Posts by pfalcon

Boffins devise 'universal backdoor' for image models to cause AI hallucinations

They seem to have forgotten lessons every parent knows...

That is, you only have to fail ONCE when it comes to setting a good example for a child. eg: swear in front of them just once - and they will repeat it back at you and everyone else to your utter embarrassment for all time...

So, AI researchers have forgotten that when gathering training data - the GIGO principle always applies. You can't just say "oh no, its too much data to check manually" and get away with it... It might also stop all of the rampant copyright abuses if they have to start keeping COPIES of their entire training database locally! Or at least make it much easier to track what they *really* used...

I wonder if the poisoning could be used to expose the training data as well? And thus act as proof for anyone trying to sue them for copyright breaches...?

What would sustainable security even look like?

On the expertise and testing side of things, I'd add that the current security Industry is making things worse by encouraging complacency.

I've just gone through the process of getting quotes to perform penetration testing on a product I'm responsible for, and as part of that, to also get the client's office network/infrastructure tested (a third party handles that side of things). The results of getting some quotes has shown some rather disturbing points:

1- Estimates varied by 100% between vendors. Now that means that each has a vastly different idea of the kinds of tests they will perform and the manpower required. Also its plain from the responses that most of the vendors have a semi-automated suite of testing tools that they apply to given situations. Now while I happily admin that to perform a serious round of testing requires they be scripted - surely the KINDs of tests and the areas to explore surely need to be highly customised for the system concerned? At the very least there needs be someone knowedgable guiding those tests - but I don't get that feeling...

2- Testing of Office networks, especially those using Microsoft 365. Sharepoint...etc seem to boil down to performing an audit on the systems and security settings in place, and calculating a "score". Now this sounds well and good as a theory, until you look at the scoring, and find out that its impossible to get even a mediocre score (let alone a "high" score) without basically quadrupling the license fees you pay to Microsoft and others for the upper tier services linked to their online suites. It doesn't focus on the true security elements of an office - like Staff Training/Awareness, or perhaps using best-of-breed systems, as opposed to just giving more money to MS (or that MS reserves "best security" only for those who can afford it!?).

How are you supposed to measure the security of a system when the processes used to measure them are so flawed?

And this is before you get into the actual developer/coding issues and gaps therein, which the article explores.

World's most internetty firm tries life off the net, and it's sillier than it seems

Now if only this didn't clash with corporate cost cutting...

What the article says is reasonable - if IT worked with their clients to actually solve problems, then we'd have both satisfied AND secure customers in our corporate divisions.

The problem is that this is entirely the opposite of what those same companies do when they outsource or otherwise budget for their IT (support) services. The typical outsource support contract is pared down and minimised so much the support people are specifically paid to NOT engage their brains, because that requires a longer support callout (and is thus more expensive).

The Outsourcing firms don't like that either, because if a customer's problem is actually solved, they don't need to call support again (ie: fewer callout charges). Instead they focus their team on solving *symptoms* only - and *never* looking into the actual problem - thus keeping the support calls (and charges) coming as long as possible...

(oh, and the above business model, on both sides, is from personal experience. At least one person was sacked for providing *too much support* because that gave the wrong picture to the firm who was about to buy the helpdesk operation)

Security/support personnel and customers working together also assumes that security knows a LOT about your business, so they can recommend something thats to the point. But of course for that to happen - these same staff need to be long term employees of YOUR company, so they have all that essential in-house knowledge. Kinda hard for an outsourced person at a call centre in another city/state/country to have that knowledge, or the handful of service people who make the in-person appearances (who, as I said earlier, aren't allowed to spend actual time with you because they aren't paid for it)

Wouldn't it be interesting if companies who fall victim to the large scale hacks could sue the executives who (10-20+ years earlier) had begun the cycle of outsourcing and removed any hope of the company withstanding the attack - and as such are directly responsible for the company and its staff being so vulnerable!! Gee, executives making a decision that was focused on something other than the next quarterly return, and taking responsibilty for it...?

Wind power: Even worse than you thought

Wind power: Even worse than you thought

The science fraternity has known for a LONG time that you solve the problem of irregular Wind capacity by having the generators create hydrogen supplies from water using excess electricty generated when it isn't practical to sell back to the grid. In times of low or no wind or when demand is high, the hydrogen is burned used to create electricity.

Wind farms should be using this model to effectively supply the grid n demand instead of simply pumping what it has straight in. Of course, it means a more expensive system up front - but you'd think the pollies and industry would see that its a better fit for the curent system, and ultimately scales better...