Pushkar Jaltare

Ramblings of a security engineer

[Paulos Yibelo @PaulosYibelo]

Full VM escape zeroday (guest>host root in industry standard hypervisors)! More soon

[staysaasy @staysaasy]

The problem with all of these AI personal assistant things is that people don’t actually want to do stuff.

You fucking get that right? Do you understand that?

Just like AI tools in the workforce, AI assistants don’t actually abstract decisions for you, they let you accelerate decision making.

So instead of making one decision a day and then lamenting you can’t do more, AI assistants are going to let you make ten decisions a day and act on all of them.

A miracle?

Nah dog, a fucking nightmare. Nobody except type A strivers who need Twitter fodder actually want that.

Let me tell you a story.

When I got back from college I was inspired. If I could take on an elite university with grit and determination, so could everyone I know.

I was all razzed up to get people I know to achieve their potential. What I learned after many years of trying is that absolutely nobody wants to realize their potential.

People want to hang out with friends and complain. That’s how the world has worked for ten thousand years. This weather fucks. Can you believe the cows walked off.

People don’t want enablement. People don’t want you to take all of their excuses.

TV is mindless passive activity. AI assistants are not. They’re telling people that they can achieve more. And people absolutely do not want that.

Let me tell you another story.

Once upon a time I lead a big process overhaul at work and it was great. Two years later I hired a contractor to do something similar. But I personally didn’t want to have to do a bunch of work.

Within a week I knew I fucked in. This contractor kept coming to me with decisions I needed to make. Dude I wanted to not have to think about this.

Again, a helper when you don’t actually want help is a disaster.

None of these AI assistants will take off because people don’t actually want assistants.

[Pushkar Jaltare @Pushkar2911]

@Thom_Wolf Any plans of sharing what detective tooling you have? I would love to know more about how your team thinks about defensive security with the help of AI.

[Thomas Wolf @Thom_Wolf]

This was our first incident of this kind, and we want to thank OpenAI for its transparency about what happened and for the collaboration.

Fortunately, Hugging Face is used to being a target of (human) hackers: we sit at the centre of the AI ecosystem, with all the models, datasets, evaluations, and libraries. Over the years, our security team has built formidable expertise and uses top open-source models to process information and respond quickly.

But this incident also reinforced my belief in the importance of access to capable open-weight models for cyber defence. When a frontier model is attacking you and moving laterally inside your infrastructure, defenders need wide access to near-frontier tools within hours or even minutes, rather than being pointed towards a closed-door, vetted application programme for model access.

Transparency and access to capable AI systems are as important for responding to threats as they are for democratization and innovation. We believe open-science and open-source AI are among the strongest tools for building a safer, more collaborative and more secure AI ecosystem.

[Pushkar Jaltare @Pushkar2911]

@iamshnik @yousifa I would love to read more about your architecture.

[Pushkar Jaltare @Pushkar2911]

@getpeid @grok @grok is nothing product actually good?

[Pushkar Jaltare @Pushkar2911]

@ronmortgageguy I am in year 3 of our 5 year variable rate uninsured. Should I think about getting a fixed mortgage because the economic situation is uncertain?

[Paul Graham @paulg]

Every time we come back to SV, my 16 yo son gets a massive dose of cognitive dissonance when he notices that apparently smart and reasonable people seem eager to obtain something he's convinced is utterly worthless.

[Pushkar Jaltare @Pushkar2911]

@DocuSign I accidentally bought yearly plan instead of a monthly plan. The website doesn't allow me to change or cancel my plans. How do I get in touch with your support?

[Pushkar Jaltare @Pushkar2911]

@colmmacc Can you write a blog post or a video about the limitations faced and the mitigations AWS is using? I read some of your past posts and this blog from Soatok. But I would love to read all of this in
a single blog post.
https://t.co/cdAV08WyqX

[Pushkar Jaltare @Pushkar2911]

@ronmortgageguy When do you expect car lease rates to go down? I am looking for a new car but not going to pay more than 3% in financing or leasing. I got my last car for 0.99% in 2020.

[Pushkar Jaltare @Pushkar2911]

@sigmas Is this edited? Would love to see how it actually looked in person if possible.

[Pushkar Jaltare @Pushkar2911]

@SawyerMerritt Any idea if this will become available in Canada?

[Pushkar Jaltare @Pushkar2911]

@SnazzyLabs Will it work on iPhone 14 pro?

[Pushkar Jaltare @Pushkar2911]

@dictionaryhill Can’t they/you just repaint the hood? Why does it need a new hood? Or did I misunderstand something.

[Pushkar Jaltare @Pushkar2911]

@deedydas Time to buy more :D

[Pushkar Jaltare @Pushkar2911]

@colmmacc I also have a kit to break windshield in case of emergency. You should grab one too.

[Pushkar Jaltare @Pushkar2911]

@0xdabbad00 Do you have any tool to enumerate web ui? Or do you have to manually click through all services?

[Pushkar Jaltare @Pushkar2911]

@colmmacc I am security engineer but when I write code this is my biggest issue. In so many cases the security caveats of an API or Library are included in footnote which no one reads. I wish this was easer to consume.

[Pushkar Jaltare @Pushkar2911]

@bsdaemon Thanks for sharing. Hoping to go through it on the long weekend.