Odyssey as a security engineering metaphor since before it was cool. www.youtube.com/watch?v=RZ7b...
Hardened JavaScript
YouTube video by Agoric
youtube.com
I like to pretend that -poke is the singular of -folk. For example: one cowpoke, many cowfolk.
Your system prompt and the attacker's payload share one context window, both competing for the model's attention. You already know that fight goes badly some percentage of the time. Real enforcement has to live somewhere the model can't talk its way past.
Build revocation so you never need the agent to cooperate. Keep the revoke handle separate from the capability the agent carries. Something looks wrong, you pull it from the outside, and the agent learns about it by failing.
This is just to say I have OCRed the text thet was in tne arch:ve and whicb yov were prabaldy seamhing for "breahtast" Fargme ms fheg mem debo:w5 sb ?mccf mmb 5c oc1b
Robin and Ramy witness Babel, the Royal Institute of Translation, in all its foreboding majesty second illustration for R. F. Kuang's Babel - illustrated edition, out now from Harper Voyager 40x30cm ink on claybord
Fun factoid: the terms “upstream” and “downstream” refer to the Styx.
Mentor was a man and *did not ment*. Mentee is therefore not a word. The word you are looking for is telemachus. For example, “I meet with each of my telemachy once a month”.
This has been a long time coming and I’m glad it has arrived. Supply chain attacks will now have *no choice* but to be slightly more sophisticated. It’s a good thing we already have lavamoat.github.io
LavaMoat
Secure your JavaScript with LavaMoat.
lavamoat.github.io
npm@npmjs.com · 4w agonpm v12 is now generally available. npm install now makes install scripts, Git, and remote-URL dependencies opt-in by default. We're also retiring npm 2FA-bypass GAT: no account management (early Aug 2026), no direct publishing (~Jan 2027). More info at github.blog/changelog/20...
npm v12 is now generally available. npm install now makes install scripts, Git, and remote-URL dependencies opt-in by default. We're also retiring npm 2FA-bypass GAT: no account management (early Aug 2026), no direct publishing (~Jan 2027). More info at github.blog/changelog/20...
npm install-time security and GAT bypass2fa deprecation - GitHub Changelog
npm v12 is now generally available and tagged latest. This major release turns on the install-time security defaults we announced in June, and it’s also where we begin a deprecation…
github.blog
hardware prices 🤝 astrology keeping an eye on chinese ram
CA residents: Just a few clicks to let your rep know you don't want your 3D printer turned into a camera into your home. www.eff.org/deeplinks/20...
We Can Still Stop California’s 3D Printer Surveillance Scheme
Ignoring EFF’s warnings about the dangers and impossibility of implementing a new mandate for 3D print surveillance software, the California State Assembly has signed off on legislation to do just tha...
eff.org
Huh if you live long enough, you really start seeing the cycles.
danielroe@danielroe.dev · last mo.wouldn't it be nice if sites could share a cache of common js? ... stuff like react, or vue or svelte? 👉 there's an early stage proposal for cross-origin storage which enables exactly this. there are challenges but I think it's very interesting indeed
Happy belated birthday to Octavia Estelle Butler, born June 22, 1947
Dr. Damien P. Williams has to go the way his blood beats@wolven.blacksky.app · 10mo ago"God is Change, And in the end, God prevails. But meanwhile… Kindness eases Change. Love quiets fear. And a sweet and powerful Positive obsession Blunts pain, Diverts rage, And engages each of us In the greatest, The most intense Of our chosen struggles" — Octavia E. Butler, 'Parable of the Sower'
"We have full audit logs" is the most reassuring sentence in agent infrastructure, and the most misleading. An audit log catches the second incident, not the first. It is a forensic tool, not a control.
To paraphrase Steve Martin’s speech at the Academy Awards regarding Crouching Tiger, Hidden Dragon: it’s because they are fabled and therefore mythical.
And today, on the centenary of Gaudí's death (10 June 1926), the central tower is to be inaugurated (it was actually topped out on 20 Feb)
Dr James Alexander Cameron@drjacameron.stainedglassattitudes.com · 9mo agoToday La Sagrada Família is having the first part of the crowning cross of the Jesus Tower installed. This will finally take it past Ulm Minster's 161.5 metres (begun 1392, completed with octagon and spire 1885-90) as the tallest church in the world!
The elephant in the room for web application security and privacy protection is that we cannot have it without breaking the web’s original sin: irrevocable trust of the publisher and its services. We need a new kind of application platform, based on web tech, but not on the web. kriskowal.com/giants
A Choice of Giants
Open Sourcerer
kriskowal.com
It is an interesting thing that it seems like no matter how you feel about AI use, any communication that you receive that smells of AI often elicits a kind of negative vibe
The industry spent years trying to make LLMs ignore malicious instructions. Turns out the cheaper bet is making sure a compromised agent can't reach anything it wasn't handed. Least authority. References as permission. We've had this since the E language.
Hi, I'm Ken. I impulse-buy domain names. I should probably sell some of them: - gastown.ai - apilint.com - civicapi.com - macroscale.io - opsfox.com - timelydb.com
