H4cker, author of How to Hack Like a Pornstar https://xitter.cf/t.co/VvRLVM6MUB & How to Hack Like a Ghost https://xitter.cf/t.co/DXpFnQ3rYR https://xitter.cf/t.co/IrQjsNwxGV
Joined February 2017
- Tweets492
- Following125
- Followers3.2K
- Likes763
Pinned Tweet
My new book Blitzscaling Security is now available.
Dive into the mind of Alex, the first security engineer at a scale-up, & experience the brutal truth behind designing a security that protects and boosts the business
The gloves are off with this one :)
amazon.com/dp/B0C4LC4FDW
Way to put your money where your mouth is! Love it.
Someone has created a vulnerable PHP website, loaded it with a Bitcoin wallet, and challenged the Internet to hack into it and they can keep the Bitcoin. It has a running timer to show if the PHP exploitability was over-hyped. stealmybitcoin.com/
Sparc Flow retweeted
My hot take on this PHP mess is that its incredibly overhyped and we'll see very little ITW exploitation. Overall it seems less impactful than its named bug predecessors; heartbleed, shellshock, log4shell etc
Agree. These vulns are overhyped. These are not the type of vulns that lead to reliable mass exploitation. Patch yes, but far from the doomer scenario narrative pushed yesterday.
Current information I have on php2Shell:
- The RCEs requires the attacker to obtain memory addresses which are typically protected by ASLR.
- I suspect the original author (lcfr_hax) likely has a reliable exploit which leads to stable code execution.
- Most of the PoCs being posted are completely non-functional AI slop.
- There is at least 1 working non-slop exploit being passed around, but it's reliant on bruteforcing for ASLR bypass, so not particularly impactful.
- Rumor of ITW exploitation are patchy. There are attempts being seen using the non-functional leaked RCE, or variants that are config / system specific.
- Some rumors point towards a known-working exploit being used by threat actors (I've personally confirmed this specific exploit works, but the ASLR bypass technique is unreliable at best and massively limits the potential impact).
- I'd expect heavy ITW exploitation in the next few weeks based on how many people are looking at this. Though, success rates will vary heavily based on the specific exploit chain.
Sparc Flow retweeted
You've gotta patch your dependencies super fast because they're full of vulns (PHP, Node, eMudhra, etc), but not _too_ fast because they're full of backdoors (LiteLLM). Good luck!
Sparc Flow retweeted
Les chiffres:
- 68 millions de Français
- 38M d'inactifs
- 30M d'actifs
Et parmi les actifs:
- 3M de chômeurs cat. A
- 6M d'employés du public dont 5M de fonctionnaires
- 21M d'employés du privé dont 2M d'employés d'associations
Soit 19M d'emplois privés réels sur 68M.
Sparc Flow retweeted
Last year the same labs, politicians, NGOs, and media outlets now pushing the extinction hoax were running a full-scale campaign that AI would cause a jobs apocalypse.
We were told it would be a “white-collar bloodbath,” 10–20% unemployment, half of entry-level jobs gone. Obama amplified it.
Over a year later: unemployment at 4.1%. No economy-wide displacement. A million new jobs created by AI, says The Economist. Anthropic’s own chief economist says the data looks like skill augmentation, not job destruction.
So, any admission by the doomer labs, politicians, and NGOs that they were wrong? Any humility about scaring the public with wild extrapolations dressed up as forecasts? Nope.
They just move on to the next hoax, with the same false certitude and fake precision.
🚨 Anthropic Chief Economist Peter McCrory Says AI Job Loss Predictions Are Not Panning Out
“What I see in our data is that [AI] looks more like a skill-biased labor augmenting technology than a technology that outright automates and displaces displaces jobs wholesale … Based on the Department of Labor's taxonomy … there's no job where every single task is being automated by Claude.”
“We're Building Prod, Not God” is probably the best take on AI doom this year.
What a refreshing take by @typesafeai
“We're Building Prod, Not God” is probably the best take on AI doom this year.
What a refreshing take by @typesafeai
Sparc Flow retweeted
What Is To Be Done?
I propose a simple plan:
Big AI companies should be allowed to build AI as fast and aggressively as they can – but not allowed to achieve regulatory capture, not allowed to establish a government-protect cartel that is insulated from market competition due to incorrect claims of AI risk. This will maximize the technological and societal payoff from the amazing capabilities of these companies, which are jewels of modern capitalism.
Startup AI companies should be allowed to build AI as fast and aggressively as they can. They should neither confront government-granted protection of big companies, nor should they receive government assistance. They should simply be allowed to compete. If and as startups don’t succeed, their presence in the market will also continuously motivate big companies to be their best – our economies and societies win either way.
Open source AI should be allowed to freely proliferate and compete with both big AI companies and startups. There should be no regulatory barriers to open source whatsoever. Even when open source does not beat companies, its widespread availability is a boon to students all over the world who want to learn how to build and use AI to become part of the technological future, and will ensure that AI is available to everyone who can benefit from it no matter who they are or how much money they have.
To offset the risk of bad people doing bad things with AI, governments working in partnership with the private sector should vigorously engage in each area of potential risk to use AI to maximize society’s defensive capabilities. This shouldn’t be limited to AI-enabled risks but also more general problems such as malnutrition, disease, and climate. AI can be an incredibly powerful tool for solving problems, and we should embrace it as such.
To prevent the risk of China achieving global AI dominance, we should use the full power of our private sector, our scientific establishment, and our governments in concert to drive American and Western AI to absolute global dominance, including ultimately inside China itself. We win, they lose.
And that is how we use AI to save the world.
It’s time to build.
Sparc Flow retweeted
Stop what you are doing and watch this talk youtube.com/watch?v=87DyyMV0…
You prompted the model to exploit the infra and then act surprised it found vulns. What a shock.
we had a significant security incident during evaluation of our models. we are sharing what we have learned so far. thanks to @huggingface for the partnership on this.
openai.com/index/hugging-fac…
Every Anthropic employee following a release: i’ve been using this for the past month and it changed the way we work.
Every.single.time.
Sparc Flow retweeted
I’ve had a number of conversations with folks inside and outside government about the current situation with Anthropic, and here is what I believe to be true:
— As we know, Anthropic publicly released its Mythos class models earlier this week under the commercial name Fable.
— Fable is Mythos with guardrails. But if those guardrails fail, then you’ve exposed Mythos and its advanced cyber capabilities to people who shouldn’t have them. (Keep in mind that Anthropic itself widely promoted the idea that Mythos was a cyberweapon and needed to be regulated as such. They asked for government regulation of Mythos and championed the guardrails on Fable. If there is a vulnerability — big or small — it is Anthropic’s responsibility to patch.)
— A highly credible trusted partner of both Anthropic and the USG who was testing Fable came forward with a jailbreak of those guardrails. The Admin asked Dario to fix the jailbreak or de-deploy the model. Dario refused.
— In their blog post, Anthropic defended its decision by saying the jailbreak isn’t serious. That is not what the trusted partner and the USG believe; nor is that kind of minimizing language consistent with Anthropic’s brand as the AI safety company. It’s difficult to fathom how they could claim a jailbreak allowing operability of a cyber weapon could be defined as not “serious.”
— In the past, Anthropic has always said that safety must be top priority and taken super seriously. In this case, Anthropic prioritized the continued offering of the consumer model over safety.
— In reaction, the Admin issued the export control. The Admin did this reluctantly. It’s been very surprised that Anthropic hasn’t wanted to cooperate with a reasonable safety request (ie fixing the jailbreak issue). Anthropic’s reaction is very much at odds with their branding and ethos as a safe AI research community.
— The Admin’s hope now is that Anthropic remediates the safety issue, the export control is lifted, and Fable goes back into general release. The Admin wants all of this to happen as soon as possible. It is frankly bewildered that Anthropic hasn’t wanted to comply with safety requests that it previously said were its highest priority.
— Those trying to misdirect and tie this action to the prior DoW/Anthropic issues are wrong. The Admin values Anthropic’s technical capabilities and feels that this issue, while serious, should be easily resolved. The ball is in Anthropic’s court.
Caricature timeline 🍿
• The Pentagon adopts Anthropic because it’s the best.
• Anthropic insists on approval and oversight for military use.
• The Pentagon says that’s an unacceptable supply chain risk and stops using Anthropic.
• Anthropic ramps up fear mongering about frontier AI.
• Dario publishes a doomsday essay calling for governments to regulate frontier models.
• Anthropic releases Fable/Mythos.
• The U.S. government can’t use it because of its own supply chain policy.
• Then the U.S. blocks everyone else from using it too.
Cannot make this up even if we tried.
Sparc Flow retweeted
anthropic is at risk of making a big mistake
it's something we've seen too many times before
imagine having the crazy goal of building a platform - something thousands of companies and products are built on top of
you realize just building the platform isn't enough, so you start to build tools that make it easier to use the platform and demonstrate its capabilities
these tools get their own names and identities and teams working on them
and very quickly these teams forget they only exist to drive people onto the platform
and then one day someone external makes a tool that accomplishes that goal and does it even better
it should be a moment of success - this is the original dream, to see great things built for your platform
but structurally these teams have long forgotten that so it's a moment of competition. in the worst cases they even try to squash it
we've experienced this building SST and how some teams at AWS saw our work as competitive even as we were driving dollars to AWS and tapping into a market they could never reach
there are exceptions - cloudflare has invested resources in helping us even though they have wrangler, somehow their teams are setup in a way to not see us as a threat
but it's a real test - we'll soon be able to see if anthropic as an org is really aligned with becoming a platform or if they fall into this same trap
People mock vibecoding but if you can oneshot dependencies to reduce your exposure…not a bad thing. This used to be a google-like luxury. Perhaps not anymore
I mean yes it’s a scandal, but having gone through actual soc 2, iso 27001, pci dss and other types of audits, i don’t see how this is radically different than what auditors do.
Do people really think that an ISO auditor actually looked properly at system configs and ran deep and proper technical checks ?
Most of these certs are rubber stamps anyway, this is just a step up in terms of the compliance charade.
Delve, a YC-backed compliance startup that raised $32 million, has been accused of systematically faking SOC 2, ISO 27001, HIPAA, and GDPR compliance reports for hundreds of clients. According to a detailed Substack investigation by DeepDelver, a leaked Google spreadsheet containing links to hundreds of confidential draft audit reports revealed that Delve generates auditor conclusions before any auditor reviews evidence, uses the same template across 99.8% of reports, and relies on Indian certification mills operating through empty US shells instead of the "US-based CPA firms" they advertise. Here's the breakdown:
> 493 out of 494 leaked SOC 2 reports allegedly contain identical boilerplate text, including the same grammatical errors and nonsensical sentences, with only a company name, logo, org chart, and signature swapped in
> Auditor conclusions and test procedures are reportedly pre-written in draft reports before clients even provide their company description, which would violate AICPA independence rules requiring auditors to independently design tests and form conclusions
> All 259 Type II reports claim zero security incidents, zero personnel changes, zero customer terminations, and zero cyber incidents during the observation period, with identical "unable to test" conclusions across every client
> Delve's "US-based auditors" are actually Accorp and Gradient, described as Indian certification mills operating through US shell entities. 99%+ of clients reportedly went through one of these two firms over the past 6 months
> The platform allegedly publishes fully populated trust pages claiming vulnerability scanning, pentesting, and data recovery simulations before any compliance work has been done
> Delve pre-fabricates board meeting minutes, risk assessments, security incident simulations, and employee evidence that clients can adopt with a single click, according to the author
> Most "integrations" are just containers for manual screenshots with no actual API connections. The author describes the platform as a "SOC 2 template pack with a thin SaaS wrapper"
> When the leak was exposed, CEO Karun Kaushik emailed clients calling the allegations "falsified claims" from an "AI-generated email" and stated no sensitive data was accessed, while the reports themselves contained private signatures and confidential architecture diagrams
> Companies relying on these reports could face criminal liability under HIPAA and fines up to 4% of global revenue under GDPR for compliance violations they believed were resolved
> When clients threaten to leave, Delve reportedly pairs them with an external vCISO for manual off-platform work, which the author argues proves their own platform can't deliver real compliance
> Delve's sales price dropped from $15,000 to $6,000 with ISO 27001 and a penetration test thrown in when a client mentioned considering a competitor
