Viewing profile — david_shaw

I said this about OpenAI/Hugging Face, and I'll say it again for Anthropic: It's not that I think this is fiction; I'm confident these events actually happened. But I think they we…

I don't think this is fiction, but it's pretty clearly a marketing-release rather than a normal security disclosure. OpenAI has strongly fallen behind after the incredible lore sur…

At risk of quoting too much of the article, it opens with this: > A requirement for staying sane while working in public as an open source maintainer is realizing that every issue,…

I'm playing through the couch co-op game Split Fiction, and this is basically the premise (with more fun gameplay).

> A nation that possesses powerful AI facing one without it—or even facing one that is behind in AI by 3 years—could be the equivalent of an army of World War II Marines facing an …

> we might have wished we prepared for more Do you mean policy-wise (like Dario is talking about), or more broadly? I wonder about broad preparedness, but unfortunately there's not…

> Members of the trusted coalition should freely share chips and semiconductor manufacturing equipment (SME) with each other, while working together to deny it to adversaries. US e…

The problem with Mythos and Glasswing related hype is that finding vulnerabilities isn't the problem for most organizations. It's great that Mythos and similar models can find vuln…

The Fallout games often exemplify this: nearly every decision you make is morally ambiguous, and often has far-reaching repercussions in the story and world.

> https://www.openbsd.org/images/PinkPuffy.png > Apparel (t-shirts, so far): https://openbsdstore.com/ Interesting. In the image you linked (PinkPuffy.png), the cat's hat says "sec…

He certainly popularized it (maybe coined it), but I've seen a lot of organizations and developers repeat that mantra. Even without the specific words, look to product teams debati…

It's easy to be cynical because, yes, both the problems and solutions seem dead obvious in hindsight. But for a long time (and maybe even still), a hacker creed was "move fast and …

We'll see more of this, but this particular review is driven by marketing narrative. I'll explain what I mean: Back in 2010, as a security engineer, I also looked at OpenEMR. It wa…

I think the idea is that if you're given an improperly configured restricted shell/command access, you can use any of the listed tools to gain access to some subset of what that us…

I don't have a subscription to The Economist, but I was interested in the concept of these organizations as "neo-primes." I found an article on The Cipher Brief describing them: ht…

> If it were secure, it would only notify that there is a message, with no details included. You're right. This is configurable via settings, but is not the default state. That sai…

I think the title should read "RunAnywhere," not "RunAnwhere."

It would be an interesting and potentially useful project to combine these camera locations with Maps routing -- similar to "avoid toll roads," we could "avoid surveillance cameras…

It's wild that all other comments in this thread (so far) seem to completely miss this nuance. There are lots of services that, in their terms, require users to be adults. This typ…

I'd prefer to see board (or executive) level signatories over lay employees -- the people who can enforce enterprise policy rather than just voice their opinions -- but this is enc…

> What does "solving" coding mean? Maybe this was sarcasm, but it's a good point: "Coding" is solved in the same way that "writing English language" is solved by LLMs. Given ideas,…

This is for sure an inspirational project, but I wish the barrier to entry was lower. I've noticed e-ink/paper displays having somewhat of a moment right now (especially very small…

> I am seeing something closer to the opposite of skepticism among vulnerability researchers. My initial claim was overly broad, but the feeling of discomfort feels widespread to m…

There's a lot of skepticism in the security world about whether AI agents can "think outside the box" enough to replicate or augment senior-level security engineers. I don't yet ha…

Totally. I meant if people were all using the same replacement software, that joining groups' different "servers" would be the same experience. Absolutely agree that if everything …