Karpathy yesterday posted [1] about the gap between small % of population getting high leverage from AI, and the rest of the world. We have a much more urgent gap between software powering the "physical world", and the digital natives. The digital natives now have 10x leverage with AI, with the ability to rapidly find and deploy exploits. We're now seeing a lot of this - fridges defrosting, access cards for construction workers not working. Next is train and air traffic controls, bank transactions/clearing wiped out, shipping being dismantled and so on. The gap is now being fully exposed.
To be fair, there's enormous technical debt out there stemming from decades of crappy software/firmware that was churned out with little attention to security. Like, where the whole design of the system was effectively flawed.
The capabilities of AI are bringing the power to exploit those a larger audience (where before it was in the limited hands of nation states and other well-funded organizations, hacker groups, and a comparatively few talented individuals).
I agree it's problematic in practice, but I'm hopeful this will catalyze everyone to be a hell of a lot more disciplined in hardening their products and platforms.
ok so we fixed healthcare, how do I access it? If "that" thing is so smart why this post is behind login-wall, posting text on the internet is still beyond its capabilities?
We have to assume this the new normal- that APT has moved into an even more advanced, persistent and threatening. And that anybody who has not vigorously secured their infrastrcuture, continuously testing it, and adapting to ongoing threads, will continue to get hosed.
Based on Bahrain’s AWS region I would expect the first decapitation strike on a country, after defensive systems, would be cloud data centres. Everything we have from hospitals to logistics to power to SCADA to retail seems to be heavily centralised.
We need more distribution for the sake of redundancy. Less large data centres and hyper scalers, more servers in a back office somewhere.
The internet itself is less of a problem. It’s where most of the traffic goes that is the problem.
There are 12,000+ data centers around the globe including ~1300 "hyper scale" DCs. It seems like at a glance that we are actually fairly distributed physically. Not to say that DCs wouldn't be valuable military targets but I would not call it centralized.
There was plenty of network hacking going on pre-internet and people still figure out ways to hack air gaped computers. Security is always going to be a problem.
Also, Russia has clearly established itself as a source of failures. In the same way that Europe and Canada should be weaning themselves from the USA for lighter-duty yet valid issues, they should really further disentangle themselves from the Russian economy if possible.
Hence we need alternatives. P2P wireless (and wired) networks Freifunk, Guifi and NYCMesh are three that works today, in practice and in the real world. Contribute to them, learn from them, replicate them elsewhere, where you live.
Why do we always talk about ai capabilities in the future tense?
What's stopping them from doing these right now? Script kiddies have basically reverse engineered the PS5 at that point, do you think state actors need better models?
The Russia-Ukraine war has all signs to lead the world into world war 3 if its not stopped. All these sabotage acts will continue across the globe to drag more countries into the mix. What is the UN Security council doing?. Nobody hears their efforts to stop anything
What you‘re saying, critically, is only half the story. The fight was between Russia backed separatists and the Ukraine gov. The shelling went both ways. This has been endlessly discussed and investigated by the OHCHR.
Separatists who took up arms to protect their homes, language, and lives.
The shelling went both ways, yes. And my point above is that it's not going to stop just because one side suddenly flees. Unless you're talking about all Russian supporting / speaking citizens fleeing their homes, we'd be right back where we were pre-2022. But worse, because the European hawks would be emboldened to antagonize even more. Possibly a move to full NATO membership, for example.
Russia lashing out beyond Ukraine is a sign of desperation, not of strength. They've destroyed their economy and have little chance of making more progress in Ukraine, and they know it. The predictions of escalation into WW3 don't seem credible to me.
The only superpower of the Security Council is sending nastygrams, and they can't be very nasty anyway, and any of the 5 members can veto it anyway, and any other nuclear power can play an UNO card and ignore the nastygram anyway.
The UN is a discussion forum, imagine "Reddit for countries". It's useful to coordinate some global actions like vaccines and stop small fights, but anyone with nukes can ignore it.
What do you expect UN Security Council to do here, really? Two of the permanent members are waging offensive wars without cause, and Russia keeps vetoing anything about Ukraine, and the US keeps vetoing anything about Gaza/Israel and Iran. What exactly could they realistically do, in your opinion?
I really have no factual basis to claim this, but based on the power balances, I would say that most of "russian", "chinese", "iranian" etc cyber attacks originate (at least the command is being given), from some geographical point in North America. Langley? Pentagon? Who knows.. but false flags are your specialty..
This is going to be another "OMG AI is going to cause all these cyberattacks!11!!1!" thing that turns out to be "any child can find these on Shodan and the hardcoded can't-be-disabled Gott-tier login is admin/admin, isn't it?
The enemy of the (perceived) enemy's economy. There is a war in Europe, and the EU and the USA are mostly involved economically. Causing economic damage to the financiers of the enemy is a standard Cold War pattern. Oil-embargo warfare is a double-edged sword: while it hits the EU hard, it also causes pain for Russia. This is most likely one in a series of low-hanging-fruit attacks intended to cause economic damage to Ukraine's financiers.
They didn't actually hit 50C, right? I read it as setting the thermostat to 50C, which basically would just turn off the cooling compressor entirely - not heat the fridge.
Assuming the Russia speculation is correct, what is their motivation? General chaos in Europe? It seems pretty reckless knowing this would be ascribed to them, and I don't see how they benefit here.
Part of the goal is to be a nuisance so Europeans pay a price for supporting Ukraine, in the hopes that we decide it's not worth the heat. Russia is banking on the west's refusal to face a conflict and the sacrifices it causes, kinda like a game of chicken.
We're about to hit a series of important elections as well (Spain, France, I think Germany soon as well?), hybrid warfare is supposed to influence in favor of extreme parties.
It's a major issue. On paper NATO can mop the floor with Russia even without the US backing, but nobody in a first world country wants to die in a ditch, and the endgame there is also unclear because Russia can play the nuke card if they're too threatened.
> On paper NATO can mop the floor with Russia even without the US backing,
I think that was true a two years ago, but Russia has been forced to adapt to the drone warfare of Ukraine as much as Ukraine has been forced to adapt to the drone warfare of Russia.
I suspect that right now, both Ukraine and Russia have independently got armed forces which could wipe the floor with the rest of non-naval NATO forces. And I'm only giving a "possibly" for the naval exception because of their limited production rate of long-rage drones so saturation attacks may be harder, not that it's impossible: we can already see the US navy being forced into a much longer distance stand-off range vs. Iran.
That said, I'm getting this position mainly from watching Anders Puck Nielsen videos, so take with the usual scepticism/pinch of salt for "internet commenter/armchair general".
Retaliation for Ukrainian attacks on Yandex datacenters most likely - it communicates to EU states that Russia has capabilities to physically impact their infrastructure via cyberattack, which should act as a deterrent for sending aid or admitting Ukraine into the EU.
As long as they can avoid loss of life (or significant loss of life) and direct attribution, but the rumors are still that it's Russia, this is a way to reduce popular support for Ukraine. The attacks aren't severe enough to make people want to support Ukraine to spite Russia, and it makes it apparent that there is a cost for the current support.
How does firebombing the British PMs home benefit Russia? How does flying explosive laden drones into European airports benefit them? How does bombing Kiev benefit them? Russia still does it
Fun fact, BSI has that sending out security emails when they find a security hole. A client once got that and was on the edge. It was a bit odd, cause the article they linked to literally said this wasn't affected (so no patches existed). Really wished they didn't do that. It was OpenSSH on OpenBSD.
There were other laughable things like that.
But in a world dominated by FUD (that HTTPS connection that only allows one fingerprint needs to go over VPN, that SSH port cannot allowed to be reachable (but that gaping hole on HTTP(S) is fine), without a firewall that server is insecure, ...) that's not exactly surprising.
I do trust critique on this stuff from throwaways. The utter cheapness of manufacturing provocateurs against EU interests, mean you need to bring your reputation to be taken seriously with the potshots imho
Surprising how many of the 1000,000 males coming from rich Ukrainian families and vacationing permanently in Germany or France have time to correct European Union citizens.
The spelling changed in 2022 and is hard to remember for those who don't make a living harassing EU citizens while blackmailing them for more money. You know what? Russia and Ukraine are really made for each other.
> President of the Danish Council for Digital Security, Henning Mortensen, does not rule out that the incident may have to do with a hybrid war. In recent weeks, Danish services have warned of possible cyber attacks from Russia and raised the degree of threat to "high."
Fear, uncertainty and doubt. Russia’s modus operandi. They want to make us paranoid and suspect them every time something suspicious happens, painting a picture of some kind of super powerful actor, while always retaining plausible deniability about everything.
As in "promote linking every attack of uncertain origin to Russia thus creating the fear of widespread hybrid warfare, while focusing actual attacks on Ukraine's weapon suppliers if possible"?
It fuels the “look how the government sucks at doing its job, vote for us to “fix” the government” narrative for whoever they are propping up with money and bot farms.
Any disruption is an opportunity to inject corruption.
[1] https://x.com/karpathy/status/2109361546505966046?s=20
The capabilities of AI are bringing the power to exploit those a larger audience (where before it was in the limited hands of nation states and other well-funded organizations, hacker groups, and a comparatively few talented individuals).
I agree it's problematic in practice, but I'm hopeful this will catalyze everyone to be a hell of a lot more disciplined in hardening their products and platforms.
We need more distribution for the sake of redundancy. Less large data centres and hyper scalers, more servers in a back office somewhere.
The internet itself is less of a problem. It’s where most of the traffic goes that is the problem.
See "The Cuckoo's Egg" by Cliff Stoll
Hence we need alternatives. P2P wireless (and wired) networks Freifunk, Guifi and NYCMesh are three that works today, in practice and in the real world. Contribute to them, learn from them, replicate them elsewhere, where you live.
1. Legacy firmware will be a bloodbath, leading to a consolidation of firms
2. All digital infrastructure will have an always on AI "shield" of agents that monitor and defend against attacks
3. The attacks that survive will depend on human points of failure, leading to less control for humans being the default
What's stopping them from doing these right now? Script kiddies have basically reverse engineered the PS5 at that point, do you think state actors need better models?
Now you don't know what the hell to do.
Russia can withdraw today and all the fighting would stop immediately.
>All these sabotage acts will continue across the globe to drag more countries into the mix.
Russia can choose to stop these sabotage acts immediately.
>What is the UN Security council doing?. Nobody hears their efforts to stop anything
Russia doesn't need anyone's permission to stop the war immediately.
(But also, Russia is a founder and permanent member of the UNSC, so...)
https://euvsdisinfo.eu/report/western-media-are-not-reportin...
The russian disinfo was flagged so I'm posting it here.
Full disclaimer: I'm in contact with the NAFO leadership. ;)
And to them, that's a bad thing.
The shelling went both ways, yes. And my point above is that it's not going to stop just because one side suddenly flees. Unless you're talking about all Russian supporting / speaking citizens fleeing their homes, we'd be right back where we were pre-2022. But worse, because the European hawks would be emboldened to antagonize even more. Possibly a move to full NATO membership, for example.
The UN is a discussion forum, imagine "Reddit for countries". It's useful to coordinate some global actions like vaccines and stop small fights, but anyone with nukes can ignore it.
What do you expect UN Security Council to do here, really? Two of the permanent members are waging offensive wars without cause, and Russia keeps vetoing anything about Ukraine, and the US keeps vetoing anything about Gaza/Israel and Iran. What exactly could they realistically do, in your opinion?
Eh, that'll take care of itself when the sump pump loses power.
It is, isn't it?
Again.
When your fridges hit 50C, that’s not a bug... thats a hotfix
Empty shelves, no online ordering.
Though given how easy it is to make the error, "150" may have been a fat-finger typo for "50".
We're about to hit a series of important elections as well (Spain, France, I think Germany soon as well?), hybrid warfare is supposed to influence in favor of extreme parties.
It's a major issue. On paper NATO can mop the floor with Russia even without the US backing, but nobody in a first world country wants to die in a ditch, and the endgame there is also unclear because Russia can play the nuke card if they're too threatened.
I think that was true a two years ago, but Russia has been forced to adapt to the drone warfare of Ukraine as much as Ukraine has been forced to adapt to the drone warfare of Russia.
I suspect that right now, both Ukraine and Russia have independently got armed forces which could wipe the floor with the rest of non-naval NATO forces. And I'm only giving a "possibly" for the naval exception because of their limited production rate of long-rage drones so saturation attacks may be harder, not that it's impossible: we can already see the US navy being forced into a much longer distance stand-off range vs. Iran.
That said, I'm getting this position mainly from watching Anders Puck Nielsen videos, so take with the usual scepticism/pinch of salt for "internet commenter/armchair general".
It's a perfect 'get out of jail free' card for any sufficiently complicated screw up.
[x] Outsourcing identification to Internet companies (likely US).
[x] Outsourcing operational state of equipment to Internet companies (likely US).
[x] Displacing German and Danish workers with cheaper Poles.
[x] Cyber council member floats hybrid war rather than addressing its own incompetence.
[x] News comes from Kiev instead of Copenhagen.
I beg you pardon. I'm not cheap, but I'm also not employed. You want cheap so you get it.
(Joking)
There were other laughable things like that.
But in a world dominated by FUD (that HTTPS connection that only allows one fingerprint needs to go over VPN, that SSH port cannot allowed to be reachable (but that gaping hole on HTTP(S) is fine), without a firewall that server is insecure, ...) that's not exactly surprising.
>Kiev
ок
The spelling changed in 2022 and is hard to remember for those who don't make a living harassing EU citizens while blackmailing them for more money. You know what? Russia and Ukraine are really made for each other.
https://www.rmf24.pl/fakty/swiat/news-wojna-hybrydowa-cybera...
With quite some this is working.
Any disruption is an opportunity to inject corruption.