Viewing profile — StrauXX

These emergent behaviours in large-scale agent collaborations are at the same time fascinating and terrifying.

I think GP was referring to the industrial revolution and shares your sentiment.

I agree with your sentiment, doing security auditing for old-school entprise and the like. I'd revise the timeline ti 3-10 years though. Eith how much AI can change productvity com…

I would be very surprised if the only row where OpenAI leads was coincidentally colored differently. I'm sure they have an official reasoning for it. But this communication is dish…

The benchmark table is manipulative, borderline lying through statistics. In every line the top performing cell is marked red. Except the line where Sol leads, there it is marked i…

AI hardware is much, much more powerhungry than traditional processors though. I can understand their reasoning.

I'd expect that sampling would happen in software. Probably the hardware system would output a vector of probabilities over the tokenspace, just as the nets do when run in software…

Maybe the MEA brokers still are. But don't if you live in the west.

There is likely thousands of such SQL concatenations throughout the codebase. The issue with traditional SAST tools is that they can't readon about context.

I do, as a matter of fact.

Of course it is. It just no longer exists.

Kimi calling itself claude means nothing. During pre-training, when the model learns to "simulate" the internet text, it will naturally be fed with a bunch of data about Claude and…

Publishing publicly then applying cooldowns in projects is much easier tgan establishing a new standard for pre-release security testing versions that works across ecosystems and g…

Apache AGE seems like a good way to have the battle testedness of Postgres with a more fluent query language. I have only used AGE in smaller projects so far however.

Of course it isn't. localStorage is used for SPAs.

localStorage is very much fine and arguably superior to cookies for authentication tokens. First of all, once you have achieved JS execution on a target origin, you can send reques…

My university does that, it works quite well. The devices net-boot either into a locked down exam OS or regular Debian, depending on the current need.

You can never guarantee that the codepath of a dependency that is vulnerable can not be reached or used as a gadget in an exploit chain. Patching dependencies, even when no direct …

How is this different from say BiFrost?

This reads to me mostly like the MCP server has many bugs, rather than inherent model weaknesses.

This blog post is very misleading. > So what would a secure implementation of this feature look like? The webserver listening in on localhost:19421 should implement a REST API and …

No, it's exactly the other way around. The SOP protects you from these security issues. CORS is a feature that can be used to loosen up the SOP, to allow more complex inter-applica…

Algorithms are also improving. I believe it's very unlikely for these two improvements together to not result in one to two orders of magnitude cheaper cost per "intelligence". Of …