ngneer

45 ms·

61.
by ngneer 2y ago
Sounds just like how Facebook got started, harvesting photos without permission. From the Wikipedia article, the Facebook precursor was known as Facemash. On Zuckerberg, "He hacked into the online intranets of Harvard Houses to obtain
62.
by ngneer 2y ago
You might be conflating the epistemological point with Turing's test, et cetera. I could not agree more that indistinguishability is a key metric. These days, it is quite possible (at least for me) to distinguish LLM outputs from those
63.
by ngneer 2y ago
Dijkstra myopic. Got it.
64.
by ngneer 2y ago
That one is tough, because they are blind to the risk. I try to only work with people who have been burned before or have been around long enough to have seen the aftermath. Let me guess, they are probably telling you "show me the vuln
65.
by ngneer 2y ago
Nice article. >Whether and how an LLM actually "thinks" is a separate discussion. The "whether" is hardly a discussion at all. Or, at least one that was settled long ago. "The question of whether a computer can t
66.
by ngneer 2y ago
Yes, remote attestation is tantamount to the hardware snitching on the execution, and not necessarily to the benefit of the platform owner. I agree with you, that from a game theoretic perspective, as soon as the vast majority of platforms
67.
by ngneer 2y ago
I am all for Right to Repair, and am upset with the "evil overlords" as much as the next guy. But, to present the treacherous computing argument all on its own, is, well, incomplete. I am a huge fan of Ross Anderson, RIP. However,
68.
by ngneer 2y ago
There are multiple privilege levels. Microcode has higher privilege than an OS/VMM does.
69.
by ngneer 2y ago
More likely a SHA variant that is susceptible to a second preimage (collision) attack.
70.
by ngneer 2y ago
Your friend is genuine in their interpretation, but there is definitely more to the discussion than the zero sum game they allude to. One can have both performance and security, but sometimes it boils down to clever and nuanced design, and
71.
by ngneer 2y ago
If compilation uses jmp2ret mitigation, a trailing ret instruction will be replaced by a jmp to a return thunk. It is up to the return thunk to do as it pleases with program state.
72.
by ngneer 2y ago
I knew this comment would come.
73.
by ngneer 2y ago
All of what you wrote is mostly true, except that "not 100% perfect in a number of fields and usecases" is quite an understatement. You mention the cybersecurity vertical. As a datapoint, I have put the simplest code security anal
74.
by ngneer 2y ago
The true problem is that the world is addicted to additive security. "What can we add to make our systems more secure?" Since the InfoSec industry sprung from the IT industry, the financial incentives are backwards. At the moment,
75.
by ngneer 2y ago
Thanks for that context, quite interesting and very much appreciated. I ought to have looked them up proper, but their name is unrecognizable in the security scene. I am not sure I understand why UL are "well suited" to provide th
76.
by ngneer 2y ago
Who are these UL Solutions? They seem to have come out of nowhere and hit the jackpot, inserting themselves as arbiters for security. Smells a bit like how Common Criteria proffered independent certification labs, which were no panacea eith
77.
by ngneer 2y ago
Strange. Wouldn't computers be better at this than humans?
78.
by ngneer 2y ago
There is no shortage of material on the topic, but I would recommend "Chip War" by Chris Miller as a complementary read.
79.
by ngneer 2y ago
I was afraid you were going to say that ;). Thanks for the sage advice. I think that "safety inspector" would not be a good career choice for people like myself, then. Methinks Boeing and OceanGate had been in the news recently wi
80.
by ngneer 2y ago
Very interesting. Thank you for making the distinction explicit and for helping me to understand the other mindset. You are totally right, in that my mindset is closer to a forensics mindset in such instances, trying to get as close as poss
81.
by ngneer 2y ago
With all due respect, (B) is logically unsound in my mind. You may have meant considering the hypotheses, and then using available data and only available data to rule in or rule out certain scenarios. In my mind, based on decades of studyi
82.
by ngneer 2y ago
You make a valid point. I stand corrected. "Hacks" is not an accurate term, and fails to account for the full circumstance. I was merely appalled at how willing EAAID were to jump to conclusions and twist facts towards a convenien
83.
by ngneer 2y ago
A rather well-written piece. My takeaway is that the French investigators are pros and the Egyptians are hacks. And that safety culture matters. One must not bend the facts to draw a desired conclusion. One must review the data without bias
84.
by ngneer 2y ago
True. Notwithstanding, I can verify that the technology stack is too complex to secure.
85.
by ngneer 2y ago
I suspect his ultimate reward for the call was sticking to his integrity, and knowing that his integrity cannot be compromised by a bully. Some people prefer that to money or fame. Agreed it would be nice if capitalism saw that as a positiv
86.
by ngneer 2y ago
Cute idea. Reminds me of the format conversions typically used to lessen the risk of steganography. But boy, the article took forever to get to the PDF -> RGB idea, talking about Simple Representation and everything in between. RGB has l
87.
by ngneer 2y ago
That whole song and dance about protection from an untrusted cloud operator sounds like a red herring to me. CSPs are the ones to deploy the technology. I suspect their main desire is to (a) avoid the hassle of law enforcement requests, as
88.
by ngneer 2y ago
For this to work, x=D(E(x)) must hold, where x is the message in military English, and E and D are the encoding and decoding functions. Ergo, the Navajo language must have as many possible utterances as military English does. This is neithe
89.
by ngneer 2y ago
I used to love HowStuffWorks in 1998 as a teenager. This was the true power of the Internet. Not scrolling through cat memes, nor making billions on commerce. Just access to a wealth of good information produced by good passionate people. M
90.
by ngneer 2y ago
I could not tell by the comment whether the article was read or not. I try to give the benefit of the doubt. Your sarcasm is hilarious, but you are attacking an argument I never made (i.e., strawman).

More ›