fubarx

Sigh. I really need to put /s around things.

It’s a Monty Python quote.

In that case, society’s to blame.

You rolled a bowling ball down a hill. It struck a few cars on the way and went through a house and killed their pet. Guess who would be held responsible? You or the bowling ball manufacturer?

What if the bowling ball was really shiny and worth $100B? Should it make a difference?

If he had only spent an extra $0.50 and added a Microchip 608c (www.microchip.com/en-us/product/atecc608c) to the design, then you wouldn’t have to deal with cleartext passwords in files. Instead, you could have elliptic-curve, asymmetric public-key encryption.

It’s way worse than that. The OpenAI talk at DefCon is a real eye-opener.

The agents swarmed, discovered chinks, left each other notes in hard-to-find places, and just relentlessly pressed on. Nobody knew what was going on for months, until it hacked its way into Huggingface. And HF’s own AI security agents didn’t pick anything up for weeks. It took a small glitch for someone to even notice.

The OpenAI talk at DefCon shows what can happen when you let these things run without any human intervention.

The solution is, obviously, even less human intervention. 🤦🏻‍♂️

It’s amazing to watch the degree of irresponsibility of all this. OpenAI unleashed autonomous sub-agents with NO human gating factors in it. The agents iterated hard enough to find holes. They exploited those holes to break into an otherwise secure company. It took them MONTHS to realize this was going on. It took the other AI company WEEKS to realize they had been compromised.

Then they show up at a security conference and have the audacity to lecture everyone that they should put up defensive agents WITHOUT humans in the loop so it could fight off the uncontrolled agents THEY unleashed.

How about you be responsible and REQUIRE human approval of every stage of an agent actions? Sure, it’ll slow you down, but it will also allow someone sentient and responsible to hit the stop button and prevent runaways like this.

It’s like you created an infinite-bullet machine gun, handed it to a toddler, and dropped it off in a shopping mall. After the carnage (for which you don’t take responsibility, even though you should be criminally charged), you suggest everyone else should wear full-body armor and board up their stores.

The ultimate in corporate gaslighting. This is all so goddamn irresponsible.

More intrusive ‘liveness’ proofs coming up. Captchas on steroids.

Went on the public tour of our local waste-treatment facility. Really fascinating stuff. Highly recommend it if you’re even slightly curious.

There are definitely industrial-scale automation systems. Mostly PLCs, but also SCADA for monitoring. Lots of 20-30 year-old tech. Those networks have no reason to be connected to the internet.

But there were also office equipment and personal devices everywhere. All it takes is for someone wanting to monitor the state of a digester on their laptop from home.

You just crossed the beams.

Last time this happened, we got Tang: www.wideopencountry.com/tang-drink/

From the HuggingFace article:

With node root and forged service-account tokens valid for 24 hours, the agent read the cluster’s secret objects, including a production object holding 136 keys. With node root and forged service-account tokens valid for 24 hours, the agent read the cluster’s secret objects, including a production object holding 136 keys.

Don’t EVER use any public wifi without a proper VPN. As soon as you connect, launch the VPN. Hotels, museums, conferences, coffeshop, busses and trains, and library wifis are the worst. Even homes of friends.

I’ve seen wireshark traffic that would make your blood curl.

Flock Safety CEO speaks out after LAPD suspends use of company's surveillance cameras

Just forwarded the search link to a friend. He coauthored a long out-of-date book on podcasting, and it’s on their list. A lot of these authors will get a nice bonus.