Phil Ames @philames

Tailscale shipped netcat over their data plane with no control plane and no account. WireGuard plus DERP for rendezvous, gVisor netstack, userspace so no root needed. Pipe stdin, forward ports, run an auth-free SSH server. The README is almost entirely commands. github.com/tailscale/tail…

WarGames came out in 1983. The entire plot is basically Give an AI a game. Give it access to production. Forget about containment. Be surprised when it keeps optimizing. Forty three years later we’re still rediscovering why segmentation matters.

GOOGLE BUILT A SECRET WEAPON FOR FILE DETECTION they ran it internally for years, gmail, drive, safe browsing, hundreds of billions of files every week then they open sourced it it's called magika and it exposes what files really are, not what they pretend to be rename malware to "resume.pdf"? magika sees through it disguise a script as an image? magika sees through it any trick attackers use with file extensions? magika sees through all of it ai trained on 100 million files. 200+ content types. 99% accuracy. 5ms per file one command `pip install magika` the same tool protecting google's billion users is now protecting yours github.com/google/magika

You can spend tokens for a model to reason through a program's state space, or use a fraction of those tokens having it generate a tool such as a fuzzer that brute forces the same state space on a CPU at significantly lower cost. This tradeoff is what the Agentic Sufficiency Curve formalizes. You need precise inference up front but only cheap CPU to drive the long tail: secure.dev/gpu_cpu_suffic… For certain kinds of vulnerability research I think this was the right approach, at least up until Fall 2025. But frontier models have continued to consume that capability and now I'm not so sure the cost tradeoff is worth it. Other domains are likely still under the curve and benefit more from models generating deterministic automation that runs on cheap CPU, than just spending more tokens. Just another anecdotal data point that the frontier will continue to remain jagged.

chrisrohlf @chrisrohlf

6 months ago

This is an excellent paper from the folks at @AISecurityInst and worth reading. I will have to read it again but this particular point is a good one and I think the takeaway is important. Cyber attack chains across a set of enterprise systems (simulated or real) have a finite

1 12 59 17K 58

THE BIG REGRESSION My folks are in town visiting us for a couple months so we rented them a house nearby. It’s new construction. No one has lived in it yet. It’s amped up with state of the art systems. The ones with touchscreens of various sizes, IoT appliances, and interfaces that try too hard. And it’s terrible. What a regression. The lights are powered by Control4. And require a demo to understand how to use the switches, understand which ones control what, and to be sure not to hit THAT ONE because it’ll turn off all the lights in the house when you didn’t mean to. Worse. The TV is the latest Samsung which has a baffling UI just to watch CNN. My parents aren’t idiots, but definitely feel like they’re missing something obvious. They aren’t — TVs have simply gotten worse. You don’t turn them on anymore, you boot them up. The Miele dishwasher is hidden flush with the counters. That part is fine, but here’s what isn’t: It wouldn’t even operate the first time without connecting it to an app. This meant another call to the house manager to have them install an app they didn’t know they needed either. An app to clean some peanut butter off a plate? For serious? Worse. Thermostats... Nest would have been an upgrade, but these other propriety ones from some other company trying to be nest-like are baffling. Round touchscreens that take you into a dark labyrinth of options just to be sure it’s set at 68. Or is it 68 now? Or is that what we want it at, but it’s at 72? Wait... What? Which number is this? Worse. The alarm system is essentially a 10” iPad bolted to the wall that has the fucking weather forecast on it. And it’s bright! I’m sure there’s a way to turn that off, but then the screen would be so barren that it would be filled with the news instead. Why can’t the alarm panel just be an alarm panel? Worse. And the lag. Lag everywhere. Everything feels a beat or two behind. Everything. Lag is the giveaway that the system is working too hard for too little. Real-time must be the hardest problem. Now look... I’m no luddite. But this experience is close to conversion therapy. Tech can make things better, but I simply can’t see in these cases. I’ve heard the pitches too — you can set up scenes and one button can change EVERYTHING. Not buying it. It actually feels primitive, like we haven’t figured out how to make things easy yet. That some breakthrough will eventually come when you can simply knock a switch up or down and it’ll all makes sense. But that's at least 20 years down the road. It’s really the contrast that makes it alarming. We just got back from a vacation in Montana. Rented a house there. They did have a fancy TV — seems those can’t be avoided these days — but everything else was old school and clear. Physical up/down light switches in the right places. Appliances without the internet. Buttons with depth and physically-confirmed state change rather than surfaces that don’t obviously register your choice. More traditional round rotating Honeywell thermostats that are just clear and obvious. No tours, no instructions, no questions, no fearing you’re going to do something wrong, no wondering how something works. Useful and universally clear. That’s human, that’s modern.

Go's silent integer overflows hide bugs from fuzzers. go-panikint modifies the Go compiler to panic on arithmetic overflows, exposing vulnerabilities that wrap around undetected.

Did you know? GDB has a built in graphic interface, called TUI. Commands: - Turn on: `tui enable` - Cycle through windows: `layout next` - Redirect target stdio/stderr to a log file to prevent curses UI breakage (or `refresh`) (Showing @alisaesage's screen)

I WANT A PHYSICAL FUCKING MENU AT A RESTAURANT. NONE OF THIS QR CODE BULLSHIT

💞 @LowkeyEnergy_

11 months ago

What’s the most boomer complaint you have?

440 77 953 24.3M 503

🔺iPhone models announced today include Memory Integrity Enforcement, the culmination of an unprecedented design and engineering effort that we believe represents the most significant upgrade to memory safety in the history of consumer operating systems. security.apple.com/blog/memory-in…

@lcamtuf

Fun. @Atlassian jams some AI enabled app called Rovo into orgs you create. It can't be removed, and you can't delete the org as long as there are active apps in it, leading to no way to delete the org.

A friend of mine (@gynvael) is organizing a course about reversing binary files and protocols: hackarcana.com/workshop-sessi… recommendation++

A lot of people don’t know this, but any platform Chrome runs on *except iOS* has a fully featured Bluetooth scanner that allows viewing, connecting, and read/writing GATT attributes. Go have some fun. You already have the tools chrome://bluetooth-internals

@troyhunt Did the spider ask if you had a bug bounty program?

@paradoxengine If you order it to be secure it is, QED

Nice overview of webauthn by @agl__ : imperialviolet.org/tourofwebauthn…

The lack of end-to-end encryption through the telco infra *is* the vulnerability. We improved Internet infra security by largely de-privileging the intermediate hops through widespread use of TLS. Now attackers go for VPN boxes because that's where traffic exists in plaintext.

FCC @FCC

2 years ago

We are taking decisive steps to address vulnerabilities in telecommunications networks following the Salt Typhoon cyberattack.

keyboard_arrow_left Previous keyboard_arrow_right Next

24 105 196 41K 51

Ok so someone MUST have already made a @ClassActionPark map for @ParkitectGame right? I don't have to do this myself, do I?

Heads up: Microsoft Office, like many companies in recent months, has slyly turned on an “opt-out” feature that scrapes your Word and Excel documents to train its internal AI systems. This setting is turned on by default, and you have to manually uncheck a box in order to opt out. If you are a writer who uses MS Word to write any proprietary content (blog posts, novels, or any work you intend to protect with copyright and/or sell), you’re going to want to turn this feature off immediately.

You can't make this stuff up.