👾👾👾
Italy
Joined June 2021
- Tweets18.2K
- Following1.5K
- Followers612
- Likes129K
Raf 👾 Getting healthy retweeted
The way frontier labs have restricted access to cyber capabilities makes no sense. If you're considered a "defender" you're not allowed access to the "offensive" versions of the models (the ones that can do development/validation of malware and exploits).
So for example, if you want to build some sample malware to test a detection system, nope.
Or if there's a major crisis due to a critical vulnerability in PHP and you need to rapidly triage fake exploits to see if there are any real ones floating around so you can warn people, nope.
Want to build a remote code exploit to make sure the detection rules you plan on proposing to the clients actually work? Hard nope.
You gotta call your red team friend and wait for them to do your job for you, because "defender" are only allowed to play in the sandbox with the children.
Not an expert, but I think that the ability to triage in-the-wild exploits during a major crisis affecting 40 million systems is possible maybe important.
And then they want to ban abliterated open weight models, which half of the people are only using because frontier labs will only give them access to lobotomized models.
"Capcom says it has identified how they got in, but not how."
I feel you man
"That work has identified issues we're working to fix."
reddit.com/r/Tailscale/comme…
tailworm.com
Raf 👾 Getting healthy retweeted
Just spent the last 7 days on the front lines of the vulnpocalypse fending off an active cyber attack on one of our products.
Some thoughts:
- Software factories are going to be required equipment for everyone. There’s just no way to keep up with the pace of highly automated adversaries without one.
- We were lucky because we had spent the last few months getting our software factory running well. It is nice to have for product development but proved to be absolutely essential this week.
- At the minimum you need to have a coding server in the cloud pre-provisioned with read only access to all your logs and all the services you depend on for observability. With that in place you are a prompt away from reasonably good situational awareness, ongoing monitoring with loops, and ability for coding agents to validate fixes against your actual, observed attack patterns.
- Shared coding server also unlocks multiplayer incident response where everyone can see every session and jump in as needed. Sharing session links that can be forked is much higher bandwidth than re-explaining things.
- You don’t need to be Ramp/Stripe/Uber scale to have a working software factory in the cloud. We are a team of 3. Ours is built with an @opencode server (thanks @thdxr!), a forked version of compound engineering optimized for automated workflows (thanks @kieranklaassen!) and a multiplayer agent in slack that handles crons (we have our own harness but pick your favorite here).
- To get our software factory up and running well, we had to stop all new product development for ~6 weeks and just focus on getting the validation systems working that enabled us to reliably shipping PR without human code review. This felt very painful in the moment but was totally worth the eventual speedup in velocity.
- KYC for @AnthropicAI & @OpenAI cyber programs is now easy and quick (at least for defensive access), but a day felt like a lifetime this week. Submit your app now before you really need it.
- Getting Mythos access unlocked a deeper level of analysis that helped us shift from reactive mitigation to proactive patching. Wish we had done this a few weeks earlier. Get started now!
A little reminder to slow down, appreciate the good things in life, and remember that we don't always have to carry everything on our shoulders.
Wishing everyone a peaceful Sunday, some well-deserved rest, and a little more kindness towards themselves.
❤️
🤖 Made with AI
Raf 👾 Getting healthy retweeted
Never label yourself a "loser" just because you've lost a few times.
Don't give yourself that mental tapeworm. It will eat your motivation, and crush your actions.
Your story isn't over yet...
Label yourself something better.
Raf 👾 Getting healthy retweeted
So much of my feed is AI investors crying about imaginary issues, because they know that open weight models threaten their ROI. All of these critical vulnerabilities were found with closed AI model, then responsibly disclosed to vendors so they could be fixed before attackers abuse them.
Even if the researchers had used abliterated models, they are still responsibly disclosing the vulnerabilities so they can be fixed, which is still providing important defenses against hackers.
Notice how they always just handwave about "critical vulnerabilities" because they know they can't point to a single real example. That Anthropic article is extremely low effort propaganda designed to try and steer the government towards banning open weight models.
Bad faith actors with ulterior motives trying to lay the groundwork for extremely harmful regulations is all these people are. What do you think happens when companies can't access cheap AI inference, but criminal hackers can, because (spoiler alert) criminals don't follow the law.
I strongly believe a part of why so many critical vulnerabilities are happening all over the proliferation of "abliterated" models, or models with safeguards removed.
You can access an abliterated GLM 5.3, a near frontier AI model, on @abliteration_ai today. And it's a world class penetration tester for like $10.
Raf 👾 Getting healthy retweeted
when my wife calls me in an angry voice I have to follow the exact commands that follow. #wife2shell
