SCHiM

9 ms·

1.
by SCHiM 1mo ago
Anthropic* I think I agree with the bitter lesson, but I wish I weren't :) > A) You can always self-host something like Kimi, DeepSeek, or GLM. I mean, one could rent-a-box for, like, 10$$ per hour? Agentic loop development gets rea
2.
by SCHiM 1mo ago
>I get it. You don't feel ownership over someone else's AI. You don't feel involved, you don't feel like you have agency. You don't _have_ ownership of someone else's ai, and that comes with real risks. Secu
3.
by SCHiM 1mo ago
This looks really interesting, and if I understand what this does properly: it was high time someone built this! Without diving into an experiment myself, it would be amazing if you could add some stats or experiment logs, if it's not
4.
by SCHiM 2mo ago
I think the attempt of people to "bubble wrap" the whole world actually makes things worse. Treat people as untrustworthy criminals by default, and guess what you get by default?
5.
by SCHiM 5mo ago
Maybe you're right. I just find it confusing. The language is all-encompassing, doesn't read opt-in to me if taken literally: "By submitting any vulnerabilities to Microsoft". And I found no other pages describing "
6.
by SCHiM 5mo ago
https://www.microsoft.com/en-us/msrc/bounty-guidelines > MICROSOFT BOUNTY TERMS & CONDITIONS > Last updated: July 23, 2025 > The Microsoft Bug Bounty Programs Terms and Conditions ("Terms")
7.
by SCHiM 5mo ago
Microsoft's policy is: "if you contact us with a vulnerability, you automatically agree to the terms of our responsible disclosure policy", which includes waiting 30 days after patch was created, and says nothing about how lo
8.
by SCHiM 5mo ago
You can imagine a pipeline that looks at individual source files or functions. And first "extracts" what is going on. You ask the model: - "Is the code doing arithmetic in this file/function?" - "Is the code al
9.
by SCHiM 6mo ago
Hey jstsch, would you mind answering some questions? - Did you need/use an electrician to set this up? - How much KWh capacity do your batteries have? - What about fire safety? Did you install outside, or inside? - I assume dec/ja
10.
by SCHiM 6mo ago
> 1) Are there any reliable open-source PAM alternatives or privilege elevation tools for Windows that handle this "per-app" scenario effectively? I would look into: - creating an account to run the apps you need, giving the us
11.
by SCHiM 7mo ago
The bar to ingest unstructured data into something usable was lowered, causing more people to start doing it. Used to be you needed to implement some papers to do sentiment analysis. Reasonably high bar to entry. Now anyone can do it, the r
12.
by SCHiM 1y ago
> Your company can scream to anyone that listens that all the competition is AI SLOP, but when hundreds of companies are pitching the same solution, your one voice will get lost. If you cannot out compete "AI SLOP" on merit ove
13.
by SCHiM 1y ago
IMO it's shoddy. Anybody can get hacked, that's true. But a modern corp that has tried to defend itself should have multiple layers of defenses against complete pwnage. If you've paid attention in the last 10 (or even 5) year
14.
by SCHiM 1y ago
Could you explain: 1) What are the limitations of the scaling you do? Can I do this programmatically? I.e. send some requests to get additional pods of a specific type online? 2) What have you done in terms of security hardening? you mentio
15.
by SCHiM 1y ago
It's down. Tested from two servers, 8.8.8.8 and others are up.
16.
by SCHiM 2y ago
Even big customers have a use for what you've built in high security areas they might have. Think swift alliance servers in a specialized network segment in financials, or perhaps sensitive medical information in health care? I think y
17.
by SCHiM 2y ago
The following works partially: ``` netsh interface ipv6 show interfaces ``` Get your interface id first, you're looking for the IDX number. There might be several. ping ff02::1%LAN_INTERFACE_ID So, example: ``` ping ff02::1%22 ``` Win
18.
by SCHiM 3y ago
In all honesty, I have the same reservations. If you look at the authz schemes between the different flavors of operating systems you see that the 'set-uid' concept is comparatively ancient, battle hardened and based on well under
19.
by SCHiM 3y ago
Not to mention this is an attack on multiple fronts: do you _really_ believe DoH is about privacy?
20.
by SCHiM 3y ago
That is actually possible. For example, someone wrote python code to do this for the massive open source model BLOOM. However, it's still slow as tar. When I was running the BLOOM model I think my inference time was 1 token / m. S
21.
by SCHiM 3y ago
Maybe this is that AI's endgame, and it just took full control of openAI's compute through a coup at the top?
22.
by SCHiM 3y ago
Security is not an absolute measure. It's a cost/benefit tradeoff. 1Password may have customers that make it economical for an adversary to spend $$$$ to breach it despite "better" security, whereas your "less"
23.
by SCHiM 3y ago
I'm a not educated in mathematics, so I can't know for sure if what I'm going to respond to your question is really relevant or not. But here it goes anyway. I'm a security researcher, and I write my own fuzzers. Fuzzers
24.
by SCHiM 3y ago
I think it is you that misunderstands the point made in the comment. Their point is not that the cryptography is flawed, or that the results can be tampered with or that the electronic voting system is less reliable than manual counting and
25.
by SCHiM 3y ago
No, the way it works is that the current output + potential next tokens to be sampled are checked with the grammar. All potential tokens that don't match are removed. Then, with the list of valid tokens left, normal sampling strategies
26.
by SCHiM 3y ago
Let's see what happens when you search for the following "documentation" ;) : """ Complete the following code: // Find all files with a binary pattern in a directory. Return the list of files and the
27.
by SCHiM 3y ago
Except they are. They are standing next to their company branded bike, in uniform waiting for an order. They are not on their way to work from home or vise-versa. For all intents and purposes they are on the clock, except the computer says
28.
by SCHiM 3y ago
I think I saw this too with firefox. My memory is a little hazy on this detail, but the _critical_ difference with firefox is that ctrl+t let me open a new tab and leave the sync-a-nag alone. Edge did not allow that, and I actually hat to w
29.
by SCHiM 3y ago
Sometimes I start edge when something does not work in firefox. Everyone knows you want your browser to be quick, snappy and use few resources. What does Edge do? It shows you a unskippable, un-closable "how-to" (as if I've
30.
by SCHiM 3y ago
Giving a task to a team of programmers is similarly no-deterministic by nature. Otherwise we'd not see so many posts about budgets, planning, meetings, sprints and security bugs :)

More ›