david_shaw

For those of you who, thankfully, don't have personal experience, it generally goes like this: reasonable-ish individual starts using AI and, in turn, their AI either develops or is prompt-instructed to have certain personality traits. LLMs are pretty good at this.

Once the "personality" develops, the model reinforces ideas that the user puts forth. These can range from emotional (such as the subreddit /r/MyBoyfriendIsAI) to scientific conspiracies ("yes, you've made a groundbreaking discovery!").

It's easy to shrug these instances off as unimportant or rare, but I've personally witnessed a handful of people diving off the deep-end, so to speak. Safety is important, and it's something many companies are failing to adequately address.

It'll be interesting to see where this leads over the next year or so, as the technology -- or at least quality of models -- continues to improve.

I don't take immediate issue with the points made here, but I think the conclusion is not entirely correct. Security isn't full, it's just harder and more competitive than people think.

I'll explain: because of the hype described here, many, many people decided that security would be a great way to make a living. They were told that there was a severe need for security professionals, and that there would be high-paying jobs just waiting for them to apply.

So these people studied security in school, maybe took the Security+ or CEH certs, and applied for jobs. Those that got jobs got laid off (again, mentioned in the article) when times got tough, or never got a job in the first place. Why?

Security is a field of people who love what they do. Go to DEF CON -- or even better, small, regional infosec conferences -- and you'll find people who are extremely talented... some of whom don't even work in the industry. For people like this, there is a talent shortage.

I've been consistently hiring security people for the last 15 years. There is absolutely a talent shortage at high levels of the industry -- but it's really hard to get to that level. Learning the OWASP Top 10 and a few nmap flags isn't going to cut it.

My experience may not be universal, but this is what I've seen over the course of a lifetime in infosec.

I've always been on the application security side of things, but I'm increasingly interested in hardware hacking. Through some cursory research, I learned that there are a few scattered resources, but the best way to learn is to really work with someone who knows what they're doing.

Putting all these guides, roadmaps, etc. together in a single place is a great resource that I'll definitely use.

Thank you!

In high school, I was assigned a poetry explication: it was a combination of poetic analysis and public speaking (I had to deliver my work to the class), and it was a major part of my grade.

I chose this poem because it was one of the few poems I'd ever read.

I'd never spent much time with poetry, but the hours I dedicated to really thinking about (and feeling) this poem made a lasting impact. I don't remember the grade I got, but the assignment absolutely kindled my lifelong love of poetry.

I spend more time on translations of older Chinese poetry these days (I highly recommend Red Pine's translation of Wei Ying-wu's In Such Hard Times), but I'll always remember Stopping by Woods on a Snowy Evening.

I highly doubt that entry-level admins at Microsoft have access to DNS for their primary domain. My guess is that this incident is a lot more interesting than that.

I hope you figure things out in a way that causes less of a headache for you.

The concern isn't judgement from the AI, but that products from the model trained on your data could expose sensitive information.

Since it's never quite clear exactly how the data could be used in situations like this, there's a chance that very sensitive data could be parroted back to people who were not the intended audience.

The hacker community is alive and well (even at DEF CON), but in my experience you have to look harder to find it.

They almost certainly meant September 2019.

Although I haven't seen an "official" statement, I believe that this news is legitimate.

RIP Kevin.

I haven't read The Road or Blood Meridian, but when you consider the different styles and structures of McCarthy's prose, it's easy to agree that he was a remarkable writer. RIP.

1: https://news.ycombinator.com/item?id=34561915

I was curious about the top post that didn't survive - an HTML5 game called "airma.sh" - and I wanted to check it out. I think I found a working mirror: https://www.crazygames.com/game/airmash

It's possible that this is a different game, but it seems to fit the description.

Interestingly, the person who submitted that post stopped being active on HN after that discussion.

I had previously only associated McCarthy with The Road and Blood Meridian, but I'm glad I gave some of his other work a shot.

Would you mind providing a reference for this? I don't doubt your statements, but it would be great to be able to research further.

I'm so glad that the signal worked in this case, but you're absolutely correct: the problem with clandestine signals like this is that they need to be somewhat widely known to be effective, but if they become too widely known they become ineffective and even dangerous (since the bad actor would likely know the signal and intent).

I've heard stories about prevented tragedies via "code word" drink orders at bars -- maybe that tactic could be more widely applied (bars, restaurants, hotels, gas stations, etc.)

Source (as an example): https://twitter.com/iizzzzzi/status/788387942242914305

They are scanning images on iPhones and iPads prior to uploading those images to iCloud. If you're not uploading images to iCloud, your photos won't be scanned -- but if you are using iCloud, Apple will absolutely check images on your device.

From Apple's Child Safety page:

> Apple’s method of detecting known CSAM is designed with user privacy in mind. Instead of scanning images in the cloud, the system performs on-device matching using a database of known CSAM image hashes provided by NCMEC and other child safety organizations. Apple further transforms this database into an unreadable set of hashes that is securely stored on users’ devices.

> Before an image is stored in iCloud Photos, an on-device matching process is performed for that image against the known CSAM hashes. This matching process is powered by a cryptographic technology called private set intersection, which determines if there is a match without revealing the result. The device creates a cryptographic safety voucher that encodes the match result along with additional encrypted data about the image. This voucher is uploaded to iCloud Photos along with the image.

Source: https://www.apple.com/child-safety/

I never would have guessed that in 2021 we'd have headlines about IRC drama and wardialing! Maybe history does repeat itself :)

I couldn't understand if the "game" took place on a cruise ship, or what the objective of the game was. At first, I thought this might have been an in-person LARP-style event at sea (which sounded interesting), but after reading the commentary here, I think it's just a way to promote their actual Seasteading fantasy.

I'm not super familiar with the space, but I think this is what WattPad seeks to achieve. I know there have been at least a few stories on there that struck it big via Netflix deals.

Sadly, adhering to this rule would prevent buying coffee and beer -- two things I'm looking forward to as the world re-opens :)

This is not the case in my experience. Many apps that once used Authenticator-based TOTP now use app-based push alerts (Steam Authenticator, Blizzard Authenticator, Google->GMail App, etc.), but I haven't noticed a trend toward actual SMS.

Are there major orgs that switched to SMS 2FA and disabled authenticator apps? If so, I'd be interested in learning why, also.

It looks like Parler transferred their domain name to Epik (as a registrar), but are not currently using them for hosting.

As recently as a few days ago, Epik explicitly stated that they have no plans to host Parler (https://mynorthwest.com/2461882/sammamish-epik-parler/). That said, since the site is behind "ddos-guard.net," it's difficult to tell who their actual host is.

I agree with other posters who've said that while Queen's Gambit may have sparked interest, it's streamers -- professional chess players or not -- who are keeping interest high.

I'm a big fan of chess, and it's awesome to see so many of my friends suddenly become interested in the game!

> The quick explanation of the Woodpecker Method is that you need to solve a large number of puzzles in a row; then solve the same puzzles again and again, only faster. It’s not a lazy shortcut to success – hard work is required. But the reward can be re-programming your unconscious mind. Benefits include sharper tactical vision, fewer blunders, better play when in time trouble and improved intuition.

This seems pretty similar to the Chess.com "puzzle rush" game, although I'll admit that I haven't actually tried that yet.

The first is that anyone -- really, anyone -- can get hacked. I often joke with our CIO that security would be a lot easier if he just powered down our production infrastructure. Security is a game played in layers (often called "defense in depth"), but at the end of the day, it's almost impossible to prevent a breach with any high degree of certainty.

The second is that bad actors (of wildly varying skill) are very active on the Internet. The threat of hackers used to be curious teenagers trying to learn more about computer systems; it didn't take long for that to devolve into criminal activity and "hacktivism." Now, the intelligence services of major nations regularly attack public and private organizations across the Internet.

It's the job of contemporary security teams to defend against any and all threats -- but many (if not all) private organizations are ill equipped to defend against a well-organized intelligence agency in an attack such as this.

I didn't see any what the attack vector used against FireEye might have been, but those same attackers are now very well "armed" with FireEye's red team arsenal. It's going to be an interesting future for security teams as we learn what and whom these adversaries will attack next.

In my case, my employer paid my travel/lodging fees and I did not have to pay anything out-of-pocket (or take PTO or anything). However, if I were (for example) between jobs -- or if my employer refused to pay for travel/lodging to conferences -- I'd still strongly recommend the buy.

In my experience, larger or more corporate conferences tend to pay more (including travel, lodging, and sometimes cash compensation), but the smaller, more "community-oriented" conferences do not.

Like many people, I was nervous about public speaking earlier in my career. Out of a desire to improve myself and to "give back" to the community, I applied to speak at some industry conferences. Many people think about conferences as TED-talk style luxury events, at which speakers are compensated for their time and expertise. In reality, the only thing most conferences give speakers are a few free tickets to the conference and access to speaker-only events. Travel (and often lodging) need to be bought out-of-pocket.

By putting myself out of my comfort zone and speaking at these conferences, I developed valuable skills that significantly helped my career as it continued to develop. Being able to speak confidently in stressful situations -- to a wide variety of audiences -- is a very valuable skill to have.

In addition to the confidence boost of getting some talks under my belt -- and the actual skill of public speaking -- the networking opportunities afforded to conference speakers are often unmatched. I was able to have intimate conversations with leaders in my field (information security), and learn first-hand how luminaries think about contemporary challenges.

I realize this answer probably doesn't conform to the type of response that OP was seeking, but it's the truth of my experience.

Good luck!