MadsRC

7 ms·

1.
by MadsRC 15d ago
I was looking forward to using Fable for cybersecurity work, but kept getting bumped to Opus… Signed my org up for CVP, went through the trouble of procuring a separate team plan from our main org as Anthropic can only disable cyber safegua
2.
by MadsRC 21d ago
“Treat the agents like coworkers” - I’m working on this exact problem with daevix.com Unique identity, dedicated and isolated compute, all ingress and egress monitored and audited as if I suspected the coworker (the agent) was secretly a DP
3.
by MadsRC 27d ago
FleetDM comes to mind
4.
by MadsRC 2mo ago
I’ve heard from people inside Google that they’re prohibited from using anything but their own models. AlbertaTech on YT, ex-Google working on YT said in a video that right before she quit someone had threatened to quit if they couldn’t get
5.
by MadsRC 3mo ago
Amazing news! The one thing I wish they’d support is multiple zones and an RBAC system to grant certain users access to specific zones. If they’d offer that they’d be a serious contender to replace Cloudflare and AWS/GCP DNS
6.
by MadsRC 3mo ago
Not really, and neither does the doc it links to. It explains the difference between a personal agent (that acts as you) and a multiplayer agent (that has its own identity). But they walk all this back by saying that for PRs in GitHub it us
7.
by MadsRC 3mo ago
I’d be curious how they’ve solved the attribution/provenance/identity problem here. Are instances of Claude Tag, across channels, sharing the same identity? Can I grant one instance access to a range of AWS roles and another insta
8.
by MadsRC 3mo ago
I would love to see a forge that consists of composable components, self-host able with federated identities and maybe a few centralized indexers
9.
by MadsRC 3mo ago
The approval part is really interesting - No problems with timeouts or operators not being around to approve?
10.
by MadsRC 6mo ago
Ah yes, the API will accept requests that doesn’t include the client attestation (or the fingerprint from src/utils/fingerprint.ts. At least it did a couple of weeks back. They are most likely using these as post-fact indicators a
11.
by MadsRC 6mo ago
What signing? Are you referencing the use of Claude subscription authentication (oauth) from non-Claude Code clients? That’s already possible, nothing prevents you from doing it. They are detecting it on their backend by profiling your API
12.
by MadsRC 6mo ago
We were not. I reached out to the team at BerriAI to offer my assistance as a security professional, given that they requested help from security experts.
13.
by MadsRC 6mo ago
Dropped you a mail from mads.havmand@nansen.ai
14.
by MadsRC 6mo ago
Very interesting! I’ve got an internal tool that we use. It doesn’t do the deterministic classifier, but purely offloads to an LLM. Certain models achieve a 100% coverage with adversarial input which is very cool. I’m gonna have a look at t
15.
by MadsRC 8mo ago
Well, the head of reliability did leave a month or two ago zD
16.
by MadsRC 8mo ago
Last I heard of it this was proposed as a directive as opposed to regulation, meaning every single member state would have to interpret it and create their own national implementation. Just like with GDPR. So 27 individual implementations o
17.
by MadsRC 9mo ago
This is cool - Whenever I have a new idea for a thing I spend too much time writing boilerplate IAM and backend stuff, taking away time that could be spend on actual business logic. Thought about packaging the boilerplate stuff up before, n
18.
by MadsRC 9mo ago
This looks cool, but I’m sad you’ve chosen a name that already associated with another security tool :(
19.
by MadsRC 10mo ago
Now? Chainalysis has always worked for governments… It was basically spawned out of the government needing help with investigating crypto - I think it was Mt. Gox…
20.
by MadsRC 1y ago
Shameless plug, I pushed a small CLI for detecting unpinned dependencies and automatically fix them the other day: https://codeberg.org/madsrc/gh-action-pin Works great with commit hooks :P Also working on a feature to
21.
by MadsRC 1y ago
This looks great! With the self-host option, it’s not really clear through the docs if one is able to override the base url of the different model providers? I’m running my own OpenAI, Anthropic, Vertex and Bedrock compatible API, can I hav
22.
by MadsRC 1y ago
When this was released I thought that perhaps we could mitigate it by having the tooling only load “rules” if they were signed. But thinking on it a bit more, from the LLMs perspective there’s no difference between the rule files and the so
23.
by MadsRC 2y ago
Data exfil detection is a game of whack-a-mole. There is an endless variation of ways I can get data of your machine or out of your network. Your time is much better spend detecting or preventing compromise.
24.
by MadsRC 2y ago
This is quite interesting. What does a seat entail? You talk about self serve (I love it!), but would the users that self-serve take up a seat? Or are seats just for the folks creating the modules?
25.
by MadsRC 2y ago
I find the JetBrains integration spotty - I have to run ‘eval “$(mise activate)”’ in every terminal session for it to pick up the env. I have vague recollections of also having issues with running executables from the IDE as it is missing t
26.
by MadsRC 2y ago
Not the parent, but I use it for projects (including Python projects) to run tests, code generation etc. when I can’t use mise.
27.
by MadsRC 2y ago
It’s actually surprisingly efficient if you batch writes at the expense of some added latency. The WarSyream team found that batching into chunks of either 4MB of data or 250ms was optimal. Downside is the 250ms latency. But then again, a f
28.
by MadsRC 2y ago
This is why systems such as WarpStream regularly runs compaction jobs to more efficiently store objects and cut down on API calls.
29.
by MadsRC 2y ago
Totally unrelated to the thread, just a comment on something I noticed: You seem to be posting from 2 different accounts: soatok and some_furry. Dunno if that’s on purpose, but in the off chance that it is not: Now you know. Love you blog,
30.
by MadsRC 2y ago
Does anyone know why companies don’t release under AGPL for everyone and then under a proprietary commercial license to themselves? Essentially dual-license it. AGPL would dissuade Google and AWS from using it, and the commercial license wo

More ›