Security, reversing, mathematics. Writing emulators and hypervisors in 🇦🇩.
Les Escaldes, Andorra
Joined December 2009
- Tweets694
- Following510
- Followers4.9K
- Likes8.1K
Recently @malltos92 gave great advice applicable to anyone doing novel research:
> DO NOT [...] USE ONLINE MODELS, LLMs will take what you have and amplify it to every code base, effectively making any novel ideas you had extinct. Do not give your knowledge away for free to these online models, monetize them offline.
holy shit.
tristan buckmaster is saying openai has a forced navier–stokes blowup via the cĂłrdoba / martĂnez-zoroa program.
and that it may have used drafts from his and levent alpöge’s private codex sessions.
that’s the cĂłrdoba / martĂnez-zoroa route. almost nobody else was on it.
he also says the first prompt went out after information about his and levent alpöge’s work reached openai. that “very little human input” was not true. that a whole team had already been set on easier problems, including euler. that even the prompt they showed him was written by prompting codex.
then he asked:
did the model have their private codex sessions.
no answer on training.
if any of that holds, openai didn’t just scoop a math result. they may have done it off two researchers’ unpublished drafts, then tried to cut the coauthor because he works at anthropic.
a millennium-problem-adjacent result just became employee drama before an ipo.
i don’t even know which part is crazier.
this is one of the slimiest things i’ve seen in this industry.
It looks like most 0day/bounty prices will drop to a slim premium on top of token costs, and cybersecurity will be proof-of-work (always has been?)
But for now, this seems like the best arbitrage opportunity in years.
Just filed an EU DMA complaint against Alphabet for gatekeeping against secure Android derivatives like @GrapheneOS via Play Integrity.
TL;DR: not certified ≠not secure. Google lacks a FRAND certification process for non-OEMs that comply with objective security requirements.
Capstone.js, Keystone.js, Unicorn.js ports have been updated and published on NPM.
You can now assemble, disassemble and execute code of many new architectures in your web browser. Faster via WebAssembly, and using BigInt to support i64 interfaces.
alexaltea.github.io/unicorn.…
Alexandro Sanchez retweeted
My emulator now has a name: Sogen.
It now manages to analyze BO6's protection right in your browser :D
Hey @googlemaps, when are you going to use gaussian splatting with LoDs (see CityGaussian or LoG papers) to render 3D maps data?
You could merge angled aerial and Street View footage for truly seamless transitions, and benefit from proper transparency and decent-ish specularity.
Are there any small USB MITM devices that let you swap keyboard Win/Alt keycodes from HID reports? Tired of doing in software for each machine...
I'm considering getting @Hak5's OMG cable for this, but feels a bit overkill (no need for WiFi, GNSS or even payloads).
Are there any cheap devices with full TrustZone exploits that could be used to generate fake attestations for @GrapheneOS devices?
Firebase App Check and Play Integrity API are getting increasingly pervasive. We need "attestation proxies" now.
Alexandro Sanchez retweeted
We're revealing details of an obscure debugging feature in the Apple A12-A16 SoC’s that bypasses all of the hard-to-hack hardware-based memory protections on new iPhones. Its not used by the firmware and we don't know how the attackers found out about it. securelist.com/operation-tri…
Do ransomware negotiations consider that a large % of AI SaaS startup valuations is contributed by the secrecy of their state-of-the-art models/params?
Real shame if weights were leaked. Yes, illegal to use, but also cheap to launder. Piracy on steroids.
If GPT-5 released today, and @OpenAI was fully breached tomorrow, would a $1b+ model ransom be fair? If so, stressful times for their InfoSec team.
Months after this tweet we got c2pa.org/ and truepic.com/. Sony A9III cameras announced this week supports it! Glad to see action.
Filling a customs form, that generates PDFs, which I have to print, "sign" (with a squiggle), scan and send... for some person to read and manually type in an identical form. Just to charge me few cents of taxes and few dozen EUR of "handling".
Bureaucrats are a waste of oxygen.
Are there any physical cryptocurrency coins?
Something like TPM w/ privkey, NFC to broadcast pubkey. Zero-cost offline "transactions" in-person. Button on the back to redeem the coin value (sign+broadcast to another wallet). Cash registers read pubkeys via NFC to compute total.
Alexandro Sanchez retweeted
The boom, the bust and the adjust
The offensive cybersecurity industry — trends and updates
I'm super excited to publish this article which embeds my experience in the offensive cybersecurity industry over the years.
I hope you will enjoy it.
medium.com/@maor_s/the-boom-…
Alexandro Sanchez retweeted
Icicle is a multi architecture emulation framework designed for firmware fuzzing.
Nice research work
Paper: arxiv.org/pdf/2301.13346.pdf
github repo (pre-release): github.com/icicle-emu/icicle
#fuzzing #firmware #infosec #cybersecurity
