ofjcihen

18 ms·

391.
by ofjcihen 7mo ago
> I think you are a bit dishonest about how objectively you are measuring As someone who has made a sizable amount of money in security research while using Claude you might be right but not in the way you think.
392.
by ofjcihen 7mo ago
I mean yeah. I’ve had these successes without scaffolding or really anything past Claude CLI and a small prompt as well?
393.
by ofjcihen 7mo ago
Could this potentially be because more researches are becoming accustomed to the tools/adding them in their pipelines? The reason I ask is because I’ve been using them to snag bounties to great effect for quite a while and while other
394.
by ofjcihen 7mo ago
I’m in the same boat as you. I believe the model is an improvement of course but I’ve been successfully bug finding 0 day hunting and red teaming with models for the last two years and while that’s impressive I have a feeling that this doom
395.
by ofjcihen 7mo ago
This was true before LLMs though. I mean even going back to Sasser.
396.
by ofjcihen 7mo ago
With the right prompting (mostly creating a narrative that justifies the subject matter as okay to perform) other models have already been doing this for me though. That’s another confusing bit for me about how this is portrayed and I refus
397.
by ofjcihen 7mo ago
Are you saying that LLMs can use fuzzers or are you saying that they work like fuzzers? Because one of those is less…deterministic? Then the other. Regardless and in the spirit of my original response my answer would be to give the LLM acce
398.
by ofjcihen 7mo ago
I’m sure the new model is a step above the old one but I can’t be the only person who’s getting tired of hearing about how every new iteration is going to spell doom/be a paradigm shift/change the entire tech industry etc. I would
399.
by ofjcihen 7mo ago
Good lord, why such a virulent response to something that seems like we should be considering? As someone in cybersecurity for 10+ years my immediate assumption is why not both? I don’t think considering that they could both have their uses
400.
by ofjcihen 1y ago
Salesforces CEO needs to consider replacing them with security product architects so they can figure out a way to send me logs that aren’t crap
401.
by ofjcihen 1y ago
I think your assumption is where this falls apart. To be clear, your assumption about where time is spent and how there can only be 2 outcomes.
402.
by ofjcihen 1y ago
In white font of course
403.
by ofjcihen 1y ago
I’m not sure where the OP said that. Can you show us?
404.
by ofjcihen 1y ago
What is the term for getting the ick from reading?
405.
by ofjcihen 1y ago
Everyone who has ever worked in security: “Ain’t no way”.
406.
by ofjcihen 1y ago
The articles title combined with the much more middle of the road sub title and then a final request that you give them money to figure out what the fuck is going on is all you need to know about the journalists integrity.
407.
by ofjcihen 1y ago
I’d love to but unfortunately I can be pretty inflammatory online and I’d like to continue using this account for personal opinions =]
408.
by ofjcihen 1y ago
Hard to say for a number of reasons but I can tell you what kind of teams we see. College grads with no seniors or too few senior devs to oversee them tend to be the worst. Surprisingly, it seems that the worst of these is where the team is
409.
by ofjcihen 1y ago
My guess is tons of small/medium sized companies were enamored with the speed and ease of use that LLMs promised and very quickly found solutions that “just worked”. Also we don’t really specialize in it since that’s not something you
410.
by ofjcihen 1y ago
OH MAN I almost forgot. We’ve had a few of these stem from custom LLM agents. The most hilarious one we’ve seen was one that you could get to print its instructions pretty easily. In the instructions was a bit about “DON’T TALK ABOUT FILES
411.
by ofjcihen 1y ago
Lmao, I love it. Is this the new Q-Anon?
412.
by ofjcihen 1y ago
Absolutely. Before vibe coding became too much of a thing we had the majority of our business coming from poorly developed web applications coming from off shore shops. That’s been more or less the last decade. Once LLMs became popular we s
413.
by ofjcihen 1y ago
As a security professional who makes most of my money from helping companies recover from vibe coded tragedies this puts Looney Toons style dollar signs in my eyes. Please continue.
414.
by ofjcihen 1y ago
This reply is actually making this more confusing.
415.
by ofjcihen 1y ago
Bob needs to lawyer up because this was a CFAA violation and a half.
416.
by ofjcihen 1y ago
Depending on jurisdiction it might be theft, could be something more recently ratified that’s basically made for exactly this purpose. Could also just be a plain old federal CFAA related charge since those are pretty “malleable”. Again, tak
417.
by ofjcihen 1y ago
As a DLP professional: please don’t tell people this. You can absolutely be arrested and prosecuted for this.
418.
by ofjcihen 1y ago
The post still has meaning.
419.
by ofjcihen 1y ago
A standard penetration tester or a good one? Standard PTs could probably be mostly replaced with a list of IF/THEN commands.
420.
by ofjcihen 1y ago
This has already been leading to some incredible profits for security companies like mine. So please, don’t be too loud about how terrible it is :)

More ›