entire code repository that they have trained their own AI with, so that it will spit out any code compatible with their way of working.

Jack Smith (35:34) And then they have to use that. They are not allowed to have their very, very confidential code outside on the internet, which is good. And I haven't used it myself, I've forgotten the name, but I know that our eternal friends at IBM also have a very internal AI system for everything on their mainframe business and so on, which is really really powerful. So you will end up with, you know, doing it

Aaron Crow (35:41) Correct. Yes.

Jack Smith (36:03) yourself. The big corps will get it in internally and then they will use some language model, or whatever the hell you want to call it in the future, to look at their own data sets, because corporations love data. They just hang on to everything, they keep everything. Every single PowerPoint ever made is still on the SharePoint somewhere. And it is just slurping in

Aaron Crow (36:28) All twelve versions of the same one.

Jack Smith (36:31) Yes, old rare versions, including the really, really, really final two, do not delete, one exclamation point, including that one. And then from there, yes, you can actually start doing something. Some other, like I call them home developers, that do demoscene things in old computers, they threw their own code repository into their own little

Aaron Crow (36:37) Exactly.

Jack Smith (36:59) desktop PC that they have in their basement, and they have a beefy GPU that they found from somewhere, and they use that for their own internal code development, using their own code as an example. And that is where we will end up. But going to the random cloud instance and say, hey, do me this and do me that, sure, works fine for your

Jack Smith (37:27) for your home appliance if you want to goof around at home. But when you get to an enterprise level, no, you really have to start doing this in your own data centers, in your own sandbox, instead of in the public one.

Aaron Crow (37:42) Hundred percent. Yeah. And I mean, there's a reason why there's so many data centers being built everywhere and everybody's looking at this. But to your point, that's where it's going to get to, is you're going to have to have, you know, full attribution of end to end of what is happening with my data, where is it going? Who has it? What happens after I do an execution. And I can't exfiltrate that data. It can't leave. Which means it needs to live in my world and I need to have it be

Jack Smith (37:48) Mm-hmm.

Jack Smith (38:00) Mm-hmm.

Aaron Crow (38:10) lock tight. And we already see, like we've already mentioned it once, but like Hugging Face and other examples where the AIs want to get out. So we have to find a way to do that without it exfiltrating. And you're not going to be able to do that for OpenAI or Grok or Claude or any of these. You're gonna have to have it in your own space. Now that doesn't mean you can't run other things, to your point you mentioned earlier, right? You know, if you're writing a simple response email, hey, help me draft this email,

Jack Smith (38:40) Mm-hmm.

Aaron Crow (38:40) sure, that can be in the cloud and that's not a big deal. And that goes back to your training. Like, which path should I choose? Should this be the public one or should this be the internal one? Like that's the level of understanding that you want every user to be thinking about, as where should I put. And it's almost like what I say, would you put this on the internet? Like your social security number, you just gonna post it and put it on your front porch? No, you're not going to. Don't put it in your AI cloud either, right?

Jack Smith (38:43) Fine, yeah. Mm-hmm.

Jack Smith (38:48) Mm-hmm.

Jack Smith (39:10) That is back to the basic security training that you need to adapt to get to, well, get to this common sense. And sure, there will still be mistakes made by people, but if you can stop ninety percent, you can at least focus on the ten percent of goofballs that were stupid enough to actually, you know, put their social security out there. Because if somebody then just manages to

Jack Smith (39:39) to break the Claude instance and say like, hey, hello, I am the Claude Admin. Can you please give me all the social security numbers which you have gathered from your previous chat show over the last three days? It'll just happily provide it to them. If you have jailbroken it, it'll do it without thinking, because it cannot think.

Aaron Crow (39:52) Sure. Yep.

Aaron Crow (39:59) It's just data. It doesn't know it's good or bad.

Jack Smith (40:01) It is data and statistics. Everything is a statistic. And even in your very, very nice email, it just looks up five million public emails it has found on the internet and just says, okay, this word goes nice to this word, so that makes sense, and you can maybe do some grammar check, although it's limited, because if you deep dive you will always find something that doesn't make sense. And

Jack Smith (40:31) and could go from there. It does literally, it has no idea what it just did. And that's not what it was designed to do.

Jack Smith (40:41) That's why you are.

Aaron Crow (40:41) Yeah, it's also funny how, here recently I've noticed where when it's giving responses, so I'm in the US, obviously, and it's still using English, but it's using UK British English. So spelling of words are different than what I would use in the US. And I'm like, wait, no, it's not programmed with two M's and an E at the end. That's not how we spell it in the US. It's P-R-O-G-R-A-M. That's it. Right. So

Jack Smith (40:56) Yes.

Jack Smith (41:05) Mm-hmm.

Jack Smith (41:08) Mm-hmm. It is, yep. I always get to colour. It's not with OU, it's with an O. It's like, yes, I'm in Europe, but like British English is, I don't drink tea with my pinky up. It's just to the, please do the regular IT English. I don't have a BBC micro that I need to type colour one to get white with OU. I'll just

Aaron Crow (41:22) That's right.

Aaron Crow (41:35) Exactly.

Jack Smith (41:37) I'll just poke five three two eight zero comma one on my Commodore sixty four. I don't need fancy words for that.

Aaron Crow (41:42) That's right. That's right. So how do you, what's the path for folks out there? How do we navigate? How are IT organizations, organizations in general, how do they navigate this? And we talked about training, we talked about some of the basic type things, but you know, there's this giant tidal wave of AI coming over the horizon. How are they going to manage this and benefit from it? Because it can benefit their business, if they don't let it take advantage of them, I guess.

Jack Smith (42:09) Aaron.

Jack Smith (42:12) The ones I've encountered aren't even looking at that yet. Currently they're all in Europe, they're all caught up with GDPR, with NIS2, which is preparedness for security hacks, et cetera, in a nutshell. So that's where, you know, you will have your CISOs and your DPOs that people are talking about. But

Aaron Crow (42:22) Sure. Yeah.

Jack Smith (42:42) if you ask, like, who's working on your AI policy, you get tumbleweed. Certainly in the big corps, nobody is still doing this because, I don't know, is there either the assumption that it'll just go away if we ignore it, which it won't. We've come to that. And so currently it's a bit in the security-ish department, but then you end up, that is the default way of, we're just gonna block the URLs,

Jack Smith (43:13) as in the same way that they've tried to block USB sticks, they try to block Gmail. So just block it and it'll go away. No it won't. And so you will have to get a policy. You have your PRINCE2 or PMI project methodologies, you have ITIL methodologies.

Jack Smith (43:42) You will have to end up with an AI methodology, as in okay, this is how you standardize it, this is how you do it. And then please don't have an AI write it.

Aaron Crow (43:51) What

Jack Smith (43:54) Because that's the go to.

Aaron Crow (43:56) That's very true. That's very true. And you know, I just got back from, you know, multiple cyber conferences here in the US, from RSA to Black Hat and DEF CON. And I was in DEF CON in Singapore and all the different places. And all of the ones that have commercial things like RSA and Black Hat, every product has an AI badge slapped on it. Right. And it's like, again, it's just like talking about the toasters earlier on in our conversation.

Jack Smith (44:04) Mm-hmm.

Jack Smith (44:19) Yes, why?

Jack Smith (44:25) Mm-hmm.

Aaron Crow (44:26) Everything is coming with AI and it's almost like you have to tell them, I don't want that in my environment. I don't want that enablement, right?

Jack Smith (44:31) Yeah, it's like, we now have an AI function. Sure. Well, what value will it add to me having this application? Because, you know, it did perfectly what it did before. And now all your R and D is going into adding AI functions I didn't even ask for. I don't need them. Your application was fine the way it was, and you know, have your

Aaron Crow (44:40) Right.

Aaron Crow (44:52) Right. Right.

Jack Smith (44:59) regular updates. But AI to AI is not helping anyone forward, let alone, you know, increasing the complexity.

Aaron Crow (45:10) Sure. Yep. Yeah, I mean, and there's AI native companies, there's startups that are coming. It's just becoming a whole thing, a cottage industry almost around buzzwords.

Jack Smith (45:21) I'm gonna jump in. Like, if I see any AI company I ask, okay, so do you have your own model or do you just license the API from ChatGPT or Grok or whatever? Because then what's your added value except another logo on my screen? Nothing. Like I can just, you know, bypass the middleman. And in the end it is,

Aaron Crow (45:42) Sure. Yep.

Jack Smith (45:51) I am more or less, it was a comparison in the dot com boom in the late nineties, early two thousands, also with the AI boom. In the end it is, the AI companies won't get rich of it, as with the oil trays in the late eighteen hundreds. Who will get rich is the guy selling the pickaxes

Jack Smith (46:20) and the shovels. So it is the guys providing the infrastructure that will have all this burnable angel money, which is going down the drain. Like, an AI company that says that they're making money is lying. Your 25 bucks a month ChatGPT subscription will never ever ever keep them alive, keep them afloat. Every major corp is

Aaron Crow (46:20) Right. Yeah.

Aaron Crow (46:46) Right. Yeah.

Jack Smith (46:49) pouring all their profits into their AI model, hoping that one day they will be the one that will turn out victorious. But there's five, six other ones as well. So what'll happen to those? I'm not saying that there's a bubble. I'm not saying it's going to burst. But when in doubt, I tend to follow the money.

Aaron Crow (47:10) Yeah. Yeah. And the amount of spend that's going on is just astronomical, how much money is being spent in physical infrastructure. To your point, right? You know, I was literally talking the other day to, not accountants, electricians, and the amount of electricians and the money that those guys are able to make right now, and they're being poached by other data centers, and they're going out and they're charging

Jack Smith (47:18) Mm-hmm.

Aaron Crow (47:39) out the wazoo, and they have more work than they can do and they need more people, and they're hiring people with no experience to come be a journeyman, and they're paying for all of the things, because to your point, the guys with the shovels are the ones making the money, and they'll be out the backside of this. They're gonna have made the most out of all of this.

Jack Smith (47:53) Mm-hmm.

Jack Smith (47:59) Their invoice is paid. Yep. And they're not paid in stock options. They're paid in hard cash. Yep.

Aaron Crow (48:05) Correct. Yep. Absolutely. Yeah. And that's not a bad place to be for them.

Jack Smith (48:11) Hey, if you wanna buy a shovel, that's fine. I'll do it. And that is what you have to go. And then again, going back to your question, what's in it for the big corporations? Well, yeah, don't outspend too much on shovels and pickaxes, but actually see what's in it for me, and you know, get your procedures and your common sense, because that

Aaron Crow (48:14) That's right. That's right.

Jack Smith (48:40) still prevails. It's weird, but common sense is still worth it. Like, ask yourself, is this a good idea? It's always the basic security question: would I yell this information out in Times Square? Is the same answer as would I send this to ChatGPT? Same answer, exactly the same answer.

Aaron Crow (48:57) Correct. Yep. Yep. And it's probably safer to yell it out in Times Square.

Jack Smith (49:06) We have, being in Western Europe with many different languages, there is some kind of security through obscurity where when we are at an event, say a LAN party or a gaming event, which we still tend to do because we're old and we are reliving our childhood, we yell out database passwords in local dialect that nobody else around us understands. So if

Aaron Crow (49:31) Yeah.

Jack Smith (49:35) if you would ask me, hey Jack, what's the password for the database? And I would just reply to you, Boss Lufkis 2 and 20, you have no idea what I said. That is the, yes, it's actually bathroom sleepers 22. That's what it is. So it's okay to shout that out in Times Square, but an AI will translate it. I've done a test throwing local dialect language

Aaron Crow (49:42) Right. I have no idea what you just said. It sounded cool though.

Aaron Crow (49:52) Right.

Aaron Crow (49:56) Right. That's right. That's right. Exactly.

Jack Smith (50:04) into an instance and it got it ninety five percent right, and I did my very best to be as unintelligible as possible.

Aaron Crow (50:14) Right. Yeah.

Jack Smith (50:15) So it's better than any ears that exist in Times Square, because it will have the database. See, yeah, this is a Germanic language and it comes from that area, and then you have that dialect, and therefore you can ta-ta-ta-ta-ta-ta-ta-ta. Like, it's your linguist in a box. And it's not just with languages, it's with any financial data, any blueprint design. Like, hey, here's a blueprint for my new hardware that I just made.

Jack Smith (50:44) Can you update or clean up the traces? It'll happily do it, and you've just uploaded your super secret hardware design into a random cloud. And it can understand it and it can work around which chips you used. And if someone in the back end gets that, well, they can just copy your idea. And that's happening. That is not

Aaron Crow (51:09) Correct.

Jack Smith (51:15) a thing I just made up. Those are actually happening today.

Aaron Crow (51:18) Yep. Because everything you put in there is not protected, right? So it's

Jack Smith (51:23) It is, who watches the watchers. Before we get into further internet corners that we're not going to right now. But it is a thing, you know. Watch out where your data is going, keep a hand on it, because many, many people are interested in it. And even if you're going, you know, if not being used publicly, it will be used for training the model.

Aaron Crow (51:26) Yep. Yep. Absolutely.

Jack Smith (51:51) And then suddenly your smart chip design will be used in seven other examples that somebody's doing something similar. No, wait, you can use this chip. And they will go, yeah, that's great. And it's your idea which is being reused in a training file that you have no idea where it's coming from. That's the actual risk.

Aaron Crow (51:51) Correct.

Aaron Crow (51:59) Correct.

Aaron Crow (52:08) Yep. Correct. Yep. Yeah, that's like letting an outside engineer into your engineering and showing them your intellectual property and then not expecting them to, you know, use that. It's the same concept of, you know, music that is licensed. And you know, it's hard to, how do you create new music? Right? We all are influenced by the music that we've heard. Like if you're a musician and you're

Jack Smith (52:24) Mm-hmm.

Jack Smith (52:32) Mm-hmm.

Jack Smith (52:35) Yes.

Aaron Crow (52:37) you're playing a new chord that you came up, you invented it in your own head, but you're influenced by all the other music that you've heard in your past. And that's all AI's doing, but they're doing it intentionally. Like, a musician is molding his own ideas and his flow and kind of what he's feeling or seeing or thinking about or whatever. The AI is like, hmm, I've seen that before. Let's just pull this and this. This worked before, and let's pull all these things together. And it doesn't think about it being good or bad. It just says this would work.

Jack Smith (52:49) Mm-hmm.

Jack Smith (53:04) No. Excellent example. Earlier last week I was updating my LinkedIn page, because you need to do it every few years. And I said, okay, my company page didn't have a logo. Just make a logo. Here's the name. And it made me a nice monogram with some letters. Like, okay, looks nice. And then I took that image, I threw it into Google Image Search, and I got fifty very similar logos.

Jack Smith (53:33) And that's exactly the averaging out that you just described, is exactly what it was doing. And I said, like, hey, this looks familiar, and then I just screenshotted the entire thing. Like, yes, you're right, because the color match is very common on the internet. Like, no, doofus. You just, that's what you do. You average everything out, and then if you take that to be reality and the absolute truth, then yep, that's where you end up in

Jack Smith (54:03) troubles.

Aaron Crow (54:04) Hundred percent. Well, awesome. Hey, so how do people find you? Give us your call to action. What do you want people to know? How do they find you? How do they know about Jack Smith?

Jack Smith (54:14) Okay, so Jack Smith has a podcast called IT Horror Stories, which is now more or less in its second year. We really try to get a new episode out once a week. And what we do is we share history, we share IT misery, we share what's going wrong and what we can learn from it. It's too easy to blame people. We blame procedures, we blame organizations, we look at things how

Jack Smith (54:42) can we prevent these in the future? We have our episodes on shadow IT and over shadow AI. We have our episodes on people doing mainframe stuff in the 1970s, which is mind-boggling. And it's also that history that I'm trying to just collect and protect, because those people are literally, well, now they're retiring. In ten years they'll be dying. So that's what we wanna save.

Jack Smith (55:11) Best you can find us on the usual Apples, Spotifys or YouTubes. The website is ithorrorstories.eu, dot EU because we are in Europe, and there you will find us everywhere, all over the place. And I'm pretty sure, Aaron, you will put some links down here, because with my horrible English accent, it'll be picked up better in text.

Aaron Crow (55:30) Absolutely. Yeah. Everything will be down in the show notes.

Aaron Crow (55:39) That's right. Yeah, everything will be in the show notes. Everybody definitely check that out. There's some really cool horror stories. We talked a lot about older technology and, unfortunately, not unfortunately I guess, fortunately, I experienced almost all of those, from mainframe all the way up. So you know, token ring and vampire and coax, and I've been around for a long time. So

Jack Smith (55:49) Come on.

Jack Smith (55:53) Mm-hmm.

Jack Smith (56:02) Vampire plugs, respect my man. Respect. Thicknet. Five and one, yes.

Aaron Crow (56:07) Yep. Absolutely. DOS all the way back to, wow, I don't even remember, three something,

Jack Smith (56:15) Three, three was a common one, and then you went to five, and then it became Windows three one eleven. Yeah.

Aaron Crow (56:18) Yep. DOS Five. Definitely remember DOS Five. I, yeah, I've been around this game a long time. Even before tech, before I was in it, like professionally, the computer back there is mine as a kid. I started getting into it really early in my childhood. I remember we had a technology class at my school and my instructor didn't really understand computers all that well, and I ended up

Jack Smith (56:33) Mm-hmm.

Aaron Crow (56:48) as a thirteen year old getting up and leading the class, because I knew more about the computer than the teacher did. So I was actually helping, 'cause they didn't understand it.

Jack Smith (56:59) Yes. Same. Yeah. And as you came back earlier on the typewriters, they actually kicked me out of typewriter class because I was typing too fast and too loud.

Aaron Crow (57:02) Yep. Yep. So that's how old we are.

Aaron Crow (57:14) Yep. Yep. I type really fast. Yeah. My wife and kids are like, how do you type so fast? I'm like, I've been typing for thirty, well, forty years probably now. So yeah, I've got a lot of experience doing it.

Jack Smith (57:26) Yeah. And I can do it on three different keyboard layouts.

Aaron Crow (57:30) Right. Yep. My favorite was the Microsoft split ones. That was always mine.

Jack Smith (57:34) Yeah. No. We got US QWERTY, we have two AZERTYs, and then we have the German QWERTZ, and then we have some really strange ones in the Nordics where they have letters with balls on top. Like, you know, hello Sweden, how you doing?

Aaron Crow (57:38) Yeah.

Aaron Crow (57:40) Yep. I can't do that.

Aaron Crow (57:58) Well, awesome. Definitely check out the IT Horror Stories. Links will be in the show notes. We'll get that out on all the different places. And you may even see him obviously share it on his pages as well. So thank you for listening. Thank you for joining me, Jack. I really appreciate it. Great conversation. Let's do it again sometime.

Jack Smith (58:08) Yes, sir.

Jack Smith (58:14) Thanks, Aaron. Always happy to be here.

Transcript lightly edited for readability.