Posts by Brewster's Angle Grinder 3368 publicly visible posts • joined 23 May 2011
If people refuse, those of us who are willing will have an innate advantage. However I suspect people will quickly learn to game the system and the practice will spread widely, aided by blogs, articles and youtube videos explaining how to do it. Because it's not a "programming language" as we understand it, but a form of search engine optimisation.
You're in a thread full of C and C++ programmers who've programmed these languages for decades without ever needing a GC. Rust seem to have automated that and does it as well as we do, while avoiding the odd mistake that humans inevitably slip in.
(And GCs aren't perfect, either; no solution is.)
"...a belief that alternative languages du jour are magically safe from security bugs because of GC..."
I'm not a Rust programmer. But Rust doesn't use a GC. AIUI, it's just better at statically tracking memory use because it was built in from the start rather than bolted on afterwards. (And that's a general axiom about all security, isn't it? Designed in is more secure than retrofitted.)
"If your actions discriminate against a group but the intention was not discriminatory, is that discrimination?"
Yes - in UK law (and EU law, I think). It's called indirect discrimination. I don't know about the U.S.
It looks to be fishing TOTP credentials. From the linked Krebs' article:
...The customer enters the target’s phone number and name, and OTP Agency will initiate an automated phone call to the target that alerts them about unauthorized activity on their account.The call prompts the target to enter a one-time password generated by their phone’s mobile app, and that code is then relayed back to the scammer’s user panel at the OTP Agency website.
“We call the holder with an automatic calling bot, with a very believable script, they enter the OTP on the phone, and you’ll see it in real time,” OTP Agency explained on their Telegram channel....
It's fairly straightforward to degrade performance to resemble a human. Your bot can then be working on millions of other pages while waiting for the human delay to expire.
We're asking machines to differentiate between humans and machines. And we're at the point where most metrics a machine can measure, another can fake. And it's only going to get worse.
"LLMs will often substitute a false answer if challenged on something they actually get right."
And humans don't do that? If a human being (say a student) is told by an authoritative human they trust (say a professor) that they are wrong, will they stick to their guns or will they scrabble around for another answer? (I wonder if there are human beings now giving up on correct answers because ChatGPT told them differently?)
And conducting "experiments" about the world is goal setting behaviour we want to avoid. ("I need to know how hard my robot body can hit a squidgy human without damaging them. I better run some tests by hitting a few...")
But I agree feedback is a missing element; if something goes wrong, it needs to be remembered for next time. And clearly humans have a much more efficient architecture - give or take the 20+ years it can take for one to reach a usable state.
True. But how intelligent are you? Is there more to you than complex statistics?
And some of the properties AI are missing, we absolutely don't want AIs to have. We don't want self-motivated, self-goal-generating machines which fear for their existence. And we don't want an AI that gets butthurt when you say something "mean".
Where I find sympathy with the argument is that language is an evolving process: i.e. that there is feedback. And that's probably fixable - at the risk AI invent their own language. But more importantly, I buy into the argument that the the context matters. But even there, humans are not good at considering at the wider context; we have very limited horizons - if we're lucky it extends to our friends and families and our colleagues. (And we are having culture wars because we don't want to consider a wider context than our tribe.)
Unlike drugs, this is not stuff that can be grown by third world farmers. They all have serial numbers.
And if you're the US administration, you've succeeded if you reduced access to the technologies. The aim is to slow China so they're never on the cutting edge. So it's a win if restrictions are making it harder, more time consuming, and more expensive to access these technologies.Though I'm sure they'll think about tightening up the restrictions.
"Is there truly a difference between using a buffer overrun or using stolen credentials, when the goal is to gain entry.."
Yes. Because a buffer overflow we can patch. (It equates with a hole in the fence.)
Misauthentication is a harder problem. (It's equates with the guards waving you through the front door because you are the evil twin of Doctor Mike.) That said, I bet 2FA wasn't in play; whether it would have been acceptable is another matter.
Never. At least, to the first part: AI is hear to stay.
We will probably get better at designing secure AI systems (there's nothing about AI that requires it to search private channels the user isn't authorised to read), but I don't think this generation of models will ever eliminate a crafty prompt.
Altman's missing a trick here. AI output should be watermarked by default, but people ought to be able to pay extra to generate watermarked free content. That means businesses can see when you or I send them an AI generated letter, but we won't be able to spot when they've done the same because they can afford to the Altman tax. And your big backers will be so happy it one rule for them and another rule for us!!
My wild guess is the temperature increases would be smaller on Mars: for starters, the average surface temperature is -60 °C (the peak midday temperature at the equator is only 20 °C) and the core looks to be about a quarter of the temperature of earth - and the crust twice as thick. That said, the boiling point of pure water on the surface of Mars is −4.96 °C...
But that's one of the things you've got to test. It's a very, very different environment to what we're used to, with very different behaviours.
Ah, the days of remapping INT 21h to INT 3h, so you could use the 1 byte CCh opcode instead of the 2 bytes CDh 21h. The memory saving was nice. But the real aim was to bugger up everybody trying to live trace it. (Because INT 3h is the debugger break point and, as the op code is shorter, it's hard to remap back.)
Also remember to remap INT 1h (single step) to something tasty, but that's more of an annoyance.
Which probably means all the corporate flaws Agile was pushing back against have now be transplanted to Agile, and that the underlying problem is corporations tend to encourage programming in this way. Maybe a few used the opportunity to reassess the situation and created a better culture.
Preventative measures are hard when you don't know where people will pop up. Many demos were planned; only a few actually happened. And some of them that did happen weren't advertised on publicly visible social media. Police have used dispersal orders, but then they need officers to enforce them. And police have limited resources, which are easily overwhelmed, or exhausted. So, you're in charge, what do you do? Dispersals orders everywhere and the run-down army to enforce them?
----
"at least some of the fashos are already wearing masks and balaclavas"
Technical question. Do we think conventional Facial Recognition has a chance of "seeing through" a balaclava? It's got the eye separation. In the right light, it could probably get the nose and the mouth. So has it got enough facial geography to take an educated guess? (Bonus follow up. Could we train an "AI" to do it?)
"The UK already has an ID system called an NI number. It just refuses to formalise it or make it more secure."
You also have an NHS number. And many of us here have a Unique Taxpayer Reference.
But an ID number can never be secure in and of itself. That number has to be shared, legitimately, with many people. Knowing it doesn't prove or authorise anything - as we proved with credit card numbers. In pre-internet days, commercial institutions could tolerate the losses from such a crude system (as well forcing some of the losses onto customers where they could get away with it). You don't have those options with an ID system. Stopping the losses (i.e. the criminals) is the whole reason for the ID system, otherwise you've added a layer of bureaucracy to the life of ordinary people for no gain.
And these days banks cards have a PIN ,for in person purchases, and 2FA for online purchases. "Making it secure" means introducing a similar infrastructure. The unique number is the least important bit. It's not an ID number, but an ID system.
What are they actually saying here? That they're going to use CPUs instead of GPUs? So instead of racks of highly specialised, densely packed, power efficient GPUs, they're going to use an equivalent number of cores in overspecified general purposes processors - which will be far less densely packed and likely use far more power and cost more?
If so, yes, you could. But fewer people will be able to do it. And you're tying up supercomputers doing AI instead of all the weapons simulations(?), etc... that you built the supercomputers for.
*cough* Liam, *cough* amanfromMars 1 is a bot. *cough* And not even an LLM *cough*
It's a site called collider.com. It rejected desktop Firefox (blocked to the max) but I've just been there in desktop Chrome: 1568 "partners". (I took a screenshot.)
The ones at the top are not pre-checked. But when you scroll far enough down, many are. (That's a fucking dark pattern, right there.)
And, yes, they are flagged as "legitimate interest". CSS suggests I would need to manually uncheck 207 to be able to consent without tracking.
I imagine impartial judges would look through that. You're trying to do an end run around the rules. (You may even find this was two bits of paper. I can't be bothered to dig into it to see.) If the law says you can't constrain a departing employee like this, then you can't constrain a departing employee like this - no matter how you arrange it.
We know the answer because we know it was a faulty AV update and, in that particular situation, disabling the AV was best. The kernel has none of that hindsight. Stopping a random driver would likely leave the machine useless; for example, booting without a working graphics driver, or a hard disk driver. And I have no idea the consequences of losing the "PCI-to-PCI Bridge" or the "High precision event timer", but I bet it's not good.
And the trickle down could make the situation worse: or do real damage. Even in this case, if it wasn't a faulty update but malware, then stopping the driver could allow the malware free run. (And Microsoft would get it in the neck if they disable AV, and opportunistic malware takes advantage of AV being down.) And do we know if CrowdStrike have just one driver, or multiple that interact? Has the system been tested with one down?
Anyway, the correct response to an unknown error is always to stop, do nothing more, and wait for help. If there's any solution, it's that data files need to be registered as part of kernel state so a rollback can be attempted to last known good.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
