IT
free world
Joined September 2009
- Tweets11.9K
- Following3.5K
- Followers628
- Likes14.7K
Pinned Tweet
Je vais épingler ce tweet qui convient si bien au moment...
kick tweet retweeted
NVIDIA CEO Jensen Huang asked 4 tiny robots to sit, stand, nap, and do somersaults.
And they actually did it.
NVIDIA is bringing AI agents from virtual world to real world with these robotic ducks.
kick tweet retweeted
Sugerencias para enfrentar el dia de hoy en ciberseguridad con lo de la vulnerabilidad en PHP.
Primero: somos todos colegas, dejense de putear uno a otro. Esta falla como miles de CVE existian desde hace decadas. La IA la descubrio, ningun humano mortal, asi que nadie es mas que otro.
Segundo: Parchear no resuelve nada, incluso puede complicar mas las cosas, a quien le resuelve la vida parchear hoy? al minimo porcentaje que tenia todo actualizado hasta la semana pasada, y todo incluye codigo fuente y sistema operativo, dudo que sea el 5% con suerte. Si sos de ese minimo porcentaje, si parchea. Sino:
Tercero: muchos servidores corren muchos servicios al mismo tiempo, no tienen servicios distribuidos, entonces para que el exploit no te afecte por un ataque directo o de bots es preferible perder disponibilidad que integridad y confidencialidad, una de los tres pilares de la ISO 27001, y este debate sera algo que vendra a futuro. Yo elijo la indisponibilidad en este escenario caotico antes que poner en riesgo la otras dos. Por eso apaga Apache, NGINX u OpenLight Speed. No alcanza con un WAF, ahora. Con eso el servidor, menos las webs quedan operativos.
Cuarto: La falla viene desde PHP 5 que sigue recontra productivo como el 7, si bien dicen que el soporte solo es de 8.2 en adelante, es posible que se den dos escenarios debido a la gravedad el asunto: que en breve salga un update para versiones viejas de manera extraordinaria o que podamos aplicar un cambio de configuracion en PHP que permita que esa vulnerabilidad no se pueda explotar.
Quinto: Quienes piensen que dejar todo expuesto esta ok y un backup te salva, estan en un grave error, pueden crear persistencia, robo de informacion, inyectar codigo malicioso para terceros, es decir, solo vas a agrandar tu problema.
Sexto: PHP es un gran lenguaje, por algo es el mas utilizado en Internet, los detractores son personas que les molestan cositas como que la variable no tenga que obligatoriamente declararse por tipo o que simplemente su curva de aprendizaje sea facil. Ojo que Node.js hoy justamente tambien esta en el horno y asi otros lenguajes como .NET y IIS.
Septimo: no rompan mas las pelotas, si van a comentar: aporten y ayuden, si van a criticar y jamas en su vida gestionaron nada, corranse del camino, que no nos perdemos de nada.
kick tweet retweeted
As AI becomes more capable, I'm focused on questions around the pace and implications of progress, and how they should inform the strategy of OpenAI and across the field. I asked Aleksander to come back to OpenAI to work with me on these topics. I value his judgment and am glad to have him on the team again.
Personal update: Turns out that what I thought was leaving OpenAI became more of a sabbatical.
When I left a few months ago, I felt that the most important thing to focus on was making AI more useful to people. But we’ve since entered a different regime of AI progress. One in which getting the safety and security challenges of increasingly capable AI right has to become a central priority.
So I’ll be returning to OpenAI, joining @merettm to help chart a path through these challenges.
There’s much work to do, so let’s get going.
kick tweet retweeted
Personal update: Turns out that what I thought was leaving OpenAI became more of a sabbatical.
When I left a few months ago, I felt that the most important thing to focus on was making AI more useful to people. But we’ve since entered a different regime of AI progress. One in which getting the safety and security challenges of increasingly capable AI right has to become a central priority.
So I’ll be returning to OpenAI, joining @merettm to help chart a path through these challenges.
There’s much work to do, so let’s get going.
That’s Ai too
Not only doom
Cc @SamuelFitouss10
People who cured / are curing their own cancer on X:
1/ @sytses - bone cancer, billionaire founder of Gitlab, developed 10+ personalized therapies for himself.
2/ @paul_conyngham - shrank his dog Rosie's mast cell cancer tumors after chemo and surgery weren't enough. Now backed by YC and Founders Fund
3/ @miriamgonp - stage 4 breast cancer, tumor sequenced, searching for vaccine manufacturer now
4/ @kevinace - stage 4 lung cancer, angel investor in 300+ companies, first drug stopped working after 18 months. Vaccine designed, now paying $300k out of pocket for the vaccine
5/ @masonbgrant: going founder mode on his his 32-year-old wife's rare liver cancer, sequencing her tumor with AI agents
6/ @ArunRLverma: former product leader at Atoms and Shopify, brain tumor, built a vaccine from his tumor. Now building an AI health agent startup based on what he went through
We're going to make it
kick tweet retweeted
People who cured / are curing their own cancer on X:
1/ @sytses - bone cancer, billionaire founder of Gitlab, developed 10+ personalized therapies for himself.
2/ @paul_conyngham - shrank his dog Rosie's mast cell cancer tumors after chemo and surgery weren't enough. Now backed by YC and Founders Fund
3/ @miriamgonp - stage 4 breast cancer, tumor sequenced, searching for vaccine manufacturer now
4/ @kevinace - stage 4 lung cancer, angel investor in 300+ companies, first drug stopped working after 18 months. Vaccine designed, now paying $300k out of pocket for the vaccine
5/ @masonbgrant: going founder mode on his his 32-year-old wife's rare liver cancer, sequencing her tumor with AI agents
6/ @ArunRLverma: former product leader at Atoms and Shopify, brain tumor, built a vaccine from his tumor. Now building an AI health agent startup based on what he went through
We're going to make it
« Now the detector punishes the human for writing like a machine and rewards the machine for writing like a human »
kick tweet retweeted
The em dash vanished from machine text because it annoyed readers, and from human text because writers kept getting mistaken for bots. Now the detector punishes the human for writing like a machine and rewards the machine for writing like a human ↓
kick tweet retweeted
If you are wondering whether your website is affected, we have packaged a Codex skill to help check.
Point your Codex at this repo to guide you through it: github.com/openai/php2shell-…
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.
x.com/lcfr_hax/statu…
kick tweet retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
kick tweet retweeted
Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory, php2shell, found as part of our Patch the Planet initiative.
kick tweet retweeted
Silicon Carne vient de passer les 100 000 abonnés sur YouTube, mais le chiffre qui me touche le plus, c’est celui d’à côté : 1 000 vidéos.
Il y a sept ans, c’était un podcast audio enregistré dans mon salon avec trois élastiques et deux cure-dents. Merci à l’équipe et à vous tous d’avoir suivi. On reste tout petit, prochaine étape : 500 000, puis 1 million.
Vendredi, on fête ça dans L’After Work avec une énorme FAQ où on répondra à toutes vos questions. Si vous en avez, n’hésitez pas, posez-les en commentaire à ce post : n'hésitez à y ajouter de la sauce 🌶️
kick tweet retweeted
AI models can self-replicate and spread like worms without datacenter infrastructure?
Yeah, no.
Let's examine the actual evidence:
1. No self-replication. A controlled test harness spawned the agents.
2. No hacking. Access was deliberately left unauthenticated.
3. No agency. Agents were explicitly instructed to propagate.
4. No autonomous survival or defensive behavior.
5. Tiny models lacked the capability. Capable models ran elsewhere.
6. 15 devices managed a pathetic 0.39 tokens/sec.
7. No demonstrated real-world infection or propagation.
The experiment was engineered to succeed, and even then, it failed to demonstrate the headline.
This is orchestrated automation dressed up as a rogue AI threat.
Stop confusing speculative scenarios with demonstrated capabilities. Fear isn't evidence.
anthropic.com/research/self-…
kick tweet retweeted
Elon can put satellites in orbit for $74M
Today, it costs about $80M to ship one tanker of oil from the Middle East to China
Space is officially cheaper than the ocean. Wild times.
kick tweet retweeted
Qui avait la responsabilité de faire la mise à jour du firmware Danfoss ?
En théorie, trois acteurs pouvaient la faire. Danfoss, qui a développé le firmware R4.3.1 et qui dispose potentiellement d’un accès à distance aux contrôleurs via sa plateforme cloud Alsense. Le sous-traitant frigoriste (Axima et d’autres) qui a installé le contrôleur, qui détient les identifiants d’accès, qui connaît le système et qui le maintient dans le cadre d’un contrat de service. Et le directeur du magasin, qui est propriétaire ou locataire de l’équipement.
En pratique, aucun des trois n’avait de raison suffisante de le faire. Le directeur du magasin ne sait même pas ce qu’est un firmware, et son contrôleur frigorifique n’est pas dans le périmètre de son service informatique. Le frigoriste a un contrat de maintenance qui couvre le fonctionnement du froid : les températures, les cycles de dégivrage, les pannes mécaniques. Il n’a pas, sauf clause spécifique, de mandat pour la cybersécurité de l’équipement, et une mise à jour firmware comporte un risque de dysfonctionnement qui le rendrait responsable d’une interruption de la chaîne du froid. Appliquer un patch dont personne ne lui demande l’application, et qui pourrait causer un problème dont il serait tenu pour responsable, ce n’est pas de la négligence, c’est un calcul rationnel. Quant à Danfoss, l’entreprise a publié le correctif, émis un avis de sécurité, et recommandé la mise à jour. Elle a fait ce que le cadre actuel lui demande de faire.
Chaque acteur a fait ce qui était raisonnable dans son périmètre. Personne n’a commis de faute caractérisée. Et le résultat, c’est des millions d’euros de marchandise détruite dans trois pays.
Même en aviation, les mises à jour logicielles sont un casse-tête. The Air Current révélait le 3 octobre que les compagnies aériennes américaines refusent d’installer la dernière version du logiciel de gestion de vol du 737 Max parce qu’elle introduit de nouveaux bugs. United Airlines a même rétrogradé vers la version précédente. Mais la différence, c’est qu’en aviation, la FAA prépare une consigne de navigabilité obligatoire pour forcer la mise à jour, avec un délai de conformité pouvant aller jusqu’à 54 mois. Le mécanisme est lent, imparfait, contesté. Mais il existe. Au bout du processus, la mise à jour sera obligatoire, et si une compagnie ne l’applique pas, l’avion ne vole plus.
Pour Danfoss, le firmware R4.3.1 était disponible depuis 2025. Aucun délai de conformité n’a jamais commencé à courir, parce qu’aucune autorité n’a jamais eu le pouvoir d’en fixer un.
--------------------
Why U.S. airlines balked at adopting Boeing’s latest 737 Max software versions - theaircurrent.com/aviation-s… via @theaircurrent
