Somewhere inside that isolated network, port 22 is open, and it has been open since the outage six months ago that nobody wrote up. Andy Syrewicze and Eric Siron take apart a term the industry uses constantly and almost never earns. They walk the management plane hole by hole: SSH and RDP so somebody can patch the thing, SMB for the files that have to move, DNS and NTP because nothing works without them, and the iDRAC, iLO, and IPMI boards that get parked on the management VLAN and then never patched at all. The argument they land on is not that a real air gap is impossible, it is that calling something an air gap ends the conversation, and a promise nobody re-verifies is worse than a risk everybody can see. Chapters: 00:00:00 - Cold Open: Your Air Gap Probably Is Not an Air Gap 00:01:12 - Welcome and Show Plugs 00:04:19 - News React: An AirTag, a Rare Book, and an Amazon Scanning Facility 00:10:10 - News React: Bill Gates Changes His Mind on AI and Jobs 00:13:03 - What the Entry Level Job Market Looks Like Right Now 00:15:05 - When Nobody Is Left Who Knows How to Program It 00:19:25 - Nerd Hour: Claude Code, Agents, and Building CC Top 00:23:54 - Nerd Hour: Moving Project Runspace to Hugo, JavaScript Free 00:28:22 - What an Air Gap Actually Means 00:31:22 - Logical, Network, Virtual: How the Word Got Laundered 00:32:36 - Every Hole You Poke Just to Manage the Thing 00:34:18 - The One Nobody Segments: iDRAC, iLO, and IPMI 00:36:26 - A Brief and Deserved Detour About Printers 00:37:23 - NTP, DNS, License Activation, and Telemetry 00:40:34 - Why Leaving Hyper-V Out of the Domain Is Not Security 00:43:16 - VLANs, Switch Fabric, and Breakout Attacks 00:44:40 - Assume Breach: Zero Trust, JIT, and JEA 00:50:36 - Sneaker Net and Poisoned USB Drives 00:52:20 - Stuxnet and the Gap That Was Real 00:54:59 - How Would You Even Safely Clean a USB Drive? 00:56:58 - Say What You Have, Then Defend It 00:57:29 - The Real Danger Is the False Sense of Security 01:00:23 - The Windows Firewall Lesson 01:03:11 - What a Genuine Air Gap Actually Costs 01:04:59 - Wrap Up and Outro Resources / Show Notes: - Symantec Security Response, W32.Stuxnet Dossier, the canonical technical analysis: https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en - Ralph Langner, To Kill a Centrifuge, on why post-Stuxnet air gap strategies miss the point: https://www.cs.yale.edu/homes/jf/Langner.pdf - The 2008 USB breach of US military networks, Agent.btz and Operation Buckshot Yankee: https://en.wikipedia.org/wiki/2008_malware_infection_of_the_United_States_Department_of_Defense - Microsoft Security Advisory 967940, the update that killed USB AutoRun: https://learn.microsoft.com/en-us/security-updates/securityadvisories/2009/967940 - NIST SP 800-82 Rev. 3, Guide to Operational Technology Security, for naming what you actually have: https://csrc.nist.gov/pubs/sp/800/82/r3/final - 404 Media, tracking a shipment of rare books to an Amazon AI training facility: https://www.404media.co/we-tracked-a-shipment-of-rare-books-it-ended-at-an-amazon-ai-training-facility/ - Semafor, Bill Gates has changed his mind about AI and jobs: https://www.semafor.com/article/08/25/2026/this-is-crazy-this-is-insane-bill-gates-has-changed-his-mind-about-ai-and-jobs Gates Notes, the essay itself: The turbulent AI era is here: https://www.gatesnotes.com/a-turbulent-ai-era-and-critical-choices-to-make - SysAdmin Weekly, all show links: https://www.sysadminweekly.com - SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com - AndyOnTech: https://www.andyontech.com - Project Runspace: https://www.projectrunspace.org - GitHub Discussions, tell us about your air gap and why you have one: https://github.com/ProjectRunspace/sysadmin-weekly/discussions
