351–360 of 407 posts
Most of the exploits are for opensource/free software. I don't know what methods where used to find these exploits but I am starting to think security through obscurity might not be a bad thing in this day and age, where someone can just let bots loose on your codebase.
Because pretty much all server software is open source. Hackers only care about attacking stuff that’s exposed to the network.
I took a look at the Ghidra ones (because I use Ghidra), and I'm unimpressed: https://github.com/bikini/exploitarium/blob/main/ghidra-12.1... The first requires being able to overwrite binaries in the Swift tool directory. Yes, if you overwrite binaries executed by ghidra, you can trigger code execution. This is not a surprise. The second, idk, I'm not familiar with TraceRMI (but it's probably worth noting that "RMI"…
The bigger takeaway is someone that smart is pissed off and dropping their shit with zero warning... but hey, that's just like, my opinion man.
So, knowing that bad actors have an unending river of cheaply acquired zero days, the best response is to publish them so that maintainers also have access to them. Existing methods of slow disclosure cannot keep up with the AI firehose.
It’s ugly, but it will force needed change. A thorough AI red team effort is the lowest bar of releasing software responsibly in this day and age.
Earlier quoted context omitted.
> Law as a tool to punish those who have committed a prohibited act You're thinking of criminal law. And it's not just some group's rules and norms - there already exists familial or social group punishment for that. Criminal law is prosecuted by the State . It's the code of conduct of the society you exist in. If you want a thought experiment for what life would be like without organised society, read Leviathan Henc…
> You're thinking of criminal law. And it's not just some group's rules and norms - there already exists familial or social group punishment for that. Criminal law is prosecuted by the State. It's the code of conduct of the society you exist in. What I meant is more about why and how laws come to be, which depends on what we think they’re for. Hobbes’ point of view is one. Locke and Rousseau had different opinions. F…
Earlier quoted context omitted.
Wireshark dissectors (protocol decoders) are basically all written in C, and anyone sending packets can pick a dissector.
I'm more worried about AV software. Code that also needs to be able to parse a large number of file formats, opens every file that enters your computer through one of many pathways, and generally runs at a high privilege level. A huge attack surface that's easy to reach and with far reaching consequences if it can be exploited. Add to this that it's in wide use, often even mandated by corporate IT and its recipe for…
Media codecs pretty much, single-handedly even, drove about a new era of defenses and mitigations in Android: https://blog.isosceles.com/the-legacy-of-stagefright / https://archive.vn/x3d0Y
Earlier quoted context omitted.
Wireshark dissectors (protocol decoders) are basically all written in C, and anyone sending packets can pick a dissector.
I'm more worried about AV software. Code that also needs to be able to parse a large number of file formats, opens every file that enters your computer through one of many pathways, and generally runs at a high privilege level. A huge attack surface that's easy to reach and with far reaching consequences if it can be exploited. Add to this that it's in wide use, often even mandated by corporate IT and its recipe for…
The readme was recently updated. > In regard to AI usage, my fuzzing workflow was automated by AI with a strict harness. I used GPT-5.5-3-Codex-Spark for ALL the fuzzing, as barely any "thought" is necessary when provided with an efficient harness. Contrary to the growing narrative that I'm just some random child burning tokens, I DO actually have a degree in the subject and have published multiple papers on fuzzing…
Earlier quoted context omitted.
This is how it's always been. The law just produces another axis of strength that is easier to gatekeep.
Nope, it reduces the issue even if it isn't solving it entirely. Without laws and law enforcement, anyone with bigger muscles than you could break your nose just because they feel you looked at them the wrong way.
To a first order, laws basically just codify how the government (the overwhelmingly dominant applicator of violence in any given society these days) will apply violence so that the peasants can reason about it in advance and avoid it.
You don't need any of that for the basic "if I do violence upon others without a damn good reason violence will be done upon me" workflow though.
Earlier quoted context omitted.
The bigger takeaway is someone that smart is pissed off and dropping their shit with zero warning... but hey, that's just like, my opinion man.
The point is that anyone looking for zero days has them in spades, in this age of LLM use. So, knowing that bad actors have an unending river of cheaply acquired zero days, the best response is to publish them so that maintainers also have access to them. Existing methods of slow disclosure cannot keep up with the AI firehose. It’s ugly, but it will force needed change. A thorough AI red team effort is the lowest bar…
Doesn't GitHub require phone number these days? Shouldn't be hard to trace
Of course no services to fake this exists or have existed. I mean, a well determined person can het around such issues.