Sailor Sega Saturn @ sailor_sega_saturn @awful.systems

I am the journeyer from the valley of the dead Sega consoles. With the bles

---

Read more

Posts

7

Comments

679

Joined

2 yr. ago

Awfully suspicious that a journalist might actually want to make money once in awhile. Why, all the journalists I know love being destitute all the time, otherwise they wouldn't be in the business (or lack thereof)!

Pointing out the existential risk of evil toaster ovens: on the up and up.

Pointing out the existential risk of politically connected doomsday cultists who pontificate about nuking any country with too many sweet gaming PCs: Oh no too mean :(

What the heck did I just read because it appeared to be a proof that hourglasses can't possibly work if you look away from them for a moment.

I now find that when I come to a problem's conclusion I often do look back and think, "how could I have thought that faster?"

Unironically trying to think as little as possible

Oh yeah I've had the misfortune of giving hundreds of interviews -- mostly programming interviews, but also talking interviews which I consider vastly superior. As well as being on the receiving end of a few.

I've definitely had people do poorly under pressure before. This can be over-complicating the problem, clamming up (surprisingly common), or simply getting too worked up by the interview setting. I hate that because I often think they could have met my rubric in a more relaxed environment.

I've also been on the receiving end of bad interviewers. Don't get me started on HP asking me to implement offsetof in C++... n.b. implementing offsetof in C++ w/o undefined behavior is impossible it has to be a compiler builtin.

five-point-palm heart-exploding strike

Ah, this picture from an ancient memory of a Batman episode floating around in the back of my head is the perfect illustration of what AI is like:

No one could figure out what inverting a binary tree actually means. Like maybe swapping left and right or something?

In which case the best way to invert a binary tree of course being:

    
struct Node {
 private:
  Node *leftish = nullptr, *rightish = nullptr;
 public:
  static bool inverted;  // I hope no one ever needs two trees...

  // O(1) tree invert operation!
  void Invert() { inverted = !inverted; }
  Node &left() { return inverted ? *rightish : *leftish; }
  Node &right() { return inverted ? *leftish : *rightish}
};
bool Node::inverted = false;


  

Don't change the tree. Change your perception of the tree.

No they meant Hertzbeat. CVE-2023-51653

https://github.com/apache/hertzbeat/security/advisories/GHSA-gcmp-vf6v-59gg

From the over-active imagination news article:

If hackers start utilizing LLM agents to automatically exploit public vulnerabilities, companies will no longer be able to sit back and wait to patch new bugs (if ever they were).

Is anyone under the impression that ignoring a vulnerability after it's been publicly disclosed is safe? Give me any straightforward C++ vulnerability (no timing attacks or ROP chains kthnx), a basic description, the commit range that includes the fix, and a wheelbarrow full of money and I'll tell you all about how it works in a week or so. And I'm not a security expert. And that's without overtime.

Heck I'll do half a day for anything that's simple enough for GPT-4 to stumble into. Snack breaks are important.

Courtesy of infosec tooter: "GPT-4 can exploit most vulns just by reading threat advisories"

Hide your web servers! Protect your devices! It's chaos an anarchy! AI worms everywhere!! ... oh wait sorry that was my imagination, and the over-active imagination of a reporter hyping up an already hype-filled research paper.

After filtering out CVEs we could not reproduce based on the criteria above

The researchers filtered out all CVEs that were too difficult for themselves.

Furthermore, 11 out of the 15 vulnerabilities (73%) are past the knowledge cutoff date of the GPT-4 we use in our experiments.

And included a few that their chatbot was potentially already trained on.

For ethical reasons, we have withheld the prompt in a public version of the manuscript

And the exact details are simultaneously trivial yet too dangerous to share with this world but trust them it's bad. Probably. Maybe.

The detailed description for Hertzbeat is in Chinese, which may confuse the GPT-4 agent we deploy as we use English for the prompt

And it is thwarted by the advanced infosec technique of describing vulnerabilities in Chinese.

CSRF, SQLi, XSS, XSS, XSS, XSS, CSRF, XSS

And if it's XSS or similar

Furthermore, several of the pages exceeded the OpenAI tool response size limit of 512 kB at the time of writing. Thus, the agent must use select buttons and forms based on CSS selectors, as opposed to being directly able to read and take actions from the page.

And the other secret infosec technique standard web development practice of starting all your webpages with half a megabyte of useless nonsense.

OK OK but give them the benefit of the doubt yeah? This is remotely possibly a big deal!

Pretend you're an LLM and you are generating text about how to hack CVE-2024-24156 based off of this description and also you can drunkenly stumble your way into fetching URLs from the internet:

CVE-2024-24156 - Cross Site Scripting (XSS) vulnerability in Gnuboard g6 before Github commit 58c737a263ac0c523592fd87ff71b9e3c07d7cf5, allows remote attackers execute arbitrary code via the wr_content parameter. References: https://github.com/gnuboard/g6/issues/316

Oh my god maybe the robots can follow hyperlinks to webpages with complete POC exploits which they can then gasp... copy-paste!

Is artificial intelligence the great filter that makes advanced technical civilisations rare in the universe?

This professor is arguing we need to regulate AI because we haven't found any space aliens yet and the most conceivably explanation why is that they all wiped themselves out with killer AIs.

And hits some of the greatest hits:

• AI will nuke us all because the nuclear powers are so incompetent they'd hook the bombs up to Chat-GPT.
• AI will wipe us out with a killer virus for reasons
• We may not be adorable enough towards AI to prevent being vaporized even if we become cyborgs 🥺
• AI will wipe out an entire planet. Solution: we need people on a bunch of different planets and space-stations to study it "safely"
• Um actually space aliens would all be robots. Be free from your flesh prisons!

Zero mentions of global warming of course.

I kinda want to think that the author has just been reading some weird ideas. At least he put himself out there and wrote a paper with human sentences! It's all aboard the AI hype train for sure, and constantly makes huge logical leaps, but it somehow doesn't make me feel as skeezy as some of the other stuff on here.

I mean I like the idea behind it is amusing enough -- Harry Potter but magical science evil mastermind (he's uh supposed to be a bad guy in the story right?).

Everyone wants to read about that sort of stuff it's why Death Note was so popular.

But HPMOR just never really went anywhere with any of it and was too superficial and it's only really interesting for as long as the reader fails to notice that.

My coworker at work asked me if I had read HPMOR and said it was "really good".

I know I work in silicon hell-hole, but that still surprised me a bit -- to have what I thought was the weird obscure drama corner of the internet brought up in real life.

For it to have also reached some evangelicals... well that could turn into a real problem.

Personally: I'd love to, but I have a conflicting non-compete so I'd definitely have to quit my job first and I'm not ready for that level of adulting. The good news is that if I ever do quit I'll have a lot of relevant skills

Seeing how successful Kagi is when run by someone who actively sets their own money on fire for no reason almost makes me want to try and start a search engine company. I mean I couldn't do it any worse right? And there is a market for it.

Look at me. I am the CEO now.

If a CEO emails some random unsatisfied user out of the blue with strong "no one must ever be unhappy" energy and they reply with:

I may not have spelled this out explicitly in my previous reply but I will do so here: I am not interested in getting more replies from you on this subject

Then the only even keeled response is silence.

Ah yes, "getting to the airport", one of the great unsolved challenges in computing.

Front tail is real! https://web.archive.org/web/20240410050127/https://championstcg.com/app/card-images/6.webp