Joshua Rogers

something of an nes expert, something of a hacker. i login to twitter once every 6 months on average. sometimes to post travel pics. sometimes for troublemaking

[Joshua Rogers @MegaManSec]

@JUSTcatmeme https://t.co/X3DYkkuWp7
Lore

[John Scott-Railton @jsrailton]

NEW: malware developers added nuclear & biological weapons text to to their spyware.

Goal? To trigger LLM safety refusals... so that their spyware wouldn't be analyzed by an AI security scanner.

Cleanest practical example I can think of for why over-indexing on first order safety alignment is risky.

When closed (and open) models ship with aggressive refusals, they will be sprinkled with second-order blindspots that attackers will discover...and exploit.

We are only in the earliest days of attackers leveraging these features, and it wouldn't surprise me if users systems that need to handle complex cybersecurity issues demand that models be less safety-blunted.

In the weeds: @SocketSecurity's post also shows why intention matters in how you design a malware analysis pipeline to avoid prompt manipulation.

H/T to colleagues that shared this with me https://t.co/f3Aj9TYxU4

[Joshua Rogers @MegaManSec]

https://t.co/ypyUnagdrK

[Joshua Rogers @MegaManSec]

說大人，則藐之，勿視其巍巍然

[Joshua Rogers @MegaManSec]

https://t.co/3vDyZnZBzl

https://t.co/3vDyZnZBzl

[The Tennessee Holler @TheTNHoller]

“You picked Johnny Cash’s picture. You did not pick his message. Try listening to the words.”

@HunterBiden putting on a master class

[Hunter Biden @HunterBiden]

@Kenneth_Belkin Do I look like I’m a part of the elite oligarch class. This was taken at a super 8 motel off I95 by the way.

[Joshua Rogers @MegaManSec]

@calif_io @lcamtuf oh my:)

[Joshua Rogers @MegaManSec]

Sigh....

[Crémieux @cremieuxrecueil]

raising a seed round in 2030 like

[SandboxEscaper @WeirdQuadratic]

To quote a great hacker:

[Joshua Rogers @MegaManSec]

yet another website with the "security" of hiding the email address that you *just typed in* when registering an account. this is what happens when security teams don't understand how people use their product.

[🐝🇬🇷 @bee_fumo]

Rsync developer started using claude :)

[Joshua Rogers @MegaManSec]

@corban_villa @daryakaviani yeah looks like duplicates (see cve ids on the left)

[Joshua Rogers @MegaManSec]

@corban_villa @daryakaviani thx. looks like something got messed up and now there's duplicates in the atlas.json. it says there's 321 rows for aisle, but it should be much lower. lots of duplicate CVEs with `agent: "Unknown", source_kinds: ["record"]` and `agent: "AISLE Analyzer", source_kinds: ["other"]`

[Joshua Rogers @MegaManSec]

@daryakaviani @corban_villa namely (from public): https://t.co/OrOR2M4rRJ

[Joshua Rogers @MegaManSec]

@daryakaviani @corban_villa jfyi, there's a full list of our CVEs at https://t.co/VvQ927kNeL. it seems a lot of them are missing from your (very cool) page

[Joshua Rogers @MegaManSec]

I found that sharing a Magic Touchpad and Magic Keyboard between two MacOS systems sucked. So I made Magic Switch: https://t.co/xEI0IG9pXc

[Joshua Rogers @MegaManSec]

Has anybody used AI to find vulnerabilities (heresies) in TempleOS yet?