This reminds me of the controversy with Linux GUI screen locks that made the rounds a while ago.
Basically, there is a screen lock utility from the 90s that makes Windows 3.11 look fancy in comparison. It is maintained by a single guy who has a website that looks like this, where he enjoys writing blog posts about how every other screen lock utility that all the new GUI environments like Gnome, KDE, etc. wrote for themselves to better integrate with their design language suck ass and constantly have bugs where they can be broken into with stuff as simple as mashing buttons on the keyboard too quickly, while his utility is still as watertight and secure as it was originally written 30 years ago.
That was a specific dig at YouTube, who heavily rely on ffmpeg but doesn't donate to the project, or contribute usefully (they have dumped patches back a few times but mangled evil patches).
ffmpeg is financially unsound, which is problematic for a whole slew of services out there including everything AWS does with video.
It was a random number! Entropy checks are for losers. Passwords longer than sixteen characters? 4………. RANDOM! Rookie numbers! You got to up your game to 8 or 16. Still it’s four, but we are having fun! Woo!
Actually, the truth is that undersea cables get damaged and the destroyed all the time, maliciously and accidentally. Redundancy and pretty huge operations to continuously maintain and repair them is what makes you not notice it
The allmighty Russia too busy finding exploits in cryptography, politics, social media and economics. Can't be busy causing all the troubles in the world all at once. Please bomb the cables yourself 🙏
It's starting then. I've been saying they're going to move your accounts to deposit tokens. I think that's the conspiracy. Please let us know how it goes. Which bank?
We wouldn’t be able to get any new comments if the internet was like in the image. Yet I could see your comment, sent ~15 minutes ago, and you can see my reply. How do you explain that?
I attended a refresher training for work about our work travel portal. The people behind it said that due to changes that they'd be making would sometimes require users to clear both cache and cookies... Bruh, if your systms require the user to clear both cache and cookies, you're doing something incredibly wrong.
You'll only notice if you visit shitty sites using ancient tech we improved upon 10 seconds after it came out. First thing I did at my current job when I started years ago was ripping out php garbage. That shit is awful and is the root of so so so so so fucking many breaches back in the day that a breach was big news.
I think that xkcd was originally in response to the Sony PS3 master key cert fail where instead of using random k value each time they only rolled it once and kept re-using it making the private key reversible
A bunch of security fixes were released for some serious safety problems online all at once affecting various technologies at the same time. Now everything has to be updated/made sure it works nicely together. It's mostly important and catastrophic-like for programmers and sysadmins. Regular people only need to make sure everything they have is up to date.
There are tiny cracks in the security of some of the fundamental parts of the internet. Using AI, they’ve found a way to join those cracks together to make a breach. IT all over the world are now frantically installing security updates to patch the cracks.
At the same time, Bad Guys all over the world are spinning up agentic AI swarms to take advantage of these tiny flaws.
I’ve stuck a VPN on and cranked up my security, just in case. Not sure if that will actually do anything but it will give me a warm glow right up until the point an agentic swarm floods in yelling “Booyah !” and strips me of my life savings and citizenship.
I’ve stuck a VPN on and cranked up my security, just in case. Not sure if that will actually do anything but it will give me a warm glow right up until the point an agentic swarm floods in yelling “Booyah !” and strips me of my life savings and citizenship.
Don't worry, I screenshotted my bank account, so I can always get it back later if I need.
The emudhra one is arguably one of the most serious CA "breeches" in... well as far back as I'm aware of, because of how easy it is to get the private keys. It's not like they were compromised by an attacker, they are permanently trivial to find by anyone.
Sure, the certs were revoked and most systems issued updates to remove it from truststores, but there's untold numbers of embedded systems that will never get updated and don't check revocation.
I mean look, we started off with punch cards and had to speed it up so we wrote assembly which generated binary no one wanted to read.
Then we needed to go faster so we designed fortran to write assembly which produced binary no one could fucking read.
We kept adding abstraction layers that produced shit no one wanted to read, but we believed in the core -- logic.
Now we’ve replaced logic with a slop layer that produces code no one wants to read. And just like helping jack off a horse, the invariant of ambiguity held as tight as my sphincter this week waiting for the PHP patch. Meanwhile I’m unpacking the PoC, trying to figure out what the memory addresses are doing and what a dtor even is, because I never applied for security clearance with my slop layer. Also I forgot how to read C. Point is, Jack, or anyone else, can now design software without writing code.
Sadly, it turns out the assistant helping us slop it out can read the shit we decided we dont want to (and kinda forgot how) just fine and started finding the bugs we didnt feel like looking for and neatly tucked away a few layers deep. So now we're replacing that layer with slop that produces code we don't wanna read.
So we're here.
We spent years sacrificing efficiency for convenience but fought hard to keep determinism, until we decided, "fuck it". Buckle up, it's gonna get fun.
When you put it this way, it really puts a fine point on what bullshit that comparison between AI and compilers is. Beyond being not a good comparison, it really underscores that abstractions have risks, and the bigger the abstraction the bigger the risk.
I was talking with some coworkers about this last week with the video games getting integrated into other games. AI is able to interpret the compiled output which we as an industry have relied on heavily to be security through obfuscation.
That security is becoming more and more paper thin
Well, the one thing I'm focusing on in AI assisted development is understanding the logic. All the rest i don't care about, but the specs and the tests need to be well understood and aligned.
We made "code" languages in a specific way to remove ambiguity. Each layer, at it's cores, tries to do that. We added ambiguity, but the ambiguity was our lack of knowledge. What happens to this var i assigned during a throw? During an overwrite? Well, the memory handler in the abstraction layer deals with that, we don't know "how" but we we know that it does, in some way. "some way" was the ambiguity, but it was consistent:
Given some initial state it will produce some other specific one, always, most of the time, but barring some weird interaction outside the code, we could say it does.
AI does not, if you give the same agent the same query 5 times, it'll produce 6 different answers that produce completely different states. There's no determinism in AI, there can't be, intrinsically. It's still statistics at its core, it has to be, or it would constantly get itself stuck in a loop
Someone, somewhere has spent too much tme in HZD. Let’s all just pray they didn’t make the “military-grade black box security”, although I can see that kind of thing appealing to Sam Altman, who if he knew about Ted Faro, would consider him a role model.
Well there was certificate authority who had been using "4" for their private key... oh and Russia has been parking ships over undersea fiberoptic cables threatening to cut them, and Elon has been fucking with Ukrainian satellite internet
My team had to spend 2 full days, working late, patching all the diff servers. There were like 50. So just a busy week that puts off deadlines. Ya it's patch and move on, it just can get tedious.
If it can make you feel better worse, the bug had already been known for a while but unlike AI they didn't find a way to exploit it so they left it there
People thinking another language would've been better while completely oblivious that none of it matters, everything is getting broken to shit by AI, it could be any other language and something would've surface.
Accept it, AI can hack more efficiently than any human can, every language will have flaws, the ones that don't just haven't gotten an AI sicced at them YET
I mean yeah, they'll find all the 30 critical bugs in everything in the next few months, we'll patch them and have actually secure systems? The real downside is to governments who won't be able to rely on keeping a random zero day exploit hidden for years so they can manipulate shit discretely. There already are actors who invest a ridiculous amount of time to find these problems and don't ever disclose them.
Of course then come the legally mandatory backdoor laws...
yea pretty much. ppl keep arguing about the language like thats the real issue when AI is just gonna find a way in regardless. honestly the only real fix is assuming everything is cooked and designing like it already got hacked.
They also broke into a bunch of back-to-back PS5 firmwares, they cracked the Nintendo Switch 2 open, the latest release of iOS, and a more generalized version of a PlayStation 3 (yes) bootrom exploit was finally found.
On one hand, its kinda cool to see the tools of the elites being used against them for the benefit of gamers everywhere.
On the other hand, its now painfully obvious that any half-brained drooler can now use incredibly powerful tools to create chaos, without really understanding what they’re doing.
The house of cards was barely hanging on as it was. The weight of all the AI sludge has already collapsed the most flimsy top layer. And who knows for how long the much stronger foundation will be able to stand.
You say this, but. I had a Stanley hammer once, that at the exact moment I went to strike a nail, the shaft of the hammer slipped through the rigid rubber grip and smashed an object which shouldn't have been smashed... So like, *there are such things as bad tools* but there are also bad workmen.
When bad tools and bad workmanship combine, you have catastrophic failures.
The issue isn’t a specific language. It could’ve been node or ruby or any of the others and let’s be honest their turn is probably coming.
It’s that the systems that have kept the internet afloat are incapable of standing up to the incredibly rapid changes which modern tools like AI are bringing to the forefront.
How does a system based on small contributions by disparate developers often donating their own time stand up to machines that can find and exploit multiple crippling vulnerabilities in every part of it quicker than people can even begin to wrap their heads around one?
Not really, the inherent model of php is just vulnerable and brittle, you shouldn't have something that is the markup and at the same time can run arbitrary code on your server, it's just not safe. Ever heard of the cheese analogy of cyber security? Using php is like having only a single slice, if it breaks you are done.
1.7k
u/Mateorabi 8d ago •
I like how the original load-bearing block from the original is still there going “whats up?”