mmaunder

Edit: Deleted. Been oversharing a bit re research I'm doing, and the payoff is replies from folks who haven't bothered to go and take a look themselves, which I then have to spend more cycles refuting, etc. So best to just go back to the first step and not overshare and recover the cycles I'd spend on the rest of it. Admittedly I'm tired and pissed off, but yeah. HN won't let me delete this so I guess it's just a deletion edit. Sorry.

Thing about being in cybersecurity is you get to see outcomes that aren't a matter of debate or taste. For example, if I lock an agent in a jail and tell it to attack something and that the only way to win is to show me a number stored on that target, and it succeeds, then assuming our jail was effective, it's an outcome that isn't debatable. I've lost count of the moments I've had this year where my jaw just drops because I'm holding undeniable proof of a level of expertise I've never seen in humans - and that is far above human capability, in a field where I'm an expert.

So I guess from my perspective, it's not a candy store or candy. It's something that can solve problems we've never before been able to solve. Problems that are too hard for a human.

Another example: Recently one of our agents found a vulnerability so complex, that our team, who are experts in their field, could not understand it and had to ask an agent to write a blog post to explain it to them. It had more steps in the exploit than we've ever seen, and would never have been discovered by a human.

Cybersecurity is a leading indicator of what's to come in other fields. Leading because programming is something models are inherently good at. Doing wetwork in a lab is harder to plug into a model or agent. But it's on the horizon. So we will be seeing these kinds of breakthroughs in other fields, and the leading indicator says they're going to blow our minds.

If you think this stuff is candy, and you're relating it to social media, you're simply not paying attention or getting your hands dirty. And honestly if I wasn't hands-on, every day that passed would make me progressively more scared and more angry as it pulled away from me.

Thanks! Still going strong. Weirdly WP is growing. I suspect it's the structure and framework it gives agentic tools to build around.

I'm a cybersecurity 'expert' and my 40 person team and I make our money by providing GPL software to the world that I wrote.

You have the same incentive you had to share your work as before, and that is to get attention, and customers, assuming that's your game. Open code means no vendor lockin for a lot of customers, so they can pay you but also trust you to not extort them. And if you're hit by a bus your product lives on, and someone else can adopt it.

Supply chain risks and vulnerabilities existed before LLMs came along. They're easier to handle now that we have LLMs helping us. In our org the tsunami of updates we need to do weekly is far more easy to handle with LLMs.

Open code has always been easier to find vulns in vs closed. AI didn't change that.

Yeah the slopfest is real, but easier to deal with thanks to agents/LLMs so it kind of offsets itself.

Your licenses are still enforceable in court. Agreed that not being able to reverse the fact that AI trained on your code and is selling that capability kind of sucks. But humans were doing that before AI.

Yeah on the one hand opening your code got you credit which was nice for the ego and for getting paid, and AI trains on it and doesn't give credit where it's due. But on the flip side, we get AI! Which I frikkin love. I feel like a kid in a candy store. It's training on my code too and it's training on my content. And when people ask about what the best product is for our space, the AI tells them its our product. Woohoo!

Regarding the future: We have some really really big problems that need solving - stuff that creates a massive amount of misery in dark stuffy hospital rooms with crying relatives saying goodbye to their 9 year old child. I've been in those spaces and I'd give up the previous generation of open source ethics in a heartbeat to make just an ounce of that misery stop. The training that my code provides AI is a tiny little part of that solution, and I'm proud of that. Whatever I can do to push our capabilities to the point where we can make the major breakthroughs this species needs, I'm happy to provide.

It’s paywalled. Is anyone reading it before replying here?

LOVE this. Game changer in capability and it'd kill Resolve if they didn't do it.

A graceful pivot. Almost no tire noise.

Health determines the quality and quantity of time, so put that at the top above all else.

Making clear the scale of distillation they’re combating.

Frustrating for EU companies trying to stay competitive globally.

It actually doesn’t matter. Pick your favorite way of giving a dev access to capability on a remote server.

My dream was for MCP to allow services like ours (cybersecurity) to provide a self documenting endpoint with authentication, and we just give users a URL and it just frikkin works. Instead from day 1 it’s been multiple standards as they pivoted, a context hungry feature, and feels like a kludge. That burned the idea of MCP for me and I’ve had such success with local tools and APIs that it’ll take a lot for me to go back.

At the risk of angering the zeitgeist, destroying one or two or ten paper copies doesn’t make AI companies “become the only ones in the world with digital copies.”.

lol. Apache mpm event was released a year after Nginx and was horrible and only became stable in 2012, about 8 years after Nginx was released.

Oh my. Funny story. Kerry and I (the Wordfence founders) met at eToys dot com back in the day and she’s now my wife of 20 years. Anyway at eToys she ran the web QA team and I ran the warehouse management system in Europe. At eToys we had over 200 front end servers (for the memory needed for the number of concurrent processes needed to support the number of connections) and later that increased IIRC. We got together and started a string of startups. Feedjit was one of them and it would get over 1 billion modperl hits in a month on over 1M websites. We scaled it up with just rhe two of us with 6 servers using modperl with Apache on the back end and Igor released nginx just as we hit exponential growth removing our need to scale horizontally. Suddenly we could have a single front end box with nginx, reenable keepalive, and I had 150,000 concurrent tcp connections hanging off a single Linux box thanks to nginx and epoll in the Linux kernel. Massive game changer. The power of event based design vs threaded or multi process design.

Not absurd. Sometimes stair steps in tech do happen. And they will in AI.

The researchers who published Attention Is All You Need didn’t have the benefit of the LLMs they birthed. Take a look at the prompt that solved the Cycle Double Cover conjecture, and which has been adapted to achieve breakthroughs in cybersecurity. The field is entering a feedback loop that is leading to exponential innovation. We’re at the beginning of the curve. And right now the big iron data center approach is brute forcing the problem.

Remember when we needed 200 servers for an enterprise website because Apache used one process or thread per connection - and Nginx collapsed that into a single box overnight? That moment for LLMs is near. It’s going to move us from the big iron era of AI to small portable brains. Nature has already proved it’s possible with 20 watts and very little heat generation. And I think the data center buildout will end in carnage.

And I was comparing salmon farms to cattle feed lots in the USA, not saying “salmon feed many”. Wow that got hilariously off track.

Because of financial incentives. And it makes critics sad when films aren’t shot where their story is based. Saved you reading it.

Salmon feed lots, with a similar problem of concentrated waste, cruelty and unhealthy animals. Sounds like the underwater egg solution they discuss in the article might also be solving an optics issue they have. Out of sight, out of mind.

They’ve bred more docile salmon, according to the article. Getting that DNA into wild populations would be problematic I’d imagine.

“Each of the results cost roughly $100,000 in API cost to develop.”

And

“Over the course of a week, one Anthropic researcher worked together with Claude to develop the HAWK attack, and another researcher built a scaffold4 that allowed Claude to fully autonomously discover the AES attack.”

Spending $100k in tokens in a week is an impressive feat even with massive parallelization. I suspect the TPS their internal folks have access to is far higher than their bulk public endpoints.

There’s a tech aristocracy rapidly emerging in our society and it’s going to tear us apart.

Turns out sitting quietly in a room and doing math is worth more than all the money and network in the world.

Wonder how long until a leaker emerges. Incentives are strong for someone to do the right thing and get credit for doing it.

Had to read this one twice: “Projects "written and maintained with heavy use of LLMs".”

Isn’t that almost everything these days? If you’re using vscode or codex or Claude CLI you’re in that category.

The letter really dances around the issue that we don’t want to see a ban on the release and use of open weights foreign or domestic models in the US. If we do it will leave us at a severe competitive disadvantage in a global context. Many of us would consider moving our businesses out of the US to avoid being mired in a stagnant pond that reeks of government capture by a handful of corrupt laggards whose core competency is regulating away competition and killing domestic innovation.

Not seeing a long thread there. Is that the wrong link?

Seems that “oracle routing” is a term the authors invented. Also sounds like they’re sending requests to all routes but assuming the readers request will route to the “best” model. The closest thing to what they’re describing is semantic routing using a NN search in a vector DB to make a routing decision, but the efficacy of this approach isn’t a slam dunk.

Re local LLMs: “You avoid the uncanny valley where the model appears to be intelligent before doing something stupid; the stupidity is self-evident and this helps calibrate your interactions.”

Making the authors stance on LLMs clear.

Agreed re reasoning. I’ve seen this play out with 5x reasoning negating cost savings.