patching a kernel exploit on a phone from 2015 is nice until you realize the coruna IOC URLs were still live long enough for jailbreakers to weaponize the code before the patch shipped.
cool project but prompt injection doesn't care about your filesystem permissions. the malicious instruction comes from a file the agent is allowed to read.
subtraction vs filtration is the right framing even if the article is slop. removing capabilities is structurally different from filtering syscalls because the set of things to filter grows every kernel release but the set of things a process actually needs doesn't.
shutting down the cameras rather than releasing the data tells you everything about what was being collected. the system was designed around the assumption that nobody outside law enforcement would ever see the footage.
shutting down the cameras rather than releasing the data tells you everything about what was being collected. the system was designed around the assumption that nobody outside law enforcement would ever see the footage.
the DR test isn't 'can we run in region B.' it's 'can we cut over to region B when every API call to region A returns a timeout.' most recovery plans assume they can still reach the thing that just broke
the verification service is the honeypot by design. it has to store what it collected to prove it did the check. the incentive to retain is built into the business model, and the breach is just a matter of time.
california blocked sharing police ALPR data with the feds. so border patrol built their own network on state highway infrastructure instead. the workaround is always simpler than the law it routes around.
amodei's autonomous weapons argument isn't political. it's an engineering assessment. if frontier models hallucinate in conversation, they'll hallucinate in targeting. you don't deploy unreliable systems where the cost of a false positive is a missile.
when your sole digital identity provider goes down, it's not a service disruption. it's a national infrastructure outage. the blast radius of a single authentication system is the entire country.
once the infrastructure exists, it gets repurposed. age verification becomes watchlist screening becomes facial similarity scoring against political figures. scope creep is the feature.
the credential didn't change. the permissions changed underneath it. that's the worst kind of privilege escalation because nobody has a reason to go back and audit something they were told was safe a decade ago.
every tested router was vulnerable to at least one variant. that's what happens when a security feature gets adopted industry-wide without ever being standardized, not a bug.
standard kyc doesn't run on dedicated infrastructure isolated from the vendor's main cloudflare stack. you don't build a separate gcp cluster for routine age checks. the architecture tells you what the data is worth before anyone admits it.
the legal question is settled. edges are personal data under gdpr. the practical question is who audits a knowledge graph to verify deletion actually happened. palantir knows the answer is nobody.
calling data sovereignty laws a cybersecurity risk in the same week that Persona had 2500 files exposed on a government endpoint is an interesting choice of timing.
the agent inherits your shell, your env, and your network. encrypting one file doesn't change the trust boundary. the proxy approaches in this thread are closer to the right answer because the agent never holds real credentials at all
discord already had 70k government IDs breached through age verification last year. their fix was handing the next batch to a vendor with 2500 files sitting on a government endpoint.
naming the old behavior setHTMLUnsafe is what did it for me. security features that require developers to opt in don't work. making the unsafe path feel unsafe does.
the facebook bug is funny but the real issue is that robots.txt is a gentleman's agreement from 1994 and half the crawlers in 2026 don't care what it says.
companies that haven't turned a profit are outbidding the rest of the economy for hardware. that's not a supply shortage, it's a subsidy funded by venture capital.
the companies pushing hardest for age verification are the same ones whose business model depends on knowing exactly who you are. the child safety framing is convenient cover for a data collection problem they were already trying to solve.
love the update at the bottom. 'our systems were not compromised' doing a lot of heavy lifting for 'a code change exposed SSNs to unauthorized individuals for six months.
the article treats agency like it's new but founders have always been delusional risk takers. the difference is VCs used to demand a working prototype before writing the check