101–110 of 131 posts
Not being funny but does most of HN subscribe to the economist? I dont think ive ever paid for an online newspaper ( and Im not trying to be edgy )
If I was going to pay for a news subscription, it would probably be the economist. Or maybe the financial times. They both seem to still have solid journalism.
This quote from TFA is highly likely to be a conflation, exaggeration or extrapolation of what actually happened: > "On June 11th Mark Warner, the vice-chair of the Senate Intelligence Committee, said that General Joshua Rudd, who leads the National Security Agency and the Pentagon’s Cyber Command, had told him that Mythos “broke into almost all of our classified systems, not in weeks, but in hours”" Why: 1. It's a p…
>On June 11th Mark Warner, the vice-chair of the Senate Intelligence Committee, said that General Joshua Rudd, who leads the National Security Agency and the Pentagon’s Cyber Command, had told him that Mythos “broke into almost all of our classified systems, not in weeks, but in hours”. From outside? Or did you have a shit ton of unpatched systems that only internal users could access?
What are the chances this is a fun honeypot the NSA has set up to get adversaries pointing their best LLMs at NSA systems and suss out their capabilities?
Not a surprise. I got in a LOT of trouble for identifying and outlining a trivial privilege escalation attack that worked on both NIPR and SIPR. In the end I got to help write up the issue but to my knowledge they never patched it as it would have caused major issues with maintenance by closing off access needed for some legacy software patches.
Actual title "Donald Trump’s blocking of Anthropic is capricious and chaotic"
Earlier quoted context omitted.
I’m not familiar with this, but what does “solved” mean in this case? Guaranteed inability to compromise systems?
Pretty much. If you've got a microkernel / capabilities based OS, the amount of mischief that someone can cause is severely reduced. It's my belief that we can have general purpose, easy to use, secure computing for everyone. No UAC crap, or horrible systems like AppArmor, no virus scanners, etc... just computers that do what you want, and only what you want. We could have had it decades ago, if things had happened i…
there are some BSD spinoffs like 5BSD which might end up with a good capability model but even there things like capsicum have their limits and IOMMU based isolation is still a dream. (because entire OS kernel is in one privilege level, accessible as root user, so DMA capable devices kill a lot of those securities).
(my os puts every subsystem, service, device driver, app etc. in their own hardware VM, likely there will be IPC bugs or hypercall bugs still tho in that case)
Nowadays with AI its getting more to a point where people can actually build these systems for themselves. Maybe that is a bigger threat to these big corporate tech companies than some security things. It will allow nations and companies to detach from their Tech...
Earlier quoted context omitted.
Everything but the specific usage
But what does that mean? Can I browse a webpage, open a doc, if those are listed as specific usage? And if not, what's the purpose of this and why are people talking about it with such import?
Earlier quoted context omitted.
Pretty much. If you've got a microkernel / capabilities based OS, the amount of mischief that someone can cause is severely reduced. It's my belief that we can have general purpose, easy to use, secure computing for everyone. No UAC crap, or horrible systems like AppArmor, no virus scanners, etc... just computers that do what you want, and only what you want. We could have had it decades ago, if things had happened i…
Capabilities-based OSes aren't magic. Their robustness still depends on underlying assumptions, which may or may not hold. See eg relevant disclaimers in seL4 whitepaper(s). And hardware glitches are a thing (edit: and supply chain attacks). But I do agree that verified correct software can offer very strong guarantees that go well beyond those of commonly deployed software. We could have been in a much better place…
still not immune to be hacked ofc. I think the last step would be making it common place again to build these things custom. that way they'd have to have more specific information available as threat actors to exploit you. It'd be harder to have generic methods affecting millions of systems.
regardless there are no silverbullets, and tradecraft/opsec will always be a thing. most compromises are because people hand out keys unwittingly rather than 0days and crazy sploits. (they do happen though, but its more expensive than fishing and just loggin on under some dudes credentials)