Matt's Homepage

It feels like the American industrial and manufacturing landscape has been left behind in the digitalization revolution. But recent changes demonstrated in both Ukraine and a small robot company in Pittsburg may be pointing to the coming revolution.

Gecko is a scrappy robot company founded by a college senior that saw workers spending hours putting up dangerous scaffolding to check and fix pipes in a power plant. What if he could build robots to scale around the pipes and check and fix them? It turns out they could – and it is revolutionizing maintenance in refineries and energy infrastructure across the country. The robots now no longer can crawl and inspect/repair – but they can create new digital maps of a plant’s infrastructure. Inspections are taking orders of magnitude less time. Plants can have their actual systems instantly remapped/re-diagrammed instead of relying on out of date schematics.

It turns out someone else has the same problem: the military. Systems like Gecko allow the navy to build and repair ships faster. Gecko’s small robots reduced nuclear submarine inspection times from 300 hours to just 6 hours. But this revolution is bigger than just repair of existing systems.

The war in Ukraine is now being won not by ‘exquisite’, complex, and exorbitantly expensive weapons systems. Instead, it’s being won by swarms of low-cost drones. Million dollar tanks are being disabled by $200 drones carrying explosives. Military experts around the world are watching Ukraine and re-thinking everything. Even before the Ukraine war, the US navy was already started the move from big capital ships to cheaper, faster to build modular ships.

Anduril wrote a paper in 2024 that goes a step further. They claim that these low-cost robotics and AI systems are making existing weapons systems vulnerable and outdated. Modern, 1st world weapon systems are too complex and hugely expensive. They take too long to make in quantities required for something beyond a short war. What is needed is to establish fast, cheap, commercial manufacturing of these systems that can be built and deployed rapidly. This is leading to a revolution of automated manufacturing.

The future is not going to belong to giant, expensive, monolithic systems – but fast, easy to build, capable systems built in large numbers.

Give the article a read.

The TeamPCP hacker group on the Breached cybercrime forum claimed it had gained access to nearly 4,000 private GitHub repositories via the breach.

GitHub has officially confirmed, via an X post today, that thousands of its internal repositories were breached after an employee’s device was compromised through a malicious Visual Studio Code extension.

The group alleged that it had exfiltrated internal source code and other private data, and stated that it was seeking at least $50,000 from potential buyers for the stolen material. “This is not a ransom,” the group wrote in its post, adding that it intended to sell the data rather than extort GitHub directly, and threatening to leak the repositories publicly if no buyer emerged.

TeamPCP has previously been linked to several high-profile campaigns involving platforms such as GitHub, PyPI, npm, and Docker. At the same time, malicious VS Code extensions have repeatedly surfaced in recent years as an increasingly effective vector for breaches and malware delivery.

Federal agencies will no longer be required to solicit software attestations that they comply with NIST’s Secure Software Development Framework (SSDF).

The SBOM requirement has lead to a small cottage industry of scanning and CI tools that provide this functionality. It will be interesting to see how that all develops, but constantly changing industry standards and practices is not good for businesses.

The US used to thoughtfully and carefully roll out changes like this in the past. In our increasingly polarized political climate, software companies are increasingly whipsawed back and forth. Adding and removing requirements like this is not a zero-cost change. Compliance burdens cost money, time, and credibility to any company based here in the US.