execveat

5 ms·

31.
by execveat 3y ago
Nobody in their right mind is using GCE for training. Take a look at real prices: https://vast.ai/
32.
by execveat 3y ago
Yeah, but that could require multiple queries, which isn't very efficient. Training model just to fix JSON would be better.
33.
by execveat 3y ago
You'd need to put the input first for this approach to work, but in my testing models work better if you lead with a question.
34.
by execveat 3y ago
I love the project, but the whole premise is broken. People brainwashed into supporting Russia do not deny the scale of devastation and human tragedy. They just attribute it to the Ukrainian military. So, while documenting the terror is a c
35.
by execveat 3y ago
You shouldn't start with a blank state, instead you should be querying https://api.github.com/meta . But there are so many repos on Github itself which hardcode the host keys in Github Actions, etc.
36.
by execveat 3y ago
This is factually wrong. All major HSM vendors offer ways to backup and replicate keys, it's usually done using key-wrapping keys. Here's an example: https://www.ibm.com/docs/en/datapower-gateway/201
37.
by execveat 3y ago
Charitable explanation is that they rotated they key without waiting for an analysis.
38.
by execveat 3y ago
poe.com is a web interface (by Quora) to multiple LLMs. Right now it's ChatGPT, GPT-4, Claude, Claude+ as well as Sage and Dragonfly.
39.
by execveat 3y ago
What is the polite response to this nonsense? Are you still supposed to respond to recruiters who clearly didn't spend a minute reading your profile? Or do you just ignore them and don't respond at all?
40.
by execveat 4y ago
Yes, I'm subscribed to poe.com and am playing with all public models. They all suck at debugging issues with no known answers (I'm talking about typical problems every software developer, DevOps or infosec person solves every day)
41.
by execveat 4y ago
There's no reason this couldn't happen, but surely it would require something better than LLM.
42.
by execveat 4y ago
Yeah all this talk about complex systems being written by a language model which has no concept of files, code paths and import systems sounds like a job security to me. I'm a pentester though.
43.
by execveat 4y ago
Yeah, but now ask it to write a program that uses this API and then let it debug problems which arise from the swagger spec (or the backend) having bugs. I don't think LLMs have any way of recognizing and dealing with bad input data. T
44.
by execveat 4y ago
Rust doesn't prevent integer over/underflows.
45.
by execveat 4y ago
Usually non-technical management are the ones that are against this kind of measures. This recent Passkeys initiative (that's what allows using secure enclave as a Webauthn key) is amazing though, I really hope it changes the game and
46.
by execveat 4y ago
There isn't enough information to tell. With keylogger you can steal password every time it's used, MFA will just prevent / limit it's use. So it doesn't tell us anything about their MFA implementation and whether a
47.
by execveat 4y ago
Intrusion detection systems are utter shit and usually undergo even less real-world testing than recovery from a cold backup. Although we don't know LastPass'es architecture, it's also highly likely that with engineer's
48.
by execveat 4y ago
You could ask user to present second factor (secure one, Webauthn) for every password they access. That would be a notable obstacle for me as an attacker, but I can't imagine any organization implementing this for real (maybe apart fro
49.
by execveat 4y ago
Preventing this thing from happening costs a lot of $$$, so pretty much everyone just "accepts the risk" seeing that probability of something like this happening to your company (during your tenure) is still super low. All compani
50.
by execveat 4y ago
Privilege escalation on Windows is super easy though, every red teamer I know has a bunch of ready to use exploits (most of them public) up their sleeve. And it is virtually impossible to get a good baseline of a developer's machine, s
51.
by execveat 4y ago
I'm all in for VM based privilege separation, but that won't protect you from infected endpoint. Assuming this was a targeted attack, folks that achieved RCE on DevOp engineer's machine could have waited for her to authentica
52.
by execveat 4y ago
On the other hand, prosecutors don't get any consequences for lying (see Doug Evans). Maybe they should just target their product at DAs.
53.
by execveat 4y ago
You're right of course, but given how much better (useful) ChatGPT is compared to it's predecessor GPT3, it is incredibly impressive. Starting from the current state, you could make ChatGPT much better programmer simply via brute-
54.
by execveat 4y ago
It's not clear at all. The scope UI says 'Repositories - Public repositories'. It does not sound dangerous and only reveals that the access is r/w (not r/o) after expanding the dropout. It does not mention stars at
55.
by execveat 4y ago
The required scope for stars is 'public_repo' and the UI for that does not mention stars at all. Unless you click the dropout all you see is 'Repositories - Public repositories', which does not sound dangerous at all (al
56.
by execveat 4y ago
For context, in order to star projects on user's behalf you'd need to request public_repos scope[1], so the UI will look like this: https://github.com/login/oauth/authorize?client_id=33a703d01... (I used
57.
by execveat 4y ago
Awesome work! Also, thanks for pointing out that RouterOS supports Docker now, there's no way this is the only vuln in that implementation.
58.
by execveat 4y ago
AFAIK, for a long they were pretty hostile and there's still this webpage which asks a $45 wire transfer in order to receive a CD with open source components used in the routerOS: https://mikrotik.com/downloadterms.html
59.
by execveat 4y ago
The article is incredibly patronizing, while being also incredibly stupid. If the orcs were half as smart as would be needed to extract metadata from (poorly) encrypted traffic, they would just sidestep that altogether by adding a second de
60.
by execveat 4y ago
It is optimized for chat. So if multiple answers match to a certain degree, it will choose one at random, not necessarily the best fit. It should be possible to fix this, eventually.

More ›