Replying to
@rikviergever@mastodon.social ik heb het probleem al eens in een Play Store review gemeld, maar nul respons gehad. (Als GrapheneOS gebruiker, maar komt op hetzelfde neer.)
Remote
Bart Groeneveld
@bartavi@mastodon.nl
mastodon 4.7.3+procolix.mnlSoftware-ontwikkelaar. Geïnteresseerd in privacy, duurzaamheid (lange-termijn efficiëntie) en ethiek.
Berichten hier dienen als tijdelijk te worden beschouwd, en weerspiegelen niet per se mijn huidige overtuigingen.
86 Followers
71 Following
21 Posts
Joined December 28, 2022
Webstek:
Languages (CEFRL levels):
Dutch (C2), English (B2), German (pre-A1)
Replying to
@bartgroothuis@mastodon.online @teacher_rick@mastodon.nl @joepbc@mastodon.social de 'innovatie' van hoge stroomrekeningen, AI-slop en dus kapitaalvernietiging? 🤷
RE: https://infosec.exchange/@drwhax/116997238394916522
This is both very reasonable and very problematic at the same time. Essentially, people are almost literally cooking the earth in a way that is completely unsustainable (economically speaking: sponsored tokens. Let alone the environment and other ethical issues), and our only mitigation is... doing the same thing.
Contrast this with other infosec work, which can be very sustainable, and is sometimes as easy as increasing key lengths (minor extra work for the defenders, major extra compute necessary for the attackers).
Quoting
I know Mastodon hates LLM's and AI. So here goes!
I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.
The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.
I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.
I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.
The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.
I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.
I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.
Please run an LLM over your code base if it's internet facing or something critical, we thank you!
Can't wait for the discussions on this!
Open quoted postReplying to
@yvanspijk I am a bit confused on how it went from 'to stay' to 'to leave'. The meaning switched to the complete opposite?
Replying to
@ruben As a left-handed person, I can only be jealous at being able to write with a fountain pen at all.
There would be to much pressure on the tip of the pen (because it points in the writing direction), and my hand will go over the just written ink, smudging everything.
I compensated for this by buying a way to expensive gell pen, and putting learning a rtl language on my todo list.
Replying to
@freedominternet het nieuwsbericht vermeld dat jullie ergens op jullie website vermelden welke domeinen jullie blokkeren, maar ik kan dat nergens terugvinden. Of is het nieuwsbericht met de link naar de Duitse lijst zelf de vermelding?
Replying to
@badkeys Is there also a security risk, or is just about using another format than was initially specified?
Replying to
@freedominternet toch bijzonder dat een glasvezel een jaar lang effectief niet kan worden gebruikt. Tenminste, Odido biedt geen volledige internetverbinding aan, alleen IPv4.
Replying to
@gregprice @Elliptickiwi @djb if I understand correctly, their argument is that maintaining hybrids is not cheap, given the complexity of hybrid key management and, according to them, the vulnerabilities resulting from that complexity. Add to that that PQC has to work anyway, so they pour all their resources into that.
I mean, I can understand that.
Replying to
@RosaCtrl@social.vivaldi.net I like how this is most likely a subtle critique at vibe coding.