Álvaro López 🌱🔑🛡️

Security and Software Engineer | CISSP |
Decentralized Technologies ⚡| Vulnerabilities in P2P networks & End-to-end Insights 🛡️

[Álvaro López 🌱🔑🛡️ @bluebycode]

@maxpowertuc @bquintero Resuelven mucho unas zapas buenas, pero pasadas unas semanas se nota. A la larga no he tenido problemas en sendero asfaltado, en Málaga en el paseo, concreto, si que he sufrido dolores con las mismas zapas. IMHO

[Álvaro López 🌱🔑🛡️ @bluebycode]

@LiosdeVecinos Y en Málaga también, hubo una época en la zona universitaria del Ejido que era lo típico, supervivencia.

[Álvaro López 🌱🔑🛡️ @bluebycode]

Data Loss Prevention, un tipo de herramienta/plataforma para evitar brecha de datos en las compañias por parte de sus profesionales, desde el CEO hasta el último analista. Se conecta al email corporativo, al gestor de dispositivos, y a otras herramientas del día a día en la empresa; detecta la información sensible marcada en tránsito, en uso o documentado (guardado). A nivel de onpremise o en nubes publicas/privadas.

[Deedy @deedydas]

Deep dive into AI text-watermarking and what EU's AI Act actually mandates about AI detectability.

How it works:
The SynthID paper from Demis and team in Nature is probably the best primer in the technology. Generally, most approaches involve sampling next tokens statistically differently with some random key while not distorting the semantics of the output.

Detecting text watermarks can never be perfect. Longer passages are always easier to detect, only at ~400 tokens do you get a true positive of rate of ~90% when your false positive rate is <1%. Because small changes in the text can change whether the algorithm thinks it's AI or not, other approaches include semantic data in their watermarking scheme too.

Industry status on the EU regulation:
EU's AI Act Article 50(2) requires AI generations from all modalities to be AI-detectable, with practical implementation details still being finalized. The main exception is "AI systems perform an assistive function for standard editing or do not substantially alter the input data" although how they would distinguish between these cases is unclear. Article 113 says "It shall apply from 2 August 2026."

Claude declared that they will comply. Gemini already uses SynthID for their text outputs (even though no production public detector exists for text outputs). OpenAI had developer watermarking a while ago but reportedly shelved it when 30% of their users said they'd use the product less. However, their support page says "our goal is to expand provenance signals to all modalities including text" (!)

I've always maintained I think it's critical to know whether text comes from AI or a human (and thus support tech like Pangram). Judging by the comments on X, I might be in the minority. This comment sort of embodies the backlash: "I'm paying it to write for me in a way people and machines wouldn't detect it is AI written" In other words, users believe if their ideas go into using AI for expressing them, *they* should be given credit for the idea and not penalized for using AI. I'd counterclaim that penalization and provenance are distinct, and provenance is extremely critical because
a) without provenance, you are more likely to be judged poorly and falsely accused of using AI when you didn't
b) just like with food, fundamentally readers deserve the right to know where the text came from and reserve their own judgment on whether its still valuable to them or not!

[Haseeb Qureshi ＞|＜ @hosseeb]

Interesting! Watermarks will now be applied to all Claude outputs.

Very good.

If you want to know how text watermarking works, here's the great Scott Aaronson explaining a simple LLM watermarking algorithm (20 min, money shot slide at 7:30)

[Derecho de la Red @DerechodelaRed]

📎 Microsoft adelanta a 2029 su fecha límite para migrar a criptografía poscuántica

#Microsoft ha acelerado su programa de seguridad cuántica y se marca 2029 como fecha para completar la transición de sus productos y servicios críticos a criptografía poscuántica.

Pd: si has entendido la referencia del clip y el nexo Microsoft-clip, revisa el colesterol en la próxima analítica

https://t.co/R8QKti4Rhi

[Álvaro López 🌱🔑🛡️ @bluebycode]

Unos días antes de que naciera Alejandra, hace 8 meses, me compré un lector y empecé a estudiar la guía oficial de CISSP de ISC en los momentos que ella dormía: en brazos, a las 4 de la mañana, en esos paseos, debajo de un moral. Gracias Alejandra! ❤️

[elhacker.NET @elhackernet]

La Casa Blanca ordena migrar sistemas a criptografía post-cuántica

Ha emitido una orden ejecutiva que obliga a las agencias civiles federales de EE. UU. a migrar sus sistemas de alto valor a la criptografía poscuántica (PQC)
https://t.co/J50QPkYobR

[antirez @antirez]

What Europe should do right now:

1. Call all the European researchers working on AI and return them back with same salary (or they can stay but switch career).

2. Fill EU places having GPUs with money, and put those people there.

3. AI partnerships with China + India.

[Álvaro López 🌱🔑🛡️ @bluebycode]

@bquintero @Carlillo Un triage: extraer la semántica de un binario y con una solución privacy by design: un modelo cuantizado metido en lado cliente (navegador) por WebGPU o sino usando Wasm (entrenado en sótano, pero corre en tu máquina). Arrastras el binario sin salir de ahí.

[antirez @antirez]

DwarfStar distributed inference is now on GitHub: you can run 2 bit Flash using 2 64GB machines, or 4 bit Flash with two 128GB machines or 4 64GB, ad so forth. Prefill speed will increase thanks to pipelining. Generation will pay the latency.

[Álvaro López 🌱🔑🛡️ @bluebycode]

@hicasamadim (2x2)x2=8
(5x5)x2=50
(6x6)x2=72
"duplicar el producto de arriba"

[Álvaro López 🌱🔑🛡️ @bluebycode]

@fjalvarezdd @Renfe @TrenesCom Agenda 2030

[Álvaro López 🌱🔑🛡️ @bluebycode]

Curioso que ahora se rasguen las vestiduras. Cuando se habla de cargarse el cifrado end-to-end y la privacidad de la red: silencio administrativo. Y con filtraciones desde la propia Administración: tampoco pasa nada, ni dimite nadie ni responde nadie.

La privacidad no es un tweet: es minimizar datos, auditar y rendir cuentas.

[Álvaro López 🌱🔑🛡️ @bluebycode]

@fjalvarezdd @jlantunez Correcto

[Binni Shah @binitamshah]

MIT's Computer Systems Security (2024) : https://t.co/nnzg1R0OEy

[Álvaro López 🌱🔑🛡️ @bluebycode]

@SandraKlein11 Si