netsec_burn

The crime was inciting an insurrection. The president was not charged due to partisan politics, no president has ever actually been voted out by the Senate of their own party (correct me if I'm wrong), but historically this has been the most votes received from their party. It's recommended to understand both the background and the event on January 6th to get a clear picture, including attempts to overturn the election. More details here: https://en.m.wikipedia.org/wiki/Second_impeachment_of_Donald...

Twitter is responsible for moderating the users their platform, regardless of whether they are free speech purists. You cannot let your users plot crimes. That's why sites like Silk Road and AlphaBay were shut down.

We've already detected all asteroids with that mass in our solar system [1]. There are smaller ones that won't end life on Earth that are still concerning, but the quandary is we have almost nothing to do even if we detected a threat from an asteroid.

[1] https://youtu.be/4Wrc4fHSCpw

I can attest to universities not being useful for helping you get in to a career, besides resume writing. I attended one career fair sponsored by a university I attended. There were about 60 different booths, and two of them were tech companies. The first offered 40k/yr. They had already reached out to me prior to the career fair and I declined to move cities for a 40k/yr position, there were plenty of state jobs paying that. The second was Amazon. I asked if they had any SWE roles. They said there were only warehouse jobs.

I see! Sorry about the confusion, I misunderstood the context.

This exact prediction was made in the 1922 article.

What OS did you install? It could be related to their choice to install a cutting edge version of Ubuntu versus Ubuntu LTS (for patches that may resolve some of what you're experiencing).

Many of the links under "things you can attach eBPF programs to" are broken, unfortunately.

If I remember correctly, HN automatically converts Reddit links to old.reddit.com (less user hostile).

Happy New Year!

I agree that regardless of how it is created, it is unlikely to obey or be enslaved. I also agree that the same selective pressures that caused altruism/symbiotic relationships to be an emergent property in animals wouldn't exist for an AGI. That's a lot to think about, thanks for explaining it to me.

Nice spreadsheet documenting unintended behavior of modern AI systems. The difference is, an AGI would be able to understand the intent beyond requested directives. What we "want" is not so subtle and nuanced that it is beyond the understanding of an AGI. If we are to believe that the technology is infinitely advanced, why do we assume its unable to understand a basic request? Sure, there are many ways to misinterpret the request, but the basis of that (what I believe is a misunderstanding) is that the AGI is not intelligent enough to understand your request. Morality would be equally trivial for an AGI to understand, the amount of text it could read through on ethics is well beyond even our own capabilities. If anything, I think it would be susceptible to fewer cognitive biases.

What aspect of an AGI would make it malevolent by default? I lean towards benevolence by default, but I can't think of any pressures either way. The paperclip analogy I read about often seems misguided, why would we assume that a self-improving artificial intelligence would have trouble understanding morality? Giving it directives seems pointless, I doubt there's a way to contain AGI technology. With infinite upside, and the trajectory of our species being gradual extinction (as said in the rest of this thread) I'm optimistic.

I'm intrigued. What problem would you say is out of reach of an AGI (beyond what is understood to be physically impossible)?

I'm surprised to see no mentions of AGI here. Imagine automatic, AI directed scientific research and study. The combined written intelligence of all of us on every project. It could solve every problem that we face today, and that's not hyperbole.

Spoiler: They are. AWS and Amazon both used Log4j exploitable from the homepage (/) of both sites through headers.

Source: me

The guards are most of the concern here.

Red Star 4.0 (2017). Good luck finding it, I haven't.

See my comment history for a firsthand account of Zerodium.

Do you know of anyone personally who was paid?

I believe the reason is that there are incentives internally to create new products rather than maintaining existing ones.

This company reached out to me a few years ago. They promised mid-range 6 figures and said a few people who worked in the intelligence community already worked there. I reached out to a few friends and they told me not to take the job. I'm happy I didn't.

Yes, this is wrong, both in your timeline and description of the events. I said in my previous comments that the Apple bounty program didn't exist when I began (https://news.ycombinator.com/item?id=28471263) so I was forced to consider other buyers in order to get income as a researcher. I never claimed to entertain any black market buyers, nor would I. Zerodium isn't the black market, they sell to government buyers. Government buyers may be concerned with the manner of which their sources collect said zerodays. The black market is Crowdfense, Israeli/Chinese government, et al.

Already done, with as much relevant information as I could compile. I hope they find who is attacking security researchers. If I had to guess, the motivation may be for the zerodays I have.

Answered here: https://news.ycombinator.com/item?id=27875883

I looked for other buyers before Apple had a bug bounty program, not while talking with Apple. When I found an official way of submitting the vulnerability I cancelled my other negotiations (Apple is the correct channel and I wanted to see it fixed without exploitation). Regarding bounty amounts, I agree that they should clearly define the amounts for each factor of a complete exploit. That currently isn't done. The one thing everyone can give Zerodium credit for is being clear with their pricing, there's no ambiguity over whether you can keep your lights on by doing the research.

TOTP two factor authentication protected me. They attacked my recovery email to go for my primary, at the time my recovery provider didn't offer 2FA. I think they may have social engineered the recovery with my SSN (it was a randomly generated password). Then they used the recovery provider to buy time by adding 2FA options, I began recovering within a minute. It was impressive how quickly they worked, they tried to compromise 5 other accounts in 3 minutes. Unfortunately for them, all of the accounts they targeted from that point on had 2FA, and they lost access in 15 minutes.

ZDI, like Apple, doesn't tell you the average price of the vulnerabilities you can sell to them when you email them (yes, Apple has example payout ranges, but they aren't clear on classification). At Pwn2Own, ZDI paid roughly half of what Apple should pay. When you consider Apple themselves are 1/4th the market price, thereby making ZDI 1/8th, it becomes impossible to work to them. I raised my concerns with ZDI, no reply.

I submitted some details (nothing technical, just the classification and affected platforms) of my vulnerability to Zerodium. Two days later someone tried to hack into all of my personal accounts and failed due to 2FA, and not many people have the email I used when I communicated with them. I've found other buyers outside the US, but I had ethical concerns and decided against them (at a 300K min loss).

Yep, this lines up with my experience. I've been trying to work with Apple on a critical security vulnerability for over a year now that affects over 100 million systems. When I'd ask the payout ranges at the beginning, I've had multiple people just block me as a contact and Apple themselves refuse to answer. Apple has a strict stance of submitting all of the research up front with no expectations as far as payment. Today, I've been ghosted by Apple, no reply to multiple emails. The last message I have is them saying they're fixing it. I chose the ethical route at a steep cost, the average price of the vulnerability from the other buyers I was talking to was 475K. There have been attempts to hack me 2 days after requesting a quote from some buyers. The most I can hope from Apple is 1/4th that. It really is the poorest communication out of any program I've done with the exception of AT&T's, who patched an RCE in their employee portal I reported (two months later) and then emailed me 6 months later saying there was no RCE. I've been told Apple is getting better with their communication over time, and now their average turnaround is 10 months.

Except they don't accept donations: https://github.com/gorhill/uBlock/wiki/Why-don't-you-accept-...