keyth0s

2.2K posts

keyth0s banner
keyth0s

keyth0s

@keyth0s

Katılım Kasım 2023
150 Takip Edilen49 Takipçiler
Sabitlenmiş Tweet
keyth0s
keyth0s@keyth0s·
Been playing around with Codex for the past week. Having explored Cursor, Codex, and Claude code, I have fairly mixed reviews. I thoroughly enjoy them, but I'm honestly terrified from a security point of view. From a security point of view, they will create vulnerabilities and bugs that should just not exist in modern software. The type of bugs and vulnerabilities that when we hear "Cisco had hardcoded credentials in a recent version of IOS" we think "well shit, how the fuck is that still possible in the 2020s". There is no question to that. They are doing it currently. The onus is on the user to understand what the code is, have the required background to interject and prompt it to review things within a specific security context, and to ultimately assume the risk. We already have a plaque of vulnerabilities created by human code where people know better, and this is only going to add to that. It's incredibly important that we build out workflows that assist developers using LLMs in rapidly identifying, modeling, and mitigating these risks. We can't just say "Security is everyone's responsibility" or "Well, if they don't know what they're doing, they shouldn't touch it". We should be enabling. Enabling them to do it securely. If you're in security, I implore you to explore these and build out a project. Start from how a normal user with minimal security background might interact with them. Don't prompt them to do things securely. Review the code you receive, then put your security hat on. Prompt it for threat models, specific CWEs, mitigation plans, SBOM, and more. Then figure out how to operationalize that in your org. We can't put the genie back in the bottle, but we can operationalize workflows in the security context that mitigate much of the risk, and leverage existing workflows to verify the work. What they do well: * Rapid prototyping, it's incredibly simple to get a working and usable prototype. This is what they excel at * When used in context by someone with a security background, they are fairly good at threat modeling, and useful for things like SBOM and inventorying attack surfaces. * Bridging gaps; allows those with coding backgrounds who do have experience writing their own code, but who don't have the time much anymore, to still explore their projects and ideas. What they still suck at: * Implementing secure coding practices from the start, without explicit intervention. * Adhering to modern standards on just about anything. Tell it to do anything cryptographic, and without explicit intervention, it will always choose the least secure method. * Long running sessions and context; the longer you go on without creating a new session with clean context, the less output you'll receive, and you'll also start running into circular patterns where the model keeps generating the same code that produces a crash over and over again. What the really really suck at: * With Codex (ChatGPT Plus), I had to switch to API based usage within my first 2 days after I exceeded the limits after 2 4 hours sessions. This is a tough one. It costs money to run these, but at the same time, if I just want Codex access, the API is expensive. In the first day I spend $15.68 on API usage alone. This can be cost prohibitive and add up incredibly quickly. This is with what I'd consider "moderate" usage, where I'm exploring it, and not in a real workflow where I'd be producing production grade software. * With Cursor, the variety of models is fantastic. However, you will get completely different results and feels just by switching models. Compose feels way different than Sonet, which feels way different than Grok Code. Specific examples of bad practices: * When asking it to implement an "irreversible" secret storage method (I explicitly mentioned it was for passwords and API keys), one provided for a method using MD5, the other provided a method using SHA256. * When asking Codex to create backend APIs, they default to allowing all CORS origins. Obviously not the most pressing issue (trust me...there are far more serious things it does wrong), it's a simple thing that almost assuredly would go unchanged by an unseasoned developer pushing something to prod. * When asking it to implement an MFA solution, it chose to use pyotp, defaulting to SHA1 (RFC6238), which in the context of near-future compute, is vulnerable to replay and collisions (though to date, notable that nothing real exists on this...yet) * When designing backend API calls for audit logging, it chose to just allow anyone with a valid session token to make calls to this API, which could allow someone to forge audit logs or overload them and make them useless. It also failed to create a signature validation method for audit logs, both requiring explicit intervention to fix. * When designing an RBAC mechanism, it will almost always revert to allowing less privileges roles to access things that they shouldn't, such as reading API secrets. Explicit intervention is required to prevent these from sprawling * Using localStorage for session tokens, which is honestly not worse than human created apps, but makes it vulnerable to any XSS explot or browser extension stealing and reusing the token. * Pinning dependencies. By default, pins dependencies. Usually choosing older, more vulnerable versions. Interesting, it choosing 3 year old versions in some instances, but in others allows the latest minor release. * When building the initial docker image, it did not create a user with less privileges, instead allowing the app to run as root within the container.
keyth0s tweet mediakeyth0s tweet mediakeyth0s tweet mediakeyth0s tweet media
English
1
0
1
249
keyth0s
keyth0s@keyth0s·
@Gavin_McInnes probably a good thing they didnt have kids then. mentally unwell.
English
0
0
0
27
Gavin McInnes
Gavin McInnes@Gavin_McInnes·
The guy decided not to have kids because he needed more spare time. His wife carried their dog in a baby backpack and almost killed herself when it died.
English
680
165
4.6K
581.9K
Jeremy Judkins
Jeremy Judkins@jeremyjudkins_·
And the road immediately turns to shit
Jeremy Judkins tweet media
English
35
6
321
9K
keyth0s
keyth0s@keyth0s·
if @sama replies I'll switch my $200/mo Claude Max sub to Chat Jipitee
English
0
0
0
2
keyth0s
keyth0s@keyth0s·
@rekdt cybercrime keeps me employed. thank you, cyber criminals.
English
0
0
0
26
keyth0s
keyth0s@keyth0s·
@ZeldaZealot they would have tried. thats for damn sure. or enslaving them all.
English
0
0
5
1.1K
Link🇻🇦
Link🇻🇦@ZeldaZealot·
If you honestly think they’d ethnically cleanse all that land I have a bridge to sell you.
English
5
0
343
13.4K
keyth0s
keyth0s@keyth0s·
@mushroomzulu01 nobody loves the carolina hurricanes as much as moneypuck does.
English
0
0
0
907
keyth0s
keyth0s@keyth0s·
Claude legit thought about lying to me.
keyth0s tweet media
English
0
0
0
8
keyth0s
keyth0s@keyth0s·
@MrBeast why would anyone ever press blue other than virtue signalling. red ensures YOU always survive, regardless of final tally.
English
0
0
0
6
MrBeast
MrBeast@MrBeast·
Everyone on earth takes a private vote by pressing a red or blue button. If more than 50% of people press the blue button, everyone survives. If less than 50% of people press the blue button, only people who pressed the red button survive. Which button would you press? BE HONEST.
English
9.9K
3.2K
31.6K
40.6M
keyth0s
keyth0s@keyth0s·
@BLUECOW009 did you give your llm root access? well. thats dumb.
English
0
0
1
17
@bluecow 🐮
@bluecow 🐮@BLUECOW009·
i cant image running agents on linux for experimentation, you bash command away from breaking the system completely, this is almost impossible to happen on macos
English
20
0
18
1.8K
keyth0s
keyth0s@keyth0s·
@Adidotdev $20? Codex, only because higher functional limits than Claude and Anthropic is moving to remove Code from new subscribers at $20. $200? Claude. It's still better, even with everyone shitting on it. Night and day differences.
English
0
0
1
128
Adit_Yah🍁
Adit_Yah🍁@Adidotdev·
Developers, you have $20. What are you buying ? -Claude -Codex
Adit_Yah🍁 tweet mediaAdit_Yah🍁 tweet media
English
188
8
250
32.1K
Crime Net
Crime Net@TRIGGERHAPPYV1·
A Tesla flipped over during rainy conditions in Merced County Fortunately the occupants escaped with only minor complaints of pain
Crime Net tweet mediaCrime Net tweet media
English
89
18
1.6K
583.6K
keyth0s
keyth0s@keyth0s·
duality of AGI.
keyth0s tweet media
English
0
0
0
5
keyth0s
keyth0s@keyth0s·
@KyleSeraphin If you work in first responder fields, you can also have your personal phone added to Firstnet. It get's second tier priority after agency devices. Source: Local Gov worker in public safety. ATT offers it to us at my org.
English
0
0
2
412
Sawyer Merritt
Sawyer Merritt@SawyerMerritt·
If you use any version of FSD (Supervised) V14, what is the most common reason you disengage (even if it’s rare)?
English
1.1K
93
879
215.4K
keyth0s
keyth0s@keyth0s·
@sama sama. im begging you. use caution. the internet is already fragile enough.
English
0
0
0
4
Sam Altman
Sam Altman@sama·
feels like a good time to seriously rethink how operating systems and user interfaces are designed (also the internet; there should be a protocol that is equally usable by people and agents)
English
1.8K
787
12.5K
1.5M
keyth0s
keyth0s@keyth0s·
@Thinkwert fancy way of saying "metal detector" so people think you're more sophisticated.
English
0
0
3
1.1K
keyth0s
keyth0s@keyth0s·
@GergelyOrosz Issue is non-existent on desktop app running Cowork. But yes, it's frustrating in web to have to click continue a million times.
English
0
0
0
17
Gergely Orosz
Gergely Orosz@GergelyOrosz·
I regularly run ChatGPT and Claude side-by side. ChatGPT gets the same task done, while Claude just doesn't... I am souring on Anthropic based on my recent experiences What is the point of an AI tool if I have to manually click 3-4x to have it complete my task...
Gergely Orosz tweet media
English
155
50
1.6K
109.4K
keyth0s
keyth0s@keyth0s·
Question could be solved if both sides just said "yeah we're not thrilled about that, but theres something in it for us" but they won't because of TDS and vocal minority communities controlling political matters.
English
0
0
0
5
keyth0s
keyth0s@keyth0s·
Action in Iran is beneficial to all. It's deterrence. Then, the elephant in the room. Diego Garcia. Under no circumstances will the U.S. let them return it. It is perhaps the most strategically positioned based in the Indo-Pacific. Solution: mutually beneficial arrangement.
English
1
0
0
15
keyth0s
keyth0s@keyth0s·
So, as I understand it, the Brits are mad that the US is now considering reverting to it's historically neutral position on the Falklands rather than supporting British sovereignty over it? Guess they don't understand "special" relationships require mutual benefactors.
English
1
0
0
13