Tootfinder

Security personnel around the world are on high alert following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet.
As of late morning Tuesday, browser makers and some major apps and programming languages had blocked all eight of the intermediate certificates.
There are no reports of certificate transparency logs, which track the issuance of all browser-trusted certifi…

The Internet goes on high alert after discovery of 8 compromised TLS certs
Intermediate certs allow anyone to mint web credentials for any Internet server.

Counting Dogs And Broken Films
Athena apparently knows exactly how many treats she’s supposed to get, while my dad’s old home movies proved a little less cooperative. Between updating my genealogy site and repairing a broken 8mm film, it was a surprisingly busy quiet week.
http://www.bobmuellerwriter…

Counting Dogs And Broken Films – Bob Mueller
Athena counts her treats, I update my genealogy site, and a broken 8mm film sends me searching for a way to repair Dad’s old home movies.

Coming up to my 4 year anniversary on Mastodon (28 Oct 2022). Sitting & feeling that I've never been comfy here. I don't hold any anti-Fedi views, I don't prefer corporate social media, but this still isn't *home*.
I know I'm quieter than advisable on social media. Should I push myself to be more outgoing?
I sometimes look at other servers (instances) that seem more mutually supportive ... beige.party & corteximplant.com, maybe also wandering.shop come to mind.
Would I be happier elsewhere?
Or do I just know some of the more prominent members, so the support I see is just popularity?
Or should I move to where my interests lie, a gamedev-focused server?
I'm still sad mastodon.lol closed ...

I just watched the #BlackHat #OpenAI #HuggingFace talk (#OpenAI understands it themselves. However, emergence is still no indication of actual intelligence, and the talk is again ripe with anthropomorphism.
3. Yes, it is surprising and somewhat terrifying how good these LLM agent loops have become in finding and exploiting vulnerabilities. We are seeing a much stronger version of the earlier next-generation fuzzing leap in tool capabilities.
4. The comparison with fuzzing and other tools is important for another reason: #OpenAI conducted their experiments on the live Internet. No, forcing internal test runs to go through a proxy server is *not the same as running in an isolated environment*. If there is a connection to a live production system, it is by definition not an effective sandbox. What happened to people letting their cool new fuzzers run live on non-consenting production targets on the Internet back then? They were criminally liable. Why should #OpenAI not be held liable for any damages caused by their systems?
Just because you don't understand the complexity that you built doesn't mean you aren't responsible for what it does!
5. The agent loops first successfully started exploited their proxy server on May 26th, discovered July 4th-6th as active exploitation and takeover. Credentials were revoked and the proxy server patched. "At this point, AI training and evaluations resume."
WHAT THE ACTUAL F...? You discovered emergent behavior in your overly complex system that you didn't understand, saw active exploitation of your internal systems to an extent that they were owned with admin privileges, and your response was to patch the uppermost surface holes, and then continue letting the out-of-control complex system run and continue on the same course? You didn't think to, let's see, maybe stop or at least pause the highly irresponsible experiment while figuring out - in detail - what went wrong, why, and how to avoid the same thing happening again on a systematic level?
6. On July 8th, completely unsurprisingly, the LLM agent loops continue to do the same thing and find another surface hole that hasn't been patched yet to take over again. Why should this have stopped? You haven't done any root cause analysis on the system level. Why do you expect that the problem should have stopped?
7. It takes another 11 days to discover that this is happening again. So you turned the system that had broken something back on again without a detailed root cause analysis and then didn't even watch carefully? I can't even...
8. And no, the response is not to fight fire with fire. Complexity on the attacker side (#OpenAI is the attacker, not the defender - they are the guilty perpetrator, not the innocent victim of circumstance) should be fought with *reduced* attack surface on the defender systems. Adding LLM agent loops that the "frontier" companies themselves quite obviously have no control over to already brittle systems with the hope of auto-patching your way out of vulnerabilities does not seem like a wise course of action. You don't mitigate complexity with even more complexity. The next 2 years will be ... exciting - and your best bet is going to be to disable all dependencies and complex interactions that your production systems don't absolutely require.

Saw #WizardOfTheKremlin , probably the last screening at my local. Now I'd like to read the book.
For a film about Putin (told from his advisor's point of view), you learn almost nothing about his motivations / mentality. But I did learn that events I had separated in my mind occurred at nearly the same time (Putin turning to politics/Russian apartment bombings 1 month later) (Sochi Olympics/'little green men' invasion of Ukraine).
There are a number of interesting one liners/points of view from all of the protagonists and some nostalgic (for me) nightclub scenes.
The costume, hair and makeup departments were excellent, btw, with exactly the right bad haircuts. Alexander Zaldostanov and Igor Sechin looked especially convincing, Putin was also surprisingly true-to-life.
P.S. feel free to recommend me *good* films/books on related topics