HNHacker News
TopNewBestAskShowJobs

ofjcihen

1,851 karma · joined September 4, 2023

Cybersecurity - Babysitter for devs

Vibecode makes emergency contract wallet go brrrrr

submissionscomments
ofjcihen··on Chained PHP2Shell exploit roots 25 servers, including US Government servers
Your ability to recognize snark is suspiciously selective too.

Weird.

ofjcihen··on Chained PHP2Shell exploit roots 25 servers, including US Government servers
What does that even mean?
ofjcihen··on Chained PHP2Shell exploit roots 25 servers, including US Government servers
They are, and again, believe it or not, more goes into it than “RCE bad”.

Ease of exploitation, feasibility do play a part which I’m sure surprises you.

ofjcihen··on Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers
Most goalposts I’ve seen say “bad but clumsy”.

Believe it or not in cybersecurity there are many considerations in how “bad” a vulnerability is.

ofjcihen··on America has lost 200k of jobs in media, film and the arts. How much is AI?
Sure, but that’s not what OP said is it?
ofjcihen··on America has lost 200k of jobs in media, film and the arts. How much is AI?
Hah…trust me, I’m old enough.

But not finding joy in anything is an actual sign of depression. Have some media standards declined? Yes, definitely. But by no means is literally everything bad now. You can still find plenty of non-formulaic media on streaming services.

ofjcihen··on America has lost 200k of jobs in media, film and the arts. How much is AI?
Honestly sounds like you’re just depressed. I don’t even mean that in a mean way.
ofjcihen··on AI-Assisted Paper on Z-Library Cites a TorrentFreak Article That Doesn't Exist
This is one of the worst legal takes I’ve ever seen. Well done.

I have no obligation to provide accurate or safe material for scraping. Intent is a non-starter here because nothing else is satisfied.

The only obligation here is on the LLM providers.

ofjcihen··on There isn't an easy exploit for this PHP vulnerability
It’s unfortunate but you’re correct.

There are a few “social media famous” cybersecurity folks really worth their salt who didn’t immediately dumpster their morals and skills at the first sign of an ego boost.

People like Krebs, Allison Nixon, Joanna Rutkowska.

Most of them though are just addicted to likes as it’s become a core part of their self worth.

ofjcihen··on Using thousands of AI agents to uncover new leads in biological data
Not stuffing every part of a number space into a sequence?
ofjcihen··on Feds suspect ransom negotiator ran ShinyHunters extortion site
A group of especially egregious, threat actors.

https://en.wikipedia.org/wiki/The_Com

ofjcihen··on Feds suspect ransom negotiator ran ShinyHunters extortion site
“Well then it’s a good thing I wasn’t paying a ransom but instead a pentesting fee!”
ofjcihen··on Feds suspect ransom negotiator ran ShinyHunters extortion site
No honestly, most of the time it’s very formulaic. You can usually tell how it’s going to go once you know who has your data.

For instance, what’s mentioned in the article about not dealing with COM actors is great advice because chances are they’re going to keep your data and sell it or use it for future extortions no matter whether you pay.

Other actors though have a reputation to uphold to get paid and they know it.

An example of the process is something like:

1. Notification by ransom operators Including proof. Negotiations start at some arbitrary number like 6 percent of reported earnings.

2. Negotiators notified.

3. Back and forth begins. “This isn’t really that much data, do you have more? It’s not that damning. Fine, my client is willing to pay 50k. 60k? Okay, but you need to provide proof of how you got I the data so we can close the gap”.

ofjcihen··on Feds suspect ransom negotiator ran ShinyHunters extortion site
Working in the IR space I’ve had a lot of opportunities to work with negotiators before. Most of them are extremely professional and worth their weight in gold for what they provide to their clients.

Ridiculous that scumbags like this are tarnishing that space.

ofjcihen··on Deepfake of Washington County, Oregon, Candidate Goes Viral Nationwide
I’m including all of the images linked in both.

And now that you’ve said that I’ve retried the same image 5 times and gotten AI 3 times and Not AI twice.

Something tells me that tools is about as reliable as Pangram.

ofjcihen··on Deepfake of Washington County, Oregon, Candidate Goes Viral Nationwide
That’s not the question. The question is “were they even there” before the “screenshot”.

As an example, I can screenshot your comment and have AI edit it to have you say “I really enjoy misleading people on the internet for money”, post it, and then say “I took this screenshot before they deleted it.”

ofjcihen··on Deepfake of Washington County, Oregon, Candidate Goes Viral Nationwide
Unless I’m missing something all of the pictures in the article and on X that it links to return as being AI generated?
ofjcihen··on Deepfake of Washington County, Oregon, Candidate Goes Viral Nationwide
“Before they deleted them” aka no way to check if this is BS.
ofjcihen··on Germany's far-right AfD: half a million internal documents leaked
Thank you. This is the typical response from these people when caught red handed.
ofjcihen··on DeepSeek banned from U.S. federal civilian agencies under new DHS order
“Completely disregarding security aspect”

Did you miss the part of my comment where I mentioned this would be the US’s version in your rush to reply as smugly as possible?

Maybe read the content of a response before responding.

ofjcihen··on DeepSeek banned from U.S. federal civilian agencies under new DHS order
Eh I don’t buy it. The framework for a US owned Deepseek is there and easy to put together. What isn’t there is the money.

My assumption is that money has been hitting the right pockets to make that not happen.

ofjcihen··on DeepInfer: High-performance inference framework for DeepSeek models
I mean what’s to argue about really? If the product can do what I need it to do at lower cost and much lower exposure why wouldn’t I use it?

The vast majority of operations don’t need SOTA anyway.

ofjcihen··on Germany's far-right AfD: half a million internal documents leaked
Are you just trolling?

The documents have been provided.

If you don’t believe it go and download the documents and grep through them. You act like 300gb is large. It’s not. The next FPS will probably be that big.

ofjcihen··on Germany's far-right AfD: half a million internal documents leaked
“Here’s the files so you can look for yourself”

“I refuse to and I’m still going to complain.”

ofjcihen··on Namecheap just seized and disabled all my domains
Hilarious because namecheap is the number 1 provider of lookalike domains that we see in our incident response actions.
ofjcihen··on Anthropic's proposed AI safety bill only kicks in if 50 deaths or $1B in damages
HN seems to have an incredibly poor understanding of what Mens Rea means or how it’s applied.

You don’t need someone to jump up, wave their arms and scream “I meant to do it!” to establish intent.

It can be established in any way deemed believable by a jury including repeating the same action that leads to a similar outcome multiple times.

It’s even been instructed to juries that they can find intent in the deliberate decision to not seek out the likely outcome of performing an action.

ofjcihen··on Tesla Roadster
Reading some of this feels like I’m having a stroke.

>This provides enough suction to hold the vehicle upside down, even when stationary.

Neat car though.

ofjcihen··on I Know Why the Mathematicians Weep
It’s normal to be one of 10k.
ofjcihen··on I know why the mathematicians weep
500+ is a lot?
ofjcihen··on I know why the mathematicians weep
I own my company and directly participate hiring. What’s changed among me and my peers is that we’re on incredibly precarious economic grounds with no telling what’s going to happen next month.

LLMs haven’t done much in the way of informing me or others I know regarding “who and how many”.

Page 1 of 23Next →