Somewhere inside that isolated network, port 22 is open, and it has been open since the outage six months ago that nobody wrote up.
Andy Syrewicze and Eric Siron take apart a term the industry uses constantly and almost never earns. They walk the management plane hole by hole: SSH and RDP so somebody can patch the thing, SMB for the files that have to move, DNS and NTP because nothing works without them, and the iDRAC, iLO, and IPMI boards that get parked on the management VLAN and then never patched at all. The argument they land on is not that a real air gap is impossible, it is that calling something an air gap ends the conversation, and a promise nobody re-verifies is worse than a risk everybody can see.
Chapters:
00:00:00 - Cold Open: Your Air Gap Probably Is Not an Air Gap
00:01:12 - Welcome and Show Plugs
00:04:19 - News React: An AirTag, a Rare Book, and an Amazon Scanning Facility
00:10:10 - News React: Bill Gates Changes His Mind on AI and Jobs
00:13:03 - What the Entry Level Job Market Looks Like Right Now
00:15:05 - When Nobody Is Left Who Knows How to Program It
00:19:25 - Nerd Hour: Claude Code, Agents, and Building CC Top
00:23:54 - Nerd Hour: Moving Project Runspace to Hugo, JavaScript Free
00:28:22 - What an Air Gap Actually Means
00:31:22 - Logical, Network, Virtual: How the Word Got Laundered
00:32:36 - Every Hole You Poke Just to Manage the Thing
00:34:18 - The One Nobody Segments: iDRAC, iLO, and IPMI
00:36:26 - A Brief and Deserved Detour About Printers
00:37:23 - NTP, DNS, License Activation, and Telemetry
00:40:34 - Why Leaving Hyper-V Out of the Domain Is Not Security
00:43:16 - VLANs, Switch Fabric, and Breakout Attacks
00:44:40 - Assume Breach: Zero Trust, JIT, and JEA
00:50:36 - Sneaker Net and Poisoned USB Drives
00:52:20 - Stuxnet and the Gap That Was Real
00:54:59 - How Would You Even Safely Clean a USB Drive?
00:56:58 - Say What You Have, Then Defend It
00:57:29 - The Real Danger Is the False Sense of Security
01:00:23 - The Windows Firewall Lesson
01:03:11 - What a Genuine Air Gap Actually Costs
01:04:59 - Wrap Up and Outro
Resources / Show Notes:
- Symantec Security Response, W32.Stuxnet Dossier, the canonical technical analysis: https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
- Ralph Langner, To Kill a Centrifuge, on why post-Stuxnet air gap strategies miss the point: https://www.cs.yale.edu/homes/jf/Langner.pdf
- The 2008 USB breach of US military networks, Agent.btz and Operation Buckshot Yankee: https://en.wikipedia.org/wiki/2008_malware_infection_of_the_United_States_Department_of_Defense
- Microsoft Security Advisory 967940, the update that killed USB AutoRun: https://learn.microsoft.com/en-us/security-updates/securityadvisories/2009/967940
- NIST SP 800-82 Rev. 3, Guide to Operational Technology Security, for naming what you actually have: https://csrc.nist.gov/pubs/sp/800/82/r3/final
- 404 Media, tracking a shipment of rare books to an Amazon AI training facility: https://www.404media.co/we-tracked-a-shipment-of-rare-books-it-ended-at-an-amazon-ai-training-facility/
- Semafor, Bill Gates has changed his mind about AI and jobs: https://www.semafor.com/article/08/25/2026/this-is-crazy-this-is-insane-bill-gates-has-changed-his-mind-about-ai-and-jobs
Gates Notes, the essay itself: The turbulent AI era is here: https://www.gatesnotes.com/a-turbulent-ai-era-and-critical-choices-to-make
- SysAdmin Weekly, all show links: https://www.sysadminweekly.com
- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com
- AndyOnTech: https://www.andyontech.com
- Project Runspace: https://www.projectrunspace.org
- GitHub Discussions, tell us about your air gap and why you have one: https://github.com/ProjectRunspace/sysadmin-weekly/discussions
