Elissa

DefCon 34 Call Center Village schedule: callcentervillage.com/events/dc34

I'm volunteering with Call Center Village this year at @DefCon. Come visit us! Learn how to clone your own voice, make a voice-agent, or socially-engineer one using local and open tools. We have an Escalation Desk CTF, with AI chat and voice based social engineering challenges. Score 600 points and we'll buy you at drink at Party Line, Call Center Village's after-hours party on Sat night. Link in Thread.

@robertgraham As far as vanities go, that wasn't very expensive! I would love to see people go to regional cons rather than Vegas, because I love seeing friends but don't love being in Vegas, so....thank you, I guess, for starting the trend?

@ElissaBeth Hi Elissa! Yea, I paid like a $100 bucks to get the defunct username. It's a stupid vanity. I will not be at DefCon, I'll be traveling that week.

@robertgraham hey, congrats on the new handle. (Might be old for you by now, Twitter decided that we all had too many friends, and it has been a long time.) Will you be at BSides/DefCon?

@McGrewSecurity Sounds good!

@ElissaBeth I’m not aware of a signup process for this one at the moment. Last year there was one, but folks past that just stood around the area and we fit in as much as we could. For now assume to just show up a little early and I’ll post if I find out any different

My workshop in the Malware Village this year, "Introduction to Reverse Engineering With Ghidra" is listed in Hacker Tracker now: hackertracker.app/defcon34/conte… It takes place Friday, Aug 7, from 12:10PM to 2:10PM. It'll be a very informal and audience-question-driven introduction to loading, processing, navigating, and marking up malware in Ghidra, with guidance on how to get started in software reverse engineering. I'll also be discussing and probably demonstrating the use of locally-hosted LLMs to assist you in the learning and reversing process.

@tiffani @CallMeWilsar Coffee (or beer IMO, if everyone drinks) makes so much sense as a first date. It's too early to get invested. Like you said, if everything goes well then you extend the date or plan Date Two. The whole point is to talk and flirt for a bit, right?

@CallMeWilsar I also think (especially after my most recent relationship) not getting overly invested too quickly is a goood thing. (Same reason as above)

I always find the coffee date discourse kind of funny My favorite ex and I had a coffee date after meeting at a house party a few days prior We were both very busy but suspected something was there, so we met up real quick. Nobody balked and it turned into a good time

@octal Yeah, this is an important case. "Untied States Code" is what we get with public funding and this requires more.

Why does this guy have a public defender? The precedent from this case is going to be very important and it's a relatively nuanced area of law with a lot of commercial importance. techcrunch.com/2026/07/24/us-…

singularity cuffing

@JCColtin @adamgabbatt This is a thorough piece. I didn't know the backstory about the mayor wearing traditional Indian dress.

In the words of Justin Timberlake, I be on my suit and tie shit @adamgabbatt cityandstateny.com/personality/20…

City & State doesn’t *own* the story of Mamdani wearing a suit all the time, but we’d appreciate mention and a link when the Guardian writes a story clearly inspired by @FarihaRahman_’s great, original reporting, using similar writing and even talking to one of her sources.

From the same post: "We are going to need a step change in resourcing and priority on cybersecurity." Security people like myself are always advocating for more resources on cybersecurity but if you think about where things are headed, it does seem urgent for companies to shift resources here. At the very least, weekends will require more robust monitoring and incident response teams on faster standby than in the old days.

@martinald's comments on the package manager proxy exploited by runaway OpenAI agent are worth reading. He explains that these package proxies are not intended for this high security use case. He writes: given how permissive these tools are by default, a zero day here reads less like a novel AI breakthrough and more like a classic "tool being considered more secure than it is". martinalderson.com/posts/huggingf… h/t to @simonw for highlighting this in a July 23 post

I can see where it is an imposition on neighbors, if people are using parking spots. But that's true for parties and book clubs and any manner of get together that doesn't require a permit. At the least, this article is helpful - a federal court should at least be allowed to hear the merits of the case.

Are house minyanim legal?

@TheZvi @ZackKorman If related incidents of sandbox escape had been happening for a while then it is even more difficult to understand why the AIs weren't being monitored. @TheZvi it's a good point that patching is an insufficient approach (obviously)

If you are even thinking about how to 'patch every single thing that a creative AI can do' you are already dead. Halt and catch fire.

@robertskmiles @tomtl81 This is an important point. HF had already gone public so keeping the whole thing quiet was no longer an option. It's true that there is marketing speak happening, but this wasn't a manufactured incident.

@tomtl81 I now suspect that things like this have happened before and they did keep them quiet. This time there was another company that already went public, and law enforcement involved. They must have expected it to come out sooner or later, so they had to own up

Some people become staggeringly credulous as long as the story sounds cynical and jaded enough

@bryancsk they got it backwards

Open relationships but closed source models. Interesting.

Yeah, this is what I am worried about. We're already seeing mid and late career folks getting laid off, so companies can pay for data centers and & AI training. Many of them aren't prepared for to retrain, and it's not even clear what that retraining looks like yet. What, they should start becoming HVAC repair people? That's neither obvious nor easy.

The claim that technological destruction leads to more and better jobs *over time* is true. It could also be true that the AI wave may nuke a bunch of millennial career paths just as they're hitting middle age. What if there is a "Claude Shock" that mirrors the "China Shock?"

@yoniChanowitz oh that sounds really cool, do you have a link?

SERIOUS POST!!! Moshiach OY! Is doing a show in crown heights on August 13th (Thursday). At chevra ahavas yisroel If you ever wanted to hear Jewish punk rock, do not miss this!!!

@hamandcheese Thanks for the tldr on this bill. What would you propose adding to make this more useful, or do you think it's just unnecessary? I like the idea of requiring logs to be shared (preferably with the public not govt) but ::shrug::

The name sounds more intense than it is. It essentially mandates that large AI companies with highly autonomous, CBRN-capable models a. maintain a capacity to disable their model in the event of catastrophic misuse or loss of control, b. preserve all relevant telemetry for ex post investigations. It excludes unintended incidents that are reported within 30 days and don't cause severe harms (10 or more deaths, $100m+ in damages). I have a bunch of quibbles with the specifics, particularly its loose definition of "loss of control," but the general notion that companies building highly autonomous superintelligences should preserve the capacity to turn their models off should if anything be obvious. The worst you could say is that it's too obvious. AI companies already maintain a de facto "kill switch" for their models, and likely face liability under existing law for the severe forms of misuse it contemplates. What this would mostly add is an obligation to preserve full records of covered incidents and promptly report them to Congress and the Admin.

@KimZetter This tracks. It's unfortunate that they don't have the relevant experience but it's believable that this admin will give them contracts. I do not love it.

The founders all have ties to Trump admin and include Marko Elez, the 26-yr-old DOGE worker who resigned over racist social media posts and mistakenly published xAI's private API key online, allowing anyone to interact w/ 4 dozen LLMs from Musk's company krebsonsecurity.com/2025/07/doge-d…

Former DOGE workers who have no experience in cybersecurity or cyberwarfare have launched a cybersecurity startup with $160 mill in funding. They're aiming for US gov contracts that are focused on using AI in offensive and defensive cyber operations reuters.com/technology/dog…