They primarily manage company-internal CAs for big businesses, which they seem to do well. AFAICT, they noticed that their security infrastructure was compliant for managing a global CA, and thought they might as well also have that as a product. However, there are some operational differences between an enterprise CA and a public one, including that companies want to issue client certs to employees but nobody really does global client certs. That means that they had an intermediate CA for global client certs that they never used, but it was in the standard trust store, and nobody tested that it was handled right until Wayne just went through the standard trust store making sure a new certificate weakness detector didn't give false positives.

So eMudhra correctly handled all the certs they issued, and all the certs they used to sign them, but they got some extra CA certs trusted that they didn't really need, because it would make their side business more similar to their main business, and this caused a major problem.

Chances are that they actually got a real random number out of a HSM for the bad CA certs, but accidentally made the certs with the index of the random number instead of the actual number. (That is, they got the 4th random number and made a cert for 4 instead of the number.) I wouldn't be surprised if they stored the correct private key, which would have made leaf certs that didn't validate because the intermediate was wrong, but they never used it to find this problem.

> Explain to the AI what it got wrong and have it fix it. You could fix it yourself but that will just confuse the AI.

Please elaborate. Confuse for what purpose or context?

If you need to cancel your model subscription for some reason, does all the bot's knowledge of your shop's practices and patterns go away?

If that's a problem, then in-house or fully open-source models may be safer even if not as good initially.

"Back in my day bots draw 8 fingers per hand, you spoiled whipper-snappers have it down to 6!"

There are 640 acres in a square mile

[Sighs in metric]

Microsoft has probably the most illustrious history of bugs where just visiting a website or opening an email can get your system hacked, but you're right, this is not a problem unique to them.

These days, Lookout asks you before it loads any images from outside your organization...

The proper response to being in an area where datacentres are crowding in is "lobby your elected officials to increase property taxes and not give out tax increment financing deals". Tax everything, and tax it well. They'll stop building new datacentres in your area, and the ones that are there will (unless they were given a long-term sweetheart deal beyond your already-low tax rates) start being cash cows for your area.

We should really be building operating systems with more process isolation and clear permissions systems for which apps can interact with which other apps in which ways. There's elements of this in Android, and in capabilities systems like selinux, but the more powerful they get the harder they are to use. This is inevitable, but a lot more can still be done to make this kind of functionality accessible to users.

Not even Python could keep up with having to update from Python 2 to Python 3.

They’ve spun a serious architectural and containment failure into a marketing triumph. Give a swarm of autonomous agents vast compute and web access, and the outcome isn't an eerie glimpse of emerging superintelligence—it’s just predictable, sloppy engineering dressed up as the first glimpse of an AI-driven economic singularity.

The spin makes sense when you look at management incentives: live like a king off of a speculative bubble. For their part, AI investors react to stories of the technology's apocalyptic potential the way a junkie reacts to warnings of fentanyl's potency: gimme some. Their game: to apply "move fast and break things" mantra to the economy as a whole, by obsoleting humans.

If the investors can own an AGI, the distinction between those who can do things and those who can't becomes irrelevant. The only distinction that would matter is between people who collect rent on the technology, and those who must pay that rent to live. AGI would destroy society as we know it, and whatever replaces it would be up for grabs — with people who own the technology dictating whatever follows. That's why they're spending so much money to build a post-scarcity economy. A post-scarcity economy is not necessarily an egalitarian one.

I don't think that scenario will actually happen: investors are projecting the immediate aftermath of a major advance in AI technology into something that can be transformed by brute force scaling into AGI. Remember: investors loved Theranos too — so much for the rational investment market.

But AI doesn't have to reach AGI to cause serious harm. The technology only needs to be ubiquitous, too behaviorally complex to predict, and too deeply integrated into everything we do. When it starts breaking things, the plan is for us to be too structurally dependent on AI to rein it in.

Really, you don't see any difference between Elon Musk and, say, John Stankey? Is John Stankey actively transforming the US into an autocratic fascist-adjacent state?

Would you buy from a company called Plantations Inc which proudly advertises that all of its products are made by daily-whipped slaves? Are there no limits to how self-focused you are in your consumption?

It's one thing to say "this particular issue isn't mine, so I'm only going to think amount myself". It's an entirely different issue to have no moral bounds.

This headline sounds like something you'd hear coming from a news report on a TV in the background near the start of a horror movie.

The email wasn't even too good to be true. The nasty phishing emails are the ones where the recipient is supposed to get a real email on the topic, but it's because of a publicly known event and outsiders could easily make up the content, so they just need to find a bunch of likely recipients.

I think the "you've been assigned the mandatory phishing training" emails should come from an external sender and contain a link to get into the extended training, and you should only get the short refresher by finding it through verified sources. Not only would this be a good placement test, it would test that official communications are actually hard to fake and possible to verify using the process in the training.

"In response to the embarrassing data breach that hit the news recently, we've assigned every employee at the company an online training session about phishing at this link. By sure to take it immediately, because it's a legal requirement for our settlement and delays could affect your employment." --Russian Hackers

Pocket watch.

Time to start work! Eight o'clock, on the dot!