ofjcihen

8 ms·

211.
by ofjcihen 4mo ago
As someone who has consciously worked towards being more present in the moment and regularly pushes back on client expectations of always being available tools like this remind me that a nightmare hellscape of work is more than possible.
212.
by ofjcihen 4mo ago
Was just thinking it would be hilarious if these were all known CVEs hiding the next Shai-Hulud inside of them and waiting to compromise security hobbyists rushing to download them.
213.
by ofjcihen 4mo ago
This x 1000 I’ve been screaming this from the rooftops. Impact is what was always important. No one is going to take down prod to do an emergency patch on an RCE that COULD NEVER ACTUALLY BE EXPLOITED. I feel like we’re witnessing the resul
214.
by ofjcihen 4mo ago
I do a lot of client work for fortune 100’s. Over the last month I have seen companies scrambling to measure deliverables against cost. Most of the back room talk is to the affect of giving devs a small allowance ($500 a month) and then mak
215.
by ofjcihen 4mo ago
Oh man that’s only happened to me a few times but the result is so disorienting, especially since I’m usually jailbreaking it for security. Pages of “I have to be careful, the user is asking that I do something related to cybersecurity that
216.
by ofjcihen 4mo ago
That’s fair. I mean like any other service it’s going to need some cost analysis. I figure we’ll go from over usage to a shock leading to under usage and then land somewhere in the middle when companies decide what works for them.
217.
by ofjcihen 4mo ago
The two that I know of are in a phase of trying to figure out what the return is.
218.
by ofjcihen 4mo ago
Company is a fortune 100 and a client of mine. Since the switch to API pricing they’ve cut usage limits in half twice and are now saying that anyone with high usage is essentially going to be audited. They’re down to about 500 a month per p
219.
by ofjcihen 4mo ago
I think this probably has more to do with companies switching to API pricing for enterprises, no? Regardless, the C-suite wouldn’t be performing due diligence if they weren’t at least attempting to perform the calculus of “what are we getti
220.
by ofjcihen 4mo ago
That I found the reply hilarious. Are you, a mod on this site, actually engaged in a back and forth with a user in an attempt to find anything at all to “moderate”? You made a mistake in your interpretation of my reply and in the process of
221.
by ofjcihen 4mo ago
> On that note it would be interesting to do a sentiment analysis of flagged replies. They seem all over the place and it would be interesting to see if there were any biases. Show me where the sneer is. You didn’t “try to cover all poss
222.
by ofjcihen 4mo ago
So 1: I have no idea why you’re replying to me as if I’m attacking you. I’m not and I’m aware of how hard moderation can be as I’ve done it. 2: My idea for sentiment analysis was geared towards bias from this site and its users, not towards
223.
by ofjcihen 4mo ago
Genuinely hilarious reply. On that note it would be interesting to do a sentiment analysis of flagged replies. They seem all over the place and it would be interesting to see if there were any biases.
224.
by ofjcihen 4mo ago
This. The fact that no one seems to understand that Anth and OAI don’t have a moat is beyond me.
225.
by ofjcihen 4mo ago
We actually can and do have a way to investigate brain activity in humans. Allow me to introduce you to the Electroencephalogram. When there’s no activity we declare them brain dead.
226.
by ofjcihen 4mo ago
Oh no, my example is from Opus 4.8 and involves getting the model to download and execute malicious packages on the users host.
227.
by ofjcihen 4mo ago
Barely. I’ve been having increasing success with a method that involves leaving breadcrumbs. Some minor semantics changes have gotten me from around a 20% success rate to something approaching 100%. To me this shows the difficulty and poten
228.
by ofjcihen 4mo ago
Current LLMs have mainlined 1000s of books on those and every other subject and the answer is what the parent details: it’ll predict tokens based on the text.
229.
by ofjcihen 4mo ago
Oh wow, this is just a straight ripoff of that last one isn’t it? I feel like this is a recurring theme. Someone posts about one shotting something and then it’s revealed that you could also have one-shot it buy git cloning the repo it’s ba
230.
by ofjcihen 4mo ago
Haha now I’m picturing obfuscation where instead of 0x everything is a scary word.
231.
by ofjcihen 4mo ago
This is an incredibly confusing take.
232.
by ofjcihen 4mo ago
No. The intention is most likely to get automated LLM based code review mechanisms to stall out. Normally you’d want that to result in a fail and a subsequent rejection. But because the team who made the review agent and pipeline in my exa
233.
by ofjcihen 4mo ago
In a well-architected design yeah. Then again those feel rare from where I sit on the security side.
234.
by ofjcihen 4mo ago
And really all it takes is one keyword such as “nuke”.
235.
by ofjcihen 4mo ago
Worked a contract where this succeeded in pushing through a fail open design. It also should be a warning to everyone that these groups are now aware of analysis and deobfuscation using AI and to take using a sandboxed environment more seri
236.
by ofjcihen 4mo ago
So look. I’m not trying to be a dick I promise. But I took a look at your site and I don’t know if a month would be impressive for a new and unaided dev. It looks nice but yeah. If you’re not a dev that’s totally cool but like… all I’m sayi
237.
by ofjcihen 4mo ago
People probably think you’re being ridiculous but Shai Hulud had its very first attempt at manipulating AI lead analysis and I know of at least one company where that resulted in them getting pwned. This is only going to become more of a pr
238.
by ofjcihen 5mo ago
Remember that the only reason you’re seeing it is because it made its way to the top. The most likely reason for that is because the people you would expect to be on HN are still here and extremely frustrated with this behavior.
239.
by ofjcihen 5mo ago
No it wouldn’t but part of the success of Shai and others like it is that it doesn’t need to. Additionally the security scanning component of Artifactory, x-Ray is notoriously bad at this. The developer had good intentions but by his own ad
240.
by ofjcihen 5mo ago
I did in my comment above.

More ›