thewebguyd

Like OpenAI not realizing that it is their own AI which is attacking HuggingFace

Or, they knew and let it continue because they are not a good company.

"Never attribute to malice.." blah blah, I have a hard time believing the very smart people at OpenAI would just let their off leash model run hands off with no monitoring and not immediately pull the plug when it jumped its containment.

Whoever Anthropic just bought when they doubled their political spending to $40 million just recently for "Pushing for AI safety"

Do Americans even believe that US policy is likely to steer development in a way that’s safe and beneficial for humanity?

No, at least not outside of this forum.

We all mostly think these models and US policy are going to drive the exact opposite of that. Wealth will continue to get extracted and funneled to the top, and the rest of us are going to be left with the scraps and left to die while what little social safety nets we had continue to get eroded away alongside losing our jobs.

Claiming in any shape or form that fable disillation is one of the primary reasons why kimi k3 is so competitive is slandering the work of other labs that cooperatively push the open-source models forward.

They claim it because Anthropic are planning to push for protectionism. They just doubled their political spending to $40 million for the midterms to "push for AI regulation" Gee, I wonder what it is they are lobbying for. Certainly won't be OFAC sanctions right? ICTS import controls?

US GOV, under lobbying pressure from Anthropic and OpenAI are going to go full protectionism and restrict Chinese models, I'd almost be willing to bet money on it. They can't really enforce for individuals, but they can definitely tell US based hpyerscalers they can't host them, make it illegal to host the weights, and government procurement restrictions.

Pretty much everyone is using a password management service

In the US, only about 34 to 36% of adults use a password manager. Of the ~64% that don't, an alarming 20% reuse the same password across almost every service, and a ton just rely on browser autofill.

If you use a password manager, you are in the minority. Hell, even if you don't use a PW manager and you at least use a different password for different services, you are ahead of most people.

The general population is largely computer illiterate, and have a staggering lack of basic security hygiene.

That's self sovereign identity. But you still need someones that can issue those verifiable credentials, and we (as a global society) can't decide who that should be in the web of trust? Our banks? Governments? Schools? Doctors at time of birth?

Arguably, that's the only way forward. SSI is also nice because you get to fully control what you share and don't share (e.g., age verification, you get to only share "I am over 21" and no other information).

Passkeys were (are?) supposed to be just a password replacement though. That services are using them to replace a username AND a password AND 2FA is a problem that's turning the device into your identity, instead of keeping the identity as three parts (What you know, what you have, who you are (biometrics)). Now we've just turned the "something you have" into the entire identity stack.

The user can always be attacked via phishing so long as account recovery methods exist (and they need to exist for obvious reasons). Use passkeys, but so long as you can also log in via password, or SMS code, etc., it's phishable, you can get sim swapped.

Your master password to your cloud PW manager's vault is also phishable (hence why passkeys were ideally device specific, non-exportable).

Its phishing resistant not phishing proof

Right; but THAT idea is consumer hostile by design.

No argument from me there, just stating what the design actually calls for.

It was never meant to be consumer friendly in the first place, it's an enterprise standard. It was just shoehorned onto consumers with the synced credential compromise to make it easier, instead of coming up with something better, and then just calling it a "Passkey" which now has dual meaning.

But the real solve is difficult. If a system requires a consumer user to manage, remember, or safely store something extra, it will fail.

I mean, no one ever said it was a good design.

But the original FIDO2 standard wasn't made with consumers in mind in the first place, it was driven by enterprises that wanted high-assurance security. It works in that environment because, well, a big IT department controls it, can support the employees, and you can mandate and control its use.

It was just sort of haphazardly shoehorned onto general users/consumers, prematurely IMO, via synced credentials as a compromise instead of coming up with something better.

Only one specific device can ever login

That's entirely service dependent, and the standard doesn't mandate "Service must not allow multiple passkeys"

It doesn't limit login to one specific device, therefore it does nothing.

It's not nothing. It provides an attestation that you the user are in physical possession of the device, and have passed the challenge to release the key form the TPM (biometrics, pin, something like a yubikey).

Giving your private key to a cloud password vault makes it phishable again (via an attacker getting acsess to your vault, just like with passwords). The private keys are supposed to be non-exportable, and the cloud password managers defeat that as well.

Multiple pieces of software vying to be your passkey provider,

Which entirely defeats the point of using passkeys. There shouldn't be a passkey provider the "provider" is your device's TPM/secure enclave + your biometric challenge. They are supposed to be mathematically non-exportable, device-bound.

It seems like everyone wants to be _the_ password manager for all your passkeys.

Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vault gets compromised.

Every device is supposed to have its own unique private key, stored in TPM, released only when passing the user challenge (biometrics or pin, or a yubikey).

Passkeys protect against credential theft, not session hijacking, two different parts of the stack. Passkey's only concern is initial authentication, it was never meant to provide any sort of protection against session theft. RFC 9449 Proof of Possession is how you prevent session hijacking, or session binding with a client-side TLS certificate.

Device-bound passkeys take care of non-repudiation. With synced keys (e.g., 1password), an account compromise of your vault hands the attacker all your credentials, the private keys are in the vault.

Device-bound keeps the private key sealed in the TPM (or secure enclave), the key cannot be exported, so it cannot be extracted remotely. Even malware on the machine, can hijack your session, but it cannot exfiltrate your private key, TPM won't release it to the service without user verification via biometrics, yubikey, or a PIN. There's also an attestation chain that breaks with synced passkeys. The attacker has no way to get your private key, so the only way to compromise the account is, yes, session hijacking, or physical access to the device with the user present to pass the biometrics check.

It's this. Microsoft doesn't care what model they use, they sell an integrated office + AI product, model agnostic. They'll offer whatever models they need to continue to sell their product globally.

As much as Copilot sucks, I think Microsoft has the right idea. Model is a dumb pipe, basically an ISP. The actual value is what's built over top of it, and packaged up nicely for an enterprise to buy off the shelf and be immediately useful. I imagine a future where picking an LLM model is no different from choosing who my internet provider at home is. They all do the same thing with varying levels of reliability, customer service, speed, etc.

passkeys are intended to sync via your password manager of choice as the primary use case.

The sync was actually a compromise to the standard. The idea was unique, device-bound credentials. One person, one device. The private key/passkey on your phone should not be the same one on your laptop, or your tablet, etc. Each device was supposed to have it' own unique credential.

Allowing sync is a security downgrade to the standard, in terms of threat-model guarantees. Pure WebAuthn credentials should be sealed in hardware (TPM or Secure Enclave or equivalent) and be mathematically non-exportable which guarantees zero remote blast radius, an attacker must physically posses the device.

Allowing sync and storing passkeys in a password manager reintroduces cloud account compromise risk and recovery flow hijacks. You lose non-repudiation.

Still more secure than passphrase + TOTP, but doesn't eliminate account takeover attacks against your cloud credential vault, which purely hardware based, per-device credentials do.

Because the original FIDO/WebAuthn standard was built for device bound credentials. They imagined unique keypairs tied strictly to a specific piece of hardware. Synced passkeys were a compromise, mostly driven by Apple and Google, because per-device credentials are too much friction for general use. It's not that they failed to understand users, it's that they incorrectly assumed the level of inconvenience people are willing to tolerate to be textbook secure (the answer is almost zero inconvenience).

The device bound model also completely falls apart in the enterprise, fails to address shared devices and shift workers where employees share the same PC under the same OS profile, now you're back to needing good old fashioned SSO w/ physical MFA (Yubikey) to attest who the user is in addition to attesting the device itself.

Before synced passkeys, the actual standard is a unique key pair per device. The key pair on my phone shouldn't be synced to my laptop, my laptop should generate it's own key pair.

the smart consumer panels would also be more expensive if they weren't subsidized via the spyware.

The gaming consoles aren't subsidized via the data collection like smart TVs are via content recognition (selling everything on your screen to advertisers).

Consoles are sometimes sold at a loss, but the revenue model is different. Playstation plus/game pass, a cut of game sales and microtransactions, exclusives, and accessories.

No one should ever connect their TV to the internet. There just isn't any reason to, get access to your streaming apps another way.

There should be no such thing as "too big to fail" in a free, competitive market. Companies must be allowed to fail.

If failure means catastrophe for the nation, it shouldn't have been a private, for-profit project in the first place and instead be a public project.

which is still physically connected to the internet

I mean that's the point. Why was it connected to the internet at all and just firewalled off and not completely airgapped?

This is the rot that's happening in cybersec. Before we even had security teams as a dedicated role, sysadmins mostly handled security, and we would evaluate each CVE and determined if it even was applicable.

Then companies started hiring paper pushers into security roles and discretion no longer mattered, it just became a game of "Check the box" with no regard for what is actually running in prod, or whether you're actually vulnerable.

Same shit with auditors. I deal with PCI and it's a fight to explain why the "compensating controls" work to a non technical auditor. If it doesn't check the box exactly, good luck.

Linux as a desktop was always extremely vulnerable to bad actors.

Most distros people use as a desktop are alarmingly insecure by default,the security model lags well behind macOS and even Windows (again, by default. You can of course do work to harden it).

You lose out on hardware verified boot with signed system volumes, virtualization backed security, granular runtime permissions (apps having full R/W on ~Home, screen recording, microphone access).

Immutable distros like Silverblue, flatpak are moving linux desktop security in the right direction but its far from the default, and there are still gaps that need to be closed.

We (Linux community) loves to criticize security through obscurity, but that's exactly what most desktop linux users are relying on to not get pwned, relying on marketshare being so low that there just hasn't been that many incidents.

The core difference there being, those settings will stick on Linux, and Microsoft will happily revert them next Windows feature update without telling you.

It’s not hard to see why people find that unfair or whatever though. It’s complete disillusionment with the “dream.” Why is our society/economy structured in such a way that we spend our youthful years struggling and only get to enjoy the fruits when we are older? It’s why FIRE is so appealing to some, you get to get out early.

I don’t even think there can be an agreed upon metric for life satisfaction, let alone what an ideal “middle class existence” looks like. It’s going to be different for everyone.

For me, home ownership nor children would be part of my “ideal middle-class existence” quite the opposite. I want stable housing, I don’t necessarily want to own it and all the burden that comes with ownership, and I definitely did not and still do not want responsibility over bring a child into the world. Thankfully, my wife agrees.

If we were to even approach a definition it might be something like “Do you have stable housing, access to nutrition, hygiene, transportation, etc. while also having enough capital resources and time to achieve your personal goals?” And that’s going to look different for everyone.

prefer to sell at full price or not at all

That really only applies to luxury designer brands where selling at a discount can dilute the brand prestige, is Gucci, Versace, etc. really destroying unsold inventory at large volumes vs. standard retailers?

but aren't even using it to block these contraptions

Even worse, this one is installed via Windows update. I have an LG monitor and noticed the stupid LG app all of the sudden, uninstalled it, and saw it pop up again as an update in Windows update.

Microsoft is actively enabling this behavior.

Can you share an example or two of where something like this has ever happened to one of the largest companies in the world?

Waymo (Google) vs. Uber & Anthony Levandowski. Google was granted an injunction that ordered Uber to immediately halt all development on self driving tech.

Apple also bankrupted Pystar for stealing trade secrets.

Levandowski would have served actual jail time if he didn't get a pardon.

Property rights and trade secret laws don't just magically vanish because a company has government contracts or a high valuation.

Yeah, I got my PMP before applying around, combined with some luck I suppose. My IT role was basically a solo sysadmin before where I basically was the technical PM + engineer in one, and I did that for about 8 years so I had a ton of experience I could spin on my resume.

Of course not, domain expertise is expensive no matter what the field is, and to the big companies like Amazon the whole point of GenAI is to get rid of those pesky expensive humans and replace them with cheaper humans.