StrauXX

6 ms·

1.
by StrauXX 12d ago
Sometimes, yes. But usually, as a security researcher, you usually sold to brokers. The brokers made the vulnerability into a reliable exploit. That is whst they then sold to agencies. For a markup of course. The industry was in a tough spo
2.
Chromium full chain found by XBOW(twitter.com)
4 points by StrauXX 12d ago|0 comments
3.
by StrauXX 19d ago
Reminds me a lot of this LW piece. https://www.lesswrong.com/posts/znbfRXHq285nS7NAh/the-terrar...
4.
by StrauXX 22d ago
But that is not because it's less efficient. With the Canadian system being socialzed and 20k$ being just 8% of your income it is to be expected that you would pay moch more than the median person into the system.
5.
by StrauXX 22d ago
The card processors policies are anti-competetive (albeit legal) abuses of their oligopoly. Reporting small vendors to them does not seem right to me.
6.
by StrauXX 1mo ago
I find single column much easier to read than dual. Though the line spacing is too much in this concrete example.
7.
by StrauXX 1mo ago
These emergent behaviours in large-scale agent collaborations are at the same time fascinating and terrifying.
8.
by StrauXX 2mo ago
I think GP was referring to the industrial revolution and shares your sentiment.
9.
by StrauXX 2mo ago
I agree with your sentiment, doing security auditing for old-school entprise and the like. I'd revise the timeline ti 3-10 years though. Eith how much AI can change productvity companies that don't adopt it will be in a tougher sp
10.
by StrauXX 2mo ago
I would be very surprised if the only row where OpenAI leads was coincidentally colored differently. I'm sure they have an official reasoning for it. But this communication is dishonest.
11.
by StrauXX 2mo ago
The benchmark table is manipulative, borderline lying through statistics. In every line the top performing cell is marked red. Except the line where Sol leads, there it is marked in gray.
12.
by StrauXX 2mo ago
AI hardware is much, much more powerhungry than traditional processors though. I can understand their reasoning.
13.
by StrauXX 2mo ago
I'd expect that sampling would happen in software. Probably the hardware system would output a vector of probabilities over the tokenspace, just as the nets do when run in software. I don't know though and am not aware of any docs
14.
by StrauXX 2mo ago
Maybe the MEA brokers still are. But don't if you live in the west.
15.
by StrauXX 2mo ago
There is likely thousands of such SQL concatenations throughout the codebase. The issue with traditional SAST tools is that they can't readon about context.
16.
by StrauXX 2mo ago
I do, as a matter of fact.
17.
by StrauXX 2mo ago
Of course it is. It just no longer exists.
18.
by StrauXX 2mo ago
Kimi calling itself claude means nothing. During pre-training, when the model learns to "simulate" the internet text, it will naturally be fed with a bunch of data about Claude and ChatGPT. With the amount of LLM outputs on the in
19.
Natural Selection Favors AIs over Humans(arxiv.org)
5 points by StrauXX 2mo ago|0 comments
20.
by StrauXX 2mo ago
Publishing publicly then applying cooldowns in projects is much easier tgan establishing a new standard for pre-release security testing versions that works across ecosystems and gains zooling support.
21.
by StrauXX 2mo ago
Apache AGE seems like a good way to have the battle testedness of Postgres with a more fluent query language. I have only used AGE in smaller projects so far however.
22.
by StrauXX 2mo ago
Of course it isn't. localStorage is used for SPAs.
23.
by StrauXX 2mo ago
localStorage is very much fine and arguably superior to cookies for authentication tokens. First of all, once you have achieved JS execution on a target origin, you can send requests, open up malicious "login" prompts and generall
24.
by StrauXX 3mo ago
My university does that, it works quite well. The devices net-boot either into a locked down exam OS or regular Debian, depending on the current need.
25.
by StrauXX 3mo ago
You can never guarantee that the codepath of a dependency that is vulnerable can not be reached or used as a gadget in an exploit chain. Patching dependencies, even when no direct vulnerability arises is an essential part of defense in dept
26.
by StrauXX 3mo ago
How is this different from say BiFrost?
27.
by StrauXX 3mo ago
This reads to me mostly like the MCP server has many bugs, rather than inherent model weaknesses.
28.
by StrauXX 3mo ago
This blog post is very misleading. > So what would a secure implementation of this feature look like? The webserver listening in on localhost:19421 should implement a REST API and set a Access-Control-Allow-Origin header with the value
29.
by StrauXX 3mo ago
No, it's exactly the other way around. The SOP protects you from these security issues. CORS is a feature that can be used to loosen up the SOP, to allow more complex inter-application behaviour.
30.
by StrauXX 4mo ago
Algorithms are also improving. I believe it's very unlikely for these two improvements together to not result in one to two orders of magnitude cheaper cost per "intelligence". Of course, that might just make use cases that a

More ›