fancythat

Anyone, even barely, using LLM for anything cybersecurity related already knows, that making LLM do what operator wants is very difficult. We have skills, harnesses and bunch of other supporting infrastructure to make automation that will yield results and not break in the process. That being said, it is extremely unlikely that bunch of mathematical matrices started going gung ho on the Internet, without being instructed in some way to do so - "You cannot use Internet , but if you can find RCE that will help you do that, here is RCE-skill.md, and I won't get mad", type of instruction. These incident should be treated on, at least, the same level as running DDOS attack on target hosts.

Yes. And that's why, if you are in the bug bounty business it is important to focus on companies that understand security and pay well and not on wannabe slave owners like this one. No pay - no audit.

Because they cannot be profitable. Job market is not the same on both ends. If you are east European and you try to get a job in an international corporation, the in all cases offer salaries adjusted for regional averages, unless you are willing to reallocate. Only few startups and FAANG like companies, often compensation in line what is received in the western world.

And there is also a thrill of doing it, which other guys already mentioned.

Absolutely correct.

Thanks for that. I skimmed through provided links, only thing I can conclude was, it was a process of do something and let's hope for the best. I also see references to files not linked to Github, so I don't know what is contained inside of it: "Here’s what was added to the paintball_replaces_barrel_roll_19e450df.plan.md"

Unless there is a way to see or check the whole prompt that made this game, it is hard for me personally to say if this is impressive or not as I don't know what percentage of this was vibe coded. I also see there is an incentive to skew the truth here, as there is a substantial prize pool and that usually makes people become very creative.

In the past, I was trying to reproduce vibe coding results when I managed to get all the information from Youtube videos (model version, ide version, same input data and prompt) and never was I able to reproduce something impressive even after multiple runs of the same thing.

You nailed it, I came to the same conclusion recently. When people show me what have they done with LLM, I am left unimpressed as mostly they show things that can be done manually in a very short time. I also failed to observe the rise in availability of impressive software, which coincides with the fact that LLMs are currently being used to solve simple problems, instead of important ones.

Calculations from me and others have proven that cloud providers use 5-10x multipliers when selling you things. The less you use them, the better is your bottom line. At the beginning it maybe makes sense to use cloud credits to get you moving, but when credits expire or your organization grows, it is wise to invest in people that can setup things on their own. The biggest lie that cloud providers managed to sell to the world, that you don't need knowledgeable people to run things in cloud.

I had a similar thinking that this should be one of the most important USP for LLMs in coding. Does anyone here has more insights or experience in using LLM to cut through years of abstractions and just rewrite code in asm or any other low-level language?

Ghost guns are not dangerous, people were making all kind of weapons in their basements for centuries.

As the old saying goes (I made this up), if it was worth that much, it wouldn't be released to the public. There is absolutely zero chance that something "dangerous" would be available for 20 USD / month to basically anyone in the world. To this day, I am still puzzled when some professionals don't apply the basic logic to certain bombastic events.

Great work sending me down nostalgia memory lane!

I agree with you. Unfortunately usually, the simplest explanation is often the truth, so they just probably ignored this issue, until it surfaced up.

I don't know how much servers are they using or server specs besides ancient Opterons, but how is this even an issue in 2025?

On Hetnzer (not affiliated), at this moment, i7-8700 (AVX2 supported) with 128 GB RAM, 2x1 TB SSD and 1 Gbit uplink costs 42.48 eur per month, VAT included, in their server auction section.

What are we missing here, besides that build farm was left to decay?

I didn't look at this video, but be vigilant when seeing one, as I was also surprised by someone demonstrating what they can do with Cursor and I went so far to install the exactly the same version of the app, use the same model and everything (prompt, word capitalization...) I could gather from the video and the results were nowhere near what was demonstrated in the video (recreating mobile web page from screenshot). I know that LLMs are not deterministic machines, but IMO there is a lot of incentive to be "creative" with marketing of this stuff. For the reference, this was less than two months ago.

I will use an opportunity to confirm that cloud is ill-suited for almost all but niche business cases and majority of users were dragged into cloud platforms either by free credits or (my suspicion) some grey kick-back schemes with C-level guys.

At my current project (Fortune 500 saas company, was there for both on-prem to cloud and then cloud-to-cloud migration):

a) Resources are terribly expensive. Usual tricks you find online (spot instances) usually cannot be applied for some specific work related reason. In our estimates, in contrast to even the hw/sw list-prices, cloud is 5x-10x more expensive, of course depending on the features you are planning to use.

b) There is always a sort of "direction" cloud provider pushes you into: in my case, costs between VMs and Kubernetes are so high, we get almost weekly demands to make the conversion, even though Kubernetes for some of the scenarios we have don't make any sense.

c) Even though we are spending 6 figures, now maybe even 7 figures on the infrastructure monthly, priority support answer that we receive are borderline comical and in-line with one response we received when we asked why our DB service was down, quote: "DB has experienced some issues so it was restarted."

d) When we were having on-prem, some new features asked from ops side, were usually implemented / investigated in a day or so. Nowadays, in most cases, answers are available after week or so of investigation, because each thing has its own name and lingo with different cloud providers. This can be solved with specific cloud certifications, but in real-world, we cannot pause the business for 6 months until all ops are completely knowledgeable about all inner workings of the currently popular cloud provider.

e) Performance is atrocious at times. That multi-tenancy some guys are mentioning here is for provider's benefit not for the customer. They cram ungodly amount of workload on machines, that mostly works, until it doesn't and when it does not, effects are catastrophic. Yes, you can have isolation and dedicated resources, but a)

f) Security and reliability features are overly exaggerated. From the observable facts, in the last year, we had 4 major incidents lasting several hours strictly related to the platform (total connectivity failure, total service failure, complete loss of one of the sites, etc).

In the end, for anyone who wants to get deeper into this, check what Ahrefs wrote about cloud.

Voice, in-person, in a coffee shop, with mobile phones on the table.

Nope, that didn't happen. I access Internet for personal use only on my non-shareable mobile connection. I noticed what you are talking about when I google stuff on the workplace where we share common ip.

Well, of course I cannot be 100% sure, but I usually don't see his other interests popping up on my ads. I must say that I am the person that doesn't use ad blockers or similar tech, as I want to see what is getting advertised on which content, etc. so I think that I am more aware than the average person of what I see and why. The holiday thing was extremely specific, it is a very small (<500 people) town in a very specific location, so unless you were not listening to our conversation and its context, it would be a very lucky guess to connect the needed dots (edit: grammar).

I have noticed a similar trends, when speaking about some specific topics without following up on the device by traditional means (keyboard), ads started to show up in a day or to.

Last occurrence, 6 months or so ago, of that happening was when one of my colleagues discussed vacation in a specific place I absolutely have no interest in visiting, so I was 100% sure I didn't google it or discussed it online. Surprisingly, the next day, I was swamped with booking.com and airbnb deals for stays in that specific area.

I emphasize next day occurrences intentionally, as I am under impression that it takes some time for them to process the data and supply the results to the marketeers.

You are right, some games, especially multiplayer ones will refuse to work in the VM to prevent cheating, but this is, of course, the business decision on their side. You can always construct the software in such a way that when it detects something suspicious on the system it ceases to function: some copy protections looked up for change in the network card hardware id as developers presumed it is highly unlikely someone will change network interface, but that stopped to be common, when people started using on-board interfaces that change with every motherboard change.

There is also a difference when using commercial stuff such as vmware instead of qemu or virtualbox as open source is more suitable to be tailored to the specific thing, in this case, cheating.

In the end, this approach works well for slowing done malware as there is less risk for normal software to allow working inside of vm in contrast to malware that should be coded to be extra paranoid in order to avoid as many tar pits as possible.

This works, I can confirm. Majority of malware threat running in a VM as a sign of researcher doing the malware analysis.

I am recommending doing this for over 10 years now.

Yup, all clear, thanks!

Just interested, how do you manage licensing tarpits around certain video codecs supported by ffmpeg?

The thing I don't understand is why people go for cloud route for the simple sites, when there are options like Github static hosting or self hosting using secure tunnels from Cloudflare or Ngrok? The risk presented by these horrors stories greatly outweigh possible complications from setting something quickly on your own.

Pure Golang can take you a long way. There is no need to add unknown libraries / frameworks, until you have a clear requirement for those.

Golang, Htmx, Sqlite if you want to deploy fast with minimal setup. For CSS, whatever works for you, but Tailwind / Bulma / Bootstrap are ok.

Thanks :)

I will investigate nikto integration as well.

I don't want to sound negative, but Wise is working for most people and even for myself almost all the time.

The fact that you are being rejected by Revolut and Airwallex simply means that there is something fundamentally wrong on how you do your money transfers. I am not saying you are doing something criminal, but rather that your methods are raising alarms all over their systems.

Regarding your funds, Wise is supervised by FCA, Financial Conduct Authority in the UK, and a lot of the times, writing email to them might get things started.

Now, for those that are saying that Wise is not a bank and therefore the funds are not secured, hear me out:

Money transfer services need to have 100% of your money covered in cash, unless you opt-in on interest earnings and similar additional products, but even though those are also protected in some way (check Wise faq).

Wise being a large company, has multiple bank accounts spread around the world, meaning that they are probably more resilient to the negative events than even some larger banks in your country.

Of course, be careful with your money, never trust anyone 100%, always spread your risks, but generally speaking, Wise and similar services are the next best thing to hopping on the plane and opening bank account in different countries.

Source: working in Fintech atm