OddOpinions5

It is happening again! This weekend I have the color furnace rented- and everything was in place to pull tubes- but all of the metal oxides I ordered to tint the glass were still in the mail. Mike could help with all the metal oxides I needed except for the silver nitrate. I called around- got in touch with some wet plate photographers before I paid about double what I already paid to get the silver nitrate- but I was able to avoid shipping entirely by taking the train. We will be mixing a silver and tin and zinc color that I think will be strange, reactive, and beige, and a smaller, 10 pound amount of a manganese, cobalt purple that could potentially go brownish if kept at annealing temperatures too long. So far, the furnace is heading up to temperature so that by tomorrow, Mike and I can meet in the morning, and we can send it up, so that by the time the colors are mixed, the furnace is at charging temp. I plan to charge all day tomorrow. #residency #glass #color #furnace #nyc

I know Mastodon hates LLM's and AI. So here goes! I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities. The speed at which these parrots can find bugs and be creative enough to exploit them is staggering. I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours. I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them. The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace. I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore. I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure. Please run an LLM over your code base if it's internet facing or something critical, we thank you! Can't wait for the discussions on this!

"An insecure sandbox is not a demonstration of cyberprowess." -Loren Kohnfelder (on Openai's model "escaping containment" and attacking Hugging Face's servers) https://designingsecuresoftware.com/writings/commonplace/