@VessOnSecurity
Anti-virus, malware and infosec expert, crypto amateur, privacy advocate and general annoyance.
PGP keyID: 0x365697c632dd98d9
Relays (1)
- wss://relay.ditto.pub – read & write
Recent Notes
People think a lot about the output they get from AI tools and chatbots.
But they don't think enough about the input they give to the AI tools and chatbots.
Your input is very likely collected, ta...
@nprofile1q... At least in Claude, this (use your input to train the AI) is a setting, off by default. I've turned mine on. I'll die soon; I want at least a small part of my person to remain somewhere.
Found the bug.
Pop star Ariana Grande has sued two hackers for stealing and unreleasing unreleased music and studio footage.
The hackers allegedly stole the materials from her photographers and producers.
https://...
@nprofile1q... Now she just needs to actually find them, LOL. Good luck with that, she's gonna need it...
I kept reading how open-weights LLM models like Kimi are "almost as good" as closed-weights ones, so I decided to put this notion to the test.
I used Kimi 2.6, not the latest-and-greatest K3 model, because I don't have access to Fable/Mythos (and it would have refused to work on cybersecurity tasks anyway) and I wanted the test to be fair by comparing Kimi 2.6 to Claude Sonnet 5.
I asked Kimi to analyze the codebase of Cowrie (a high-interaction Telnet and SSH honeypot, available on GitHub) and report any bugs it could find. It came up with 15 bug reports, listing a grand total of 198 bugs. Quite a lot, eh? Well, not so fast.
Then I asked Claude to double-check these reports and produce fixes for the actual bugs (which Kimi didn't bother doing). Claude's verdict: 20 genuine bugs that need fixing and reporting. I'm in the process of reviewing its fixes right now and will report them to the Cowrie maintainer later today.
The rest was nonsense, ranging from "this is not a bug; it is intentional", to "this assumes that the honeypot operator who has set up and configured the honeypot (and who has root access, in order to do it) is trying to attack the system on which the honeypot is running", to "allowing just about anyone to log in via Telnet or SSH is not a 'vulnerability'; it's the whole fucking purpose of a Telnet & SSH honeypot, hey!", to (and this one is my favorite) "imaginary bug in non-existing code".
So, don't tell me how Kimi is "almost as good" as Claude...
I used Kimi 2.6, not the latest-and-greatest K3 model, because I don't have access to Fable/Mythos (and it would have refused to work on cybersecurity tasks anyway) and I wanted the test to be fair by comparing Kimi 2.6 to Claude Sonnet 5.
I asked Kimi to analyze the codebase of Cowrie (a high-interaction Telnet and SSH honeypot, available on GitHub) and report any bugs it could find. It came up with 15 bug reports, listing a grand total of 198 bugs. Quite a lot, eh? Well, not so fast.
Then I asked Claude to double-check these reports and produce fixes for the actual bugs (which Kimi didn't bother doing). Claude's verdict: 20 genuine bugs that need fixing and reporting. I'm in the process of reviewing its fixes right now and will report them to the Cowrie maintainer later today.
The rest was nonsense, ranging from "this is not a bug; it is intentional", to "this assumes that the honeypot operator who has set up and configured the honeypot (and who has root access, in order to do it) is trying to attack the system on which the honeypot is running", to "allowing just about anyone to log in via Telnet or SSH is not a 'vulnerability'; it's the whole fucking purpose of a Telnet & SSH honeypot, hey!", to (and this one is my favorite) "imaginary bug in non-existing code".
So, don't tell me how Kimi is "almost as good" as Claude...
Petition to rename the straight of Hormuz to the straight of Schrodinger. It's both closed and open depending on whether you look at it or not.
Activist charged with felony after giving border agent "duress code" that wiped his phone
The government says destroying his own data during an airport interrogation was illegal.
https://arstechnica....
@nprofile1q... I've been saying this for ages - don't do this shit, because you'll be charged with obstruction of justice, destruction of evidence, and probably half a dozen more crimes.
Instead, ask for a lawyer, then shut up and don't say anything (don't give them the password, etc.).
Instead, ask for a lawyer, then shut up and don't say anything (don't give them the password, etc.).
Migrating a physical data center to the cloud(s):
How various AI models are trained:
"Meet Phantom Twist, a stealthy new drone that hides in plain sight by tricking your eyes":
https://www.livescience.com/technology/robotics/meet-phantom-twist-a-stealthy-new-drone-that-hides-in-plain-sight-by-tricking-your-eyes
https://www.livescience.com/technology/robotics/meet-phantom-twist-a-stealthy-new-drone-that-hides-in-plain-sight-by-tricking-your-eyes
Moonshot's Kimi K3 AI model performs significantly below the cyber capabilities of AI models released by US frontier labs
Kimi guardrails also failed to stop users from developing exploits
https://w...
@nprofile1q... That has been my experience, too. Kimi is good - but by far not as good as Claude.