rootkits as a service

just about a month since we had the LLM security thread, and now there’s some more hilaribad coming out at blackhat

1. attempt to learn from llm
2. have llm tell you about success criteria
3. get some or other shit done
4. ???
5. be personally satisfied, individually

new electronics design standard everyone! no more need for EDA sims, we can just ask this clever poster for verification! progress! i’m sure it’ll be perfectly fine!

nod

a fairly enjoyable read, if you can stomach exposition of millennia and hopskotch-scifi

fair ‘nuff :)

it happened

I popped out somewhere to have a drink, and got to have someone tell me about their “edutech” startup that “uses AI”

they very definitely overpromise (not gonna rinse their bullshit), and topped it off with “and then we use a LLM for suggesting improvements”

(I ejected from the conversation but I can still hear it; it’s progressed to “talking about property” in the terms of mediocre early-20s white kids talking leveraging daddy and uncle’s assets)

you just really don’t get it, do you?

other Tschaikovsky (Adrian)

while that’s also a problem, doesn’t really seem that’s what happened here

Tschaikovsky reader detected?

you appear to be lost, this isn’t “sama stan club”

and by library I hope you don’t mean a place of knowledge other humans rely on

I scrubbed through this video to see if it included handling/inserting a SIM card, it didn’t. gonna presume eSIM. probably the deal guess - they signed some kind of special-APN deal with t-mo to get it live, didn’t think they’d need to port (or let t-mo have preferential timeframe, or somesuch), and just never implemented it

also, in this video at about 13:10, some hilarious footage: trying to show the shitty projection, entirely out of focus, in a room already-dark to try capture the contrast… because it has that little luminance on the project (which is duh, because battery device)

many, many lols

this includes “It’s a standalone device with its own SIM card” but it doesn’t make clear whether eSIM or hard-sim

also, that’s a snip quote. the full quote is:

It’s a standalone device with its own SIM card, and there’s no screen — just vibe

just amazing

I haven’t read into it at all so treat this as pure speculation, but from context: the t-mo thing sounds/smells like MNO lock on the SIM service. a lot of operators offer subset-services type products (e.g. SIMs with only data services, SIMs that only work within a specific localized network, etc etc), and I could see this maybe having been launched with something like that

I’m unfortunately not current enough on the technical implementation of eSIM (especially wrt issuance and HLR interaction) to make a guess as to how this would impact if it were eSIM vs hard SIM

love how they edited their comment to be “more specific” and just made it even worse

my armchair linguist ass loves this post

there’s a whole strain of extreme terribleness in the wider infosec industry ito naming and references, it’s so goddamn bad

the most recently visible form of this is post-heartbleed how lots of researchers/groups now fall over themselves to give vuln publications Branding (logo, catchy name, etc), but also all kinds of other things that they constantly mix some terminology soup up

AWS probably has pre-filled patent documents ready for CloudStrike, just waiting on some acquihire or popular open source thing they can product-leech

it’s not like things like this haven’t been posted consistently since chatgpt started on the scene

oh no, wait, I meant the other thing. the one where it’s always been this awful dogshit.

“imagine it’s due to eu law” what the FUCK? I’ve seen some wild takes but wow, you’ve just strength-hammered the shit out of the fair bell in a way I haven’t seen in a while

to get on my developing-nation[0] soapbox for a little bit: it is, and it’s also hilarious how often this sort of shit happens with things developed by people who you could largely handwave as “their smallest computer is a 3yo max-spec mbp” (I know this isn’t precise but ygwim). “talk to your users” is obviously useful and it’s often largely clear that a lot of these orgs don’t, but it’s even more clear in places further down the economic ladder. the one thing people in such markets often have is bucketloads of time. I do like that the phrasing used in the article was “you do not actually have to spend any money” rather than calling it “free” - this is still work. but you will readily find maaaaaany people who will do this sort of thing

[0] - speaking from experience, large consideration in stuff I have to design for in services