HNHacker News
TopNewBestAskShowJobs

rocqua

9,896 karma · joined June 25, 2016

[ my public key: https://keybase.io/rocqua; my proof: https://keybase.io/rocqua/sigs/AD9P-qxDGGDOohLYLbex3ZY3mUsdH4wAEMxYDgnxXAE ]

Currently working for TNO in the department Cyber Security and Robustness.

submissionscomments
rocqua··on Binance-hacker-1029 – $5.6B stolen from Binance
Except that plenty of exchanges can also blacklist a wallet, and then block transactions that include funds that (indirectly) come from those blacklisted wallets.
rocqua··on Binance-hacker-1029 – $5.6B stolen from Binance
Frozen funds remain frozen, until they are unfrozen.

So mechanically Tether pockets the difference, unless they unfreeze. But as a matter of accounting, because of the unfreeze capability, the liabilities of the frozen Tether stay on the books. So they can't just spend the money. It also makes it hard for Tether to compensate the victims from the frozen funds.

The alternative would be to let Tether burn funds, but that is highly problematic for well intentioned users. Because a freeze can be challenged in court and reversed. A burn cannot.

rocqua··on Binance-hacker-1029 – $5.6B stolen from Binance
Russia uses crypto for sanctions evasion and money laundering. They also indirectly profit of it from their domestic ransomware operators using crypto. But Russia does not gather state funds through hacking. That is pretty much uniquely a North Korean thing.
rocqua··on Binance-hacker-1029 – $5.6B stolen from Binance
Did you do the bankruptcy proceedings? They payed out quite well.

Turns out there was decent money to be made in having your MtGox Bitcoin stolen.

rocqua··on Code-execution flaw in UEFI firmware threatens most servers on planet Earth
An interesting part of this is actually in defeating secure-boot or bitlocker. If a device is misconfigured for PXE boot with an otherwise locked down UEFI system, and strong secure boot. This could let you break the boot-chain and then disable secure-boot or extract keys from a TPM.

The main question here is how often devices you'd want to try this against have PXE boot enabled. I'm thinking of locked down laptops mostly. Either corporate laptops, or manufacturer locked-down devices (chromebooks, I think some microsoft surfaces).

rocqua··on Code-execution flaw in UEFI firmware threatens most servers on planet Earth
Even if there is a passphrase, this would likely allow for brute-forcing it.
rocqua··on Code-execution flaw in UEFI firmware threatens most servers on planet Earth
If you want to filter this, you should probably do that at the network level, not the host level. Ideally at switches, otherwise with firewalls.
rocqua··on Three new discoveries in mathematics, computer science, and physics
It's not the type of problem where a useful solution can be verified in Lean. Which makes LLMs a lot less good at solving that type of problem.
rocqua··on Kimi K3.1 Pro and K3.1 Pro Highspeed
I think the implication is heavy distillation.
rocqua··on Every AI model has the same "controversial" take on humans
only if you tell it to be controversial.
rocqua··on Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds
In practice we have Certificate Transparency Logs that let us check whether a CA has issued a certificate for a domain you control without you asking them to.

This really reduces how much we need to trust the CAs, because we can detect any untrustworthy actions after the fact. Now detecting after it happened is too late. But it does mean that mistakes or malicious actions are much more expensive to a CA. In practice this has really reduced the risk, especially to those whom aren't interesting enough to burn a valuable capacity on. Which is the vast majority of people. Though perhaps if you count TLS traffic weighted by importance that count is different.

rocqua··on Do dentists know what they're doing?
The thesis behind private equity is: people from finance can run small business better and more efficiently than small businesses owners.

A small part of that is more efficient administration. But the bulk of it is squeezing the customers harder, and squeezing the business for credit. Sometimes combined with a sector roll-up causing a monopoly.

Trust busting would help a little. But a lot of the pain comes from the squeezing of customers. And that’s much harder to fight back on, other than avoiding private equity.

rocqua··on Terence Tao: Math 2.0 [pdf]
These runs are very likely also going to be a part of Reinforcement Learning and internal distillation no? As well as being analysed for what reasoning directions worked well, and which directions did not work well.

The mathematical results are valuable as PR, but the real value might be in the improvement this can bring to other training runs.

rocqua··on Improper redaction reveals Google Data Center water and electricity usage
It’s not ‘spare goes to training’. These data centres are training first. Inference is really rather efficient, so not why datacenters are so big.
rocqua··on So you think you could be an electrician?
I think it’s just that the dangerous jobs are avoided y those who can avoid them. So they are left to those who have little choice, which depresses wages. This is rather immoral, but Covid made quite clear that the essential jobs weren’t the high-status or high-paying ones.

I find this worrying because the entire economy is built on the idea of cheap physical snd cheap unskilled labor. So if we do a good job educating, we’ll need to fill these jobs by paying more rather than preying on the desperate. And I don’t see the current world being willing to pay more.

rocqua··on Why the Bronze Age Collapsed
After the Bronze age collapse, the Roman Empire rose. Once that collapsed it also took a very long time before another big empire arose (with perhaps a brief exception under Charlemagne).

It seems instead that the process of building a bureaucracy that can support an empire is tough. And that the conditions left behind after an empire collapses are particularly tough to re-consolidate under another empire.

rocqua··on The Advisory Group on Mathematics and Artificial Intelligence
Presumably OP believes that software engineers went to far in the direction of “started worshipping the machine god and loudly claiming their whole field is solved.” Certainly within software engineering there is much louder voices on that side of things. By now the voices saying that it’s useless have pretty much died out. But it seems quite reasonable to say that the wider software community didn’t “come together, assess the situation, and calmly, empathetically, and rationally act.”

One might argue that this is due to size of the software community, or commercial interests. But I do believe OP was right in his description of the response of the math community as different from the software community.

rocqua··on How An AI math breakthrough ignited a controversy
It seems very hard for OpenAI to prove that independence. Since they seem unable to exclude the possibility that their model was trained on transcripts by the two mathematicians.
rocqua··on Ubisoft's FOR HONOR will block SteamOS / Linux players starting September 10
It’s extra hard on Linux because the amount of ways you can reconfigure a linux machine to work around boot- or root-kits, the ways you can modify a running process, and hide what is happening from an existing process.

Really, linux is meant to give you control over the software that runs in your computer. Anti-cheat is inherently about limiting what you can run on your computer. Windows is much more aimed at allowing you opt in to hard limitations.

rocqua··on Iceland votes on whether to restart talks on joining EU
Trumps short term actions will have long term consequences on the alliance. Specifically on how the alliance views reliance on the US. Trump has shown how unreliable an ally the US can be. Putting that cat bag in the bag doesn’t reverse the realisation that there’s a cat in that bag.

This will likely strengthen NATO in the long term. But only if it doesn’t get tested by Russia in the short term.

rocqua··on Nvidia agrees to acquire Hugging Face for $13B
The worry is not that Nvidia isn’t open about their models.

The worry is that Nvidia is trying to control the way you run those models. Trying to bake CUDA assumptions into model design, and pushing the software ecosystem to be as Nvidia first as they can.

rocqua··on Startup founders urge U.S. government not to shut off Chinese open weight AI
Your looking at this from a legal perspective. Consider a diplomatic one instead.

Model training is expensive. Model distillation is cheaper. If you train models, and that lets your adversary distill them for much cheaper, that gives your adversary an advantage. Giving your adversary an advantage is bad, so you address it.

It doesn’t matter whether the advantage was gained legally, not even if it was fair. The advantage in and of itself is bad, and sufficient reason to act. You couch it in less nakedly power hungry terms, but this is the reasoning.

rocqua··on OpenAI and Hugging Face address security incident during model evaluation
It’s more like eating your own fiber supplement in public, and then shitting your pants and telling everyone about it. Sure, it’s embarrassing. But it shows how potent your product is.
rocqua··on LoRA Speedrun – a public wall-clock leaderboard for fine-tuning techniques
I especially wonder about the quality of N big models in a delegation harness against M smaller models in a delegation harness with N and M tuned to use the same amount of total compute. (So a few agents of big models against a lot of big models). I wouldn't be surprised if the advantages of delegation and the corresponding compression of context outweighs the lower quality of the smaller models.

Or put differently a wide exploration of long chains of obvious insights might be more valuable than a more narrow exploration of shorter chains of deeper insights. But perhaps that is a wrong sense of the difference between a small model and a large model.

rocqua··on The EU is about to sell our most sensitive data to the US for visa-free travel
https://travel.state.gov/content/travel/en/us-visas/tourism-...

It states regarding a visa: "A visa allows a foreign citizen to travel to a U.S. port-of-entry (generally an airport) and request permission to enter the United States. A visa does not guarantee entry into the United States.

The Department of Homeland Security (DHS), U.S. Customs and Border Protection (CBP) officials at the port-of-entry have authority to permit or deny admission to the United States. "

rocqua··on The EU is about to sell our most sensitive data to the US for visa-free travel
Under the assumption that this framework is somewhat sane and only shares biometric data of those people who actually request an ESTA, I don't see the issue.

This data already leaks whenever you travel legally to the US, because they take it from you as a requirement of entry. All this does is let them check the data they take on entry against the provided data. Which seems fair. The fact this data is already in passports is a very different matter, but that is something the EU has done voluntarily.

rocqua··on GPT-5.6 used a prompt to close a 30-year gap in convex optimization
That's a valuable extra distinction between Mathematics and Software.

In Mathematics there is much more clarity on what question you want to answer. It's much less likely you get an answer to a question, and then realize that the question was useless. Whereas in software its almost guaranteed that your first implementation, correct or otherwise, will solve the wrong problem.

rocqua··on GPT-5.6 used a prompt to close a 30-year gap in convex optimization
It seems to me you hooked onto the wrong part of proofs vs software compared to what OP meant. The difference OP cares about isn’t how much one cares about style. Instead the important difference lies in validation. A proof can be validated as either correct or wrong. That type of hard feedback really helps combat the optimism and desire for shortcuts of modern models.

Now, that still doesn’t help an LLM distinguish between good and bad correct proofs. But it still really helps a lot. On top of that, taste in proofs is a lot more uniform than taste in coding. That helps LLMs be better at judging the quality of a proof, because there’s less disagreement in the wider world.

rocqua··on Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance
Do you want others to have an identity? Say policemen, someone who borrowed something, the postman, people asking for donations, your doctor etc?

And does it make sense that at least some people do want your identity before interacting with you?

rocqua··on Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance
A significant risk with ZKPs is that they can make a lot of explicit control rules palatable by making the side effects much less extreme.

If a company can come up with a reasonable reason to check something, then a ZKP enables that check without wider harm to privacy. But it still gives the narrow harm to privacy that otherwise wouldn’t exist.

Put differently, privacy concerns have shielded us not just from surveillance, but also from powerful control. Control in the form of “you are only allowed X if you meet criteria Y”. With ZKPs, that shield of “why would I tell you enough information to determine Y” stops working. But those conditions on X are harmful more broadly.

Take the US border checks of Social Media. Are those more OK if all of a sudden there’s a ZKP you have to give of never having called Trump a cunt in any private message?

Page 1 of 34Next →