🗡️🇨🇦🔪 I am a student of the language of the people of the land of the sun, the moon, and the stars.
double root
Joined July 2022
- Tweets12.6K
- Following738
- Followers1.5K
- Likes132K
All is legible before the American state's flensing gaze.
Effective Altruism has been noticed, inspected, and cast aside as markets are allowed to do their thing.
Other forces great and small that will notice them in turn. Main characters wannabes don't get to be illegible.
New article today about AI alignment, as practiced
Enjoy
adorableandharmless.com/p/al…
The flip side of OpenAI not learning anything new since their 2018 DotA 2 showboating is, most of the DotA player base is low agency pond scum.
Beating the community as a whole is a titanic task.
Beating 90% of the players is trivial.
GCU Tense Correction retweeted
So this is a silly story, but for a year or two before in 2013/2014 I went around telling everyone I could find about this little cryptography library called “OpenSSL” and how it was used everywhere, but had almost no developers or security budget.
GCU Tense Correction retweeted
Many smart programmers for many years before LLMs: All the C code is infested with memory vulnerabilities
LLMs: You were right, here they are on tap
I wouldn't necessarily take this as evidence all the hard problems in other fields will fall with minimal prompting.
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
waiting patiently for marketing budgets to run out
who's going to pay for bug hunting in Linux 8.x? :)
GCU Tense Correction retweeted
me: kinda fucked up how many people are offloading their whole lives to muse or instinct or grokbot or whatever
claude: yeah
GCU Tense Correction retweeted
let’s put this company out of its misery, please, pour encourager les autres
otherwise, we can expect a string of failing ai labs pivoting to attempted govt sinecures via retarded panic mongering
heads on a sticks, prominently displayed, and onwards.
In the spirit of transparency and openness, we are releasing the traces so developers can test this out for themselves. We noticed this behaviour without prefilling with the following prompt, but this is rare. If you want to reproduce it, you can use this prompt with prefilling.
Open models make for better science and are part of why this problem came to light at all: developers running Qwen3.8 on their own machines spotted the strange links, and having the weights let us study the behaviour in depth.
We're encouraged by the thoughtful discussion our research has sparked across the AI and security communities. It's our belief that open-weight models are an important part of the future of AI, and we've recently released several under the Apache 2.0 license.
Trace, raw tokens, & minimal reproduction script: huggingface.co/datasets/Cohe…
GCU Tense Correction retweeted
Holy shit. I just got pwned. iPhone suddenly crashed, rebooted, locked. Checked router stats. Total exfiltration ongoing. Panicked, tried to shut off network. Router also locked. Unplugged router. Didn't matter. Router harvesting zero-point energy. As a last-ditch resort, tried to smash my iPhone. All the atoms in the hammer quantum-phased right through. Hackers got everything, all of it. All my penis pictures.
GCU Tense Correction retweeted
Big tech companies have proven, time and time again, that they will do everything they can to screw over white hats, including actually rugging them.
We are entering a golden age for black hats, no doubt, but until big tech fixes their issue with paying people to secure their product, I expect way more black hat news than white hat news.
For those in AI new to cyber (or w/e kids call infosec now) the turnkey abliterated model providers you see are all honeypots/watering hole attacks.
GCU Tense Correction retweeted
warlock.ai/blog/warcraftsim-…
Best game on best map
