Proxy

This is incredible lol, Orange Tsai popped browser from calc

ok update on the deleted repo thing, since it kind of blew up first, some context on why i posted it like that. there have been so many security incidents lately that my brain is basically stuck in alert mode. so when i saw a stranger in our audit log deleting a private repo, i assumed the worst. we figured out what happened. nobody hacked us, and it wasn't a github bug. that repo was a private fork of a repo owned by @StainlessAPI, the company that generated our SDKs. our entire SDK pipeline ran on it. Stainless got acquired by @AnthropicAI back in may. and on october 27, with zero heads-up to us, someone there deleted their copy of the repo. turns out when you delete a private repo on github, every private fork of it gets deleted too. same request, under two seconds. and our audit log shows the person who deleted *their* repo as the one who deleted *ours*. that's why it looked like a random outsider walked into our org and nuked something. no email. no "hey, we're cleaning these up, grab a copy." just gone, along with the production repo behind every one of our SDKs. github support walked us through all of it within a day, which, genuinely, thank you. one ask though @github: put this in the audit log. right now the event for our repo just says "repo.destroy" by an outside user. if it said "deleted because upstream fork parent X was deleted", we'd have understood it in two minutes instead of spending a night thinking we'd been breached. we had a local clone, so we pushed it back up as a standalone repo and the SDKs are running again. if you were a Stainless customer and you've got anything living as a private fork of one of their repos, go detach it today. it takes ten minutes. their delete is your delete.

Here's a direct link to OpenAI's PDF claiming a refutation of ETH. In particular, it's claimed that 3SAT on n variables is in about exp(n/(log n)^{1/2+o(1)}) time github.com/openai/math/blob/…

this is why i'm pessimistic(ik lots of pessimism last two days) about formal verification as a solution to securing the entire existing software stack, and much more optimistic about reducing complexity and attack surface first, then formally verifying the critical parts. with llms, we can definitely formally verify a lot more software, and we absolutely should. but claiming we can verify the entire existing software stack for $ X sounds absurd to me, almost like throwing resources at a lost cause. the problem is you have billion states in complex software with insane amount of interactions between components and humans and specifying what exactly "secure" means is way harder look at this example of how things can go wrong. tldr is @AnthropicAI and @theoremlabs formally proved a asan based memory safe property for some gif encoding library's compiled fuzz target, for inputs under 64 MiB. but the fuzz harness rejects images exceeding 10k total pixels, so the verified program never reaches the libraries large image states including >10k <64mib which they intended to prove and there is a 32bit integer overflow. (ik the input required to crash is way beyond 64mb limit and outside the theorem, but you get the gist of what can go wrong.) the proof appears to be correct, claude proved exactly what it was asked to prove but it doesn't prove what they intended, all inputs below 64 mib to "library" now imagine doing this for browsers, kernels, servers, and applications running on top of them. even when you prove something correct, how do you know your next model won't find a security critical case that your specification missed? it still looks like the same cat and mouse game to me

messaging my wife a link containing proof of her husband cheating on her from an anonymous instagram account and then when she clicks on it texting her to let her know she failed the family phishing test and she has to retake my cybersecurity course

Sorry everyone... We're announcing a 0-Day vuln in QUIC that allows anyone to remotely turn off a server running these libraries. I swear we didn't plan this. foxio.io/blog/header-accordi…

Why is Wiz taking any credit for this? Their blog post words it like they discovered it.

if this PHP vulnerability allows remote code execution, doesn't that mean we can use the vulnerability to auto-patch all vulnerable servers?

eMudhra, an Indian certificate authority, has had 8 private security keys compromised with half the internet is cooked The keys were incredibly weak. One of them was literally just “4” The keys could have been used to create fake HTTPS certificates and make malicious websites appear legitimate. Chrome, Firefox, Apple and Microsoft have blocked the affected certificates. Older devices, software and apps may still need updates.

arstechnica.com/security/202… The private keys for these certs are literally the numbers 4, 56, 66, 115, 155, 156, 230, and 237 (life imitates XKCD, again).