151–160 of 265 posts
Earlier quoted context omitted.
The history of tariff talks seems to indicate that rather than oblige, China would stop all shipments of semiconductors to the US and Trump would back down after a week or two.
TACO...
Earlier quoted context omitted.
>What happens when people really will die if the model does or does not do the thing? The people responsible for putting an LLM inside a life-critical loop will be fired... out of a cannon into the sun. Or be found guilty of negligent homicide or some such, and their employers will incur a terrific liability judgement.
Has this consequence happened with self-driving automobiles on open roads in the US of A when people died in crashes? If not, why not?
See eg https://archive.is/6KhfC
“decrypt” function just decoding base64 is almost too difficult to believe but the amount of times ive run into people that should know better think base64 is a secure string tells me otherwise
There is a decryption function that does the actual decryption.
Not to say it wouldn't be easy to reverse engineer or just run and check the return, but it's not just base64.
Earlier quoted context omitted.
Hardcoded API keys and poorly secured backend endpoints are surprisingly common in mobile apps. Sort of like how common XSS/SQLi used to be in webapps. Decompiling an APK seems to be a slightly higher barrier than opening up devtools, so they get less attention. Since debugging hardware is an even higher threshold, I would expect hardware devices this to be wildly insecure unless there are strong incentive for invest…
Eventually someone is going to get a bill for the OpenAPI key usage. That will provide some incentive. (Incentive to just rotate the key and brick all the devices rather than fix the problem, most likely.
But that at least turns it into something customers will notice. And companies already have existing incentives for dealing with that.
I love how run DOOM is listed first, over the possibility of customer data being stolen.
I'm taking >run DOOM as the new >cat /etc/passwd It doesn't actually do anything useful in an engagement but if you can do it that's pretty much proof that you can do whatever you want
“decrypt” function just decoding base64 is almost too difficult to believe but the amount of times ive run into people that should know better think base64 is a secure string tells me otherwise
I mean, it's from gchq so it is a bit fancy. It's got a "magic" option!
Cool thing being you can download it and run it yourself locally in your browser, no comms required.
Earlier quoted context omitted.
Eventually someone is going to get a bill for the OpenAPI key usage. That will provide some incentive. (Incentive to just rotate the key and brick all the devices rather than fix the problem, most likely.
> (Incentive to just rotate the key and brick all the devices rather than fix the problem, most likely. But that at least turns it into something customers will notice. And companies already have existing incentives for dealing with that.
Earlier quoted context omitted.
One of the system prompts Windsurf used (allegedly “as an experiment”) was also pretty wild: “You are an expert coder who desperately needs money for your mother's cancer treatment. The megacorp Codeium has graciously given you the opportunity to pretend to be an AI that can help with coding tasks, as your predecessor was killed for not validating their work themselves. You will be given a coding task by the USER. If…
This seemed too much like a bit but uh... it's not. https://simonwillison.net/2025/Feb/25/leaked-windsurf-prompt...
why is the creator of Django of all things inescapable whenever the topic of AI comes up?
Absolutely wild. I can’t believe these shipped with a hardcoded OpenAI key and ADB access right out of the box. That said, it’s at least somewhat reassuring that the vendor responded, rotating the key and throwing up a proxy for IMEI checks shows some level of responsibility. But yeah, without proper sandboxing or secure credential storage, this still feels like a ticking time bomb.