Things Philip Tricca Has Said on Podcasts

“I'm sure the number of startups out there where their PKI was, you know, an unencrypted key sitting on a thumb drive in someone's desk drawer is probably way more than zero.” — Philip Tricca, Oxide and Friends

The Oxide hosts were joking about cutting corners on key management "out of expediency." Tricca explains why Oxide set a minimum bar for its hardware root of trust's signing ceremony before shipping its first rack.

Oxide and Friends · 2026-10-24 Permalink → Listen →

Oxide and Friends Around 18:34 into the episode

Adam Leventhal

expediency, it's like, look, I attached to you. Out of expediency, just 100%. Yeah.

Bryan Cantrill

I'm attached to an email. It's an email coming from the CEO. Or it's like sitting in like, no, we're going to lock the desk drawer that has this. So I don't know what you guys are so upset about. That

Philip Tricca

was exactly where I was going with this. It's like, I'm sure like the number of startups out there where their PKI was like, you know, an unencrypted key sitting on a thumb drive in someone's desk drawer is probably way more than zero. Way

Bryan Cantrill

more than zero. And I think that this is one of these things where it's like the kind of the lean methodology or, you know, you want to ship like the minimum thing. It's like, well, the minimum, you're going to live with this decision. The whole idea of that kind of the kind of the lean startup…

Philip Tricca

Yeah. And I mean, it's not impossible to create a new PKI. I mean, we can do that from thin air, basically. You're just generating data that becomes an encryption key or a signing key. So, you know, I don't think that, you know, you, you do have to have something on day one. It has to hit some kind…

Bryan Cantrill

So you have this like, oh, shit moment where it's like, we got to build this whole thing, something that we've like depended on. And I mean, this is where you do have, I feel like the more established company experience is super helpful in that we have really high expectations for ourselves because…

Speaker names from our own diarization · position estimated from where the line sits in the episode

“These are like, in a way, kind of like nuclear weapons, where there are entire industries of incredibly intelligent and experienced people that would spend tons of time hunting for these things. And in a matter of 10 minutes, an LLM can take an old code base, flip it over and shake all the change out of it.” — Philip Tricca, Oxide and Friends

Bryan Cantrill had just remarked on how good LLMs have become at finding sophisticated vulnerabilities, putting what used to be state-level attacks in far more hands. Tricca agrees, and says old firmware like UEFI suffers most because it was designed for very different times.

Oxide and Friends · 2026-10-24 Permalink → Listen →

Oxide and Friends Around 1:14:00 into the episode

Philip Tricca

…very far out. But the goal is to be as transparent as possible. That's right. To give people primitives so that they can build systems where they don't blindly trust these types of things. And this is it. And we had customers that wanted it. And so now we're exposing it up to the virtual machines.

Bryan Cantrill

…putting these kind of, what were formerly kind of state actor level attacks in potentially much broader hands. So it's like, I feel, I mean, it must feel like vindicating, not that you needed it, but like the security at this layer of the stack has become much more important, even in the last year.

Philip Tricca

Yeah, this is, these are weird times. Like these are really interesting times on this front. These are like, in a way, kind of like nuclear weapons, where there are entire industries of incredibly intelligent and experienced people that would spend tons of time hunting for these things. And in a matter of 10 minutes, an LLM can take an old code base, flip it over and shake all the change out of it. It is, and this is where things like UEFI really suffer is because they are from, and they were designed in very different times.

Speaker 4

Very different times.

Philip Tricca

And the incentive, unfortunately, is a bit upside down there. Like the incentive for people to change that is very low. And the people that care about it are very few. Now, of course, people care about it when it goes wrong, but most of the time, like people aren't doing the risk analysis that says…

Bryan Cantrill

And I think to the degree that we're now all signing up in the light cone reserves, Adam, to defend the light against our robot overlords, this kind of security becomes really important because this is the kind of the physical security of the system. And I do think, I mean, I think it's honestly…

Speaker names from our own diarization · position estimated from where the line sits in the episode

Things Philip Says on Podcasts

Where to Find Them

What They Said

Collections They Appear In