Product & Engineering. AI. Local LLMs. Open Source. Ultrarunning. ⏩
West Cork, Ireland
Joined February 2007
- Tweets75.3K
- Following1.8K
- Followers3.8K
- Likes80K
Conor O'Neill retweeted
Oh FFS. Thank you for your concern Sam, but don’t spread your FUD and doom bait in my waters.
I lead one of the most utilized Linux operating systems in the world for data centers and enterprises, and I founded its predecessor too.
While AI is surely accelerating finding human created security issues, it is a temporary problem, and most open source project leads have already figured out how to also use AI to reduce new bugs moving forward.
Here is a graph from GKH (who maintains the stable kernel) on how many CVEs they are remediating per release:
github.com/gregkh/kernel-dev…
This graph describes how much better each release is now getting:
github.com/gregkh/kernel-dev…
This doom based marketing approach that the AI labs are pushing is really short sighted. While this will of course drive business to us, I find it unethical to distort the truth and use scare tactics in messaging.
The greater truth is that AI is making the software industry more secure, by identifying the human errors in code, and soon we will end up in a much better place.
🚨Sam Altman says the internet can no longer be SECURED by patching bugs.
"I no longer think we're going to be able to just patch all the bugs," the OpenAI CEO said, warning smarter models can find "hardware level insane stuff."
He says OpenAI can't responsibly open source its best model "anytime soon," but the open source world isn't far behind: "Not super."
Conor O'Neill retweeted
gold rush where u dont even sell shovels anymore just hoard them
Conor O'Neill retweeted
Beginning today, we are starting to invite members of our mailing list to try Rex, our multiplexer.
superlogical.com/updates/pub…
Conor O'Neill retweeted
Person who is reverse engineering his tv gets banned from OpenAI
You aren't allowed to stop your tv from spying on your family. You have to ask for permission
Or, maybe, maybe we accelerate
Conor O'Neill retweeted
The only way out is through.
They're calling it the Bugpocalypse. LLMs are being used to find long-hidden cracks in the software infrastructure, and it's happening at a furious rate. 3% of all compromises in computing history happened in the last week, claims one source? I believe it.
There are people saying public access to the frontier models ought to be locked out, or heavily guardrailed, over this. The problem with that idea can be summed up in one sentence: when lockpicks are outlawed, only outlaws will have lockpicks.
The lockpicks will be Chinese open-weight models, if nothing else. There's no way to stop those from becoming ubiquitous.
There are two futures in front of us. One in which only the bad guys have lockpicks, and security holes go undiscovered until they're exploited. Another in which everybody has lockpicks and is aggressively red-teaming their own software so it gets fixed before the holes are exploited.
The corpus of human code is huge but finite. The number of defects in it has to be finite too. We can fix those defects now; we have a million friendly robots to do it with.
The only way out is through.
Conor O'Neill retweeted
Finally got to put together a complete deck on the state of open models.
What they are, licenses, how competitive they are, signs people are using them, distillation's impact, and how we balance the risks and benefits of openness!
Will record a video lecture of these soon, and hopefully re-do them a few times a year.
Conor O'Neill retweeted
The only thing that stops a bad guy with an abliterated LLM is a good guy with an abliterated LLM.
Conor O'Neill retweeted
I just quit my job at [large AI company]. After seeing what I saw, if we don't reassess the power of what we're building, [dire prediction]. Check out my interview on [stupid media outlet].
Conor O'Neill retweeted
AIG confirms John Gillick no longer with company following the Jewish Representative Council of Ireland's complaint concerning extensive antisemitic material published through @JohnnyGpops.
The material included descriptions of Jews as “evil” and “human scum” and calls for Jews to be thrown out of Ireland.
This case became important to the Jewish community far beyond the actions of one individual.
People need to know that antisemitism of this kind is given due weight.
We are relieved and grateful that AIG treated our complaint seriously and acted following its own review.
We appreciate AIG’s engagement and its unequivocal condemnation of antisemitism.
𝗥𝗲𝗽𝗼𝗿𝘁𝗶𝗻𝗴 𝗮𝗻𝘁𝗶𝘀𝗲𝗺𝗶𝘁𝗶𝘀𝗺 𝗺𝗮𝘁𝘁𝗲𝗿𝘀.
Conor O'Neill retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Conor O'Neill retweeted
I have no idea what is going on or what is about to happen, but I do know that it proves I was right about the thing (whatever it is) and more people should've listened to me at the time (whenever that was).
Conor O'Neill retweeted
Finally full DOOM on a Vape😅
Source:
github.com/atc1441/Vape_DOOM…
Since the previous custom firmware was only Screen Sharing it this was finally needed!
Only possible by Arturs impressive work on making DOOM go bzzz on 32kb RAM