pixl97

24 ms·

721.
by pixl97 3mo ago
I mean, in an electronic prison, you just issue the ticket and wait. Eventually people have to do things like renew licenses and they are arrested there. This is very similar to systems states are using now preventing the renewal of expired
722.
by pixl97 3mo ago
Assuming cops actually present the evidence they have and don't hide it from the defense. The police and DA don't care if they put a guilty or not guilty person in jail, the 'tough on crime' faction that tends to get peo
723.
by pixl97 3mo ago
"No, no, no" a person on Reddit, Hacker News, YouTube screams for the billionth time. "It's all marketing" as the terminator bots kick in the door and slaughter their families.
724.
by pixl97 3mo ago
Possibly, possibly not, honestly you probably can't really tell much from this. With the RAM and storage costs being out of control it's odd it didn't happen long before now. On top of that I wonder what running any kind of f
725.
by pixl97 3mo ago
Huge companies tend to make money from network effects, rent seeking, and lock in. They tend to be horrifically bad when it comes to innovation, especially when it may disrupt exiting departments in the company. Those departments will fight
726.
by pixl97 3mo ago
It doesn't need to, it just updates the code, you have the human publish.
727.
by pixl97 3mo ago
This still does nothing to prevent anyone from publishing a bad package, for example a compromised device/dev in the organization. A cooldown of a day, and maybe not updating on weekends will save you from that. It's time to stop
728.
by pixl97 3mo ago
LLMs are better at attacking than writing secure code. LLMs aren't terrible at securing systems, humans are bad at using secure systems and typically disable measures with insecure workarounds.
729.
by pixl97 3mo ago
While they may struggle on what to study, we'll be able to spin up millions of them.
730.
by pixl97 3mo ago
Saturation and duplication is one of the biggest problems now. Our discovery systems aren't terrible, but it's hard to stand above the rest unless your game has a really good execution and gimmick to attract attention.
731.
by pixl97 3mo ago
Really the days of "Lets run this stable configuration forever" are gone. Getting rid of as much stuff in your OS and software stack as possible should be the security teams ultimate goal, so you have less to upgrade in the end. B
732.
by pixl97 3mo ago
Exactly, the amount of time it takes to figure out if you're exploitable generally exceeds the time to patch the application in the majority of the cases. You tend to try to focus on the ones that will cause the most interruption. And
733.
by pixl97 3mo ago
It's going to be very very difficult to build this system as the exploitability of any particular CVE can massively vary depending on your system configuration. There are a lot of things that are bugs, but cannot be exploited in a stan
734.
by pixl97 3mo ago
Hence future CVEs on a lot of projects will likely demand working exploit code for testing. This at least attempts to lock the issue down to something more tangible.
735.
by pixl97 3mo ago
So we just need a redundant array of George Hotz, I wonder how much that costs? This is where quantity becomes a quality. Actors with huge budgets and at least a small team to keep the AIs on track now have an immense amount of potential po
736.
by pixl97 3mo ago
>Or, maybe we like working with people who can https://croissanthology.com/earring We like whispering earrings. We'll follow a low friction happy path even if it leads us off a cliff.
737.
by pixl97 3mo ago
Assuming most humans accept moral responsibility seems rather dangerous in itself. Especially as they climb the corporate ladder.
738.
by pixl97 3mo ago
Eh, when we see this from Microsoft, Linux kernel, and Apple all at the same time just thinking it's everybody being dumb becomes risky. Now, if you're an F100 that's currently not using Anthropic it's pretty likely you
739.
by pixl97 3mo ago
I mean, we're just the neo-luddites in this case. Or maybe the rust belt when jobs moved elsewhere. The real question isn't if things are going to change around our jobs, its are we going to be able to move fast enough to avoid st
740.
by pixl97 3mo ago
We can shoot for 100% accountability by demanding 100% accuracy. Of course what will really happen is anyone looking for problems will stop going to the source for fixes and will start gaining cred in the dark markets of exploits and proble
741.
by pixl97 3mo ago
>Don’t pin versions In enterprise software..... I only dream of work where some ancient version isn't pinned because 200 person hours are need to adapt the code to newer versions. And the update versus cooldown are fun. Can't w
742.
by pixl97 3mo ago
This sounds like a piss poor implementation of zero trust on your part. Security is an onion, you have lots of layers because layers peel off and fail all the time. With your current setup a single foothold gives an attacker all the lateral
743.
by pixl97 3mo ago
Having your LLM look at the security really isn't a great option. Most users don't have unlimited budgets and can't dump the necessary time and funds needed to find these flaws. On top of that, ability to prompt about flaws m
744.
by pixl97 3mo ago
Yep, once you have code execution you find a local privilege escalation and go from there.
745.
by pixl97 3mo ago
And when you chain another weak CVE to run the tool in a method that would have previously been a noop? Security can be a major pain in the ass, and it's pretty often we see CVEs that were low valued suddenly become more urgent when so
746.
by pixl97 3mo ago
The hard part is accurately making that flow chart. You have your software composition you have to keep accurate. Your software configuration and it's changes. Environmental systems and its changes like VM hosts and network hardware. A
747.
by pixl97 3mo ago
Yea, this is where the problems start coming in. In testing with LLMs with good exploit finding capabilities and a lack of guardrails on writing exploits, quite often LLMs will chain together a surprising stack of exploits to get what they
748.
by pixl97 3mo ago
>some knowledge that derives from first-hand experience of being an actual sentient being This is where things kind of fall apart. We all agree (hopefully) that humans are sentient. The question is, "what else is sentient". Are
749.
by pixl97 3mo ago
Eh, well, stop building AI. We're not going to do that, so it's pretty much unavoidable. If I had to make a "most probable guess" of what the future looks like, we'll have some kind of AI mess caused that will cost
750.
by pixl97 3mo ago
I mean, the LLMs that you get to use are the ones designed to help things and this is after bunch of RLHF and other training methods to get them to act a particular way. When it comes to unaligned agentic models that are left with a large a

More ›