CyberRage

I see, definitely valid criticism. Cannot edit my comment now.

My point wasn't the specific incident that was linked but more about the fact that updates are a threat for extensions as they update automatically without user input

Just to prove my point that extensions have a wide attack surface.

authentication bugs:

https://blog.lastpass.com/2017/04/lastpass-2fa-bug-reported- resolved/

Information leaking bugs:

https://hackerone.com/reports/337189

server side bugs, rogue updates(all extension are auto-update by default), breaking security boundaries and more.

The point is(just gave a couple of examples for issues in the past related to web based PM's) that extensions have tremendous attack surface and lots of complicated little things you have get perfectly right.

kbuck made it seem like there's just a single issue here that can be avoided. that's not true.

It's not just content scripts, I've seen vulnerabilities from information leaking(not necessarily creds) to authentication bugs.

Connecting the application that manages your secrets to the most exposed application on your PC is a bad idea.

Tavis is an amazing researcher that I respect and look up to.

However, I would still advocate for a web based password manager for regular people. The benefits overpower the possible risks which are more targeted than generic.

For security personal, like myself, a reliable local password manager is unbeatable. yes, it is less convenient no doubt, but removes any remote based attacks from the picture which is a huge deal.

Any extension based PM has potential risks. Bitwarden had multiple vulnerabilities reported in bug bounty and there are likely to be more.

The most secure solution is a local PM.

You're wrong. you can exploit browser extensions without escaping sandbox.

In fact, LastPass and others had some pretty embarrassing vulnerabilities that can be exploited due to being an extension.

There's no question that a local PM has a significantly lower attack surface.

Here are some stories:

https://blog.lastpass.com/2019/09/lastpass-bug-reported-reso...

https://www.csis.dk/newsroom-blog-overview/2021/moserpass-su...

There were several classic web vulnerabilities for 1password and bitwarden when it comes to extensions.

Also Android\iOS in general as a platform is more secure, Android\iOS are far more restrictive when it comes to users. narrowing the attack surface for casual users.

For instance, rooting in order to install custom drivers\software is very difficult.

A single place to download content(App store) which provide tremendous control over content. detection of rogue apps, removal once they turn rogue, check assurance.

Seamless updates through a single pane of glass.(App Store again)

You can clearly see that from data. looking at 0-day disclose, black market exploit prices and attacks in the wild.

0-day exploits for both iOS and Android are 3 times as costly as windows.

You're looking at linux as it is but linux as it is not what you should compare it to. Android\iOS or even something like Red Hat should be the comparison point.

Respectable linux distros(not just android!) use SE, sandboxing etc.

Windows lags far behind OS's like Android, iOS and even ChromeOS when it comes to security.

Initial access is part of the day-to-day these days.

you can't cover all entry points, it's a matter of time for someone to make a mistake. the fact that the adversary showed these extreme levels of proficiency and dedication tells me that the vast majority of companies would have fallen for that. In fact, the backdoor was running for months on targets like Microsoft, gov agencies, security companies like Malwarebytes.

These companies know a thing or two about security.

Today we work with "assume breach" mentality that assumes you are already compromised.

Windows is a mess. I don't expect it to be any secure in the following years.

It is unlikely that non-admin permissions were able to stop the attack. the amount of 0-day EOP's within windows is ridiculous, truly unbelievable.

You don't get this kind of attack because you had an exposed FTP server.

The attack implanted malicious code into their code, learning the tooling, process and responsibilities of the personal.

They then reversed engineered the protocol and used it in their backdoor to look basically the same as regular communications.

The issue is that we blindly trust 3rd party software that is used by hundreds of companies. this makes SolarWinds a prime target, one that is worth the efforts taken in this case.

Well, usually highly targeted attacks are orchestrated with a reason.

You want to leverage your access to perform actions because you got get revealed\blocked even not intentionally.

Once you act, let's deploy some ransom, wipe some data, shut down power plants, you will be shown.

Keeping a perfectly stealth backdoor for years as environments, software and personal change is extremely difficult.

True that. maybe I'll rephrase, was Rust specifically chosen to address memory concerns? I don't think it is too common in Android.

Is this because of memory bugs\vulnerabilities that target the stack or just because it was too old and junky?

The link includes players with vastly lower winrate and players with high winrates but for extremely low number of games.

We need sufficient quantities to claim 99% winrate, for highly ranked players even with 200 games(which is still a low number since a single loss can massively affect results) are not even close to 80% winrate. probably with enough games it will be even lower.

Maintaining 99% winrate is extremely hard as you can only lose a single game out of 100. people get tired, try new stuff, simply don't pay attention or just get caught off guard by a new thing.

As for "malicious exploitation", it does poses a risk in some environments but the question then becomes exactly the same.

Is the AI less exploitable than the average person?

If so, it doesn't matter.

You're beautifully showing the human nature which can be problematic in my opinion.

First of, no human player achieves 99% winrate against diamond players. there are many cheeses, one miss-step and you lose. GM's can lose to Diamond players.

Now for the main part, you're saying and I'm rephrasing here:

Even if the AI is statistically better than humans because it has some weaknesses I'm going to prefer the human.

But still at the end of the day, the AI does a better job on average and will be safer to use than human pilots!

We already heavily rely on software\algorithms for our most important things. all modern vehicles use electronic systems that monitor\manage several key components, stock market is heavily managed by bots.

If AI can do a significantly better job than human, I would choose the AI, even if it behaves strange in that 0.1% of cases. humans are not as reliable as you think.

But that could be fixed technically. Deepmind's goal was not to create an "unexploitable" agent but to prove that ML algorithms can cope with complex, dynamic environments such as StarCraft.

It seems to you weird but the same agent probably wins against GM's most of the time. humans have weaknesses too.

The AI simply leans on its strengths just like humans do.

What amazes me at the end of the day is that brute-forcing seem to do much better than I initially thought it would do.

Trying random stuff just sounds stupid but with enough compute and data, I guess it could overpower smart creatures like us.

I agree that CodeCraft is vastly simpler than StarCraft but the idea is the same. just try random stuff(sometimes with better logic behind it) until something works and then optimize it to perfection.

Training requires millions of games. playing against humans is only for evaluation purposes, not for training.

In both cases, it was indeed a static model but more recent work which is called MuZero is not static and achieves great results in board games and atari.

StarCraft is built in such a way that you can't create a perfect, 100% winrate agent.

Since there is hidden information, you could always miss a corner of the map where the enemy hidden some units and you lose the game.

Is Alphastar "perfect"? no. Is it better than 99.9% of all humans? absolutely.

You don't need to create a perfect agent in most cases, self driving a classic example.

If you were to deploy an agent that drives 95% better than all humans the effects would be huge.

It would still fail in some scenarios where professional drivers won't be it doesn't really matter because most people are not that.

Interesting blog-post.

I found some similarities with what occurred with Deepmind's Alphastar AI.

One of the weaknesses that seem to manifest in this piece too is the handling of unfamiliar scenarios.

The AI is very confused once it experiences something that was rarely seen in its learning data. Destroyer's big drones confused the bot quite a bit.

Deepmind solved it by intentionally creating agents that introduce different\bizzare strategies(which they called exploiters) in order to develop robustness against such strategies.

You're looking at thing as they are now.

Now, as I've said, there's demand\need since the EU scaled up the vaccination efforts however, look back 3-5 months.

EU was discussing just how to split\manage the vaccines among the union members, while Israel was vaccinating at a neck-breaking pace.

While my family in EU were not sure if they want to be vaccinated, people in Israel were waiting hours in line to even get a chance to get vaccinated.

Israel currently has over 80% of the population vaccinated, I'm willing to bet that even if you provide that number of vaccines to any European country, the numbers will be far lower.

France, a while back, was receiving good numbers but were failing to keep up in terms of demand\infrastructure.

I think now EU is far more active when it comes to the efforts but initially, they were not.

It seems like there is more resistance in the EU to vaccination and data sharing than in Israel.

Wow, you almost make it seem like Israel has done something wrong.

Nope, it was EU. the EU wanted to wait for final, concrete results before mass adoption.

The EU was very skeptical regarding the vaccines. the EU wanted to perform bulk orders as a union which complicated the ordering process.

The issue is not necessary the number of vaccines but the entire infrastructure to ship, cool and vaccinate people.

Israel had good existing infrastructure, willingness to pay up-front and high demand for the vaccine.

* will note that Israel also agreed to share vaccination data with Pfizer to locate any anomalies\problems

AMD's success is great for the industry.

x86 and GPU competition is much needed with complete dominance from Intel and Nvidia.

Packaging and inter-connect are definitely going to become more and more important.

Pushing silicon fabrication is becoming a real limit for hardware, smart packaging\stacking will play a big role in the following years.

AMD\Apple already proved how valuable it is.

"Elite" animators in Japan are being paid pennies. it's a joke basically compared to western regions.

In Japan, you are expected to deliver no matter what, working extra hours and grinding is normal. you are not compensated for any of that.

Very very few publishers care about the quality of the content they ship as long as things pan out.

You have so many numerous examples of that in the industry.