I asked Rod Schultz for his favorite interview question, and he gave me mine.
“And I would ask people to design a secure garage door opener with me.”
Rod Schultz, at 17:12
I told him on tape that I had used that exact question over and over, and he figured out why before I did: people at Apple liked it so much they folded it into their own interviews, and somewhere along the way it reached me. Rod’s explanation of what the question is for is the best two minutes of hiring advice I know for a security team.
“So we would start with this concept of, like, all right, we’re gonna make millions of dollars on a secure garage door opener. What, you know, how are we gonna do it? And it goes into, like, okay, it starts out with identity, and security, and replay protection, and all kinds of things, like non-repudiation. And you can kind of start to build up different levels of complexity to your protocol, because it starts to go into protocol design as well. And just the understanding of what’s the threat model? What are you concerned about? What’s characterizable in some ways, and what’s [not] characterizable? Okay, how are you going to do that at cost? How are you going to do that at scale? How are you going to do that at volume of transaction logs and things like that?”
Rod Schultz, at 17:49
We published this on June 3, 2023, and the show notes were 39 words. The conversation wanders the way conversations between two FairPlay alumni do, from a spy book in Durham to the Matrix sequels. This page is the rest of it: the garage door question and what a toy and a $30 radio did to the real thing in 2015, the paragraph about public key cryptography that started it all, the FairPlay years and the subpoena that brought him to an Oakland courtroom in 2014, why DRM was always a business enabler and never the point, the slalom between big companies and small ones, the thirteen people he hired at Zoom in a hurry, what good chemistry on a team actually is, the diamonds on the surface of things at DUST Identity, the best and worst days of his first six months there, why you are Yoda and not Luke Skywalker when you present, asking yourself why, and the four ways to create value. There are four things to try along the way: a quiz on the episode, a scorecard that runs Rod’s interview question against your own product, a calculator for how long a fixed code lasts, and a timeline you can filter.
What a toy did to the garage door
The question works because the garage door is a real product with a real history of getting it wrong, and every generation of it teaches one of the things Rod is listening for. The first openers used a fixed code, a handful of DIP switches inside the remote that sent the same 8 to 12 bits every time you pressed the button. On June 4, 2015, seven years after Rod left Apple and eight before this episode, Samy Kamkar published OpenSesame, a modified Mattel toy that opened fixed-code garages in seconds. His arithmetic is the cleanest lesson in protocol design I know. Sending every 8 to 12 bit code the way a remote sends it, at 4 milliseconds a bit and five transmissions a press, takes “88576 bits * 4ms * 5 transmits = 1771.52 seconds = 29 minutes.” But the receivers only checked the last bits they heard, so a single De Bruijn sequence, in which every possible code overlaps the next, does the same job in “((2 ** 12) + 11) * 4ms / 2 = 8214ms = 8.214 seconds.” His summary: “We went from 1771 seconds down to 8 seconds” (Samy Kamkar).
I've released OpenSesame, a new vulnerability that can open fixed code garages in under 10 seconds with a Mattel toy https://www.youtube.com/watch?v=iSSRaIU9_Vc
Samy Kamkar (@samykamkar) · June 4, 2015
The second generation was the rolling code, which changes on every press so that a recorded code is useless. Kamkar answered that one too, two months later at DEF CON, with a $30 device called RollJam: it jams the signal when you press the button so the opener never hears the first code, records it, jams and records the second press as well, then replays the first so the door opens and you notice nothing, keeping a valid code that the opener has never seen for later. “My own car is fully susceptible to this attack. I don’t think that’s right when we know this is solvable,” he told Wired (Engadget). The fix is the third generation, the one a strong candidate reaches by the end of the interview: the opener issues a fresh challenge and the remote signs it, so there is nothing useful to record in advance. That is replay protection, freshness and identity, which is three of the things Rod listed before he got to cost and scale.
The best comment on the Hacker News thread about OpenSesame is also the shortest, and it is the joke every candidate makes about ten minutes in.
"Time to enable two-factor authentication on my garage."
josep2, on Hacker News, June 4, 2015
Why the question beats a whiteboard is the part Rod cares about most. He used to watch interviewers ask candidates to write C code on the board or recite block ciphers, which only tests “could they regurgitate, you know, some knowledge back at me?” What he needed to know was whether someone could collaborate. I added the part I love about it: it lets the candidate drive, and you get to see where they go, whether they roll the car right up to the edge of the cliff to show you the view or zoom in on the paint on the road. Rod’s version is that you can give a few helpful nudges, “introduce concepts that they hadn’t thought about, and just see how receptive they are to it.” He has been on the other side of the bad version too: thirty minutes with his back to the interviewer, writing C code on the board while the interviewer sent and received email, and countless interviews where “they’ll look up, and they’ll be like, hey, you missed a semicolon on that line of code.” Talk about dry feedback. The scorecard further down is this question pointed at your own product, one generation at a time.
The key to lock and the key to unlock
I asked how he got into security, and the answer was a gift he got in middle school, for a birthday or Christmas, since his birthday is in December.
“And I got this book, and it was called Spy Tech, I believe. And, you know, I kind of cruised through it, and I was always fascinated by subterfuge and spy stuff and things like that. And then there’s this one small kind of paragraph in this section on, you know, encryption and decryption, or cryptography, I guess. And it was about this concept called public key cryptography. And at the time, this is back in the eighties, there wasn’t a whole lot that you could find on public key encryption.”
Rod Schultz, at 2:29
The paragraph said that the key to lock the data is different from the key to unlock it, “And that blew my mind. At the time, I only knew common everyday algebra, and I could not figure out for the life of me how, if you had A and C, you could not solve for B in the equation.” That confusion is the right one, and it is exactly what the mathematics depends on. He spent the I-Search project of his junior and senior years of high school on it, nine or ten months with the same teacher. He grew up in Durham, North Carolina, so he went to the libraries at Duke and the University of North Carolina and pulled old issues of Scientific American off microfiche. He does not say which articles. The most famous one on the subject is Martin Gardner’s Mathematical Games column of August 1977, “A new kind of cipher that would take millions of years to break,” the first public description of RSA, published the year after Whitfield Diffie and Martin Hellman introduced the idea of public key cryptography (Wikipedia). The book was probably Graham Yost’s Spy Tech, a 1985 Facts on File title with that name (Open Library). He went to the University of North Carolina himself, and on the way to a degree in applied computer science he took applied physics, biomedical materials, quantum mechanics and two kinds of chemistry, which is as good a description of a security career as any.
Then he met one of the people who wrote the mathematics. Rubicon Labs, the startup he joined from Adobe and stayed at for five years, had Whit Diffie as an advisor, “and one of the kind of reasons I left was they had Whit Diffie as an advisor.” I pointed out that this was the Diffie of the Diffie-Hellman key exchange, based on the difficulty of the discrete logarithm problem, and that working with your childhood hero must have been something. His answer was the wise one: “it’s sometimes, you know, be careful what you wish for. It’s dangerous to meet your heroes.” Not because of anything dramatic, he said, only that heroes do not always match the mental model you built of them as a kid looking through spy books. Diffie and Hellman shared the 2015 Turing Award for the idea in that paragraph. The idea Rod took from it is the one I quote to parents most often.
“But I tell people that foundationally, my career has been based on top of mathematics that didn’t exist, you know, fifty years ago or sixty years ago. And that is, like, when people say, like, you know, hey, what should my kid do when they grow up? I, you know, my response is: hey, it’s very possible that the technology or the, you know, the mathematics or whatever that your child is going to base their life on doesn’t even exist today.”
Rod Schultz, at 4:41
So focus on solving hard problems that fascinate you and that the world will get value out of. Public key cryptography looked useless, and then the context switched and the security of the entire world came to rest on it, the internet and e-commerce first, and “a lot of the stuff that we had to work on at Apple and in FairPlay.”
FairPlay, and the subpoena
Rod and I share a lineage. He was a senior software engineer on Apple’s FairPlay team from January 2006 to March 2008, before my time there, on the team I later joined, and FairPlay was the copy protection on everything the iTunes Store sold (Computerworld). The store had opened on April 28, 2003 with FairPlay on every song (Wired). In July 2004 RealNetworks shipped Harmony so that songs bought from its store would play on an iPod, Apple said it was “stunned” and broke Harmony in a later update, and in October 2006 Jon Lech Johansen announced he had reverse engineered FairPlay (Wikipedia). Rod’s own account of the work is in an article he wrote in 2012 for a French hacker magazine, The Many Facades of DRM. Computerworld quoted it when it mattered: when a group called Brahms reverse engineered the latest FairPlay in early 2008 and released a tool called Requiem, “This was the beginning of a secret war between the FairPlay team and Brahms, costing millions of dollars,” and Requiem was “an extremely sophisticated attack of Apple’s FairPlay.”
It mattered because of a courtroom. In December 2014, a class of about 8 million iPod buyers took Apple to trial in federal court in Oakland, before Judge Yvonne Gonzalez Rogers, claiming the iTunes 7.0 changes that locked out rival music services had cost them about $350 million, which antitrust law would have tripled to around $1 billion (eWeek). The plaintiffs could not get Rod’s 2012 article admitted, so they subpoenaed him, and on December 12 he testified, reluctantly, that his work had been “intended to block 100% of non-iTunes clients” and to “keep out third-party players” (Computerworld, AppleInsider). He also reportedly agreed with Apple that the updates brought real security, operational and visual improvements. Four days later the jury found for Apple, unanimously, after about three hours.
On tape, eight and a half years after the trial, Rod described the article the way an engineer describes a thing he is proud of and uneasy about at the same time.
“So I wrote an article for a French hacker magazine called The Many Facades of DRM. And it was basically, [the] intro, [the] framing of the story is about Steve Jobs and why he hates DRM. And it was really just a [smoke and mirrors] game in some ways for Apple to control a market. But yeah, the premise of that was all about: I worked on this technology. We used cryptography to effectively create barriers to entry, and do it effectively, almost too effectively, in some ways.”
Rod Schultz, at 43:38
“Almost too effectively” is the most honest description of a security control I have heard on this show. The cryptography did exactly what it was asked to do. Whether it should have been asked is a business question, and that is where the conversation went next.
DRM is a business enabler
I told Rod the moment I understood why we were doing it, which is a story about an all-hands.
“And I didn’t understand why until it was, like, shoved into my face. Because, you remember, we had those old [all-hands]. At the time, Steve Jobs was still leading Apple. And someone asked him a question in a company-wide all-hands about, like, what’s the future of iTunes and DRM? And his response, I remember, it was something along the lines of: you know what? DRM is stupid. We wouldn’t do it unless we absolutely had to.”
Jon McLachlan, at 42:12
“In, like, those two or three sentences from Steve Jobs, my world was shattered,” because here was the chief executive saying he hated the team I was on. It is the same position he had taken in public on February 6, 2007, in Thoughts on Music, the open letter asking the four big labels to let Apple sell music without DRM and arguing that Apple used it only because their contracts required it (Wikipedia). On January 6, 2009, eight million of the store’s 10 million songs went DRM-free as iTunes Plus, with the rest due by the end of March, and Jobs said “We are thrilled to be able to offer our iTunes customers DRM-free iTunes Plus songs in high quality audio” (Apple). What I said on tape is that I understand the requirement now: the content owners had a clause that made Apple responsible for keeping their music off Napster and the torrents, and in an era when the music industry was suffering, a computer company walking in with digital music on iPods must have sounded like a joke. DRM was what opened that door. Rod put it in two sentences.
“Yeah, it’s a business enabler, right? That’s effectively what DRM is. It enables that business. But, you know, you don’t want to be in the business of DRM unless you have to, because it’s a tough game to be in. It’s hard.”
Rod Schultz, at 45:22
That sentence describes more of the security industry than it seems to. A SOC 2 report is a business enabler. So is a penetration test letter, a data processing agreement, an answer to question forty of a security questionnaire. Each one exists because a customer’s contract says it has to, and the work is real work, and the best teams do it without forgetting that the point is the deal it unlocks, not the control itself. FairPlay never went away. FairPlay Streaming protects video over HTTP Live Streaming, App Store apps are protected and code signed with a variant of it, and Apple Music runs on it (Wikipedia). Rod’s own read on the moment, twenty-seven years after Napster, is that something similar is happening to fraud now, and he wrote it up in October.
In almost 30 years working in technology (Cisco, Apple, Adobe, Zoom...several startups), I’ve seen a few moments when something changes so fundamentally that an entire industry must reorganize around it.
Rod Schultz · October 20, 2026
In 1999, I, along with many of you reading this, witnessed this exact transformation.
On June 1st of that year, Napster launched. Almost overnight, music went from scarcity to abundance, and the cost, friction, and necessary skills to distribute music collapsed.
The slalom
Rod’s career alternates between big companies and small ones, and he has a word for it that he got from Richard Egan, his chief executive at Rubicon Labs.
“It’s, yeah, you always kind of struggle, right? Going from these large companies to small companies. And my CEO of Rubicon, Richard Egan, would call this, like, the slalom, where you would go from, like, the big company to small company, back to the big company, back to the small company.”
Rod Schultz, at 9:18
The gates are easy to list. Cisco from 1997, almost nine years designing wide-area networking protocols, mobile IP and data protection. Apple and FairPlay from 2006. Adobe from March 2008 to October 2014 as a senior computer scientist and project lead for Primetime DRM and Flash Player content protection, on desktops, phones and set-top boxes. Then the small companies: Krimmeni Technologies, the Apple and Broadcom veterans’ startup that raised an $11.7 million Series A from Third Point Ventures and Pelion in October 2014 and became Rubicon Labs, where he was vice president of product and then chief product officer for an identity platform for small connected devices until December 2019. A few months consulting for Oasis Labs. Zoom from September 2020. DUST Identity from November 2022 (LinkedIn, Silicon Hills News, RSA Conference). He holds ten patents, by the RSA Conference’s count, and a business certificate from Berkeley that matters to a story further down.
I told him I run the same slalom out of necessity, a high-risk adventure, then a lower-risk one to recoup, then the next high-risk one, and that I will keep doing it forever because I do not understand people who retire. His friends ask him the same thing, when is it done, “And I’m like, you know, I like innovation, I like technology. And if you can do it with people who you have good chemistry with, and who you can collaborate with, and solve fun problems, it’s incredibly rewarding.” The small company going from zero to one is the part he likes best. Rubicon’s pitch in 2018 is one most founders who listen to this show will recognize: give every small connected device a secure identity, and the manufacturer can control it and sell subscription services on top. Rod presented it at the RSA Conference that April as Secure Identity: Prevent Attacks, Control Devices, and Generate Revenue (GlobeNewswire).
Thirteen people at Zoom
The big-company gate in the middle of the slalom was the most visible security job in the world in 2020. Zoom’s daily meeting participants went from about 10 million at the end of December 2019 to more than 200 million in March 2020, and on April 1 Eric Yuan announced a feature freeze for the next 90 days, “shifting all our engineering resources to focus on our biggest trust, safety, and privacy issues” (Zoom). Zoom bought Keybase for its end-to-end encryption expertise on May 7, its first acquisition (TechCrunch). The 90-day report on July 1 listed AES 256-bit GCM for every meeting, a council of 36 chief information security officers, a central repository for bug reports from HackerOne, Bugcrowd and email, and a newly hired head of vulnerability and bug bounty (Zoom). On November 9 the FTC announced a settlement requiring a comprehensive security program and biennial independent assessments, over claims of “end-to-end, 256-bit encryption” Zoom had made since at least 2016 while holding the keys on its own servers, and a hidden web server installed on Macs in 2018 (Help Net Security). Rod had arrived in September as head of product security and privacy, and the week after the settlement, Eric Yuan introduced him in Zoom’s Ask Me Anything.
Didn't catch last week's AMA with @ericsyuan? This is what you missed:
Zoom (@Zoom) · November 23, 2020
🔒 Recent security updates,
🩺 Enhancements to our healthcare license,
🔐 Intro to our Head of Product Security & Privacy, Rod Schultz
💙 Our team sharing what they were thankful for. https://bit.ly/AMA1118
His LinkedIn describes the job as growing a team “from one to 12 PMs + architects” responsible for product security, privacy, governance, trust and safety, anti-fraud and data protection (LinkedIn). On tape he said he had to hire about thirteen people over a very short period of time, and what he told each of them in the interview is the best recruiting pitch I have heard for a security team.
“And what I would tell people in the interview process was: look, my job is to make it so that you can walk out of here in two or three years and do something amazing, and to set you up with problems that put you on, you know, a trajectory to be more powerful than you are today, and to be, you know, and to pick and choose where you want to go.”
Rod Schultz, at 12:52
If you can line up the problems in the direction of the company’s success and the employee’s at the same time, “more power to you, and you’ve done some fantastic things.” I added the obvious footnote, that companies have to make money to build the next great thing, and the alignment between great people and what the company needs is the leadership skill. A startup cannot offer what Zoom offered in 2020, the most watched security program of the year, one that every hire’s next employer would have heard of. It can offer the same promise, and the problems to back it, and for a first security hire that promise is usually the whole pitch.
What good chemistry is
Rod used the word chemistry three times in the first ten minutes, not counting the organic and physical chemistry he took in college, so I asked him what it means. His answer starts with what it is not.
“Yeah, it’s interesting. I think one of the challenges that you have a lot of times, especially in today’s world, is, like, there’s this competition for who can be the smartest guy in the room sometimes. And I’ve definitely kind of grown averse to that archetype, I guess I should say.”
Rod Schultz, at 10:53
Rarely is the smartest guy in the room the easiest person to be around, and “The day of, like, the lone genius in the closet” is over. Collaboration is the job now, often remote, and if you cannot do it in a fun, effective way, it is hard to find the extra mind share week after week. What chemistry is, in his telling, is properly defined roles and responsibilities, and “is there a willingness to admit that you’re wrong, or a willingness to ask for feedback, be receptive to feedback?” I asked for the telltale sign that a leader is missing it, and he gave three: no one in the room challenges the leader, the people around the leader just amplify their opinion, and a lack of diversity in thinking. And then the distinction I have used in every leadership conversation since.
“So there’s task conflict, which is great, right? If you and I disagree on tasks, that’s fine. But relationship conflict is a challenge. And trying to manage and balance out task conflict versus relationship conflicts and strategy conflict, and all of [these] things, in a very quickly moving world.”
Rod Schultz, at 14:12
My own version, which I said on tape, is two assumptions I make about every disagreement: everyone is smart, just in different ways, and everyone wants to do the right thing. If both are true, a conflict means somebody is about to learn something new about how the world works, or see it through a different set of values, and everyone goes home a little wiser. Rod’s addition is the important one for security teams in particular: you may only get a handful of those moments in a career, and if you find them and grow from them, “it’s huge.” A security review is a task conflict by design. The team that keeps it from becoming a relationship conflict is the team that gets invited to the next design meeting, which is the same instinct behind our post on enabling AI instead of saying no.
Diamonds on the surface of things
The small company Rod was at when we recorded does something I still think is one of the cleverest ideas in physical security.
“So DUST Identity, and they have raised venture capital around the concept of using diamond nanocrystals to put onto the surface of objects to give those objects uniqueness.”
Rod Schultz, at 7:45
The name stands for diamond unclonable security tag. DUST came out of MIT in 2018, founded by Ophir Gaathon, Jonathan Hodges and Dirk Englund out of research on the quantum properties of diamond, and emerged with a $2.3 million seed led by Kleiner Perkins with New Science Ventures, Angular Ventures and Castle Island Ventures (SecurityWeek). Tiny diamond particles go into a polymer coating, the kind already sprayed on circuit boards, and as it dries they lock into a random pattern that a microscope lens and a camera can read. The pattern is the identity. The randomness is the point, since nobody can predefine or copy it, and the company is careful to say that it detects tampering rather than preventing it. Kleiner led a $10 million Series A in July 2019, with Lockheed Martin Ventures and Airbus Ventures as strategic investors, and Gaathon gave Fortune the number: “You can generate 10 to the power of 230 (10^230) serial numbers using only 10 diamonds” (Fortune).
Why a security person would find this exciting is that it gives a physical object the thing software has had for decades, a cryptographic-grade identity, and every question from the garage door applies to it. What is the threat model? Counterfeit parts in an aircraft engine, a tampered circuit board in a weapons system, a forged jersey sold as game-worn. What does it cost per unit? How does it scale? Rod’s description from LinkedIn covers both ends of the market: “objects as diverse as game worn NFL jerseys and aerospace engine parts,” with his team harnessing “the entropy from distributed diamonds on the surface of objects” (LinkedIn). The same idea from the other side, a fingerprint read from the object itself with no tag at all, is Alitheon’s, and Roei Ganzarski made the case for it on episode 103, with our write-up in Your zero trust stops at the sticker on the box.
Fast-moving water
I asked about his best day at DUST, six months in, and his worst. The best was in February 2023, when he flew back to Boston at an inflection point. He had already won over the board to a change of focus he calls fast-moving water. DUST had been concentrating on aerospace and defense and still was, but the company needed faster product iteration to learn what to build, and it was stuck in what he called contract stasis.
“Yeah, all of the above. Like, hey, we don’t know. We’re waiting for them to define this. They’re waiting for us to define that. They gave us a picture. We don’t know if that picture is of Earth or of Venus or of Saturn. Like, we’re just not sure how to identify this. So there’s a lot of malaise.”
Rod Schultz, at 23:06
I pointed out that Pluto had been kicked out, so at least they knew it was not Pluto. What he did next is a small masterclass in arriving at a startup. He spent the first 30 to 60 days interviewing people and listening, without the luxury of the usual advice to do nothing but listen for the first three months, and found “this overwhelming sense of a little bit of, like, thrash,” people being jerked from one space to another. He had the board and the leadership team. He still needed engineering, sales and marketing, so he built a presentation and made the pitch to the company. “And the feedback was overwhelming.” People were excited to go on the journey even though it was going to be a grind, and it is one, because “Innovation itself is hard, because you’re solving problems that have never been solved before.” The record shows where the fast-moving water went. In December 2023 DUST raised a $40 million Series B led by Castle Island Ventures, with Amex Ventures joining Kleiner Perkins, Airbus Ventures and 8VC, and announced Oxygen Esports as a partner for authenticated game-used merchandise (FinSMEs, Pulse 2.0). In July 2025, a year after Rod left, the memorabilia company Metabilia launched an authentication process protected by DUST across its NFL team relationships for the coming season, with Gaathon’s line “At DUST, we deliver Trust in Things” (Business Wire).
The worst day was the same month, a layoff he flew back to the East Coast for. “It’s never easy, it’s never fun, and it’s heartbreaking.” He had seen the industry’s cycles from Cisco, where one in five people disappeared in the 2000 and 2001 downturn without so much as a going-away party, “the dirty underbelly of tech,” and through Adobe’s November layoffs, and he said 2023 was the first time he had watched the pendulum swing that hard against big tech, at that scale, across companies that had weathered every storm before. I offered the practical view, that a package can be the best way to leave a company and sometimes the kick to find another horse to hitch your wagon to. Rod gave the more important one: there are always those stories, but “I don’t think you can underestimate the pain that a lot of the people go through.” Both are true, and the second one belongs to anyone who has to deliver the news.
You’re not Luke Skywalker, you’re Yoda
Everything at a startup is sales, I said, including getting a company to buy into a strategy, so I asked how to get better at it. Rod’s answer started with continuing education money at Adobe, which he spent on a week or two a year at Berkeley’s Haas School, and one class in particular.
“And one of the classes I took was a, a class called Art of the Pitch. And they brought in a bunch of movie producers out of Hollywood, and they taught us how to tell compelling stories for product ideas. Which was, of course, makes a lot of sense, because at the end of the day, every movie is a pitch, and it’s just, like, this idea.”
Rod Schultz, at 26:40
Can you invest $50 million into my movie? Two characters, a conflict, a resolution, an idea. It was much harder than he expected. The second half was a book he picked up when he joined Rubicon in 2014, Nancy Duarte’s Resonate, and the lesson he has used in every presentation since.
“And one of the key takeaways I had from that was that, you know, when you’re on stage, or when you’re presenting, you’re not the hero. The audience is the hero. And that was, when I started to think about that, that made a lot of sense, because your goal is to get the audience to go along with you, not for them to be amazed at how awesome you are. So, you know, the analogy they use in that book is that, you know, you’re not Luke Skywalker, you’re a Yoda, right?”
Rod Schultz, at 26:40
I recommended Rob Biesenbach’s Unleashing the Power of Storytelling in return, and the habit I took from it: keep one or two personal stories in your back pocket, each with a moral that connects to security, and do not be afraid to be vulnerable in them, because that is how a story builds trust. Rod’s broader point is the one every security leader should tape to the monitor. Our brains are story-consuming machines, the greatest religions and the most successful companies run on stories, and a story helps most when it points toward value creation, “which is generally what a sale is.” The board that funds your security program is an audience. Make them the hero of the story, the people who kept the company’s promise to its customers, and you will get a different answer than if the hero is your threat detection rule. It is why our post on the security slide your board deck is missing puts the money on top.
Ask yourself the why
The advice to his younger self was short.
“Interesting. I think, try and, I think the advice I would give is: understand the why, or ask yourself the why. And the reason why I say that is, you know, when I came out of school, I was just interested in solving problems. And my assumption was that if it was a hard problem, it was worth solving. So I spent almost nine years at Cisco trying to solve hard problems, but not really understanding the why.”
Rod Schultz, at 40:47
He called himself a cog, growing skills in narrow areas that created value for Cisco without the perspective to see the whole, “tunnel vision, blindered,” and wondered aloud whether that is the curse of the engineer. It resonated because it is exactly my FairPlay story. I spent the first six years of my career sinking my teeth into problems I could not believe I was paid to think about, and it took Steve Jobs calling DRM stupid at an all-hands for me to understand that I was working on something that enabled a business deal. Rod’s correction to that, at 43:23, was generous: it was a really important business deal, important enough to have an entire team dedicated to it. Both things can be true. The why is not always the thing you imagined from the engineering side. It is usually more important than that, and someone on the business side can tell you what it is if you ask.
Four ways to create value
I asked for final words of wisdom, and Rod gave the framework that ties the whole conversation together.
“Yeah, good question. I don’t know if I have any words of wisdom, other than, you know, when people ask me, like, you know, what they should focus on, I basically say: listen, there’s really only a few ways to create value, and one of the most consistent ways I’ve found is through innovation. And so if you can innovate on problems that are hard, you will probably be very successful.”
Rod Schultz, at 46:03
The hard problem has to attach to a business model, he said, a problem space that moves profit, cost, time to value or risk, “if you can map a problem into one of [those] spaces and solve it, you will be very successful.” It is the same lesson as asking why, put as a checklist, and it explains his career better than the job titles do. FairPlay mapped onto profit, because without it the labels would not have signed. A diamond fingerprint maps onto risk for an aircraft part and onto revenue for a game-worn jersey. Security usually lives in the risk box, and the teams that get funded are the ones who can show which of the other three their work moves as well.
The record since the tape shows him doing it again. In November 2024 Bolster, the AI-powered brand protection company that finds and takes down phishing sites, impersonation and scam campaigns, named Rod chief executive, citing nearly 700,000 malicious websites, more than 53,000 apps and 23,000 social media threats taken down since January 2023, and automation that needs no human in 95 percent of cases (PR Newswire). He came back on episode 62 in February 2025 to talk about the four-hour AI scam. On October 20, 2026 Bolster shipped Threat Graph, which traces the infrastructure behind a phishing site instead of taking it down alone, and Rod’s line in the release is the garage door question at internet scale: “Finding and taking down a phishing website is important, but what about the other infrastructure supporting that attack?” (Yahoo Finance).
We’re all in a race we didn’t choose: protecting trust. In his new @Forbes piece, our CEO Rod Schultz breaks down the “86,400-second war” — the nonstop fight against identity abuse. The future of security is real-time awareness + real-time response. 🔗 https://shorturl.at/iuqMn
Bolster Inc. (@BolsterAI) · November 14, 2025
The founder notes
The books. A neighbor’s copy of The Anarchist Cookbook in middle school, which he was not allowed to bring in the house, and which pulled him toward “the quest for knowledge that you weren’t supposed to have.” Tony Fadell’s Build, for its frameworks for building out a product team and simplifying the narrative around it. And twenty years ago, Neal Stephenson’s Cryptonomicon, which he loved and told everyone to read, and which people looked at and said “there’s no way in hell I’m reading that book, it’s too big.” The only book larger, I said, is Atlas Shrugged.
The movies. I watched The Matrix at a far too impressionable age, and what I took from it was the security mindset applied to everything: here is a system, what assumptions is it making, and how can we violate them? Then the red pill and the blue pill, the grit of reality against the comfort of a steak that is not really in your mouth. Rod asked whether my life crumbled when the sequels resolved none of it, and I said, as far as I am concerned, only one was ever made. His review of the fourth: “a crime against humanity, almost at the same level as the fourth Indiana Jones movie, which I refuse to speak the name of.” I acknowledged his suffering. V for Vendetta, which the Wachowskis wrote a few years later, made the same argument about systems and their assumptions, and the lesson I said I take into every startup is that good things can come from destroying old ideas. Rod’s reply was the line I would put on a startup’s wall: “tomorrow’s promised to no startup, and you better work like hell to try and solve hard problems.”
Everyone is smart in different ways. My two assumptions, and his addition that a great leader positions people so their strengths are shown.
Ask for feedback, out loud. The yes signal in an interview, for Rod, is a candidate who teaches him something: “Oh, actually, no, you can’t do that because of X, Y, Z.” He is looking for people who are smarter than him in their area and not afraid to say where he is wrong. Not in the “what a fabulous sweater” sense, I said. Although, he added, the sweater counted too.
The exit. “Jon, thank you so much. It’s been awesome, man.” The pleasure was all mine.
Did you catch it? A six-question quiz
Interactive · six questions
Did you catch it?
Six questions on what Rod actually said, with the timestamp for each answer. The answers are under each question for anyone reading without JavaScript.
-
What is Rod's favorite interview question?
- Reverse a linked list on the whiteboard
- Design a secure garage door opener with me
- Explain how TLS works
b. "And I would ask people to design a secure garage door opener with me." It starts with identity and replay protection and ends with cost and scale. Transcript, 17:12.
-
Where did Rod first read about public key cryptography?
- A paragraph in a spy book he got in middle school
- A class at the University of North Carolina
- A manual at Cisco
a. "it was called Spy Tech, I believe," and in it, "this one small kind of paragraph" on public key cryptography. Transcript, 2:29.
-
Which cryptographer was an advisor at Rubicon Labs, and one reason Rod joined?
- Bruce Schneier
- Ron Rivest
- Whit Diffie
c. "one of the kind of reasons I left was they had Whit Diffie as an advisor." Transcript, 6:12.
-
What does Rod's old Rubicon chief executive call the move from big companies to small ones and back?
- The pendulum
- The slalom
- The boomerang
b. "Richard Egan, would call this, like, the slalom." Transcript, 9:18.
-
What did Rod tell people he was hiring onto Zoom's security and privacy product team?
- That his job was to set them up to walk out in two or three years and do something amazing
- That they would never have to write code again
- That the 90-day plan would be over by the time they started
a. "my job is to make it so that you can walk out of here in two or three years and do something amazing." Transcript, 12:52.
-
In Nancy Duarte's Resonate, who are you when you present?
- Luke Skywalker
- Darth Vader
- Yoda
c. "you're not Luke Skywalker, you're a Yoda, right?" The audience is the hero. Transcript, 26:40.
Would your product pass the garage door question?
Rod’s question works on any product, because every product has a remote and a door: a client, a device or an agent asking for something, and a server, an API or a lock deciding whether to say yes. This scorecard asks eight questions about your own product, in the order a good candidate would raise them, each tied to a point on the tape or to the three generations of the real garage door, and tells you which generation your design is in.
Scorecard · eight questions
Would your product pass the garage door question?
Answer for the most sensitive thing your product lets a client, device or agent do, as it is built today, not as the design document hoped.
-
How does your system know which client, device or user is asking? (The garage: which remote is this?)
- A shared secret or API key that every copy of the client carries
- Per-device or per-user credentials issued at enrollment
- Per-device keys held in hardware or a secure enclave, never exported
"it starts out with identity." A fixed code is a shared secret, and a shared secret in every remote is a secret in everyone's hands. Device-bound credentials are the third-generation answer.
-
If someone records a valid request, can they send it again and get the same result?
- Yes, a captured request works again later
- Timestamps or counters limit it, within a window
- Every sensitive request answers a fresh, single-use challenge from the server
"replay protection" is the second thing Rod listed. A rolling code fixed replay and RollJam still beat it, because the code could be captured before the opener ever saw it.
-
Could an attacker capture a valid code or token that never reached your server, and use it later?
- We have not considered it
- Tokens expire quickly, so the window is small
- Tokens are bound to the session or device and to a server challenge, so a captured one is useless
This is the RollJam question: jam, record, replay later. Some manufacturers moved to codes that expire quickly, and challenge-response removes the window entirely.
-
How big is the space an attacker would have to guess, and is guessing rate-limited and noticed?
- Small codes or short tokens, no limit on attempts
- Large enough, but nothing slows or flags repeated attempts
- Large space, rate limits, lockout and an alert on repeated failures
OpenSesame went from 29 minutes to 8 seconds because the receiver accepted any stream of bits. The calculator below shows what a few more bits buy.
-
Where does the secret live on the device or client, and could someone with the device in hand read it out?
- In firmware, the app bundle or a config file anyone can extract
- Obfuscated in software
- In a secure element, TPM or enclave that signs on request
FairPlay was "a secret war" with people who had the software in hand. A key you ship in software is a key you will eventually see in a forum.
-
If one device, laptop or remote is lost or stolen, can you revoke it without re-keying everyone?
- No, everyone shares the credential
- Yes, through a support ticket and some manual work
- Yes, in one action, logged, and the rest keep working
The lost remote is where non-repudiation and identity meet the help desk. The blast radius playbook is the drill.
-
Is the threat model written down: what you are worried about, what you are not, and why?
- No
- In someone's head
- Written at the design stage, with what is out of scope, and reviewed when the design changes
"what's the threat model? What are you concerned about?" The design stage is where it costs least, which is the argument of episode 76.
-
Do you know what your product logs about each use, what that costs at your volume, and who can read it?
- No idea
- We log everything and sort it out later
- We log what a review or an investigation needs, priced at volume, with access limited and retention set
"How are you going to do that at volume of transaction logs?" Rod ran privacy as well as security at Zoom. The log that answers the investigation is also a record about people.
Every copy of the client carries the same secret, a recorded request works again, and nothing notices someone guessing. That is the first-generation garage door, and the fix is the same one the industry made: give each device or user its own credential, then make every sensitive request answer a fresh challenge from the server. Start with the first two questions this month.
Each client has its own credential and replays are limited, but a token captured before it reaches you still works, the secret is readable from the device, or a lost laptop takes a support ticket to revoke. That is RollJam territory. Bind tokens to the device and to a server challenge, move the key into hardware, and make revocation one action.
Per-device keys in hardware, fresh challenges, rate limits, one-action revocation and a written threat model: the answer a strong candidate reaches by the end of Rod's interview. What is left is the cost and the logs, the last two things he asks about, and the habit of running the question again every time the design changes.
How long a fixed code lasts
Samy Kamkar’s arithmetic is simple enough to run yourself, and it shows the two things the garage door question is really about: how fast the space of possible codes grows with every bit, and how much a single assumption in the receiver can give away. Change the numbers. The defaults are his, from the OpenSesame write-up.
Calculator
How long a fixed code lasts
A fixed code of some number of bits, sent at some speed, tried one code at a time the way a remote sends it, then swept with a single De Bruijn sequence against a receiver that only checks the last bits it heard. Then the same sweep against a longer code.
A 12-bit fixed code has 4,096 possible values. Sending each one the way a remote does takes about 16 minutes. One De Bruijn sequence takes about 8 seconds, because the receiver only checks the last bits it heard. The same sweep against a 40-bit code takes about 70 years, which is why the fix was a code that changes, and then a challenge nobody can answer in advance.
Kamkar's own 29-minute figure covers every code length from 8 to 12 bits at once, not 12 bits alone. The De Bruijn sweep assumes a receiver that accepts any bits in a row, which is the flaw OpenSesame exploited, and it says nothing about rolling codes or challenge and response, which a longer sweep does not touch. Real attacks on those, like RollJam, record and replay instead of guessing.
Thirty years on one line
Everything on this page sits on one timeline, from the paper that made public key cryptography possible to the week this page was written. Filter it by thread.
Timeline · 1976 to 2026
Thirty years on one line
Filter by thread. Dates are from the public record except where marked as Rod's own account on the tape.
- Public key cryptography
Whitfield Diffie and Martin Hellman publish the idea that the key to lock can differ from the key to unlock (Wikipedia).
- "A new kind of cipher"
Martin Gardner's Scientific American column introduces RSA to the public (Wikipedia).
- A paragraph in a spy book
Spy Tech, he believes, and a mind blown by an equation he could not solve. Then an I-Search project and microfiche at Duke and UNC.
- Cisco
Almost nine years on wide-area networking, mobile IP and data protection, and a 2001 layoff of one in five.
- The iTunes Music Store opens
With FairPlay on every song (Wired).
- Harmony
RealNetworks makes its songs play on iPods, Apple is "stunned," and a later update breaks it (Wikipedia).
- Apple's FairPlay team
Senior software engineer on music and video DRM, through March 2008 (Computerworld).
- Thoughts on Music
Steve Jobs asks the four big labels to let Apple sell music without DRM (Wikipedia).
- Adobe
Primetime DRM and Flash Player content protection, through October 2014 (LinkedIn).
- iTunes goes DRM-free
Eight million of 10 million songs as iTunes Plus, the rest by the end of March (Apple).
- The Many Facades of DRM
Rod's article for a French hacker magazine, and "a secret war between the FairPlay team and Brahms" (Computerworld).
- Krimmeni, then Rubicon Labs
An $11.7 million Series A, Whit Diffie as an advisor by Rod's account, and five years as vice president of product and chief product officer (Silicon Hills News).
- Rod testifies
Under subpoena in Oakland, that his work was "intended to block 100% of non-iTunes clients" (AppleInsider).
- The verdict
A unanimous jury finds for Apple after about three hours (eWeek).
- OpenSesame
A Mattel toy opens fixed-code garages in about 8 seconds (Samy Kamkar).
- RollJam
A $30 device jams, records and replays rolling codes, shown at DEF CON (Engadget).
- DUST Identity emerges from MIT
Diamond unclonable security tags, a $2.3 million seed led by Kleiner Perkins (SecurityWeek).
- $10 million Series A
Kleiner Perkins, Lockheed Martin Ventures and Airbus Ventures. "10^230 serial numbers using only 10 diamonds" (Fortune).
- Zoom's feature freeze
From about 10 million daily meeting participants to more than 200 million, and 90 days on trust, safety and privacy (Zoom).
- Zoom buys Keybase
Its first acquisition, for end-to-end encryption (TechCrunch).
- Head of product security and privacy
A team grown from one to twelve product managers and architects, through June 2022 (LinkedIn).
- The FTC settlement
A comprehensive security program and biennial independent assessments (Help Net Security).
- Zoom introduces Rod
In Eric Yuan's Ask Me Anything the week after the settlement, recapped by Zoom on November 23 (X).
- DUST Identity
Senior vice president of product, through August 2024 (LinkedIn).
- Fast-moving water
A pitch to the whole company in Boston, and the same month, a layoff.
- Episode 29 airs
This conversation. "design a secure garage door opener with me."
- $40 million Series B
Led by Castle Island Ventures with Amex Ventures, and a partnership with Oxygen Esports (Pulse 2.0).
- Bolster names Rod chief executive
Nearly 700,000 malicious websites taken down since January 2023 (PR Newswire).
- Back on the show
Rod on episode 62, the four-hour AI scam.
- DUST for the NFL season
Metabilia's authentication process, protected by DUST. "At DUST, we deliver Trust in Things" (Business Wire).
- The 86,400-second war
Rod's Forbes piece on the nonstop fight against identity abuse (X).
- The whole slalom, on CyberBytes
Cisco to FairPlay to Zoom to fraud and cyber converging (YouTube).
- Threat Graph, and Napster
Bolster traces the infrastructure behind a phishing site, and Rod compares the abundance of AI fraud to music after Napster (LinkedIn).
What to do this week
Four things, in the order Rod’s candidates usually get to them.
- Answer “which remote is this?” for your product. Find every place a client, device or agent proves who it is. Any shared secret that ships inside every copy of the client is a fixed code. Replace it with per-device or per-user credentials, and for the most sensitive actions, keys held in hardware.
- Record a request and send it again. Take the most sensitive call your product accepts, capture it, and replay it an hour later. If it works, add a fresh, single-use challenge from the server to that path, and bind tokens to the session or device so a captured one is useless elsewhere.
- Write the threat model in one page. What you are worried about, what you are not, and why, at the design stage of the next feature. Then price the security per unit and per transaction, and decide what the logs need to say and who may read them.
- Use the garage door in your next security interview. Let the candidate drive. Nudge, introduce a concept they missed, and watch how they take it. You will learn more about how they collaborate in thirty minutes than any whiteboard of C code will tell you.