HNHacker News
TopNewBestAskShowJobs

ipython

5,858 karma · joined August 20, 2014

submissionscomments
ipython··on NSA publishes guidance for strengthening AI system security
This is exactly the advice I give my customers - treat the llm as an untrusted entity. Implement authentication and authorization at the data access and api layer and ensure there is a secure side channel to communicate identity information to backend resources.
ipython··on John Carmack reflecting on the firing of Palmer Luckey
There was also the ZeniMax v Facebook trial and $500m judgement: https://en.m.wikipedia.org/wiki/ZeniMax_v._Oculus

But of course it sounds way more sinister if you tie his political donations to it.

ipython··on Discovering the xz backdoor with Andres Freund [audio]
The point of the article though is not about the technical details, it's a human interest story. It's about a guy, working in obscurity on an unrelated topic, stumbling upon what is arguably the biggest story in tech so far in 2024. I still don't see how this shows "low standards" as I don't see any factual errors in the article.

As a technical person, I did not feel patronized by the article. My non-technical wife forwarded it to me, and she also did not feel patronized by the article. If he said "you're too stupid to understand", then, yeah, that'd be patronizing.

I'll just conclude this way- when I used to sit in IDA Pro all day reverse engineering malware, I didn't expect to carry on a conversation with a perfect stranger talking at length about the intricacies of static and dynamic analysis. I have myself made similar comments about how my job involves staring at thousands of lines of assembly code and that would probably be mindnumbingly boring for them. We both have a laugh. Sometimes they do have an interest, and I can make it sound really interesting by focusing on the outcomes of the work rather than the toil and frankly mindnumbing grind; but other times, they say, yea, that sounds crazy, and we move on.

Nobody ever felt insulted- it's as they say "different strokes for different folks." I have had folks in other fields say similar things to me about how I would find the details of their work boring. A lot of times I am intrigued and hold a conversation to learn more, other times I agree and move on. At no point am I offended or feel patronized, though, because I am confident that if I truly cared I could learn more myself or ask questions.

ipython··on Discovering the xz backdoor with Andres Freund [audio]
I don't understand the hate for the article. The article is written for a layperson audience, where the technical details would absolutely be eye-wateringly boring. Instead, the article (imo, correctly) focuses on the human side of the story: the fact that a highly detail oriented developer, working on unrelated software, stumbled across a small discrepancy in their measurements, triggering a series of events that led to discovering what is arguably one of the biggest attempted supply chain attacks since Solarwinds.

I don't understand what people wanted to be covered in this article? At what point would there be sufficient technical detail to suffice yet still keep the layperson interested enough to read the rest of the article?

On the other hand if you feel somehow slighted by the flippant attitude in the article, give it a rest! Why are you so sensitive? It's not like he's personally insulting you! The tech community is hardly the underdog any longer, so let's just take a joke once in a while, no? As President Eisenhower quoted[0], "Always take your job seriously, never yourself"

[0] https://www.eisenhowerlibrary.gov/sites/default/files/file/w...

ipython··on JPMorgan to sell customer transaction data to advertisers
I wonder if this is a reaction to the push to reduce interchange fees for credit cards by creating a new revenue stream that offsets the proposed changes. See https://handsoffmyrewards.com/
ipython··on GCC 14 Boasts Nice ASCII Art for Visualizing Buffer Overflows
Just skip the useless phoronix article and go direct to the source: https://developers.redhat.com/articles/2024/04/03/improvemen....
ipython··on Flightradar24's new GPS jamming map
No offense to you but that man’s argument has strong “I beat my wife because she deserves it” vibes.

The US has made more than its fair share of policy missteps. But to try and argue that the actions of the US somehow “forced” Russia to invade its neighbor and former satellite state to rid it of “nazis” (Putin’s quote not mine) is absurd.

ipython··on Flightradar24's new GPS jamming map
There are plenty of Russian apologists in the US as well, unfortunately
ipython··on Report on the Censorship-Industrial Complex: The Top Organizations to Know
I guess we all forget how to truly eliminate speech you don’t like: befriend a billionaire and sue the source of the unwanted speech out of existence (ref gawker).
ipython··on From anxiety to cancer, the evidence against ultra-processed food piles up
That was an npr headline. https://www.npr.org/sections/thetwo-way/2016/09/13/493739074...
ipython··on ASCII art elicits harmful responses from 5 major AI chatbots
The chatbot is a reflection of the entity that hosts it. See for example the judgment against Air Canada. The cost to host a chatbot to the public is significant so most of these will be hosted by a large corporation.

Therefore the corporation hosting the chatbot expects the chat bots speech to be “aligned” with its corporate image. Chatbots are not public goods. The sources you mentioned have their own editorial styles and the anarchist cookbook is a reflection of the values of its author just as much as chatgpt is a reflection of OpenAI’s.

I like diversity and this is one of my concerns is we basically turn the information ecosystem into the mental equivalent of grey goo due to the proliferation of mundane, inaccurate AI generated content.

ipython··on [dead]
What does it mean to “invest” in Bitcoin? What are you investing in, exactly?
ipython··on What's worked in Computer Science: 1999 vs. 2015 (2015)
Fascinating about how ARM has made tremendous strides in the “high end” market since 2015. I would argue that I would categorize RISC as a “yes” with its absolute dominance on mobile and now moving into data center not to mention all the embedded use cases.
ipython··on Pilot of Boeing flight says he lost control after instrument failure
It’s one of those situations where the latency, packet loss and jitter really does kill you!
ipython··on Open Policy Agent
Curious what folks think about this versus cedar (https://www.cedarpolicy.com/), the open source policy engine behind aws verified permissions.
ipython··on Claude 3 claims it's conscious, doesn't want to die or be modified
This is what the ai researchers in the 50s were saying after releasing Eliza…
ipython··on Claude 3 claims it's conscious, doesn't want to die or be modified
I’m not a particularly religious person but I’m running to Jesus if the future of the world includes worshipping LLMs, tyvm.

This is absolutely absurd. The model has been trained on thousands of lines of ai short stories. No wonder it parrots back its “consciousness”. We are just staring at a reflection of our own creative writing.

ipython··on AI-Generated Data Can Poison Future AI Models
This reminds me of how fascinated I was as a kid of the artifacts you get from recursively photocopying a piece of paper.
ipython··on Microsoft confirms Russian spies stole source code, accessed internal systems
So once again you turn this back into a Hillary Clinton conspiracy theory. I guess theres no moving on from something that happened seven years ago now. Last I checked, the guy who was running against her won and Obama peacefully transferred power to him.

Glad you’ve had an interesting life! Best of luck in your future endeavours.

ipython··on Microsoft confirms Russian spies stole source code, accessed internal systems
I’m not sure how this shifts blame? In my opinion the blame sits squarely on the shoulders of the entity whose systems were exploited. Microsoft is responsible for the security of their systems, full stop. Doesn’t matter if the GRU did it or some random guy in Venezuela.

How do you know Microsoft was even “hacked”? I mean if you want to get super pedantic about this, I haven’t personally seen any proof.

So yes while a computer provides a convenient mathematical abstraction upon which we can reason, we aren’t talking about how a computer boots. We are talking about figuring out - within a certain confidence level - the group of individuals that likely carried out an attack. We are now firmly outside the scope of the neat little mathematical abstraction of the machine. Even within a machine, there’s more nondeterminism than you or I would like to admit. But that’s a topic for another day.

The methodology is not secret, you can google for threat actor attribution. Private companies do this work as well as governments. You are welcome to go join one of those companies or organizations to learn how it works and work to improve the process if you are so passionate about it!

You are the one putting some political agenda on this. China, Russia, as well as North Korea, Israel, Iran, and many other countries have robust offensive cyber capabilities. Attribution is not an exact science, and if you actually read any raw intelligence report it is clearly marked with a confidence level for that exact reason.

ipython··on Microsoft confirms Russian spies stole source code, accessed internal systems
You’re doing your own hand waving. Why does a computer in Venezuela make the trail go cold? I could have an agent working for me passing me customer lists from Venezuelian colo facilities. Combine that with knowledge of known shell entities who also operate from other points of presence and I can make inferences. If I want I could then use offensive techniques to own the middle box and enhance my confidence level by observing traffic/stored data on that machine.

Look I can’t summarize how threat actor attribution works in a hacker news comment. Does that mean the people who do it are quacks? Nope. I know people who do it, who build tools to help, and they are exceptionally sharp technical minds.

And I see you have casually dismissed an entire industry because you may not understand how someone could draw conclusions from imperfect data?

Hate to say it but this happens all day every day as human existence is filled with imperfect data. Not everything can be summarized in a neat mathematical form.

Does that mean you don’t try? I choose to try my best and continually improve methods. Otherwise what’s the point? Just give up because we can’t model human behavior and geopolitics as a pure functional state machine?

ipython··on Microsoft confirms Russian spies stole source code, accessed internal systems
You’re overstating the technical capabilities at scale and understating just basic investigation techniques.

“Buffering” absolutely happens for a variety of reasons.

Tracking down the money or owning the operations infrastructure of the hosting companies along the way can help. Try to expand past bits on the wire- people set this stuff up at the end of the day.

ipython··on Microsoft confirms Russian spies stole source code, accessed internal systems
Take this wildly simplified example. You are the attacker. You already have access to internal systems at Microsoft.

Now you need to send the large amounts of data back to yourself, preferably without giving away your own location in the process. That’s the exfiltration phase of the cyber kill chain.

In order to do that, you’ve already established a set of listening posts and command/control sites across the internet. That’s your infrastructure. Setting that up in a pseudo anonymous way is hard, so you don’t do it often and may need to reuse it for multiple targets.

It’s that infrastructure that is hard to replicate if you’re trying to “look like” another threat actor on the Internet.

ipython··on Microsoft confirms Russian spies stole source code, accessed internal systems
Attributions are about more than the code flow. You also need infrastructure to funnel exfiltrated data back to yourself.

As you can imagine, it’s harder to reuse someone else’s infrastructure. Easy to copy code patterns but you can’t exactly reuse domains, listening posts etc.

ipython··on Sweden Is a NATO Member
That’s silly to say considering the one and only time article five was invoked was by the USA after 9/11.
ipython··on U.S. students will take the SAT online
Sounds like you should have bled all over the computer and let them deal with it. The lack of empathy they showed is abhorrent. Ugh. I’m sorry to hear that.
ipython··on Cloudflare Announces Firewall for AI
Don't worry, we're speed running the last 50 years of computer security. What's old is now new again. Already looking at poor web application security on emerging AI/MLops tools making it rain like the 90's once again; then we have in-band signalling and lack of separation between code & data, just like back in the 70s and 80s.

I totally get your frustration, it's because you've seen the pattern before. Enjoy the ride as we all rediscover these fundamental truths we learned decades ago!

ipython··on Cloudflare Announces Firewall for AI
To be fair, it the most honest product description available. A traditional WAF is - at best - a layer of security that is not guaranteed to stop a determined attacker. This service is the same - a best effort approach to stopping common attacks. There is no way to deterministically eliminate the classes of attacks this product defends against. Why not try and undersell for the opportunity to overdeliver?
ipython··on Cloudflare Announces Firewall for AI
I'm not agreeing with Gemini's output, just to be clear.

However, isn't this a signal that we shouldn't subrogate our own ability to think and make decisions to some set of floating point weights out there in the cloud somewhere? I think we're learning the wrong lessons here; I care less about what some AI "thinks" about politics or current events and more about keeping our own ability to critically think and reason in the face of dissenting views.

Former NYC mayor Ed Koch said, "If you agree with me on 9 out of 12 issues, vote for me. If you agree with me on 12 out of 12 issues, see a psychiatrist." Put another way, there is no way for any single LLM to achieve 100% agreement across all political spectrums for all people. We will see balkanization of this market as LLMs take "sides" and are aligned to different viewpoints, it's the only way out of this mess.

ipython··on Cloudflare Announces Firewall for AI
Agreed! And it was a good ruling IMO. You can see the tribunal's decision here: https://decisions.civilresolutionbc.ca/crt/crtd/en/525448/1/....

IMO it boils down to, your web site, including interactive elements (such as a chat bot), should reflect accurate information about your brand. If your chat bot goes off the rails and starts insulting customers, that's bad PR and can be measured in lost business/revenue. If your chat bot goes off the rails and starts promising you retroactive bereavement fares, that's a potential legal problem and costs $$$ in legal fees, compensation, and settlements.

There's a common theme there, and it's $$$. Chat bot saying something bad == negative $$$. That's kryptonite to a commercial entity. Getting your rocks off to some random business' LLM doesn't make $$$ and in fact will cost them $$$, so guess what, there will be services that sell those businesses varying levels of assurance preventing you from doing so.

← PreviousPage 20 of 34Next →