🗡️🇨🇦🔪 I am a student of the language of the people of the land of the sun, the moon, and the stars.
double root
Joined July 2022
- Tweets12.6K
- Following732
- Followers1.5K
- Likes132K
For those in AI new to cyber (or w/e kids call infosec now) the turnkey abliterated model providers you see are all honeypots/watering hole attacks.
GCU Tense Correction retweeted
warlock.ai/blog/warcraftsim-…
Best game on best map
You won't get real security without a sacrifice.
- Google want you to sacrifice privacy by getting your stuff scanned and surveilled for your own safety.
- Enterprises want you to sacrifice perf by triple-wrapping up in redundant DLPs/EDRs.
- Ain't nobody sacrificing complexity.
GCU Tense Correction retweeted
Everyone wants to draw conclusions about the future based on what they saw in the past. Usually this works really well for people, so why stop now?
Given cheap execution, creative vision is the bottleneck.
- Have pet bug classes? Now you've got exploits!
- Bitter attack surface reduction/formal verification enjoyer? No better time to!
- Want Stormwind to look like it did in your imagination as a kid? Have some shaders.
And another one. Real deal security for some ;)
New on our Frontier Red Team blog: using Claude to formally verify software at large scale.
Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time).
With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks.
Read our research in full here: anthropic.com/research/forma…
GCU Tense Correction retweeted
Since PHP is trending again(php2shell): It’s time to bump my old research about the Zend engine/PHP Internals :^)
github.com/0xbigshaq/php7-in…
Organizational IQ test to watch: who stops using PHP?
>90 IQ orgs stopped in the last two decades. >80 IQ orgs stop this quarter. Anyone left...
GCU Tense Correction retweeted
What you’re seeing right now is decades of technical debt finally catching up in one intense burst rather than a prolonged string of incidents.
There are decades where weeks happen, and weeks in which decades happen.
GCU Tense Correction retweeted
Attack surface reduction is the one thing that reliably works.
Reducing the attack surface of deployed services and apps is a fundamental component of software that is secure by design. Earlier this year we tasked Claude with autonomously mapping and reducing the attack surface of 25 large and widely used OSS codebases. This blog post covers some of our methodology and a preview of the data we collected.
This research resulted in a significant reduction in OpenSSH pre-authentication attack surface (now fixed in 10.6). And over 500 findings where reachability could be reduced and configurations hardened to ensure security controls weren’t silently disabled.
anthropic.com/research/attac…
holy shit
an Anthropic blog post that's mandatory reading
Reducing the attack surface of deployed services and apps is a fundamental component of software that is secure by design. Earlier this year we tasked Claude with autonomously mapping and reducing the attack surface of 25 large and widely used OSS codebases. This blog post covers some of our methodology and a preview of the data we collected.
This research resulted in a significant reduction in OpenSSH pre-authentication attack surface (now fixed in 10.6). And over 500 findings where reachability could be reduced and configurations hardened to ensure security controls weren’t silently disabled.
anthropic.com/research/attac…