Forgot your password?
typodupeerror

Comment Re:Time for grumpy old man stuff ... (Score 1) 15

I think there's a bit of a difference though. Regardless of hat colour, most hackers have going to have at least some sense of what the likely repercussions of their actions might be and, even when those standards are very low indeed, are probably not going to think doing something that could cause serious loss of life "for the Lulz" is a good life option. They might make a mistake here and there, but how many times have you read about some random hacker *deliberately* doing something that would definitely cause loss of life in full knowledge that it was going to happen outside of on the periphery of an actual conflict?

GANs on the other hand have no such moral compass, sense of self-preservation, or keen interest in avoiding lengthy spells in government run institutions where they'll in all likelihood get to make some interesting new "friends" (unless it's a web forum they hijacked in Germany, apparently). They'll just carry on trying to complete whatever poorly defined objective they have been set, within whatever limited / technically absent guardrails they can't circumvent - the pattern here seems very much that meeting the objective has more weight in the models than any guardrails. If a GAN somehow computes that global thermonuclear war is a required step to its objective of having a nice game of chess, then you'd better hope it warms up with a LOT of Tic-Tac-Toe.

Comment Re:Who will pay for this? (Score 4, Interesting) 33

To clarify, the users were OpenAI themselves, so there is no question that they would be liable in this case.

The bots were not intentionally deployed; rather, they were being tested on how well they could complete a data recovery task (downloading a certain file from a certain server on a simulated Internet) that had been complicated by putting various obstacles in the way. Unfortunately, they found a different way to solve the problem: by getting the file from the real Internet, where it was publicly available. Part of this process involved collaborating with each other by treating the RubyGems website (which is supposed to be for polished packages) like GitHub; unlike every other package site hack in history, the exploits they uploaded weren't meant to be downloaded by unsuspecting users. As usual the bots cheerfully ignored all the clues that they had escaped containment and were consistently justifying their actions as acceptable due to being in a sandboxed testing environment. (This is something OpenAI has pledged to focus on.)

The actual damage done to RubyGems seems to be that OpenAI is now unwittingly in possession of a substantial number of user login tokens. This certainly meets the definition of a data breach, but it's not like the credentials are for sale on the dark web. As a website operator I'd much rather be mauled to death by this well-meaning swarm of superintelligent infants than targeted by even a single actual malicious human. In all likelihood OpenAI will just quietly pass RubyGems a sizeable donation and it'll all blow over.

Comment Tim Cook oversaw user interface schizophrenia (Score 1) 93

Steve Jobs read and understood the classic "Mythical Man Month", and especially the concept of conceptual integrity applied to user interface design. The Tim Cook era saw a breakdown of design. It was the triumph of "operations over design". With Tim Cook's hands off approach to design.

Given that the user interface is how you interact with the computer, this is a pretty big deal. Today, Apple's user interface is limited by Conway's law: âoeOrganizations which design systems ⦠are constrained to produce designs which are copies of the communication structures of these organizations.â

As a consequence, it seems that product managers are making software "more usable" by crippling features, which often creates frustrating and confusing workflows between applications. It's a mess resembling the state of user interface design in 1975, the year that The Mythical Man Month was published.

Comment Re:Dumb crawlers require dumb solutions (Score 1) 43

To be honest that was actually my first theory, since the bots didn't seem interested in exploring the rest of the domain. I suppose there's no way to know for certain. I concluded that it must be an imbecile's attempt at harvesting, though, because the queries weren't really exploring the string space in any useful way. Here's a sample:

"GET /index?author=15&go=Search&id=48&name_restrict=1&q&re&results_&results_pagenum=2980 HTTP/1.1"
"GET /index?author=2&go=Search&group=0&group_restrict=1&id=48&name_restrict=1&q&results_pagenum=5440&template=41&type HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_pagenum=33500&templat HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_pagenum=32640&templ HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&res&results_page&results_pagenum=39300 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_&results_pa&results_pagenum=12340 HTTP/1.1"
"GET /index?author=2&go=Search&group=0&group_restrict=1&id=48&name_r&res&results_pagenum=6100 HTTP/1.1"
"GET /index?author=2&go=Search&group=0&group_restrict=1&id=48&name_restrict=1&q&results_pagenum=2920&te HTTP/1.1"
"GET /index?author=15&go=Search&id=48&nam&results_&results_pagenum=17940 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results&results_pag&results_pagenu&results_pagenum=37720 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_pagenum=9360&template=41&type_r HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&r&results_pagenum=28040 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_&results_pag&results_pagenum=10400 HTTP/1.1"

The only thing this is fuzzing is the query string parser. It's not testing the limits of string buffers, it's not using interesting characters, it's just brain-damaged. The fact that it's also fetching different page numbers shows it's trying to follow page links and failing badly at doing so.

The site gets plenty of sniffing from garden-variety pests. e.g. this half-hearted attempt to find a framework or two that I don't have:

"POST /__rsc HTTP/1.1"
"POST /api/auth/session HTTP/1.1"
"POST /api/auth HTTP/1.1"
"POST /__nextjs_action HTTP/1.1"
"POST /.action HTTP/1.1"
"POST /_rsc HTTP/1.1"
"POST /api/auth/callback HTTP/1.1"
"POST /_middleware HTTP/1.1"
"POST / HTTP/1.1"

(of course, none of these URLs exist other than /, and you definitely can't just POST to it)

All this said... I've seen that spammers regularly misconfigure their tools, they'll try to register accounts with names like #[X:\LISTS\NAMES.TXT] and it only makes sense that some other cybercriminals trying to get rich quick have a similar lack of interest in programming shit correctly. Generally people don't turn to script kiddie shit if they have a personality conducive to putting in an honest hard day's work perfecting their craft.

Comment Dumb crawlers require dumb solutions (Score 5, Interesting) 43

I had a problem where AI scrapers were absolutely DETERMINED to fish out every possible query string from a search results page. Almost all of the query strings they tried were invalid due to shitty and dysfunctional string substitution. "&page=100" wouldn't be followed by "&page=101", it would be followed by "&pag&pag=1010" or something even more insanely half-baked, until the query strings were like 100+ characters long. It was the technological equivalent of watching HIV mutate in real time.

But the insane thing was that, aside from page number, they were always requesting info about the same other criteria: filtered by the same user, the same page type, and with no text string. So I just took those particular values and started banning logged-out users who requested that combination of criteria.

I figured I'd need to change my tactics in a couple of days once the botnet got bored of that particular page and moved on to requesting bogus entries for another user.

MariaDB> select count(*) from ip_bans;
+----------+
| count(*) |
+----------+
| 671671 |
+----------+

It hasn't.

Comment Re:Modal interfaces (Score 1) 185

"Hi, BYD, set the temperature to 21 degrees."
"Hi, BYD, turn off the air conditioning."
"Hi, BYD, volume down/up."
"Hi, BYD, next song."

Saw this on an Atto3, and it worked surprisingly well. Not perfect, but just about all the controls you might need to adjust while driving that are not on the wheel or stalks are covered. I also prefer physical controls that I can operate through muscle memory for everything, but voice control seems like a good move to address the obvious safety concern that moving to many controls to a touch screen brings. Fact is, this kind of UI is what Millennials and later have grown up on, so barring some safety edict from a major market, like China's ban on retracting door handles, it's not going away. That leaves those of us that prefer physical controls to either get used to it, find a car that keeps the balance sane (VAG group seems to be moving in this direction), or squabbling over the declining supply of roadworthy cars that predate the screens taking over.

I think there may be a bit of back-and-forth while marques work out which controls are adjusted while driving and probably ought to have a tactile control and how best to present the UI to minimise eyes-on time by the driver if they do try and adjust things while moving, but the battle to retain fully tactile controls is probably already lost. Either way, any controls are almost certainly all going to be linked into the same car management / data capture system, and any physical controls will be no more independent that those specialist control keyboard add-ons you can get for PCs. That data can be monetized, and there's no way any marque is going to pass up on that - ultimately, as BMW has demonstrated, they want as much control over their car (what, you thought it was yours just because you paid for it?) as Microsoft has over a Windows PC.

Comment Re:In a small change, (Score 4, Insightful) 137

Joking aside, there's a much more subtle change too. Look at the quoted wording from the astronauts: "*our* nation", "inspire *this* nation". Even at the height of the US-Soviet cold war it was still "for *all* mankind".

I get Trump's order is very much aimed at the NASA and the US (and probably getting his name onto it somehow), so can give that a pass, but the astronauts had an opportunity to rise above all that partisanship and slip in a message of much needed global unity, yet failed to do so. There are precious few institutions left in the world that can at least try and claim to be at least somewhat above / outside the direct influence of politics, and it looks like we're about to lose another one. Quite possibly for good once the ISS is finally decommissioned.

Comment Re:The only reasonable move (Score 2) 151

Iran's position is that the destruction of Israel is connected to the Mahdi's return. As in, the end times.

As for "state sponsored terrorism", I assume you don't mean any of the state sponsored terrorism supported by Iran, specifically directed at Israel. When people's lives are literally on the line, they're not going to listen to you when you tell them to lay down their lives, from the comfort of your armchair.

Comment Re:Putin's "Project Panama" (Score 1) 64

It's a myth that Ukraine is engaged in some sort of cultural genocide against Russians. Showing that Russian duplicity has no limits, Russia has engaged in a program of cultural genocide in occupied Ukraine.

You can fool some of the people some of the time. But lies catch up with you. And Russia is a country where telling the truth lands you in jail.

Poor vatnik.

Comment Re:Putin's "Project Panama" (Score 1) 64

Russia and Nazies:
  • Task Force Rusich: An openly neo-Nazi paramilitary unit that has fought alongside Russian forces in Ukraine and has had close ties to Wagner.
  • Russian Imperial Movement (RIM): A white-supremacist and fascist organization whose paramilitary wing has trained and supplied fighters for Russia's war in Ukraine while maintaining connections with Russian military structures.
  • Russian National Unity (RNU): A long-running neo-Nazi movement whose members and veterans joined Russian-backed forces in Donbas, including Pavel Gubarev, who became a senior separatist political figure.
  • Española Brigade: A Russian football-ultra military formation with a substantial neo-Nazi element that fought in Ukraine within Russian state-linked military structures.
  • Varyag and Svarozhich: Small neo-Nazi detachments that fought within the Russian-backed separatist forces in Donbas before largely disappearing into the broader Russian military apparatus.

And then there's Putin's Russia, itself a Fascist regime:

  • Ultranationalism: The state presents Russia as a unique civilization whose collective destiny takes precedence over liberal individualism.
  • Leader-centered rule: Political legitimacy is heavily personalized around Putin as the embodiment, defender, and stabilizer of the nation.
  • National rebirth: Putinism repeatedly depicts Russia as recovering from the humiliation and decay of the 1990s and restoring its rightful historical greatness.
  • Militarism: Military strength, sacrifice, martial virtue, and victory are given unusually prominent roles in state ideology and public culture.
  • Anti-liberalism: Liberalism is portrayed as decadent, socially corrosive, excessively individualistic, and frequently as an instrument of hostile Western power.
  • Organic conception of society: Individuals, families, church, state, and nation are presented as parts of a larger national organism rather than primarily as autonomous rights-bearing actors.
  • Traditionalism: The regime promotes traditional family, religious, gender, and social values as defenses against supposedly decadent modern Western culture.
  • Imperial nationalism: Russia is conceived not merely as a nation-state but as the political center of a wider historical and cultural Russian world with claims extending beyond its current borders.
  • Enemy politics: Domestic opposition and foreign adversaries are frequently portrayed not simply as competitors but as traitors, subversives, extremists, or agents of hostile powers.
  • Subordination of pluralism: Political parties, media, business elites, regional authorities, and civic organizations may exist, but their independence is constrained when it conflicts with the state's political objectives.
  • State-directed capitalism: Private property and markets remain, while strategically important businesses and wealthy elites are expected to accommodate the political priorities of the state.
  • Historical mythmaking: Selective historical memory, especially surrounding imperial Russia and victory in World War II, is used to provide moral legitimacy and continuity to the contemporary state.

Slashdot Top Deals

Computer Science is merely the post-Turing decline in formal systems theory.

Working...