tptacek

22 ms·

691.
by tptacek 3mo ago
Because man made SHA-2, so it must be breakable. I don't dispute that there are systems humans make that are breakable (that would be weird given my career).
692.
by tptacek 3mo ago
OK, produce a SHA-2 collision.
693.
by tptacek 3mo ago
Kind of a weird post, since it acknowledges in the first 1/3rd that you don't need DMARC for PCI compliance.
694.
by tptacek 3mo ago
I mean I feel the same way about the stink that's on em-dashes now, but they are kind of a lazy writing habit.
695.
by tptacek 3mo ago
I think it's an interesting story and probably really does say something about the tenacity of the new OpenAI models. I just don't think it says the thing about security that breathless coverage claims it does.
696.
by tptacek 3mo ago
Security and compliance are totally different functions and one has little to do with the other.
697.
by tptacek 3mo ago
Nobody has claimed you could simply take a 2025 open-weights model, plug it into a generic harness, and have it red-team for you. I think you're also probably overclaiming the sophistication of the "chaining" we're talki
698.
by tptacek 3mo ago
There are whole companies premised on this. No existing harness you personally can go download, sure. And you're setting an artificially high bar when you talk about Mythos; I'm not saying you could just plug a 2025 open weights m
699.
by tptacek 3mo ago
Since this is a comparison between entire economies --- not just health care but the impact on economic mobility as a whole --- an inconvenient fact for this analysis is that PMC Americans are generally better off under our private insuranc
700.
by tptacek 3mo ago
The business model of the site is apparently private data sales, not ad revenue.
701.
by tptacek 3mo ago
I don't know, but these were exactly the questions the industry had to handle with CORE Impact and Immunity Canvas, and ultimately all the way back to Dan Farmer's SATAN before that.
702.
by tptacek 3mo ago
I have no doubt that somewhere there's chemical equipment an Internet attacker could break, or, maybe, if I have to stipulate, misconfigure enough to, like, poison someone. But my question is about the notion that you could synthesize
703.
by tptacek 3mo ago
I think the mental model people have about this is that pre-AI there were humans picking individual targets and post-AI the computer itself randomly picks targets. But you get the same unexpected collateral damage outcome when a human misco
704.
by tptacek 3mo ago
Stuxnet misconfigured industrial equipment that was already set up to run, and all it did was break that equipment. This scenario sets a much, much higher bar.
705.
by tptacek 3mo ago
The thing with me and this is that the teams that were competing in the DARPA Grand Cyber Competition all had this capability, like, last year. All the attention has been on software security, of extracting the next marginal vulnerability o
706.
by tptacek 3mo ago
You convert GETs into arbitrary requests through some other pivot. I'm not saying that's what happened but this is bog-standard SSRF pentesting, so I'd expect models to be good at it.
707.
by tptacek 3mo ago
How do you "hack a lab and synthesize something"?
708.
by tptacek 3mo ago
This makes sense. The largest project hosted on Codeberg today is, what, Zig? Zig is also openly hostile to LLM agents. It's a a clear identity for the site: a home for projects that identify as anti-LLM. I disagree with basically all
709.
by tptacek 3mo ago
This is still not as weird as the valley was in the late 1990s during the first Internet bubble, with the exception that housing scarcity, which was notably bad then (I had to pay my year's rent up front to secure an apartment in San F
710.
by tptacek 3mo ago
I love this. Anthropic employees just randomly have solutions to Smale's open problems in their back pockets, waiting for the right moment to sprinkle them into the training set.
711.
by tptacek 3mo ago
Would you ordinarily be able to "explain this", if a mathematician had come up with this on their own? How would that story go?
712.
by tptacek 3mo ago
Our auditor is Aprio.
713.
by tptacek 3mo ago
I'm not going to, like, whip out my resume here, but I am going to confidently assert that if you structure your Type 1 carefully, you can trivialize your Type 2, and as someone currently operating a globally deployed public cloud I ca
714.
by tptacek 3mo ago
I think you can reasonably assume that frontier models are using SymPy or something like it any time interesting math gets into the picture, and the person driving Fable here is an accomplished mathematician, but I don't think we can r
715.
by tptacek 3mo ago
(Specifically: the SOC3 is a public report; the SOC2 report generally isn't supposed to be handed out except to named clients under contract. You pay extra to get the auditors to give you a report you can just stick on a website.)
716.
by tptacek 3mo ago
A $50k audit is going to be team of 2 CPAs collecting evidence for 2 weeks.
717.
by tptacek 3mo ago
Unless you have a very good reason (I compare notes with people at dozens of firms and have never heard one), the only criteria you ever want to get SOC2'd on is Security. My experience is the opposite of yours: having a security SOC2
718.
by tptacek 3mo ago
Literally any firm can get a SOC2 Type 1, because there's no lookback to it; the Type 1 is a pinky swear. In practice, if you're careful about how you do your Type 1, the Type 2 is almost as trivial. Your HR/bizops practice i
719.
by tptacek 3mo ago
I co-ran a business with a significant SOC2 practice (we ran security programs for startups), and then oversaw Fly.io's SOC2 Type 2. The person you're responding to is more right than you are, and I would push back in a variety
720.
by tptacek 3mo ago
I wouldn't put it the way they did but they're directionally sane about this. I would worry a lot more about someone repping their SOC2 as important or meaningful than I would worry about someone who was cynical about SOC2. (I d

More ›