S16 E33: Liz Steininger on Least Authority & Auditing Open Source Software
Liz Steininger is the CEO of Least Authority: a company which specializes in auditing open source software since 2014. Originally founded by Zooko Wilcox, Least Authority has conducted more than 100 security audits in the space. Some of the best known contractors who requested an expert review include the Ethereum Foundation, the Electric Coin Company, Metamask, the KeyStone hardware wallet, and Avalanche.
Least Authority also builds products that make use of Zero Knowledge Proofs: PrivateStorage (a cloud storage system that's designed to make the host unaware of the files being stored), ZKAPs (Zero Knowledge Access Passes, an authorization system that separates the payer from the data on the items being bought), and Winden (a file-sharing service that's encrypted and requires no identity from the sender and receiver).
In a space which often defers to "check the code, it's open source", companies such as Least Authority offer high quality verification which makes it easier for the average non-technical person to trust that something is safe. Also, it helps builder have the peace of mind that what they're working on will not bring any unforeseen consequences.
Time stamps:
00:00 - Intro and Sponsor Mentions
Introduction to the podcast and sponsors: Sideshift, Bitcoin.com News, EdgeWallet, LayerTwo Labs, Citrea, NoOnes.com, and HODLING.ch.
01:17 - Guest Introduction: Liz Steininger
Liz Steininger, CEO of Least Authority, is introduced. Discussion begins about the company’s focus on security, privacy, and auditing in the crypto space.
1:57 - Irony of "Least Authority" Having a CEO
Liz addresses the irony of a company named Least Authority having a CEO, explaining their non-hierarchical approach and balance of leadership.
03:04 - Least Authority Philosophy and Nick Szabo’s Influence
Discussion on the principle of least authority, referencing Nick Szabo’s 2005 paper and its connection to Zooko, founder of Least Authority.
05:19 - Liz’s Tech Background
Liz shares her journey into tech, from early internet experiences to open-source and privacy-focused technologies.
09:36 - Role of Auditing Firms in Open-Source
Exploration of why auditing firms like Least Authority are necessary despite open-source code being publicly verifiable.
11:45 - Surprising Audit Findings
Liz discusses instances where Least Authority found unexpected issues during audits and the value of helping clients fix them.
12:16 - Notable Clients and Audits
Overview of Least Authority’s clients, including Zcash, MetaMask, Ethereum Foundation, Filecoin, Polygon, and Keystone hardware wallet.
14:35 - Predicting the Ethereum DAO Hack
Liz reflects on Least Authority’s 2015 Ethereum audit, which identified vulnerabilities that later contributed to the 2016 DAO hack.
17:43 - When to Conduct Audits
Discussion on the optimal timing for audits, depending on project roadmaps and feature development.
19:51 - Auditor Liability and Security Guarantees
Liz explains that no system can be 100% secure and discusses the limitations of auditor liability.
22:25 - Social Engineering and Security
Exploration of how social engineering can bypass even the most secure systems, with examples like SIM swapping and Pfizer leaks.
29:55 - Least Authority’s Products: Private Storage, ZKAPs, Winden
Overview of Least Authority’s products: Private Storage (client-side encrypted storage), ZKAPs (zero-knowledge access passes), and Winden (anonymous file transfer).
36:45 - ZKAPs Applications Beyond Storage
Liz discusses potential uses of ZKAPs for other services requiring privacy in payments, like VPNs or electricity.
43:53 - Winden’s Features and Use Cases
Detailed explanation of Winden’s end-to-end encrypted, identity-free file transfer, ideal for secure peer-to-peer sharing.
46:21 - Destiny: Mobile Version of Winden
Introduction to Destiny, a mobile app version of Winden using the same magic wormhole protocol.
50:00 - HRO Cloud for Human Rights Organizations
Discussion of HRO Cloud, a free version of Private Storage for qualified human rights organizations.
51:00 - Moon Math Manual
Overview of the Moon Math Manual, a resource for learning about ZK-SNARKs, inspired by the term “moon math” from Vitalik Buterin.
57:38 - Privacy, Law Enforcement, and Zero-Knowledge Proofs
Liz discusses how Least Authority minimizes data collection to avoid sharing with law enforcement, emphasizing privacy design.
1:01:59 - Privacy Market and Big Tech Adoption
Reflections on the growing demand for privacy tech and potential adoption of zero-knowledge proofs by major tech companies.
1:05:00 - Auditing Non-Crypto Projects
Liz notes that while most clients are crypto-related, they also audit non-crypto open-source projects, though funding is a challenge.
1:07:17 - Vibe Coding and Auditing Demand
Discussion on the rise of vibe coding (AI-generated code) and its potential to increase demand for audits, especially for smart contracts.
1:11:07 - Zcash Audit and Bitcoin Codebase
Liz considers whether their Zcash audit indirectly audited Bitcoin’s codebase, noting it’s an interesting question for further review.
1:13:05 - Publishing Audit Reports
Liz advocates for more industry-wide publication of audit reports to improve transparency and user education.
1:18:01 - Competing Auditing Firms
Liz discusses competition in the auditing space, varying by project type (e.g., smart contracts vs. protocols).
1:21:12 - Future of Privacy and Zcash Integration
Liz expresses hope for Zcash’s privacy tech to be integrated into Bitcoin, emphasizing its potential to drive mass adoption.
1:24:00 - Liz’s First Computer and Early Tech Memories
Liz shares nostalgic memories of using an Atari, Commodore 64, and AOL, encouraging listeners to comment “AOL” to prove they watched to the end.
1:28:37 - Closing and Winden Recommendation
Liz thanks the host and encourages listeners to try Winden, an open-source, free file transfer tool.
Least Authority also builds products that make use of Zero Knowledge Proofs: PrivateStorage (a cloud storage system that's designed to make the host unaware of the files being stored), ZKAPs (Zero Knowledge Access Passes, an authorization system that separates the payer from the data on the items being bought), and Winden (a file-sharing service that's encrypted and requires no identity from the sender and receiver).
In a space which often defers to "check the code, it's open source", companies such as Least Authority offer high quality verification which makes it easier for the average non-technical person to trust that something is safe. Also, it helps builder have the peace of mind that what they're working on will not bring any unforeseen consequences.
Time stamps:
00:00 - Intro and Sponsor Mentions
Introduction to the podcast and sponsors: Sideshift, Bitcoin.com News, EdgeWallet, LayerTwo Labs, Citrea, NoOnes.com, and HODLING.ch.
01:17 - Guest Introduction: Liz Steininger
Liz Steininger, CEO of Least Authority, is introduced. Discussion begins about the company’s focus on security, privacy, and auditing in the crypto space.
1:57 - Irony of "Least Authority" Having a CEO
Liz addresses the irony of a company named Least Authority having a CEO, explaining their non-hierarchical approach and balance of leadership.
03:04 - Least Authority Philosophy and Nick Szabo’s Influence
Discussion on the principle of least authority, referencing Nick Szabo’s 2005 paper and its connection to Zooko, founder of Least Authority.
05:19 - Liz’s Tech Background
Liz shares her journey into tech, from early internet experiences to open-source and privacy-focused technologies.
09:36 - Role of Auditing Firms in Open-Source
Exploration of why auditing firms like Least Authority are necessary despite open-source code being publicly verifiable.
11:45 - Surprising Audit Findings
Liz discusses instances where Least Authority found unexpected issues during audits and the value of helping clients fix them.
12:16 - Notable Clients and Audits
Overview of Least Authority’s clients, including Zcash, MetaMask, Ethereum Foundation, Filecoin, Polygon, and Keystone hardware wallet.
14:35 - Predicting the Ethereum DAO Hack
Liz reflects on Least Authority’s 2015 Ethereum audit, which identified vulnerabilities that later contributed to the 2016 DAO hack.
17:43 - When to Conduct Audits
Discussion on the optimal timing for audits, depending on project roadmaps and feature development.
19:51 - Auditor Liability and Security Guarantees
Liz explains that no system can be 100% secure and discusses the limitations of auditor liability.
22:25 - Social Engineering and Security
Exploration of how social engineering can bypass even the most secure systems, with examples like SIM swapping and Pfizer leaks.
29:55 - Least Authority’s Products: Private Storage, ZKAPs, Winden
Overview of Least Authority’s products: Private Storage (client-side encrypted storage), ZKAPs (zero-knowledge access passes), and Winden (anonymous file transfer).
36:45 - ZKAPs Applications Beyond Storage
Liz discusses potential uses of ZKAPs for other services requiring privacy in payments, like VPNs or electricity.
43:53 - Winden’s Features and Use Cases
Detailed explanation of Winden’s end-to-end encrypted, identity-free file transfer, ideal for secure peer-to-peer sharing.
46:21 - Destiny: Mobile Version of Winden
Introduction to Destiny, a mobile app version of Winden using the same magic wormhole protocol.
50:00 - HRO Cloud for Human Rights Organizations
Discussion of HRO Cloud, a free version of Private Storage for qualified human rights organizations.
51:00 - Moon Math Manual
Overview of the Moon Math Manual, a resource for learning about ZK-SNARKs, inspired by the term “moon math” from Vitalik Buterin.
57:38 - Privacy, Law Enforcement, and Zero-Knowledge Proofs
Liz discusses how Least Authority minimizes data collection to avoid sharing with law enforcement, emphasizing privacy design.
1:01:59 - Privacy Market and Big Tech Adoption
Reflections on the growing demand for privacy tech and potential adoption of zero-knowledge proofs by major tech companies.
1:05:00 - Auditing Non-Crypto Projects
Liz notes that while most clients are crypto-related, they also audit non-crypto open-source projects, though funding is a challenge.
1:07:17 - Vibe Coding and Auditing Demand
Discussion on the rise of vibe coding (AI-generated code) and its potential to increase demand for audits, especially for smart contracts.
1:11:07 - Zcash Audit and Bitcoin Codebase
Liz considers whether their Zcash audit indirectly audited Bitcoin’s codebase, noting it’s an interesting question for further review.
1:13:05 - Publishing Audit Reports
Liz advocates for more industry-wide publication of audit reports to improve transparency and user education.
1:18:01 - Competing Auditing Firms
Liz discusses competition in the auditing space, varying by project type (e.g., smart contracts vs. protocols).
1:21:12 - Future of Privacy and Zcash Integration
Liz expresses hope for Zcash’s privacy tech to be integrated into Bitcoin, emphasizing its potential to drive mass adoption.
1:24:00 - Liz’s First Computer and Early Tech Memories
Liz shares nostalgic memories of using an Atari, Commodore 64, and AOL, encouraging listeners to comment “AOL” to prove they watched to the end.
1:28:37 - Closing and Winden Recommendation
Liz thanks the host and encourages listeners to try Winden, an open-source, free file transfer tool.
Activity