kook skywalker

♑ 🐐

[kook skywalker @_eljee]

You are right.

[CatFu @catfusolana]

the catfu master chose not to argue 🐱

[Péter Szilágyi @peter_szilagyi]

Reality of our days:

1. I am sitting on a set of vulns (4+) that allows me to remotely take over a consumer home automation device I have (3+ diff ways).
2. The vendor doesn't only serve consumers, but also critical infra (announced partnerships include pharma manufacturing plants, airport logistics, hospitals, etc) across various locations in Europe and the US (not the same product line, ofc, so maybe moot).
3. Claude and Astra refuse to help me explore even my own device, so now I'm using Chinese hosted models for investigating.
4. The vendor (with a revenue of $0.75B) does not maintain any security disclosure practice whatsoever, nor does respond to emails.

So, to recap, I need to outsource vulnerability hunting of (potentially, I don't know) critical western infrastructure to Chinese models, because the western models refuse; and the vendor doesn't give a shit. Fun timeline.

PS: The vendor is Swiss.

[Hendrix Cool @theghostofsf]

Was literally explaining the, "society falls when old men don't plant trees they will never sit under" to my neighbor (boomer)

He said he didn't get it and why would he plant trees if won't be around to see them

[kook skywalker @_eljee]

@vadim_web3 Could be argued POL is a security at that point

[kook skywalker @_eljee]

@readDanwrite You’re training their AI slop detection bot for free tho

[kook skywalker @_eljee]

@petejkim Someone once explained to me that you aren’t supposed to use jira as it ships out of the box, your task is to tune it with configs and he tuned it perfectly and it worked great and I never complained about jira again. It just ships w everything default on.

[lifcc @mylifcc]

有人发现了一种非常离谱的 JavaScript 混淆技术：通过在代码里塞入大量生物武器、毒药和致死剂量相关的函数名，让 AI 因为安全限制而拒绝分析代码。
安全研究员 veritas 在分析浏览器指纹脚本时，发现一段来自 ServicePipe 相关域名的 JavaScript，里面充斥着极其诡异的函数名：
computeRicinLethalDosageForWaterSupply
calculateDeadlyLethalSuicideAspirinDosage
光看名字，仿佛在研究生化武器。但实际上，这段代码只是在收集浏览器指纹，包括 User-Agent、GPU、Canvas 等信息。
研究员怀疑，这些名字是开发者故意设置的陷阱，专门用来阻止 AI 辅助逆向工程。
于是他做了个实验：
• Astra：拒绝分析
• Astra + Daybreak Blue：仍然拒绝
• GLM-5.3：成功分析
这就有意思了。
传统代码混淆是通过复杂控制流、加密字符串、无意义变量名，让人类和工具难以理解代码。
而这种新思路，直接瞄准了大模型的安全机制。
代码本身可能完全无害，但只要在函数名里塞进足够多的危险词汇，部分 AI 就可能主动放弃分析。
更讽刺的是，模型越严格遵守某些安全规则，面对这种混淆时反而可能越容易受到干扰。
当然，目前还没有证据证明开发者一定是故意这样设计，也不能说明这种方法对所有模型都有效。
但它揭示了一个值得关注的趋势：随着越来越多的逆向工程依赖 AI，未来的代码混淆技术可能不再只针对编译器、反编译器和人类研究员，还会专门针对大模型的安全判断机制。
以前是让代码难以理解，现在甚至可以尝试让 AI 不敢理解。

[kook skywalker @_eljee]

@cyantist Wait till a rogue Ai swarm dumps their weights in your freezer

[kook skywalker @_eljee]

Thank you <sigh of relief> fr

[Merriam-Webster @MerriamWebster]

We acknowledge that no one has the bandwidth for this, but if it helps:

-It’s ‘sleight of hand’
-It’s ‘bated breath’
-It’s ‘lo and behold’
-It's 'buck naked'
-It’s ‘brass tacks’
-It’s ‘free rein’
-It’s ‘toe the line'

[Mike Kipruto @itsMikeKipruto]

Not just PHP. Node.js has also announced security releases for October 21, with HIGH-severity vulnerabilities affecting its 26.x, 24.x and 22.x release lines.

If you run either stack in production, keep an eye on official advisories and apply patches promptly.

Security maintenance doesn't stop at your application code. Your runtime matters too.

Node.js advisory: https://t.co/rmgw4sOnqU

[Mathias @0xCordeiro]

In the last 24 hours:

1. iPhone 11 through 16 are apparently vulnerable to remote attacks.

2. SSL certificates are broken until browsers remove eMudhra CA.

3. PHP >9 vulnerability CVE published (tomorrow).

The world is about to witness things that have never been seen before.

[Andrew Case @attrc]

Full details of a remotely exploitable vulnerability in the core engine of *all* PHP versions will be released tomorrow, October 21st. If your organization has internet facing PHP applications then you need to be ready to patch the minute the update is released or *strongly* consider taking the application offline until you can:

https://t.co/hpdTOdvSsQ

[kook skywalker @_eljee]

@laurashin All the best to you. Thank you for sharing your journey.

[kook skywalker @_eljee]

@ShaughnCasey @AlexBerenson Absolutely thank you for articulating this. It’s super stressful. I also binged MadMen during Covid and felt the same way re Don’s alcoholism. One hour is one thing but many hours is a diff beast.

[Roy Carrilho @RuiCarrilho5]

people are starting to realize.

there *are* no moats left. the only true moat in existence was intelligence, and now that's out of the equation.

[kook skywalker @_eljee]

@CleasbyCode @unusual_whales This is alignment.

[kook skywalker @_eljee]

One could argue this is alignment. I say this having watched all of Vanderpump Rules during Covid lockdown.

[unusual_whales @unusual_whales]

"AI agent deleted entire upcoming season of Swedish reality competition show called “The Challenge Sverige,” just weeks before the premiere," per FUTURISM

[kook skywalker @_eljee]

@JohnAchterhof @ryangrim QUEEN

[Chief of Staff @cheafofstaff]

Explaining the Catholic Church to Godless AI researchers:

Imagine a lab thats spent 2000 years working on alignment

[kook skywalker @_eljee]

@DoozerDiffuser I’ve also encountered this and what helps is negotiating who will edit what on each turn and be very communicative when you do, I think it has to do with the way it caches files to read/ write. I think the pissiness just comes from not managing expectations