GOOGLE BUILT A SECRET WEAPON FOR FILE DETECTION
they ran it internally for years, gmail, drive, safe browsing, hundreds of billions of files every week
then they open sourced it
it's called magika and it exposes what files really are, not what they pretend to be
rename malware to "resume.pdf"? magika sees through it
disguise a script as an image? magika sees through it
any trick attackers use with file extensions? magika sees through all of it
ai trained on 100 million files. 200+ content types. 99% accuracy. 5ms per file
one command
`pip install magika`
the same tool protecting google's billion users is now protecting yours
https://t.co/Jr3LjmQobq
You can spend tokens for a model to reason through a program's state space, or use a fraction of those tokens having it generate a tool such as a fuzzer that brute forces the same state space on a CPU at significantly lower cost.
This tradeoff is what the Agentic Sufficiency Curve formalizes. You need precise inference up front but only cheap CPU to drive the long tail: https://t.co/wg8Oj4C6ho
For certain kinds of vulnerability research I think this was the right approach, at least up until Fall 2025. But frontier models have continued to consume that capability and now I'm not so sure the cost tradeoff is worth it.
Other domains are likely still under the curve and benefit more from models generating deterministic automation that runs on cheap CPU, than just spending more tokens. Just another anecdotal data point that the frontier will continue to remain jagged.
THE BIG REGRESSION
My folks are in town visiting us for a couple months so we rented them a house nearby.
It’s new construction. No one has lived in it yet. It’s amped up with state of the art systems. The ones with touchscreens of various sizes, IoT appliances, and interfaces that try too hard.
And it’s terrible. What a regression.
The lights are powered by Control4. And require a demo to understand how to use the switches, understand which ones control what, and to be sure not to hit THAT ONE because it’ll turn off all the lights in the house when you didn’t mean to. Worse.
The TV is the latest Samsung which has a baffling UI just to watch CNN. My parents aren’t idiots, but definitely feel like they’re missing something obvious. They aren’t — TVs have simply gotten worse. You don’t turn them on anymore, you boot them up.
The Miele dishwasher is hidden flush with the counters. That part is fine, but here’s what isn’t: It wouldn’t even operate the first time without connecting it to an app. This meant another call to the house manager to have them install an app they didn’t know they needed either. An app to clean some peanut butter off a plate? For serious? Worse.
Thermostats... Nest would have been an upgrade, but these other propriety ones from some other company trying to be nest-like are baffling. Round touchscreens that take you into a dark labyrinth of options just to be sure it’s set at 68. Or is it 68 now? Or is that what we want it at, but it’s at 72? Wait... What? Which number is this? Worse.
The alarm system is essentially a 10” iPad bolted to the wall that has the fucking weather forecast on it. And it’s bright! I’m sure there’s a way to turn that off, but then the screen would be so barren that it would be filled with the news instead. Why can’t the alarm panel just be an alarm panel? Worse.
And the lag. Lag everywhere. Everything feels a beat or two behind. Everything. Lag is the giveaway that the system is working too hard for too little. Real-time must be the hardest problem.
Now look... I’m no luddite. But this experience is close to conversion therapy. Tech can make things better, but I simply can’t see in these cases. I’ve heard the pitches too — you can set up scenes and one button can change EVERYTHING. Not buying it. It actually feels primitive, like we haven’t figured out how to make things easy yet. That some breakthrough will eventually come when you can simply knock a switch up or down and it’ll all makes sense. But that's at least 20 years down the road.
It’s really the contrast that makes it alarming. We just got back from a vacation in Montana. Rented a house there. They did have a fancy TV — seems those can’t be avoided these days — but everything else was old school and clear. Physical up/down light switches in the right places. Appliances without the internet. Buttons with depth and physically-confirmed state change rather than surfaces that don’t obviously register your choice. More traditional round rotating Honeywell thermostats that are just clear and obvious. No tours, no instructions, no questions, no fearing you’re going to do something wrong, no wondering how something works. Useful and universally clear. That’s human, that’s modern.
Go's silent integer overflows hide bugs from fuzzers. go-panikint modifies the Go compiler to panic on arithmetic overflows, exposing vulnerabilities that wrap around undetected.
Did you know? GDB has a built in graphic interface, called TUI.
Commands:
- Turn on: `tui enable`
- Cycle through windows: `layout next`
- Redirect target stdio/stderr to a log file to prevent curses UI breakage (or `refresh`)
(Showing @alisaesage's screen)
🔺iPhone models announced today include Memory Integrity Enforcement, the culmination of an unprecedented design and engineering effort that we believe represents the most significant upgrade to memory safety in the history of consumer operating systems. https://t.co/ule9gaXzc1
Fun. @Atlassian jams some AI enabled app called Rovo into orgs you create. It can't be removed, and you can't delete the org as long as there are active apps in it, leading to no way to delete the org.
A lot of people don’t know this, but any platform Chrome runs on *except iOS* has a fully featured Bluetooth scanner that allows viewing, connecting, and read/writing GATT attributes.
Go have some fun. You already have the tools
chrome://bluetooth-internals
The lack of end-to-end encryption through the telco infra *is* the vulnerability.
We improved Internet infra security by largely de-privileging the intermediate hops through widespread use of TLS. Now attackers go for VPN boxes because that's where traffic exists in plaintext.
Heads up: Microsoft Office, like many companies in recent months, has slyly turned on an “opt-out” feature that scrapes your Word and Excel documents to train its internal AI systems. This setting is turned on by default, and you have to manually uncheck a box in order to opt out. If you are a writer who uses MS Word to write any proprietary content (blog posts, novels, or any work you intend to protect with copyright and/or sell), you’re going to want to turn this feature off immediately.