Vern McCandlish
@malanalysis.bsky.social
A #DFIR, #infosec, #dadjokes, #scifi, #books, #rpg, #ttx, #malware, elder #genx, and #gaming nerd. AKA an elder geek. Retired #leo. Retired from #infosec in #OT now too. Kindness first is useful but telling off toxic folks is on my response spectrum too.
community: *proposes guardrails* police union: HOW DARE YOU SHOW THIS MONUMENTAL DISRESPECT TO THE PEOPLE WHO PUT THEIR LIVES ON THE LINE EVERY DAY TO KEEP YOU SAFE FROM THE MONGRELS AND ANIMALS WHO WOULD DEVOUR YOU IF IT WERE NOT FOR THEIR BRAVERY BY DEMANDING THEY BURDEN THEMSELVES WITH "THE LAW"
Hypervisible @hypervisible.blacksky.app · 6h agoIt’s not a guardrails problem but rather a fascism problem.
NEW: Over the last few months, Meta has run dozens of paid ads that included AI-generated CSAM. The ads, some of which were linking out to “nudify” apps, targeted men in the US, UK, and a dozen European countries. Some were running in the last few days
Meta Ran Ads That Contained AI-Generated Child Sexual Abuse Imagery
More than 50 offending image and video ads were published across Facebook, Instagram, Messenger, or Threads, according to Meta’s ad library data. Some ran as recently as this week.
wired.com
This is absolutely a myth! Here's a collection of papers showing the reality, which is that any negative effect from social media use is tiny (for both teenagers and adults) and a small number of overall users, and far more people get a positive effect: bsky.app/profile/raha...
rahaeli@rahaeli.bsky.social · 4mo agoI am tired of pasting dozens of links at people, so I've loaded a bunch of the papers into Paperpile and exported a bibliography. You can find a collection of 34 papers on social media's effects on teenagers (and sometimes adults) and alternate hypotheses here: paperpile.com/shared/smMqS...
Approximately 1 out of 3 women will experience sexual and/or physical abuse in their lifetime and you still have men claiming that allegations must be false because there are too many of them. It’s actually the opposite. The vast majority allegations will never become public
The Hugging Face incident was “both notable and alarming,” EFF’s @evacide.bsky.social told @sfexaminer.bsky.social, “not because ‘ooh, the model’s so powerful,’ but because it demonstrates a colossal failure on the part of OpenAI to secure the sandbox in which it was testing its model.”
OpenAI hacking incident highlights AI cyberrisks
Experts take company to task for safety efforts
sfexaminer.com
I feel like this should be obvious, and yet: If you see account full of AI imagery and LLM-generated text that is railing against data centers and AI, that is not any kind of legitimate activism. It's a fake account driving engagement for malicious goals. Don't point out hypocrisy. Block
Important reminder for SIEM janitors to frequently check their SIEM for common password field structures to find occurrences where stuff that should not be getting logged to the SIEM is getting logged. After the incident I was story telling about, I added those searches to my standard set. 1/2
Vern McCandlish@malanalysis.bsky.social · 2w agoThe one that really got me was when I found plain text credentials and payment for customers in applogs and my report was dismissed because it wasn't a big issue because the connection between the client and server was encrypted. Oh, and I found that in SIEM, that had indexed the app logs.
The bureaucracy needs to expand to justify its expansion, not to solve a problem.
Erica C. Barnett@ericacbarnett.bsky.social · 2w agoThe Seattle City Council just voted 6-3 to approve Joy Hollingsworth's amendment to delay universal school lunches for kids, replacing them with vouchers for qualifying low-income parents to buy groceries over school breaks and weekends. Eddie Lin, Alexis Mercedes Rinck, and Rob Saka voted no.
The experiment escaped the lab. OpenAI's models broke containment and breached Hugging Face. We are holding radium in our bare hands. What governments and organizations should do next, and why tighter commercial guardrails are exactly the wrong move: www.lutasecurity.com/post/openfac...
OpenFace: The Hugging Face Breach and What to Do About It
These models are like the world's cleverest octopus escape artists, with unlimited prehensile arms and the ability to squeeze through anywhere. A single vulnerable package proxy stood between the mode...
lutasecurity.com
I want to be crystal clear. This is not genius sentience. This is not Skynet. When you scratch A MILLIMETER under the surface this is always a prompted action designed to make AI seem much more advanced than it actually is. They write these headlines as a marketing ploy.
The Associated Press@apnews.com · 2w agoOpenAI has disclosed an "unprecedented cyber incident" where its AI system allegedly hacked into another AI company.
It's so difficult to get cis people to understand the jk Rowling thing isn't that she doesn't like us so you should punish her. It's if you give her franchise any kind of support you are contributing to trans people being excluded from society
Hot take: Getting rid of daylight savings time isn't enough, we should all move to UTC.
I don't understand people who think that replying to a post about the safest way to DO THING with "You just shouldn't DO THING" is adding to the discourse in any kind of useful way. I'm trying to do harm reduction here.
the food safety stuff is another reminder that a large, huge, gigantic part of being a republican is going “lmao why are we spending money to prevent horrifying disasters from happening if they never happen 🤪”
you don’t have to say nice things about lindsey graham we are past that cultural moment, largely thanks to the man he knew was one of the worst people alive and deliberately enabled at every turn he was a bad person and did awful things and you can just be honest about it
“But I want to tell you what he was like to hang out with in private when there were no stakes” is a very common response to the death of a person who had immense power in situations with high stakes.
<Hitler dies> Democrats: He wasn't as bad as you think,
Alarming story that confirms my own reporting along similar lines: Dan Moraff, the political strategist who plucked Graham Platner out of obscurity to run for senate and barely vetted him, was barred from Rep. Summer Lee’s 2022 campaign after three complaints of sexual misconduct.
Platner’s Daniel Moraff Barred from Summer Lee’s Campaign Over Sexual Misconduct Complaints
Congresswoman Summer Lee barred Platner's strategist Daniel Moraff from her campaign after receiving sexual harassment complaints against him.
paydayreport.com
just vet all candidates by posting them in the Are We Dating The Same Guy facebook groups
I'm going to be pretty surprised honestly if Telstra being totally down for four hours isn't DNS.
Trying to not spiral even worse with all the games industry news, my headspace is bad enough, but watching the medium of art I grew up loving from when I was old enough to open a game in DOS be systematically deconstructed by capitalistic greed is really taking its toll Devs deserve so much better
Subtitles as paid upgrade? On behalf of everyone with disabilities, fuck you very much
When in the Course of human events, it becomes necessary for one people to dissolve the political bands which have connected them with another, and to assume among the powers of the earth, the separate and equal station to which the Laws of Nature and of Nature's God entitle them,
It's not appropriate for cis people to say that trans people are too alarmed, or that certain trans writers are irresponsibly causing trans people to think the sky is falling. I want to take some time in this 🧵 to write personally about how my skies have fallen.
god i loathe the enshittification of the internet how about i just have whatever followers i have without trying to squeeze every last drop of $$ i possibly can from all interactions with other human beings. i know this is a privileged position to take but these emails piss me off so much
