> who think their ICS networks are airgapped when they are running unencrypted serial over RF
Can't stress this enough. Our definition of an untrusted input needs to be any interface to a system.
i2c on your switch reading DDM from optics?
untrusted input. SMBus on a mobo? untrusted input.
that rs232 bridge sitting on 900Mhz? absent specific mitigations, untrusted input.
while humans could (and did) exploit those, it was a lot of work to enumerate them, but now the cost of enumeration both offensively and defensively has dropped significantly.
It’s too late. We needed to be spinning out open hardware & verified software to replace the vendor stacks last year with some kind of national service program to understand and migrate systems (e.g. INL & NREL doing nothing but this).
We still have folks running critical infra who think their ICS networks are airgapped when they are running unencrypted serial over RF, never mind actually being connected to the internet through paths they didn’t anticipate.
Water & Wastewater systems are probably the most vulnerable.
anyway, hi! P(bloom)>P(doom).
hoping I’ll make it to 2050 and by then we’ll have the tech to reset my practical age to 20 so I can raise some wonderfully superintelligent gene-modded children.
ALT jda with a bag and another bag taking a mirror selfie in hallway
It’s too late. We needed to be spinning out open hardware & verified software to replace the vendor stacks last year with some kind of national service program to understand and migrate systems (e.g. INL & NREL doing nothing but this).
We still have folks running critical infra who think their ICS networks are airgapped when they are running unencrypted serial over RF, never mind actually being connected to the internet through paths they didn’t anticipate.
Water & Wastewater systems are probably the most vulnerable.
It might not actually be too late, but would require an effort so nuts I don’t think it’s possible.
Ignoring technical aspects for a second, just budget and purchasing cycles are too long to get contractors in to update ICS systems.
It needs temporary federal preemption of local controland a hybrid civil eng - cyber sec uniformed group like USPHS to surge it.
Think national labs developing devices that can be easily independently tested: think a ICS analogue of the betrusted precursor. Simple enough to use older domestic fabs for components and assembly yet probably not game over if someone ordered them on AliExpress.
Running software w a ton of verification work, and tested by next gen models prior to their release.
Maybe this explains why SF has been so weird this trip?
Got cornered in Whole Foods on Monday by woman being pushy that I should model and had “incredible curves”?! and then on Tuesday a guy asked me to dinner as I was leaving 495 Powell w a massive bag of preop meds 🤔
Jade A. retweeted
"utopia ruled by god in a box"
Utopia cannot include, for me and those who agree with me, being "ruled". This implies such a large power differential that I would consider it to be a failure of alignment to human interests.
Jade A. retweeted
something that keeps bothering me is how some people see slop as something that is happening to them, like they're some kind of helpless bystander powerless to do anything about it
excuse me but you are a software engineer, you literally learned how to make sand think and make computers do your bidding?! and now you can't do anything about it? please
the 2 things you should know to cut through all the noise:
1. you need to give your agent a way to verify its own work (i just posted about this so won't rehash)
2. your codebase is memory
the 2nd is not new either, we have always had lint rules, compilers with good diagnostics and strong type systems, LSPs, etc to help us write better code. there is no difference when agents write the code instead, you just need more of them, and stronger ones.
forget rules and skills. you can add those later.
yes, your codebase is a form of memory to agents! agents love extending what already exists. so every nit and every annoyance you've ever seen, every mistake and bad pattern you observe from agents, needs to turn into a constraint, or the agents will just keep repeating those same mistakes like a virus in your code. then you keep observing and repeating this process until your codebase is locked down enough that even agents with little context can one shot a high quality PR.
an even better direction is to refactor/rewrite your code such that agent anti-patterns become categorically impossible. use type systems to your advantage, use libraries/frameworks that reduce the architectural search space, or heck, create your own framework like we did for grok bot and design high quality primitives and well thought out APIs
Listened to Tribe: On Homecoming and Belonging last night and now the cuddle puddle tendencies in some circles makes a lot of sense like now I can’t give them too much side-eye.
I’ve been asking for datacenter C-RAM for years but legal keeps saying no 😭
I need to figure out how to convey to Uber drivers that when I say my bag is very heavy and they should let me load it I’m actually serious and it’s not a challenge.
Uber Black driver nearly fell over just now lifting my 80lb Mystery Ranch flight monster into his Escalade 😔
Jade A. retweeted
This is a slide from Terence Tao's 'Math 2.0' public lecture yesterday evening at Caltech. I am highly confident that, if the cure actually worked, almost any Stage 4 cancer patient would tell you that human comprehension of its mechanism is completely irrelevant to them.
Jade A. retweeted
If a company puts some piece of shit WebView inside its software, that software must be reverse-engineered and reworked through community effort. That’s what happened, for example, with the idiots at Rode; it happened with Spotify too, and exactly the same fate awaits all the other outfits making their shit on that goddamn Electron. All of Electron will be reverse-engineered and reworked into proper native applications for our operating systems.
