ericol

I mean, obviously this is not something they should be doing. But if they are doing it, it's because LLM analysis is happening on the other side of the wire, that is an even more interesting phenomenon.

Ha. Well, your message did send me through the WAF route myself, and with the help of Mythos (Yeah, I know) I managed to craft what appears to be a solid set of rules for Nginx that we ended up not using.

Besides that, also with Mythos I managed to build PHP 5.6.40 for Jessie (Don't ask) but that's an entire different story (we ended up force upgrading to Bookworm, and there's a huge silver lining for us with that anyway)

Which tests, and against which PoCs? The public php2shell kits already crash workers on stock 8.4 (8/8 crash, 0/8 shell) — so "turned into DoS" may be the status quo, not your result.

And firing the OOM is memory_limit working as designed, not exploiting a system.

Pix, or GTFO.

Preach, brother.

There's a difference between walking on the woods at night blind, and with a 20K lumens torchlight.

A successful universal exploit is all about making it land on the correct memory address for each set up, and that is nigh impossible.

As was stated by many groups that do this for a living (E.g., Crowdstrike) "PoC yes, RCE no"

Every single group I read published with the same caveats "RCE _in our labs_" as in, they knew a lot regarding the configuration of the system. Wiz themselves had an article out last week that stated "AI written, tread carefully" and almost all of them made no effort on distinguishing how the 2 vulns operated (Or, differed)

> claims they have an "universal" exploit

That's not correct. He claims they have A exploit. Based on the nature of the vuln, I assume every one that works in the are would be very careful to claim a universal exploit, and the comment by Mr. Guido seems to be align with that.

> This looks like a trap. We have a working RCE that would claim this, but I don't want to demonstrate that because it might leak what we built to others. We still have a window for people to patch and I don't want to risk that.

So what he seems to be saying (My interpretation) is "I don't want to demonstrate thus risking giving ideas to other people regarding hhow to build exploits"

The steal my bitcoin exploit works for a specific stak, and that is the reason why the person that set that up did publish certain information in the site itself (reduced phpinfo)

Care to share it? Still trying to convince my provider to go this route...

The very first line in the repository says:

> Any window from your Mac, on your iPhone and iPad.

I don't think it can get any more clear than that.

I'm from the area where this happens (My city is actually named in the article).

Can confirm that this is, effectively, a staple of normal life around there. Calling it "the first social network" made me chuckle.

Younger generations might not be aware of this mostly due to reduced AM radio audiences, but my daughters (3x ~30 yo) do know what this is about.

yeah no thank you. There's no way in hell I am going to share with you any sort of document.

Both Player of Games and Use of Weapons are incredible good books.

I was actually surprised when I finished UoW regarding how different it was from PoG, while maintaining the quality (If not better, but PoG IS THAT GOOD anyway).

For the record, the series was recommended to be by Claude of all things, and it told me that Phlebas was not up to quality but I gave it a shot just for the sake of completeness of the series. Nop, not worth it.

It was book 3 precisely that held me down. It was too long, and kind of lost the pace of the previous 2 books.

It was too repetitive.

> people will soon *stop paying

Think you missed a word there.

Somebody somewhere here gave a list that had "consider Phlebas" in it.

That particular book bored me to death, but from the same author / series I recently read "Player of Games" and "Use of Weapons" and I can't recommend (both) enough.

Dungeon Crawler, I started the series recently but got bored mid 3rd book. It is quite more denser than the first 2, and it feels like never ending.

> Consider Phlebas -- Iain M Banks

I started The Culture series a while ago. I read both "The Player of Games" (amazing book), and "Use of Weapons". Also amazing, with a Memento-like storytelling that was also incredible. I did enjoy both books a lot for different reasons, I can't vouch for any over the other really.

I then moved to "Consider Phlebas" and honestly, got bored to death. So my recommendation is to go for these two as well.

I recently (This month, bought a recent "deluxe edition" of sorts [1]) re read Neuromancer, and then jumped to "Count Zero" but at some point got bored mid way with Gibson's endless descriptions of non things.

[1] https://www.amazon.com/dp/B0GGGZSNXQ

So we're back to clippy now, LLM powered.

Not sure if the same product. I think the one I used was Google Desktop.

I even hacked it for a company I was working for at the time: I installed it in a machine that had a lot of pdfs from some other client company of them.

I don't recall the exact details, but I did some sort of proxying between the Microsoft Web Server that came with NT? at the time and G Desktop, and then an entire team of first support agents had almost instant search across all those docs. Good times.

Yeah, I agree, but what I am challenging is the idea that creativity IS the moat.

If anything, there are several _moats_ with Creativity (Big C) being one of them.

I think the moat(s) is anything the models still are nowhere near performing on their own, OR, getting them to do that is seriously expensive.

I don't know about Astra, and have used Fable 5.1 only slightly (And burned 85% of my 5 hour quota in 1 prompt).

In my experience, LLMs are completely devoid of "thinking outside the box" capabilities. And I'm not talking about 6 thinking hats type of stuff, but slight of to the right field lateral thinking. Something a 6 year old does for fun when playing with their mates.

If this weren't so, we wouldn't have been through so many "<buzzword> engineering" in such a short amount of time.

OK, but what about a pelican in a bycicle.

It doesn't define one.

On other news, water wets.

> I often hear people use the words agent and model interchangeably

_what_ people. Would I hear one of my colleagues do this, I'll slap them across the face. With a 4 pounds salmon. Alive.

> to help us have more precise conversations.

What problem are you trying to solve. _Why_ you need more precise conversations. I mean, I understand what you aiming at. But is it really worth it to go nitpicking at people's mental models, is the gain worth it?

I had Fable bail on me because I used the word autopilot on a project. Changed to something unrelated, and off we went.

The problem is that they are not solving the problem they ought to be solving.

I don't want Shakespeare, I want Bob the builder.

Half of my work is telling claude how to behave. I'm pretty certain they have enough _data_ to realize people do the same thing time and time again.

Check this comment of mine for a better explanation of this: https://news.ycombinator.com/item?id=49413353

> You ever read a work of literature with such flowery language that right after you've read a paragraph, you pause and realize you have no clue what you actually read, only to read the paragraph maybe a second or third time and have your mind space out again and again on each successive attempt?

Any recent work by William Gibson matches the description.

The way I managed to get claude to stop doing this is telling it "This document is for you for later use, no need to over explain things or extra verbosity"

I'm not sure about the x, but the first thing that arises from that is, I feel like in my case it's way higher than 2.

The 2nd thing is, how do I measure that.

---

In my case, the details of my work (Kinda DevOps, kinda Senior Dev) makes it that having an LLM to do the heavy lifting allows me to do things not only faster, but better, and across domains I do not hold expertise on.

An example of the effect of LLMs in my daily work is that I'm in the middle of a PHP upgrade for a rather large legacy application, and the "heavy lifting" is really out of the scale, letting me concentrate on what really matters, while at the same time if I do keep "the harness" tight I'm certain the results are the correct ones. Also correcting course is just as cheap.

Not having to worry on the tooling on exchange has the incredible desirable result of my velocity being incomparable to what it was before.

Then we have the side effect of how easy to do transfer knowledge: Rather than telling the QA guy how to do the work specific for this task, I defined a set of files (.md documents, skills, an off-the-shelf customised MCP server) that assist QA into doing the work in a way that helps me do my job better and faster.

There's also a clear possibility that what I'm doing will expand to the rest of the team I am in, completely altering the way in which we approach development.

If we take 'x' as 'mileage', yours might vary. Mine has, and I'm baffled at the positive net results I AM getting.

Also, this what I do (coding?) is extremely fun again.

Being able to work close to the speed of thought is the best high.

Dude. Not even your blog post is clear enough. I had to right click one of the images and open it in another tab in order to be able to discern _anything_ on the image.

I don't think that works at all times; actually I think it only works when starting a conversation. In the middle, "Why ~did you~ while action as an export in Lisp <this happened>?" needs a certain level of mind gynmastics that is not worth it. I'd rather curse at it.

ok that cracked me. Could be worth of an update:

    I don't know what machine they were raging against, but I'm pretty sure it was an LLM

Nice read, but having your home page play music is incredible rude.

I don't need a computer to mimic a human. AT ALL

As a matter of fact, for the line of work I do (programming, devops, the works) being conscious about the fact that I am just getting an algorithm outputting text that is probabilistically related to the input I gave it would actually be healthy for me and my mental state.

I HATE having to say "you" when working with an LLM.