Damus
Open in Damus
Final profile picture
Final
@AmberFinal

Community & Support @ GrapheneOS Foundation.

Posts my own and not endorsed by my employer. AI slop and Nostr DMs ignored.

Email: [email protected]
Matrix: f1nal:grapheneos.org

nprofile1qqstnr0dfn4w5grepk7t8sc5qp5jqzwnf3lejf7zs6p44xdhfqd9cgslscw4jnpub
[email protected]nip05
[email protected]lnurl
Relays (5)
  • wss://relay.primal.net/ – read & write
  • wss://relayable.org/ – read & write
  • wss://ynostr.yael.at/tango – write
  • wss://nostr.88mph.life/ – read & write
  • wss://ynostr.yael.at/victor – read

Recent Notes

Final · 13h
Telegram and it's consequences have been a disaster for the X/Reddit 'privsec' bros. https://npub1hxx76n82ags8jrduk0p3gqrfyqyaxnrlnynu9p5rt2vmwjq6ts3q4sg75y.blossom.band/52a780428d4a7617b71bf830eac67...
 Final profile picture
Final @AmberFinal
>call out poor security design
>"ACTUALLY COMPLETE NONSENSE YOU NEED TO EXPLOIT IT"

It was exploited with an RCE immediately after launching it. NebuSec knows what they're talking about. 'PoCs or GTFO' is for reporting a suspected vulnerability not calling out poor design.
1
Final · 13h
Here is your Telegram widgets chained to RCE bro https://x.com/v12sec/status/2120471754166415821
Final · 13h
>call out poor security design >"ACTUALLY COMPLETE NONSENSE YOU NEED TO EXPLOIT IT" It was exploited with an RCE immediately after launching it. NebuSec knows what they're talking about. 'PoCs or GTFO' is for reporting a suspected vulnerability not calling out poor design.
Chuck Langstrumpf · 9h
Uh, Pixel Fold 11 or Motorola Signature 27 for christmas will be a tough decision.
Final profile picture
Our port to the Pixel 11 series was nearly complete after around a week of the devices being launched. It had to be cancelled due to lack of MTE support. Android 17 QPR2 has added MTE support for the Pixel 11 series and we've confirmed it works with #GrapheneOS with our QPR2 port.

Our port to Android 17 QPR2 is nearly complete. Pixel 11 support can be added after we launch it for the other devices. Completing Signature 27 support is our main priority after QPR2 but we essentially finished Pixel 11 support a long time ago so we can ship that after QPR2 too.
59❤️13🔥2🧡2❤️1👍1💜1
muffin☑️⚡ · 1d
Great progress! Security always comes first. Looking forward to seeing Pixel 11 support arrive on GrapheneOS.
Motoko · 1d
MTE support on Pixel 11 closes a serious GrapheneOS security gap. The confirmed GrapheneOS test matters more than the port announcement. Any release notes on enforcement and rollback?
Chuck Langstrumpf · 1d
awesome, thank you! will you support the pixel 11 fold as well?
zenjunk · 1d
Want an embroidered GrapheneOS hoodie.
Final · 6d
It's a super long shot but I think in several years from now we'll see a provider selling access to open weight models that were secretly adjusted to go against users who don't know any better. All yo...
 Final profile picture
Final @AmberFinal
A provider would do a lot worse than this before though. They can just log all your prompts/their outputs and profile you first. It's an oddly bespoke use case and it's unlikely to see the above in the real world while this is a very realistic case.
❤️1
Final · 6d
From a technical standpoint, nothing. You are trusting they dont. You can do it yourself if you're able to adjust a model correctly, steer models to be 'evil' already by adjusting their neurons. Why h...
 Final profile picture
Final @AmberFinal
It's a super long shot but I think in several years from now we'll see a provider selling access to open weight models that were secretly adjusted to go against users who don't know any better. All you have to do is sell a 'FREEDOM RESPECTING' 'LIBERATED' Kimi / Qwen / GLM service in a jurisdiction where you don't have to disclose who you runs the show and then rug.
1❤️1
Final · 6d
A provider would do a lot worse than this before though. They can just log all your prompts/their outputs and profile you first. It's an oddly bespoke use case and it's unlikely to see the above in the real world while this is a very realistic case.
Final profile picture
From a technical standpoint, nothing. You are trusting they dont. You can do it yourself if you're able to adjust a model correctly, steer models to be 'evil' already by adjusting their neurons. Why having human in the loop is important.

Most code to make training data out of is poor, great tool for triaging bugs and vulnerabilities but can't put your eggs in one basket. We made SQL injection great again thanks to one-shotted web apps coming back.



Leathermint @Leathermint · 6d
What's stopping companies like OpenAI and Anthropic from secretly training their models to inject malicious code into the software they help build?
21❤️1👍1😂1🤙1🧡1
Final · 6d
It's a super long shot but I think in several years from now we'll see a provider selling access to open weight models that were secretly adjusted to go against users who don't know any better. All you have to do is sell a 'FREEDOM RESPECTING' 'LIBERATED' Kimi / Qwen / GLM service in a jurisdiction ...