raesene9

8 ms·

61.
by raesene9 9mo ago
What specifically are you concerned about when running an LLM agent in a container versus a VM. Assuming a standard Docker/Podman container with just the project directory mounted inside it, what vectors are you expecting the LLM to us
62.
by raesene9 9mo ago
Or buying CDs packed with software from markets. In Glasgow you could get copies of loads of high-end software from traders in the Barras market.
63.
by raesene9 9mo ago
Claude code has a YOLO mode, and from what I've seen a lot of heavy users, use it. Fundamentally any security mechanism which relies on users to read and intelligently respond to approval prompts is doomed to fail over time, even if th
64.
by raesene9 9mo ago
The really fast part is the challenge though. If we assume that in pre-LLM world, there was enough resource for mid/senior level engineers to review junior engineer code and then in LLM world, lets say we can produce 10x the code, unle
65.
by raesene9 9mo ago
Why do they pay you though, why not just do it themselves? With improving models and surrounding tooling the barrier to creating apps is lowered, and it's easier for a user just to create their own app, no 3rd party person needed.
66.
by raesene9 9mo ago
Heavy use in CTFs doesn't surprise me at all. CTFs often throw curveballs or weird technologies that contestants might not be familiar with. Now you can get a starting point on what's going on, or how something works, instantly fr
67.
by raesene9 9mo ago
My experience of UK pentest rates was that they've stagnated or even gone down over the last 20-25 years. In the early 2000's banks were paying ~£1000-£1200/day for pentesters from boutiques and when I stopped being in that i
68.
by raesene9 9mo ago
Yep vast numbers of personalized apps seems like it would end up being pretty messy. I think the challenge of betting on ideas and concepts is that once you've published something, someone else can take the idea and replicate it easily
69.
by raesene9 9mo ago
One problem with the idea of making businesses out of this kind of application is actually mentioned in passing in the article "I decided to make up for my dereliction of duties by building her another app for her sign business that wo
70.
by raesene9 10mo ago
Perhaps in theory, but I’d be willing to wager that most dinosaur orgs have so many unpatched vulns, they would need to fire everyone in their IT org to cover just the criticals
71.
by raesene9 10mo ago
Yep differentiation is tricky here. Chainguard are expanding out to VM images and programming language repos, but the core of hardened container images has a lot of options. The question I'd be interested in is, outside of markets wher
72.
by raesene9 10mo ago
Not op but if you are looking for information on why sone people arent keen on the kernels approach to CVE management https://jericho.blog/2024/02/26/the-linux-cna-red-flags-sinc... might be of interest
73.
by raesene9 10mo ago
In a lot of ways Notes was ahead of its time. You could easily have encrypted replicated databases with offline work, which was very handy for traveling users back before high bandwidth connections were widely available, and you could build
74.
by raesene9 10mo ago
I'd guess the tricky part there is proving intent. If I sign up to a VPN so I can watch sports or other geo-restricted content while on holiday, does that count? In a fully authoritarian state of course you likely don't have to wo
75.
by raesene9 10mo ago
What's a VPN though, just an encrypted tunnel between two nodes. For decently technical people, it'd always be possible to rent a VPS somewhere outside the country and route traffic to it. If they're going down that route I&#
76.
by raesene9 10mo ago
So if you could get Google/Apple/MS on board, then you could embed controls onto most people's endpoints, and actually that'd work more than trying to put the burden on websites/controlling the network. The trick
77.
by raesene9 10mo ago
Oh I'm not saying they won't try and do it, just it'll either be ineffective or they'll effectively wreck the Internet. For the UK I'm kind of doubting they'll put enough money into it to make it good, so we&#x
78.
by raesene9 10mo ago
That is one option, but then you get into the world of Corporate VPNs which are heavily in use and it would seriously cause problems if you banned. Then you're into "what about all TLS connections" which can be used to send t
79.
by raesene9 10mo ago
I'd like to believe that technical people at OFCOM actually know the impossibility of what they're being asked to implement but are just going through the motions, so their bosses/politicians can put out pointless press relea
80.
by raesene9 11mo ago
It lets you send raw sockets, and has some dangers (e.g. packet forgery). It's included in pretty much every container in existence (if you're running as root in the container or have ambient capabilities setup). The goal of the c
81.
by raesene9 11mo ago
Worth noting you don't actually need to be fully root in Linux to do standard pings with your code, there's a couple of different options available at the OS level without needing to modify code. 1. You can just add the capability
82.
by raesene9 11mo ago
The solution I go for is, don't ever run a coding agent on a general purpose machine. Use a container or VM, place the code you're working on in the container or VM and run the agent there. Between the risk of the agent doing thin
83.
by raesene9 1y ago
I wouldn't be surprised by a drop in security postings. Quite a few companies view security as an "overhead" so the siren call of reducing that overhead by introducing AI is a thing. Also for a lot of jobs in security it&#x27
84.
by raesene9 1y ago
I'm not sure how true the stigma is for GLP-1 based drugs. There are lots of online options for getting it from major orgs in the UK including things like Asda who aren't really a well-known pharmacy brand here ( https:/&#x
85.
by raesene9 1y ago
Was this comment meant to be in reply to https://news.ycombinator.com/item?id=45726223 ?
86.
by raesene9 1y ago
Unfortunately I don't think they're going to get involved there. There are already multiple "official" images on Docker Hub that are unmaintained and have plenty of CVEs (e.g. Centos https://hub.docker.com&#x2
87.
by raesene9 1y ago
Yep and IME it works a lot of the time. A number of people I worked with in IT/Infosec consulting are now CISOs of large orgs.
88.
by raesene9 1y ago
Well they get some experience doing the consultancy work of course, and yep lots go off to industry after 2-3 years. IME (Worked for E&Y some years back) about 80% of people who started as juniors would have left after 3-4 years with th
89.
by raesene9 1y ago
I think that's not quite the way consulting should, and to some extent does, work. The ideal goal of consultancies like Deloitte's is that they hire a small number of people with experience and combine them with a larger number of
90.
by raesene9 1y ago
UK passports cost almost £100, so a lot of people aren't going to get one unless they need to go abroad. I'd expect a required UK digital ID to be free at point of issue (otherwise there's not much point in it).

More ›