Ace Pace

There is never enough time, thank you for yours.

[Ace Pace @ace__pace]

The WhatsApp complaint vs NSO contains some fun technical exhibits. The user manual and Ghana contract reveal quite a bit on NSOs system design and thinking.

[Ace Pace @ace__pace]

@shayahal1 You're searching for this @vivaldibrowser

[Malte Ubl @cramforce]

I've been cooking on this post for a bit, but with the cyber security events of this week I had to ship it:

Long-live static credentials must die. We never want to rotate API keys again.

Turns out only 8% of cloud and SaaS vendors support secure alternative. This is our call to action to change this AND our commitment to do our part:

- We are requiring vendors on our marketplace to support OIDC
- We shipped @shadcn components to make it easier to ship OIDC configuration
- We are expanding OIDC support on our own platform

The last generation got the web from HTTP to HTTPS. It is on us to move past API keys.
https://t.co/g3r5jk79U8

[Ace Pace @ace__pace]

Have the internet synchronize their patches to handle this vulnerability and they can't pull an updated container image (even if they did everything right) because somebody else screwed up a little step

[rmoriz @rmoriz]

PHP docker image built failed because the maintainer locked the comments and the CI has a step posting status to github comments.

[John Hammond @_JohnHammond]

i think this evening-into-morning has been a fascinating storm of chaos and uncertainty with potential proof of concept exploits (generated by LLMs) being shared publicly and privately (then analyzed by LLMs) without clarity or understanding of what is actually "the" exploit or if it is "other" exploits (found by LLMs) all to hope for potential defenses (built by LLMs)

we used to be so concerned with robots hallucinating

at this point we might be the ones hallucinating ourselves

[Ace Pace @ace__pace]

@GeoffreyHuntley You don't need Red for that. I do similar things with Blue all the time

[Ace Pace @ace__pace]

@matthew_d_green @HackingLZ Flattening the curve. This is the pacing thesis except by erecting barriers and not by slowing down models.

[Ace Pace @ace__pace]

@HaifeiLi Are bugs dense or sparse? Are we removing bugs faster than inserting them?

[Ace Pace @ace__pace]

@yoavalon When there's enough money, criminals go high end

[Ace Pace @ace__pace]

@OphirHarpaz Human brain Mk 1

[Tenzai @Tenzai_Labs]

👀

[Ace Pace @ace__pace]

@halvarflake relates to your question on advancement there. There are no precise mathematical questions

[Joshua Saxe @joshua_saxe]

I feel if there's going to be progress on alignment it'll need to be better posed and have real scientific infrastructure. ML has been successful because we've had a series of capabilities hills to climb since mnist, imagenet, hellaswag, etc, that made results commensurate and legible to researchers who weren't friends and didn't know each other and were competing with each other. There's nothing analogous in interpretability and alignment and the problems aren't well posed and it'll feel like treading water (or sinking) until that's solved

[Joshua Saxe @joshua_saxe]

I feel if there's going to be progress on alignment it'll need to be better posed and have real scientific infrastructure. ML has been successful because we've had a series of capabilities hills to climb since mnist, imagenet, hellaswag, etc, that made results commensurate and legible to researchers who weren't friends and didn't know each other and were competing with each other. There's nothing analogous in interpretability and alignment and the problems aren't well posed and it'll feel like treading water (or sinking) until that's solved

[Ace Pace @ace__pace]

@halvarflake @msuiche I was very disappointed in latest Google server side code containing trivial vulns. At least I hope it was new code..

[Ace Pace @ace__pace]

@halvarflake Are those formalized somewhere that a AI can seriously attempt to answer these?

[Ace Pace @ace__pace]

@S1r1u5_ Gladly
https://t.co/gcHbvA6cw4

[Philippe Lemoine @phl43]

Here are a few more remarks on what is happening in France at the moment.

This movement is a problem for the government for a number of reasons. First, protesters are very young, which makes the movement more difficult to deal with than a typical strike.

Indeed, whereas a typical strike is organized by trade unions (with a security service that deals with trouble makers during protests), so things are much more likely to get out of hand and the government doesn't have a clear interlocutor.

Moreover, it means that it's much more difficult to rely on repression to deal with the problem, because it's a pretty bad look for cops to beat up a 16-year-old and the government would like to keep videos of that kind of things to a minimum for PR reasons.

There is also the additional risk that, if cops end up killing a kid and the kid in question happens to be Black or Arab, the government will probably have race riots on its hands in addition to a more typical, except for the age of the participants and lack of organization, social movement.

Another reason why it's hard for the government to deal with this movement is that it's broke. Traditionally, the French government deals with large social movements by a combination of repression and spreading money around to buy peace, which for instance is how Macron was able to defuse the yellow vests movement in 2018.

But we are in the middle of a fiscal crisis with heavy upward pressure on French treasury bond yields and the government knows that, were it to try to defuse the situation by spending money it doesn't have, the yields may get out of control and turn the fiscal crisis into a full-blown panic.

As for why this is happening, I think people are overthinking it. I constantly see people who take at face value the grievances expressed by the most articulate of the protesters and assume they are the cause of this movement, but I think it's kind of ridiculous.

Have people ever talked to a 16-year-old before? They are protesting because it's fun, there is something exhilarating about thinking you're part of something important, it gives you an excuse to miss class and the carnival atmosphere in which normal rules seemingly no longer apply is very exciting.

This is especially true for young male protesters. One thing you must never lose sight of is that male human teenagers are, by a wide margin, the stupidest creatures in the universe. This explains a lot of what is happening and has nothing to do with complicated sociological explanations.

Of course, if journalists interview them, they will talk about the lack of resources, the long hours, etc. and sometimes even bring up more general issues about the current socio-political environment, but they're just repeating the rationalizations they hear people talk about on TV or, more likely in that age group, on social media.

It doesn't mean that the specific grievances they are talking about when you elicit justifications for them are the causes of their behavior and I think to believe that you really need to have a very unrealistic view of what a typical 16-year-old is like. The causes are much dumber than that in all likelihood and it's the kind of things I was talking about above.

Now obviously this kind of things doesn't explain why this is only happening now and not all the time, high-schoolers have always loved to miss class and feel they're part of something important yet they weren't protesting and burning their schools until recently, but here too I think people are kind of overthinking things.

There is a tendency for commentators to assume that everything has some kind of deep, structural explanation, but maybe sometimes there isn't? It's the same thing for people who think it's orchestrated by a handful of groups conspiring in the shadows.

For instance, the press has revealed that French domestic intelligence had produced a note claiming that the far-left was behind the protests and conservatives naturally were eager to accept that explanation, but frankly if you read the articles about that note, it seems kind of weak sauce and doesn't really show much.

All it shows is that, in a handful of schools in a specific department, far-left activists joined the high-schoolers and advised them on what to do. I'm sure that's true, and I think it's true in many other places, but it doesn't explain why this movement happened when it did.

If far-left activists could start such a movement so easily, it would happen all the time because they always try to stir up shit, but it doesn't because it's not that easy to start a massive social movement and that's not something anyone really controls in a meaningful way.

I think what happened is that high-schoolers in a handful of schools had very localized grievances, for whatever reasons they decided to make a mess and organize a blocus of their schools, posted videos on social media and then it spread through social contagion.

This was fueled by the fact that France has a strong protest tradition, so in that environment people naturally think about this mode of action and the idea of going into the streets and blockading their school will come kind of naturally to them.

Once such a movement crosses a certain threshold, it's not particularly mysterious why it will very quickly spread, so the only thing that requires a special explanation is why it crossed that threshold in the first place, but I think it's quite likely that it was just the chance coincidence of random factors.

Again, commentators are reluctant to accept that sometimes there is no deeper explanation than that, because if that's the explanation then it means they don't have anything particularly interesting to say, but I think often there is nothing more to it than that and people shouldn't be looking for deep, structural explanations that don't exist.

[zeynep tufekci @zeynep]

FBI loses extremely sensitive data of agents due to lack of patching, a common problem that’s caused major breaches. Meh?

Korean banks get attacked in the stupidest way possible, no money touched, names and loan limits may have been compromised. But AI was involved! Headlines!

[Ace Pace @ace__pace]

Comparison work at scale is full of data cleanup before you reach the thinking stage.

Oddly, AI makes this harder by hiding from you the need to do this and rarely does it itself

[Jordan Wiens @psifertex]

When the models run unsupervised (pun intended), the result probably isn't measuring what you think it's measuring! LLMs still lack good judgment.

Context for that link: decbench "fixes" HexRays output formatting to work with the evaluator but doesn't for other tools.

(2/2)