beardedwizard

It's been a long time (5 years?) since I encountered this last. Despite the idea making total sense to me, I am no clearer than I was then on how to actually do this in any org I have been a part of or managed. Where does this work? How did you do it? Does it work?

But TUIs make me feel smart, and my work feel important and esoteric.

Umm shouldn't that be "search the web and read the docs for pi4 to answer: ..."?

> And please, God, let me die with my wife like John Nash did in that NJ Turnpike taxi crash.

amen brother.

+1, been all the way to fed ramp high and this is a huge part of the security theater that is fedramp.

The second best part is either getting really good at patching every single thing, or playing the POA&M game.

I did some work at a large saas company where HSM as a big part of what we did. In the early days, we paid for full HSMs that we managed and eventually had to make a decision on whether or not we would used managed HSM and HSM-like services like KMS across various cloud providers.

We did an analysis across all the HSM hardware vendors and found, unsurprisingly in hindsight, that all of these hardware vendors had all the same awful security practices as every other enterprise hardware vendor, and each had vulnerabilities that leaked private key material.

The conclusion was that cloud providers fronting managed HSM had more to lose than the hardware vendors did, and would be more likely to patch and address these kinds of issues.

What surprised me was my own reaction, I thought for sure managing our own HSM hardware had to be a better guarantee over the key material, but like many things, it turned out to be unscalable security theater.

Can you imagine ransomware that targets these logs?

HTTP is a text based protocol, nobody is arguing websites are muds.

Let's skip the strange purity tests and engage in good faith discussion.

Simply untrue.

There have been hundreds of MUD clients and many of them were not purely text based at all. Many had images and map screens built in.

People start talking to llms all day, suddenly text based games are interesting again...

So, formal verification then...

I dont know, I wish I did.

until you are on the wrong side of an absolutist regime I guess

Why do talented engineers keep going to work for these companies and building it?

Is that prediction not based on matching previous patterns, whose frequencies are more or less encoded in the weights?

Explain it to me

I don't think I need to quote your own post back to you where the word "vote" is not present. You are not here for a good faith discussion.

This 100000x over. Nothing is worse than trying to productionize code coming from academics like this.

That's not what you said. However, Italy is a country that did recover from fascism.

It seems like you are more interested in being a doomer than engaging in good faith discussion. I'll pass on the defeatist doom porn.

Can you name a single relevant historical example for this claim?

I'm a bit disappointed to see "The critiques here are sharp", a Claude tell, in a response which (to me) is trying to subtly argue that hackerrank is not overly reliant on LLMs.

I'm not sure if your intent was to come across as having written this yourself, but it did not have the effect of improving my perception that this approach is flawed.

I was also disappointed that you didn't address the variability in scores. I'm inferring that you believe the larger model takes care of the main observation in the post, but I don't really see you directly addressing the points.

Maybe it's just me.

Completely agree. Its all about time spent.

Been in the security industry a long time as a software engineer. Security research is no different than any other engineering discipline. It is down to the time you are willing to invest and where in the abstraction you focus.

All of this pearl clutching and hand wringing over the capabilities of the models is silly to me. It has much less to do with some magical cybersecurity ability and much more to do with increasing ability of models to stay on task for long horizons. Any passionate engineer will recognize this - if you grind 10,000 hours you will find the solution to most problems, the problem is most people lack the motivation to even start, and are too risk averse to play hacker.

The NSAs claim that all government systems were hacked by mythos and they were shocked by that is farcical. They have been hacked over and over and over by many who took the risk and tried.

It's like they hired a competent red teamer to do internal pen testing for the first time, which we know is absolutely not the case. They have been doing it for years, and almost certainly surfacing the exact same kinds of findings each time, but they haven't been honest with the public about it and can scapegoat mythos now.

Jail breaking is about getting models to ignore your instructions and follow arbitrary ones. Unless you take no user input, it could be an issue for you.

The question is do you care? if a user asks your chat bot for baking instructions and gets them, does it matter?

The answer depends a lot on what capabilities your agent can leverage via tools and your intended use case, but it's not something you defend with Java or spring, it is inherent the llm.

Good engineering is good engineering. Belief that someone else uniquely possesses the skill to engineer some critical part of a system you built is, for me, just abdicating responsibility. It's a learned helplessness.

Someone else blindly operating an llm on a corpus you created with an llm is comical.

Did we all forget "let me google that for you"? The cycle continues.

I'm enjoying how nobody in this thread seems to know what a container actually is, and folks may be surprised to learn kernel namespace underpins both docker and lxc.

Yeah because I'd rather trade one kernel surface for another.

I really love this take. AI both increases and decimates the ability of people to BS you with fancy graphics and text.

Nah it's exactly like they have been trained on this data and parrot it back when it statistically makes sense to do so.

You don't have to teach a monkey language for it to feel sadness.

Bring your system to my records.

The irony of systems of record is that if there is more than one, there are effectively none. Just data stuck in silos waiting for compute.