The_Decryptor

“Finding” is also rather generous, going by numbers from Anthropic and from the Linux kernel, things like Mythos are wrong 95% of the time.

They’re much easier to run though, compared to more reliable tools. So even being wrong 95% of the time wins out if you’ve got 100x more people running them.

That street goes both ways, there’s more GPLed code in the training corpus than there is leaked proprietary code.

There’s probably flaws that would allow executing attacker supplied code, but it’s not like BIOSs had any notion of security (i.e. secure boot) to begin with, so you could just straight up have the system boot into your own image anyway.

Nah, PXE predates UEFI by like 20 years, it’s been a pretty normal feature since the late 80s.

Depends on how you handle the OOM error though, aborting the process is fine while “try to recover and continue” is the problem.

Well, they’re called “zero days” for a reason.

As nice as DANE is, it just shifts the burden of trust to your DNS provider. Like if you hop on Wi-Fi at a coffee shop, said network can simply MITM connections and supply their own certs via re-writing the DNS.

You can encrypt DNS to prevent that, but now you need a way to ensure your DNS client already trusts the desired DNS server, etc.

As much as people dislike CAs, they’re a proven solution to a problem that’s already implemented in nearly every device on the planet.

deleted by creator

Pope Leo has a bachelors of science in mathematics, they’ll never be able to convince him that matrix multiplication is alive.

If one day clang of gcc ships with a local LLM to lint code for security problems I would probably run it occasionally even on my hobby code despite being an AI hater.

Compilers already have deterministic linters built in, devs often turn them off anyway.

Quite a lot of the bugs being found in existing codebases show up as soon as you re-enable them.

And it’s also not like the hardware is improving much either, we’ve effectively hit the wall performance wise with processors and RAM.

That’s literally what all these datacenters are for, we can’t scale the individual computer performance up, so instead we build more and more of them.

The LLMs are wicked fast at reviewing code

That’s because it’s not actually reviewing the code, rather just producing text that statistically looks like review comments.

So it does look vaguely useful, e.g. if code has null checks, review comments usually won’t ask for them to be added, but it’s never actually reviewing, or understanding, or reasoning, or anything else people claim.

It’s like an actor playing a doctor in a TV show, they’re not actually diagnosing patients, they’re just following a script that looks like it.

“Prompting” isn’t a skill, that’s just asking for what you want. Same way as asking a barista for a drink doesn’t require the same level of skill as making it.

But in general yes that’s how arguments and decision-making works, for any law. These things aren’t mathematical proofs interpreted by computers, they’re people you convince of your point.

Ehh, it seems pretty targeted to me, it’s defined to only apply to automatic apps or services, e.g. it specifically exempts manually created images.

Bans X from allowing grok to make naked pictures of celebrities but doesn’t apply to people using photoshop to do the same.

you could probably rig up a steampunk sun-following mirror positioning system by just using a shitload of math and astronomical data to pre-program a daily turning system for each individual mirror

I’ve got great news.

Secure boot does have a revocation mechanism (It’s literally how this issue has been mitigated) though.

You can not only load in allowed signatures, you can also load in disallowed ones so even properly signed binaries will get rejected.

Starlink the worlds fastest growing ISP, while having an enormous profit margin is the bread and butter.

Starlink has only had one profitable year ($70m total), and that’s only if you exclude the cost of rocket launches and only count selling end user hardware and subscriptions.

From other articles I’ve seen (Here’s an example) it was telemetry and cross referencing the IPs used.

VPNs might help hide from passive identification, but they don’t help when you connect to the same service on your normal and private connections alternatively. The computer equivalent of using both your real name and an alias with the same person, they’ll know who you are.

Could be using Edge (Account syncing), or using Bing while signed in (Considering they were signing into private accounts while on the VPN, seems possible)

OEM systems come with the license key stored in the firmware (ACPI tables specifically), you can read them from *nix easily enough.

sudo strings /sys/firmware/acpi/tables/MSDM

If you boot the system and login an account then yeah they’ll be able to link that, but the install itself can “self activate”.