jdefr89

You can still exploit a system and easily prove it via simply popping a shell or calc.exe or updating a database with a new entry, etc… They didn’t have to let it loose on the network. If that system was air gapped - problem solved.

Security Researcher here. While you’re correct that air gaps aren’t a totally secure mechanism to rely on, they sure as hell can raise the bar for realistic exploitation. You pretty much need to rely on tricking someone into running your exploit or something of that nature. That said, they could have completely avoided this problem with an air gap. Simply don’t provide it network access. That isn’t too hard to do.

I am at a similar salary. I live in Kendal Square; nearly on MIt campus for convenience and due to the fact I relocated to Cambridge from PA when I took my research pos at MIT lab. I pay 4000k a month for a STUDIO. That includes no utilities or anything. Then add groceries and all that stuff. Then add supporting your significant other and various other things…. trust me it disappears fast. Yes there is some cash left over if you do absolutely nothing but stay in your home… Things get tight. I shouldn’t feel pressure given my salary but sometimes I think if things really went downhill… my salary isn’t leaving me room for a care/worry free life style. Not the way it would have 10 to 15 years ago. Things are too expensive…

Hello Joseph. I am awesome Joseph. I am at MIT LL. Can’t wait to check this out a bit deeper.

A few things here.

1. Use a proper Markdown parser. The grammar is easy to define EBNF style most implementations I see now days use some recursive descent parser, etc… Regex implementation was used in original authors parser when it became popular.

2. You can resolve ambiguities and define more consistent symbols that make sense. Most markdown implementations are decent and follow common sense best practice syntax.

3. The beauty is its simplicity. You can pick it up in a few minutes and utilize it anywhere you damn near see a text box.

4. Parsing to HTML isn’t the only option! I mostly use TUI markdown viewers that render the document via ANSI escape codes beautifully. Check out glow project. But once you parse and have a AST, you can easily walk it and render it in other ways as well. Again though. Everyone can read a text document and a html document. You can render it to a PDF if need be.

5. Do we really need a whole new markup text2<format of some kind>? Markdown is simple fast and widely supported. So I have to say.. I prefer it over most things and that includes Rst.

If you need real beauty and power you can move to LaTeX or something… My two cents anyway.

Sort of hard to do because AI it shoved down your throat in one form or another virtually everywhere you go. I also think a lot of us Hackers are mourning the fact we spent many years mastering machines and programming just to have the skill devalued (at least from the publics perspective) nearly over night. I personally think it is more important now more than ever to understand technology. To be able to write code, understand how a CPU works etc. Tech literacy will help prevent doom scenarios. A future where virtually everyone depends on AI and Computers but lacks people who actually understand them from a low level perspective seems bleak. I know thinking itself seems to have gone out of fashion and its given rise to misinformation and/or political nonsense like the rise of fascism etc... I think a lot of us just feel "empty" and are trying to express it.

Over reliance on LLMs is going to become such a disaster in a way no one would have thought possible. Not sure exactly what, who, when, or where.. Just that having your entire product or repo dependent on a single entity is going to lead to some bad times…

Which one was yours???

That’s what I really gets me. These folks who are “so rich from said technology” always need you to buy their course for $5,000… Likes buddy if you were bringing in so much money you probably wouldn’t be pestering people to take your “course” and you certainly aren’t going to give any info away that have value only because they are obscure or hard to do… They are also almost ALWAYS self proclaimed experts. Oversight everyone because an AI expert. Before ChatGPT they probably had zero AI was a large field and machine learning is one small part of it..

That’s all it came down to with me.. FreeBSD doing WiFi circa 2002 was a remote dream. Shit even Linux you had to use ndiswrapper and it still prob wouldn’t work

I’m 37 and have coded my entire life. I even got to pull the drop out of college and do star up and make money type thing before I took my current position.. I have to say AI has sucked the heart and soul out of coding.. Like it’s the most boring thing having to sit and prompt… Not to mention the slop, nonsense hype etc.. Never attach your identity to your job or a skill. Many of us do that just to be humbled when a new advancement occurs… I know I see programming and looking at Open Source code to contribute and all of it…. Is just lifeless. Literally and figuratively. Sorry for long rant I needed to vent.

I am not a graduate but Apple has reached out to me twice in the past month. Many others too so I wouldn’t say it’s absolutely dead but it’s tightened a bit.

No better way to learn System32 folder was essential is Windows than by destroying your family computer by removing it.

Vulnerability Researcher here… Unless your target has a security bounty process or reward; leave them alone. You don’t pentest a company without a contract that specified what you can and can’t test. Although I would personally appreciate and thank a well meaning security researchers efforts most companies don’t. I have reported 0days for companies that HAVE bounties and they still tried to put me in hot water over disclosure.. Not worth the risk these days.

Python and PyTorch all call out to C libraries… I don’t get what he means by “proving LLMs can run without Python and PyTorch” at all. Seems like they don’t understand basic fundamentals about things here…

All because this dude is the ultimate judge for all that is good and worth doing somehow..

Oh.. So you start doing something new and you're top 10% without practicing or being bad at it first? I'd love to test that to see if it's the case... Your logic is "You're not the best ever to do something so you are not doing it" means you have probably never done a single thing your entire life. Maybe you should just stop.

Obviously familiar with Fabrice Bellard and his technical contributions but it seems like he is a pretty private person and he keeps to himself. I don't really know much about him as a person.

As someone who does it for a living the challenge can be in both. However this article is asking its agents to do CTF like challenges which I am sure the respective LLMs have seen millions of so it can essentially regurgitate a large part of the exploit code. This is especially true for the OOB/RW primitive API.

Yea, this entire repo/article seems super misleading to me. Not to mention asking it to generate API for OOB R/W primitives is essentially asking it to regurgitate what exists on thousands of github repos and CTF toolkits.

Most modern kill chains involve chaining together that many bugs... I know because it's my job and its become demoralizing.

Vulnerability Researcher/Reverse Eng here... Aspects about it generating an API for read/write primitives are simply it regurgitating tons of APIs that exist already. Its still cool, but its not like it invented the primitives or any novel technique. Also, this toy JS is similar to binaries you'd find in a CTF. Of course it will be able to solve majority of those. I am curious though.. Latest OpenAI models don't seem to want to generate any real exploit code. Is there a prompt jail break or something being used here?

It is pretty and it can do pretty much exactly what Rust enums do if they learned basic idiomatic Go.. Rust is a cult at this point honestly.

No its because 99% of the time people use enums to give names to magic constants... That is it. Go went for simplicity and const+iota achieves it just fine. People act like enums make or break software itself or something.

What is with people and their need for enums? Functionally using go const with iota gives you the same damn thing and people use enums that way 99% of the time. I find Rusts reliance on enums annoying as hell. At this point I consider Rust a bandwagon language. The syntax is abysmal and we have had memory safe languages far before Rust. That I wont get into because as a Vulnerability Researcher I find the Rust push super misguided and it sets me off.

They don't seem to understand Go much at all. Comparisons to Rust are somewhat misplaced but that's a different topic... Back to errors. Errors are interface values. They are simple yet powerful. You can create sentinel errors that can be wrapped or just passed to be checked then discarded. Go has all the functionality it needs to provide what ever it is Rust cult members believe makes Rust error handling so great. You can use the primitive constructs Go provides to do nearly the same damn things Rust can do and it won't look like a pile of hieroglyphs your local crackhead would draw. Best of all... Its simple and the syntax of Go (veering off topic) doesn't make me want to jump off a bridge. Stop gaslighting yourselves into thinking Rust syntax is reasonable and that its some perfectly proven language with all edge cases put to rest..

Isn't this just fractal page mappings? Am I missing something?

I hold a R&D Position at an MIT lab. I also hold gov clearances for DoD work. They are pretty accepting of the fact that a lot of folks in the field are neurodivergent. No one cares because if you deliver results you deliver results. No one cares about shit under the Trump administration because its an absolute joke that has thus far only stood to get in the way of the way we carry out research. The party of "minimal government" sure as hell loves to tell public established institutions how to carry out their own damn business.

The amount of pressure young kids are under... I am surprised the numbers aren't much higher. I grew up with debilitating OCD/Tourettes. I am glad kids growing up today have more resources than I did. Society itself is sick and broken. If that many kids are having issues.. Maybe the system is the problem here?

Ok.. Let’s ask a different question. Assuming development of super-intelligence is possible.. How do you measure it? What criteria satisfies the “this is super intelligence”? You honestly sound like most pseudo-intellectuals I hear discussing this very topic..: Ironic how you think you’re the brilliant one and it’s others who are stupid… Actually not really ironic a fool doesn’t know he is a fool.