Frustrated by the AI industry’s claims of proving math results without offering transparency, a team of leading academics has proposed a better way

Lol. LMAO. #openclaw #ai

I could get behind the Discord age verification but they had a breach 6 months ago, they've had multiple senior sec leadership roles open for a year and the biggest predictor of a breach in the next 18 months is have they had one already. Not even touching the avg staffing levels on most teams

How many interview rounds, onsites, certs, and degrees would I need to work for him, I wonder?

If you are the in the target audience for a mr beast x salesforce collab you should not be free

i wonder what magic the tech industry will develop next. a calendar that is 75% accurate and gives you an eating disorder

things can be two things. But if we're evaluating comparative risk, it's mostly the second thing

China always had a two stream strategy to build out coal for electrification while also pursing more modern stuff for the long term. They publish their strategies. You can read them. Baffles me when people take an "inscrutable adversary of the east" stance on a country that posts their shit online

There's the Epstein list. But I also want the crisis comms agencies and boutique law firms helping these invertebrates weasel out of culpability list.

Sure, im going to give my credentials and API keys to an intern, leave him with a case of beer and my car keys, and tell him to do something cool by Monday. This is very infosec, no notes

OpenClaw is self harm and we should extend sympathy and support to those who feel compelled to use it.

Lol 1.5 Trillion dollars of investment and they're Mechanical Turking it www.youtube.com/watch?v=U7s_...

Booz should definitely have its contracts cancelled for security issues, just not this specific security issue

Its fun because if it worked it would be an insecure, noncompliant, uninsurable nightmare, but it doesn't work so you look crazy when you tell people they're hating it wrong

Misconduct so egregious even a notoriously violent and unaccountable police force saying whoa whoa we don't want any association with this

You all wouldn't believe me if I told you how much of US intelligence and foreign policy run on Google Translate

We absolutely messed up as a society when our government started blowing enormous amounts of smoke up the asses of tech bros. Now we’ve got all these weird nerd CEOs ceaselessly bragging about how they’re going to take everybody’s jobs, then acting genuinely confused when people hate them for it.

GTM(alaria) Strategy

www.youtube.com/watch?v=KY8t... I don't care if Harry Potter is in the training corpus, but how long until someone programmatically extracts AWS secrets from published code snippets?

Ancient cybersecurity curse: may you deeply deserve whoever you hire.

flock has audit logs?? Flock's made a cursory half hearted effort at compliance? I assumed their infosec department was a bird and 5 ChatGPT tokens

Ah yes, I've been scammed! No point in taking a detailed accounting of my preexisting relationship with Eric Adams, as he has scammed me. Ooo so mad!

Hey guess what company has had a bunch of infosec ghost jobs posted on LinkedIn for months and months?

The larger the security apparatus, the larger the support footprint required. Much like the IC, it leaks data everywhere. Time and patience can strip a despot of the mystery he relies on to intimidate. They are presumed competent to the precise degree that they are unknown.

A tip from my OSINT days: government affiliated security forces of many countries will frequently sport belt buckles, tie clips, or lapel pins with their org symbol while in civilian clothes. Even if this violates their own OPSEC policies. Goes double if its on a dating site

A technology is what it does. Any idiot knows what happens when you don't have a T&S team in place. So while one particular idiot obviously didn't, the marketing team under him sure knew what they were monetizing.

Make him famous.

As promised, audio of Intuit CMO Thomas Ranese answering my questions is in today's episode of It Could Happen Here. You can also listen to him admit he has no idea what happens when your financial data gets stolen here.

FINALLY! Someone has automated a fun hobby, leaving me more time to generate revenue for shareholders

GEORGE IS GETTIN UPSET!

Finding that IC job interviews have standardized loosely around certain skill sets. My interviews as a manager range from detailed trivia about the intersection of devops and AWS incident response, to my personal feelings on AI, to what order specific steps should be taken in an investigation

Microsoft Copilot Defender for AI App Defender Enterprise 365

This is a quote that’ll be in The Big Short 2. His entire history is getting rich off insider stock bullshit, and OpenAI has spent more than $8 billion in OpenAI stock buying other companies too. Fake money spent like it’s real

visible screen UI, visible classification stickers, discernible equipment models, obvious hotel ballroom with drapes. . .This is the sort of work you can do as an analyst when you're bored at lunch waiting for your colleague to bring back coffee.

just discovered echogram and token flipping - seeing a lot of infra leads saying they just layer additional agents for guard rails...wouldn't that just add attack surface? Feels crazy how no one is doing foundational risk analysis any more

Looking at a post claiming the urgency of using LLMs to organize around fighting extremism. That makes me so sad. Someone aware enough of deep seated problems imperiling society, but uninformed enough to think these technologies actually do what the vendors say. The good natured faith!

Today is the last day that you can repost this image

Over and over again I'm asked to do risk mitigation plans for LLMs and the client won't accept "you have to limit the functionality because full access is unsecurable." They won't accept it. Its an industry wide "no, the children are wrong" moment

He's so close...

I'm getting interviews for 'CISO' jobs where they expect me to do hands on sec eng, lead incidents, run audits, train developers on prodsec with a single part time contractor for a team if there is a team at all. . .for 160k. Yeah ok, this is just a correction to a totally normal baseline.

Absolutely bizarre that people are talking about tech's 'overexpansion' when absolutely nothing works anymore. Oh weird all these massive outages are happening at the same time as layoffs. The windows power off button just soft locks the OS? Odd business choice i guess oh well

Over on Linkedin they're talking about the "correction" from "overhiring." I'm sorry, I was running a team in 2021 - who are these managers who had an abundance of resources? Every company I've worked for as a leader has made me layoff at least 2/3rds of my staff at least once.

Hey use this thing with a human in the loop for liability reasons. Reassign your most skilled engineers to double check its output because it will confidently error out 28% of the time. Train the model locally and segment it on your network because it's unsecurable. This is critical for effeciency

Secbot has read that guardrails have 'solved' prompt injection. Simply validate your inputs. You know, like how we solved SQL injection back in 2008.

Today’s moneyed VCs are the ones whose main qualification is “got lucky betting on poop dot com using free money from the Fed”

The point of security technology is not to secure anything. Security problems are downstream effects of poorly designed human systems. Security technology is exclusively for the diffusion of responsibility of those failed systems.

Sincerely one of the funniest things the WSJ has ever written or done. www.wsj.com/tech/ai/anth...

Remember that buzzword "Active Defense?" Lockheed and Mandiant were throwing it around in 2012 ish. I was hired by an investment bank that was planning to do this. It wasn't until the lawyers explained to the CEO that he could be held personally liable that the plan was scrapped

New job interview fail state acheived: "Agentic AI as applied to SecOps tools is irresponsible because it increases attack surface in unpredictable ways with privileged access to sensitive data. However, there are other LLM implementations that can accelerate ops in safer ways."