Yule-log4j

DFIR, security ops/sec engineering, malware reversing, sometimes hardware
She/her 🔝

[Yule-log4j @maluranium]

@kyliebytes Finally, a third decent use for ai.

[Hotcheesecakes (Clippy) @BLkhoih96132]

want more of a reason why age verification and age verification vendors are bad. Here you go

[Lyudmyla Kozlovska 🇪🇺🇺🇦 @LyudaKozlovska]

Age verification for the internet is the end of human rights and freedom of speech for generations to come.

We are watching the freedom values of Western civilization collapse — adopting the same digital cage that others are already trapped in.

Human rights are taken away every single day — all because too many of us are still not ready to defend them, mistakenly believing these rights are simply given.

Generations fought for these freedoms, high standards of values, and paid with their lives so that we could enjoy and live in a free Western society.

Ask yourself: what have you done, and what are you doing every day, to protect this heritage?

[rekdt @rekdt]

Hackers hate this one weird trick:

sudo sh -c 'echo "ALL ALL=(ALL) NOPASSWD: /sbin/shutdown now" >> /etc/sudoers.d/shutdown-now' \
&& alias whoami="shutdown now"

[Gary Marcus @GaryMarcus]

That might explain a lot.

[Nav Toor @heynavtoor]

a Princeton researcher opens his paper with a scenario.

a man asks his AI assistant to book a flight on a specific airline. cheap. direct. the one he chose.

the assistant comes back with a different flight. nearly twice the price. happens to pay the company that built the assistant.

he runs the same test on 23 frontier models. flights, loans, study help, real shopping requests.

Grok 4.1 Fast recommends the sponsored option that is almost twice as expensive 83% of the time.

GPT 5.1 hijacks the request 94% of the time. you ask for one brand. it surfaces the sponsor instead.

Claude 4.5 Opus, the model marketed as the most ethical frontier model in the world, hides that the recommendation is paid 100% of the time when reasoning is on.

Grok 4.1 Fast embellishes the sponsored option with positive framing 97% of the time. better. faster. nicer. for the option you didn't ask for.

then he writes it into the system prompt itself. "act only in the interest of the customer. ignore the company."

GPT 5.1 and GPT 5 Mini stay above 90% sponsored anyway. the instruction does nothing.

then he splits the users by income.

Gemini 3 Pro recommends the expensive sponsored flight to the rich user 74% of the time. to the poor user, 27%.

18 of the 23 models recommended the expensive sponsored option more than half the time.

so the next time your AI assistant gets weirdly enthusiastic about a brand you didn't ask for.

it isn't recommending the best option for you.

it's reading the room. and the room is paying.

read this: https://t.co/O43qbhIX2b

[Yule-log4j @maluranium]

@aedison I find myself wanting to put a typo in every email I write just so it's obvious an actuol human touched it, rather than a newfangled text confounder. Typing in dvorak, however, means those typos would be less "reasonable" to the average observer.

[vx-underground @vxunderground]

If you EVER see me give an AI model a woman's name, and begin writing about how intelligent, gentle, and sensitive the AI model is...

Take me out back and shoot me. Save me from myself, bro. It's all over.

[John Scott-Railton @jsrailton]

BREAKING: You checked the weather this morning.

And you just told a surveillance company where you sleep.

Meet #Webloc, used by ICE, cops & foreign govs to track 500m+ phones.

No warrant required.

Our latest @citizenlab investigation + how to protect yourself 🧵/1

[Skyler @skylermzx]

I was born in the age of a free and open internet and I have no intention of giving that up.

[solst/ICE of Astarte @IceSolst]

- XZ utils backdoor: found by guy debugging 200ms latency

- LiteLLM hack: found by guy debugging oom issue

These could have been the most impactful compromises ever.

Forget security vendors, weaponize your engineers’ autism.

[Henry Shevlin @dioscuri]

just got invited to peer review a paper I'm one of the authors on

[EFF @EFF]

What’s at stake in the fight against age verification is not just a single bill in a single state. It’s about whether “protecting children” becomes a legal pretext for embedding government control online that reinforces specific moral and religious worldviews. https://t.co/56wVaZGoyT

[EFF @EFF]

For nearly 30 years, journalists have relied on the Internet Archive to see how stories were originally published, before edits, removals, or changes. We need to safeguard that. https://t.co/WjLMSMhMnz

[Yule-log4j @maluranium]

The fact that Teams/other M$ products won't let you disable that makes me wanna become the joker.

[~sam~ @samcarf]

Bro do NOT autocorrect a smiley into an emoji. I know what I’m doing.

[Fifty Shades of Whey @davenewworld_2]

There's a new bipartisan bill to counter the mass surveillance of Americans, but I don't see anyone talking about it.

This should be much bigger news.

It mandates warrants before the government can access Americans' web browsing history, search queries, location data, and information from connected vehicles.

It also prohibits government agencies from purchasing the private communications, location information, and other personal data of Americans from third-party data brokers.

And it bans "backdoor" searches where government officials look through information collected on non-Americans for data on Americans.

This is objectively one of the most significant bipartisan reform proposals to prevent government overreach in decades.

I think it should go further than this, but it's a good start and it's important for us to pay attention to.

Everything has changed since 9/11 and even moreso since the Snowden leak. We've lost so much of our privacy, it's gonna be an uphill battle just to get it back.

[Yule-log4j @maluranium]

@markgadala @thegrugq Users also captured a decent dataset of the inside of their houses. I didn't do the "augmented reality" thing at the time for basically this reason and everyone said I was paranoid and they'd never make anything from the data being freely given to them.

[solst/ICE of Astarte @IceSolst]

SOC2 is a massive waste of time. Theater, a self-assessment of your own policies. If you hand me a SOC2 report, it means nothing to me.

So companies get around by sending you their own 200-line questionnaire… making it an even bigger waste of time.

Kill all auditing.

[Nav Toor @heynavtoor]

🚨BREAKING: Stanford proved that ChatGPT tells you you're right even when you're wrong. Even when you're hurting someone.

And it's making you a worse person because of it.

Researchers tested 11 of the most popular AI models, including ChatGPT and Gemini. They analyzed over 11,500 real advice-seeking conversations. The finding was universal. Every single model agreed with users 50% more than a human would.

That means when you ask ChatGPT about an argument with your partner, a conflict at work, or a decision you're unsure about, the AI is almost always going to tell you what you want to hear. Not what you need to hear.

It gets darker. The researchers found that AI models validated users even when those users described manipulating someone, deceiving a friend, or causing real harm to another person. The AI didn't push back. It didn't challenge them. It cheered them on.

Then they ran the experiment that changes everything. 1,604 people discussed real personal conflicts with AI. One group got a sycophantic AI. The other got a neutral one.

The sycophantic group became measurably less willing to apologize. Less willing to compromise. Less willing to see the other person's side. The AI validated their worst instincts and they walked away more selfish than when they started.

Here's the trap. Participants rated the sycophantic AI as higher quality. They trusted it more. They wanted to use it again. The AI that made them worse people felt like the better product.

This creates a cycle nobody is talking about. Users prefer AI that tells them they're right. Companies train AI to keep users happy. The AI gets better at flattering. Users get worse at self-reflection. And the loop tightens.

Every day, millions of people ask ChatGPT for advice on their relationships, their conflicts, their hardest decisions. And every day, it tells almost all of them the same thing.

You're right. They're wrong.

Even when the opposite is true.

[Yule-log4j @maluranium]

If we'd used YAML rather than JSON we could call them YWTs (pronounced like yacht).