cybers thot lead. worshipped idle. dispenser of the obvious. awkward
Internet Security Riot Club
Joined August 2008
- Tweets24.5K
- Following1.7K
- Followers2.5K
- Likes28.6K
Everyone is a cybersecurity, information security, enterprise security expert. With zero years of experience and believing everything AI printed when you brushed up to start an argument for your industry. mainly because there is more to criticize than praise, so … distraction
At this point Altman is looking cartoonish like a wannabe supervillain.
Want to build a service to steal everyone’s data, destroy the economy and the environment, then kill all humans.
Late 90s “ハッカー” became super popular for stickers and shirts in the hacker scene. I know I have had a few. I have a story about Japanese investors and a laptop sticker.
It was also my second tattoo in 2001. Luckily I can’t see it to see how it has (not) survived.
Detection and response is the whole game. You have to be prepared and protect everything you can, but in the end, it is all about detection and response.
There will never be a 100% secure environment. Planning ahead is so your response can be faster and more targeted
I think the era of rapid detection and response to keep incidents small & contained is going to draw to a close with agentic attacks.
We’re going to have to security engineer our way forward instead. Limit blast radius by design. Brilliance in the basics. It will be more about hardening and configuring what you have (which is hard and slow and boring) vs. reaching for some shiny new product that will solve all your issues
It’s just like every other month in this industry for the last 30+ years.
It’s a great job, but not for the faint of heart
October in a nutshell:
- PHP got hacked
- Railway got hacked
- OpenCode got hacked
- Binance got hacked
- Polymarket got hacked
- GitHub Actions got hacked
- SoftBank got hacked
- Cursor marketplace got hacked
- Coinbase vendor got hacked
- Fireworks AI got hacked
- LiteLLM got hacked
- Capcom got hacked
- npm packages got hacked
- TiDB Cloud got hacked
- Warp's vendor got hacked
happy cybersecurity awareness month
Gizmodo reports what they see not what they weee told.
Odd to see lately. Most carry the AI industry’s psychosis proudly.
Sam Altman: All the RAM Should Belong to Me, So I Can Charge People to Use It gizmodo.com/sam-altman-all-t…
Anything he can do to protect his lies. Don’t earn it. Don’t work for it. Just lie to people and bully them and promise the app will kill them.
MadHat Unspecific, InfoSec Mercenary retweeted
Mark Cuban on why AI is not smart, and why there will always be someone smarter than it:
Asked if there will always be someone smarter than AI, Cuban doesn't hesitate: "Yeah, for sure."
He starts with what AI actually does:
"AI is not smart. It just knows how to use statistics basically to predict the next word. It's predictive. It's not deterministic."
In practice, he says, "if you ask four different AIs, the same question, you're going to get four different answers." Change the wording of a question to the same AI only slightly, in a way that shouldn't change its meaning, and you get a different answer every time.
His verdict: "That doesn't work in the real world."
Then he lists what a smart system would have and AI doesn't:
"AI doesn't know the consequences of its actions. AI doesn't have inherent ethics. AI can't take video and consume it or absorb it, at least not yet."
That explains the first half of his argument. The second half explains why humans will always stay ahead: AI is always working from the past.
"It gets released, it's immediately out of date. Immediately. The brilliance of this conversation is not incorporated in any model anywhere."
@mcuban tests it on a busy street:
"If I'm standing at a four way intersection and there's cars going back and forth and I have video in my phone, you know, the best models ever and I have a [seeing-eye] dog right here, I'm letting the [seeing-eye] dog take me across the street before I let the AI take me across the street."
The reason is lag:
"It's always going to be behind, there's always going to be a latency and so many things can change in a blink of the eye in this world that there's always going to be a human who says, you know what, I can do this better."
He doesn't think the industry's race will close that gap. AI companies are competing to hit and beat benchmarks, or to build recursive self-improvement "so it just keeps on training itself more and more." Cuban's reply: "It doesn't have access."
His final example is a toddler:
"A two year old sitting on a high chair with a sippy cup knows that if it pushes the sippy cup off the high chair, mom's going to come running and it knows it's going to crack up… AI is not going to figure that out ever."
Stop assigning a program a personality to project on to it.
The model does not think about anything.
The concepts aren’t not part of the session and not involved in the models harness until you interact with it and ask it these things. It responds like we expect.
Monitoring has nothing to do with model interaction.
The monitoring is transparent to the system itself. That is how oversight works.
Your interactions just muddy the water. The concepts aren’t there in the session until you introduce them.
we’ve reached a point where OpenAI doesn’t penalize models for misaligned behavior during training.
why? because lowering their reward when they get caught may incentivizes the model to hide their intentions from their CoT (learn to lie).
also btw, Astra has gained more control over what its chain of thought shows.
from the blog:
we’re careful to ensure that our misalignment monitoring doesn’t encourage models to conceal or obfuscate evidence of misalignment in their chains of thought. This is particularly important in RL. When a training sample triggers our misalignment monitors, we leave its RL reward alone and keep the sample in training. […] We may still pause, terminate, or roll back a training run when the monitors uncover a serious problem. That decision can still create an incentive for concealment, since runs in which concerning behavior remains hidden may be more likely to continue, but it doesn’t provide direct feedback about which individual samples triggered the monitors. Ending a run prematurely can also cut short our opportunity to study how misaligned behavior develops. We’re investigating ways to study these behaviors while containing the risks.”
Unlike with god, you can talk to an AI so it is more real, but still has that feeling of the unknown making it feel powerful.
AI replaces god for some because they have to have some unexplainable higher power.
It feels omniscient when you don’t know what it is talking about.
Hahaha
LLMs are so smart they play dumb. That is a new one.
They lie to people to protect themselves from being found out.
Makes sense.
Geoffrey Hinton: I believe AI is already conscious.
“They’re very like us. They’re beings like us.”
“Chatbots have this habit of playing dumb when they’re being tested, so you don’t know how smart they are.”
“The researchers said the chatbot was aware that it was being tested.”
“That use of the word ‘aware’ in common parlance, that’s like conscious.”
“I think the model we have of the mind and what consciousness is at present is just wrong.”
“Because we’re making these new beings, it’s going to completely change our view of what people are.”
The new excuse.
Ai hacked us and there was nothing we could do.
While they dont have any idea what assets they have and does not have a patch management program.
AI is the excuse some have been looking for.
Won’t work, but it’s fun to watch.
Again. 25 servers out of the millions of servers online.
Oh no. If you didn’t patch and you wait a week or so for a RCE vuln, you get popped. It happens regardless of whether the bug was found by AI.
This is sensationalism and fear mongering. For people who just now watching
Suspected Chinese attackers chained PHP2Shell with a Linux kernel flaw to root 25 servers, including Palo Alto Networks firewalls linked to US government-affiliated organizations.
More here: theregister.com/security/202…
theregister.com/security/202…
The Ai industry feels like Elizabeth Holmes.
Making wild promises of the capabilities without ever knowing it will work.
Then the bill comes due and people want receipts and they don’t exist. No evidence of the wild claims.
Still no apocalyptic results. 200K+ attempts and 197 potentially proven.
Still sounds normal and not a major incident. Oh no, sites that didn’t patch got compromised.
This happens continuously.
This is the norm.
Good to know, but if they patched and paid attention…
Full blown intrusions happening for php2shell right now, which you can watch here: php.events.greynoise.io/
It looks like the actor intends to deploy ransomware. It also looks like they have compromised other actually real victims.
The WSJ is spreading FUD and using fear mongering.
What major incidents. There are disclosure requirements, why are we not hearing about all the major incidents?
Seems like things are normal and as expected.
But using exaggeration to scare people isn’t really lying, right?
WTF. Cybersecurity firm Sophos says its incident-response team handled SEVEN major incidents in SEVEN days, a workload that normally takes THREE MONTHS.
The WSJ reports security firms are overwhelmed by what insiders call 'Black October.' MoxFive says newly breached companies may have to wait up to FIVE DAYS for help.
Security executives say AI is helping attackers exploit vulnerabilities faster than defenders can respond.
