Rob O :verified:

https://infosec.exchange/@nerdpr0f

Teaching faculty. Security researcher. Red team, DevOps, AppSec. An academic but not an academic. nerdprof @ Twitter

Public Key

npub1hq3hx0nkk5l2gtp3ec00q9sf64pyxzvma9tkxg5350qt2qljfgqssgpxge

NIP-05 Address

[email protected]

Profile Code

nprofile1qqstsgmn8emt204y9scuu8hszcya2sjrpxd7j4mry2g68s94q0ey5qgprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntdtlfkc

Publishing to

relay.momostr.pink

Author Public Key

npub1hq3hx0nkk5l2gtp3ec00q9sf64pyxzvma9tkxg5350qt2qljfgqssgpxge

Show more details

Last Notes

2026-11-03 18:35:29 GMT

- reply

I think one of big tech's (many) original sins is thinking that they can solve any problem by throwing tech at it. They largely ignore a lengthy history of technological innovations exacerbating societal problems rather than solving them and seem to think that domain knowledge in one area extends to domain knowledge in other areas, very similar to academia.
I've started explicitly calling out this kind of thinking in meetings. Just this morning (about the future of AI), "That sounds like an economic problem, not an ML problem. None of the people in this room are economists. Why do we think we have any valuable insight on this that would override what economists say on the matter?"

2026-11-03 17:54:37 GMT

- reply

The difference is probably in funding levels. LLMs explode the amount of work teachers need to do to keep students honest. Addressing that is much more feasible if you have a proper budget. I think lower income school districts are the ones looking to jump ship first and, frankly, will probably have improved outcomes if they do.

2026-11-03 17:47:38 GMT

- reply

Eh, I dunno. I think that may be the practical effect, but the backlash against tech in the classroom is getting really severe. As students are moving away from computer-driven/delivered content, schools are really questioning their educational technology investments. I think there's a real possibility that, in 5-6 years, Google is having conversations about whether to sunset Classroom if the value proposition doesn't change.
And, like anything else, AI is driving the loss of value through an increasing need to resort to pen-on-paper assessments.

2026-11-03 17:02:50 GMT

- reply

I don't know that I agree here. I think this is more of a surrender on Google's part. I think they're really worried about losing their market share in ed tech. K-12 is running away from chromebooks at a pretty rapid pace.

2026-10-23 14:44:43 GMT

- reply

The most common criticism I get for our buffer overflow assignment, paraphrased: "This is unrealistic because no one would ever release code into production without DEP or ASLR."

2026-10-21 00:36:09 GMT

PHP, TLS... I swear, if if I see one [.]./ tonight... I need to be grading my web security midterms.
(Incidentally, one of the questions was literally what to do if your intermediate CA's signing cert gets compromised.)

2026-10-16 14:14:27 GMT

- reply

Crowdstrike has entered the chat, as the kids say these days.

2026-10-15 16:14:41 GMT

- reply

It also really helps with understanding adversary behavior too. I've got a few lectures where I go off on a digression on the importance of thinking about exploit/malware devs as just evil software engineers, operating under the same financial constraints as everyone else.

2026-10-15 16:09:51 GMT

- reply

I'm increasingly in favor of adding a class on basic business decision making to tech degrees. Students (myself included, back in the day) really struggle with understanding how much business logic dictates technical progress and technical decisions. Decision making comes down to a) cost/benefit analysis and b) business/personal relationships FAR more than features.

2026-10-15 15:56:00 GMT

- reply

Hah! Ipv6 is the example I use in class to discuss this. "IPv6 has been the next big thing coming down the pipeline since I first took networking in 2003." We then pivot to a discussion of operating costs for deploying more NAT vs re-architecting for IPv6.... and students immediately get it.

2026-10-15 15:51:51 GMT

- reply

I like to think of "scam" as a spectrum, rather than a binary.
Mobile, I think, was the last legit hype that turned out to have any real substance. Cloud, to a lesser extent, specifically for IT had substance to it. It never really broke out in a way that the general populace understood... but it was more real than scam. IoT was kind of 50/50 and it's largely been downhill since.

2026-10-15 15:47:06 GMT

- reply

Yeah, that's fair. Game recognizes game, as the say.
I was just talking with someone yesterday about how one reason I think Security is a little more resistant to the AI grift is that it isn't our first ride on the merry-go-round. We've got a decade or more of experience with next-gen block-chain enabled NFT cloud-based smart firewalls.... which has largely not broken out of containment from IT/InfoSec. I think this is really the first go-around for the greater tech community. Some of them are certainly in on it, but the majority are probably where we were circa 2013.

2026-10-15 15:39:39 GMT

- reply

So, fun fact, I literally wrote my first MS thesis on the subject the plausibility of a generalized AI being morally indistinguishable from a human.
There would be a bit of pearl clutching, but I'm pretty confident that techbros knew the recent "AI is sentient" push was nonsense, unlikely to gain traction in religious spheres.

2026-10-06 16:46:44 GMT

- reply

The linked example looks like one that's been hiding, which would be the latter case.
My bet was going to be LLM generated code and that the culprit was poor training data. Stack overflow and Github riddled with code examples that ignore TLS errors. The number of times I've found code straight up copied from GitHub/Stack Overflow in production systems is... far more than it should be, including in some *very* spicy environments.
The reason that I know it was straight up copied is that I can, reasonably often, find the exact post/repo the production code was copied from.

2026-10-06 16:38:41 GMT

- reply

I haven't been following this, but this is interesting to me. Are these new bugs or just newly found bugs? I'd wager a guess on the former.

2026-09-29 15:04:48 GMT

- reply

.... I have thoughts and opinions, but NDAs and all that fun junk.

2026-09-29 14:52:39 GMT

- reply

Ugh. This brings back memories. Still not as bad as serial-to-ethernet adapters. Looking at you, Lantronix.

2026-09-23 14:55:35 GMT

- reply

What is this, 2005? What's next, that malware leverages a wormable Windows SMB vuln to spread around dorms?

2026-09-23 13:34:06 GMT

- reply

I wonder if there are rules for selecting valid domain names for their infra. If so, one might be able to RE them and exhaust the attackers financially.

2026-09-23 13:31:40 GMT

- reply

Oh god, is anyone looking at prompt injection through DNS?

2026-09-23 13:30:53 GMT

- reply

I wonder, could this attacker be dumb enough to have an "agent" that spins up new domains when a domain is burned?

2026-09-18 13:32:13 GMT

- reply

Distributed Silliness Module

2026-09-17 16:59:44 GMT

- reply

Somewhere, @viss is sensing a disturbance in the force.

2026-09-17 13:56:15 GMT

- reply

I know I'm late to the game here, but don't forget the growing body of literature around the "de-skilling" of people who use it. The only "AI is going to end the world" scenario I buy is that it makes us sufficiently dumb(er) that we do something insane.

2026-09-14 15:25:27 GMT

- reply

Pretty much, except the trackers were a part of an electronic fence. So, it wasn't just a matter of finding the sheep, one could change the borders of the fence. Modern day rustlin'.

2026-09-14 15:16:51 GMT

- reply

I remember seeing a talk a number of years back where the speaker "hacked" a heard of sheep through their GPS trackers. I bet anything we could actually set up a Moo in the Middle attack if need be.

2026-08-28 15:01:20 GMT

- reply

Yeah, I legitimately think that's the direction it will go within a decade for a number of factors. The amount of vibe-coding charlatans, increased pressure from state governments when it comes preventing harms/nuisances, increased geopolitical tensions that will impact outsourcing, the likelihood of increased attack tempos, etc.
I think the only reason it hasn't so far is the massive value generation engine that was the tech industry until around 2020-2022. As the industry's ability to generate value continues to drop, so will the willingness to allow "move fast and break things".
This kind of the normal pattern in engineering - new technology breeds a period of rapid innovation followed by a period of formalization.

2026-08-25 15:16:18 GMT

- reply

Yeah, looks like either CISA or their CDN is blocking Firefox v140. That's odd.

2026-08-25 14:39:25 GMT

- reply

Oh, this is wild. I'm on my courseprep laptop. Firefox on Parrot is throwing 401s but Librewolf is fine. They must be inspecting user-agent.

2026-08-25 14:35:43 GMT

- reply

Is this getting slashdotted? I'm getting 401s.

2026-08-14 19:43:44 GMT

- reply

Typo? I write "authenticated" instead of "unauthenticated" with some regularity.

2026-08-14 16:33:20 GMT

- reply

One last thought on this:
I've long called myself a "self hating" penetration tester, since I don't think the field itself is terribly valuable. The problem is in its artisanal nature. Results, historically, are generally not comprehensive (due to time constraints) and are often heavily influenced by the biases/skillsets/experiences of the tester(s).
I think probably the best way to think of this is "Nessus, but with the capability to assess (and potentially bypass) defense in depth" in the hands of attackers. Nothing here is new, except attacker coverage.... and, unfortunately, that's been the saving grace for lower-tier orgs.
Seatec Astronomy.

2026-08-14 14:59:51 GMT

- reply

For what its worth, I suspect this will probably reduce the number of script kiddies. So many people get into this space because of the high (I mean this literally) they get from hacking things. You don't get that from tasking a clanker. It'll reduce the cost, sure, but it also removes a major incentive.
The same thing is happening on the software dev side, where there is some literature on "The Coder's High". You don't get that when prompting.

2026-08-14 14:46:16 GMT

- reply

Oh, and it might even make detection a touch easier. I'm willing to bet that models converge on post-access TTP in a way that humans don't. I've got a capstone project looking at this next semester.

2026-08-14 14:43:48 GMT

- reply

For what it's worth, this is what has me absolutely screaming into the void about all of this stuff.
On the attacker side, this is a) boring as shit and b) removes the fun part of solving the puzzle for the next step.
On the defender side, it doesn't fundamentally change much except it makes it a requirement for orgs to do the shit we've been yelling about for at least the better part of the last decade.

2026-08-14 14:41:22 GMT

- reply

It doesn't, that much.
The problem really is for the defenders that are half-assing their defensive strategy or putting in "good enough" controls. It basically eliminates any leeway or grace period defenders might have between initial compromise and lateral.
I've been on exactly one engagement that I think would be in good shape against this kind of threat, and that client literally implemented every suggestion in our report from the previous year to the letter.
Basically, this is just going to make doing the basics properly (notably, asset management, patch management, and network segmentation) a harder requirement for doing business than it previously was.

2026-08-14 14:13:38 GMT

- reply

So, it's a little different on the attacker side. Post-shell automation has been a thing for a long time, right? Every attacker has their own in-house scripts that get automatically run whenever they pop a shell. It's not much different than that, but it does allow for much easier (and probably more effective) context-aware decision making in post-access data collection.
Once I get that initial shell, my main problem is finding an artifact that allows lateral. Having something that can do all the grunt work of analyzing the system (probably faster and more reliably/thoroughly than I can) without me needing to sit down and code 100s of pages of IF-Then clauses would be a huge aid.

2026-08-13 13:32:07 GMT

- reply

A group of fancy, chaotic geese.

2026-08-07 20:58:40 GMT

- reply

County-level IT is it's own... beast too. I've only ever consulted, but that's got to be the most complicated infrastructure I've ever looked at, largely because they've got so much of it.

2026-08-07 20:38:09 GMT

- reply

I guess I was thinking more of how much time do the devices usually spend in the field and comparing it to expected lifetimes for electrical. I was just talking about this with some folks during an admissions event who were asking about utility hacks and were shocked when I said that it's not unusual to see expected service lifetimes that span multiple decades.

2026-08-07 20:29:35 GMT

- reply

Out of curiosity, what's the expected life of products in the water sector? Similar to electrical? My favorite product assessments were always "This product is EOL, but we need to have a penetration test on the books for compliance reasons."

2026-08-07 15:13:34 GMT

- reply

Don't forget the generational improvements in working conditions and educational level. Five generations back, my family were coal miners and farmers. Four back, we have early electrical engineers. Three back, my grandfather was a mostly self-taught mechanical engineer (for the same defense contractor, interestingly). Two back, accountant/teacher. Now, college professor.

2026-08-07 15:06:10 GMT

- reply

https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/054/843/122/948/623/original/6180b14ae4116ba9.png

2026-08-07 15:04:02 GMT

- reply

I think it's funny how this hasn't changed much over time too. I had family a couple of generations back that were into electrical engineering before that was a proper field. Their parents were Appalachian rednecks*. They just kind of just screwed around with electrical stuff, figured out how it worked, and made their own. And promptly got recruited by the local defense contractor, which was making parts for planes during the war.
I mean that in the literal sense, not the derogatory sense. I think my great-great uncle was at Blair Mountain. He was a union coal miner in WV at about that time.

2026-08-07 14:33:03 GMT

- reply

Yeah, that's fair. I think - even now - the main point of the event is to try and build community. I think what's changed is the kind of community the experience is curated towards. I've met a ton of people at Def Con that I'm still in contact with and that have absolutely helped me in a variety of ways. I've also learned a ton (particularly at PHV and in some of the trainings).
These days, it feels like the experience is more curated towards the hacker aesthetic than folks who actually want to get their hands dirty. Not to get too post-modern, but it seems more about simulacra than real experience. That said, I bet anything the old guard would say the same thing about the years I was attending.

2026-08-07 14:24:43 GMT

- reply

I went every year between 2014-2019. It was absolutely wild to see how the experience changed even in that time frame. In 2014, it still seemed like - for the most part - a big community gathering. 2015 struck me as kind of a peak year, aside from the stupid giant record badges. Tons of actual learning, actual community. 2016ish, it seemed like there were way more folks hanging around from Black Hat. 2017, it seemed like Def Con started catering to them and it was down hill from there. 2019 was exhausting.

2026-08-04 20:58:46 GMT

- reply

2026-08-01 00:51:06 GMT

- reply

I've spent some time doing consulting on the product side in this space... A big part of this is devs not designing for how the systems are being deployed/used in reality. Everyone assumes a deployment environment that matches the dev's test lab and security issues bases on (reasonable) deviations are written off as the customers fault.

2026-07-24 16:07:12 GMT

- reply

Ow, my childhood.

2026-07-23 18:39:59 GMT

- reply

And, since posting this, a baby crow.

2026-07-23 18:17:25 GMT

I've had baby robins, baby grackle, baby blue jays, baby squirrels, and baby bunnies this year. I feel like I should start charging for daycare.

2026-07-22 13:34:25 GMT

RE: https://mastodon.social/@danielcornell/116963813168908488
I wonder, when did we do away with "PCAPS or it didn't happen"?
#note1u53…lgrj

2026-07-21 16:57:20 GMT

- reply

I think you'll find most websites are Wordpress these days. Wordpress is basically the default "We need a website for <thing> solution" because of the ease of setup.

2026-07-15 14:58:09 GMT

- reply

There's also a point not discussed enough - a midnight curfew isn't just pushing responsibility onto kids, it's relieving parents of the responsibility of parenting.

2026-07-14 21:23:34 GMT

- reply

Unrelated, I wonder what the depth limit is for consumer-grade underwater drones.

2026-07-14 20:43:43 GMT

Jesus christ. I just watched ChatGPT consult the Merriam-Webster dictionary for firewall syntax.

2026-07-10 15:41:12 GMT

- reply

You have no idea. At the big banquet dinner they had, they did a sing-a-long for some theme song or anthem they had written for themselves. It felt *very* culty.
The food at the banquet was amazing, though. First time I ever tried chicken satay or fried green tomatoes.

2026-07-10 15:37:29 GMT

- reply

Back in the day (2005-2013), I was focusing on AI content. I got into cybersecurity largely because the university I was teaching at wanted to offer a class on cybersecurity and ethics. I wanted to teach the ethics.
I stayed because I saw where AI was going and cybersecurity felt way less evil. I had some vague hope at the time that the field might be able to prevent the worst abuses.
The specific trigger for me jumping ship was a data mining conference (circa Snowden, don't recall the specific year) in which I watched a panel of AI researchers bemoan the fact they couldn't literally strap biometric sensors to children 24/7.

2026-07-09 21:16:20 GMT

- reply

I don't think we are.
I think the problem the distinction between "legitimate engineering practices" and "legitimate software engineering practices."
The point that we're raising here is that most (maybe very large chunks) of the software engineering follow bad engineering practices, which have been normalized in the software industry. The root cause is, of course, that real engineers have liability and that shifts organizational risk tolerance.
"If you don't know how it works or it's wrong sometimes" is bad engineering.
For example, go try to talk to and mechanical engineer or electrical engineer into including something they don't understand or that could have, say, a 20% error rate into their designs.

2026-07-09 21:08:26 GMT

- reply

Two additional quick thoughts.
One: The reason it's not possible with AI (assuming LLMs) is the stochastic nature of these systems.
Two: This, of course, hinges upon a definition of "safe" and establishing risk tolerance metrics.

2026-07-09 21:04:25 GMT

- reply

You missed a couple of words there. "legitimate engineering practices". Note that it doesn't say "legitimate software engineering practices".
One of those legitimate engineering practices is a verifiably safe design. That, by definition, is not possible with AI.

2026-07-08 14:53:48 GMT

- reply

Can we at least get an infinite number of those coked up monkeys? We're about due for a new Hamlet adaptation.

2026-07-08 14:52:03 GMT

- reply

No, but I would very much like the news not to be mad libs (no political reference intended) filled in by a 6 year old.

2026-07-08 14:50:00 GMT

- reply

I haven't clicked on this link yet, but the text here is a clear reminder that I legitimately have no clue what the next day's news cycle will be anymore.

2026-06-29 18:24:53 GMT

- reply

I absolutely read this in Matt Berry's voice.

2026-06-23 13:45:25 GMT

I see folks are choosing violence today.

2026-06-18 19:29:20 GMT

- reply

This is the single biggest reason we don't have much cloud content in our curriculum. The assessed risk of overspend is too high and there's no reasonable controls we can implement without adding too much administrative overhead.

2026-06-17 01:04:18 GMT

- reply

Back in grad school (2006ish, I think), I worked with an undergrad student on a project adjacent to my thesis. In addition to being a straight-A CS major, he ran the student jazz band. Given that our school was known for their music program and the jazz band at the time was the cream of the crop, I asked why he wasn't doing that, instead of CS.
He told me that he liked music and he didn't like computers much, so it made more sense for a career.
I think about that a lot.

2026-06-17 00:57:23 GMT

- reply

You know, I really miss when I didn't hate computers.

2026-05-11 16:05:31 GMT

- reply

That could be arranged.

2026-05-05 23:46:21 GMT

- reply

Oh, yeah, definitely. Our (purely) offensive classes are "Penetration Testing Frameworks and Methodologies" and "Offensive Security Engineering" (red team tool dev).
I would say... somewhere between many/most of our classes have either an ethics component or a societal impact component, but we don't have a full-on class in the major (taught by from the security department) dedicated to ethics.

2026-05-05 23:40:55 GMT

- reply

BS or AAS? I kind of get the argument if it's AAS or a community college. It sucks, but they're usually extremely limited in what they're able to get away with.

2026-05-05 23:37:49 GMT

- reply

Our students take 3 classes (9 credits) of ethics. Two are ones we have some say in and the third's a university-level ethics gen ed requirement.

2026-05-05 23:33:44 GMT

RE: https://infosec.exchange/@cR0w/116522719324979793
Most philosophy majors have a debate class titled something like "Contemporary Moral Issues" in which students research and debate some classically controversial issue (civilly).
Tech desperately needs an adaptation of this class.
#note1gus…q4pa

2026-04-21 21:05:24 GMT

- reply

So, the argument seems to be that acceleration of attacks (and, I assume, increased success rate) necessitate higher levels of automation. The HTB success rates, in particular, are what seem to be raising alarm bells from those on the practicioner side.
The argument is, roughly, that IF we're about to be inundated by an influx of highly skilled red-team agents, THEN we need blue team agents in the loop that are capable of responding with similar speed.
That strikes me as reasonable logic. I'm not sure I'm willing to grant the antecedent at this point, but the structure of the IF-THEN strikes me as rational.
Or maybe we could just turn all the computers off and throw them out of whatever window is nearest.

2026-04-21 19:20:27 GMT

- reply

Which, just to put a bow on the conversation, seems to be the point of both pieces.
If you accept their premise about attack speed accelerating (not sure I do,.but it *is* a reasonable hypothesis), then it's probably time to actually get those things done... And to do that at a fast enough pace, one probably needs agents (and the restrictions outlined).

2026-04-21 17:04:16 GMT

- reply

One of my hotter professional takes is that cybersecurity is no longer a fast-moving industry and that we've had a pretty solid notion of how to do security right for at least a decade.
Our problems these days are more about making sure those things get done than in figuring out what the right thing to do is.

2026-04-21 16:44:47 GMT

- reply

I agree, but what are the chances at getting a substantive regulatory framework or product liability regulations in this space?
I'm using "engineering" as shorthand for design/implementation since, as we all know, most of what tech does really shouldn't be called engineering.
There's a few interesting nuggets in there, though. In addition to "The boring basics like asset management, least privilege, and network segmentation really do matter", the relative importance of penetration testing (declining), detection engineering (increasing), and the shift towards "assume you're compromised" all strike me as reasonable points.

2026-04-21 16:33:27 GMT

- reply

The argument that both pieces seem to be putting forward is that they expect attackers, in the future, to be leveraging AI/LLMs to increase the pace of attacks to a point where will no longer be feasible for humans to play the same role in the incident response loop that they currently play.
I'm not sure I accept that, but it's a clear hypothesis that be tested for correctness with data. It's also not rooted, as you say, in happier vibes.
The set of controls proposed by both appear to differ (I only skimmed the one you posted). Mubix's piece focuses on two attributes, one of actions and one of agents.
Agents need to have minimally constrained scope (so, least privilege applied to agents). The set of actions they are permitted to take should also only be actions that are reversible. The rest of the document outlines engineering best practices that absolutely need to be in place (and, as we know, often aren't) in order to facilitate those.

2026-04-21 16:17:48 GMT

- reply

That said, a non-trivial amount of the recommendations of both are, in z nutshell, "Get your act together and finally do the basics right."

2026-04-21 16:14:59 GMT

- reply

Ehhh, the CISO to current practitioner ratio is low, but there's definitely folks on there from a practitioner background. It also echoes many of the same points as the ones Mubix made here:
https://infosec.exchange/@mubix/116415117902139733
I haven't drunk the proverbial KoolAid, but I find interesting that both position papers are a) providing reasonably precise (and testable) hypotheses about how they are anticipating the threat landscape will change over the medium term and b) describing reasonably precise control sets needed to mitigate that risk (as well as the risk caused by the technical debt accrued by the lack of oversight of past AI investments).
#note1kzd…w4l8

2026-04-14 15:35:38 GMT

- reply

It's almost like having an "engineering" discipline with little in the way of professional liability is a bad thing.

2026-04-13 18:21:45 GMT

*sigh* Mythos messaging is starting to hit regular people. I've already had to explain twice, now, how Mythos isn't going to decrypt all network traffic.
This is exhausting.

2026-04-10 19:42:41 GMT

- reply

I get the sense that the economy has a lot of folks feeling very french. Late 1700s french.

2026-04-10 15:57:25 GMT

- reply

Oh god, think about all the InfoSec techbros that are about to become experts in astrophysics.

2026-04-10 14:22:55 GMT

- reply

I've also wondered, to some extent, how much of this is the result of "main character syndrome", for lack of a better phrase.
People want to believe they're doing something wild, exciting, and innovative. So much of cybersecurity, however, is glorified accountancy, tradesman (plumbing/electrical/etc), and janitorial work.
It's hard for folks to wrap their head around the fact that their jobs are much more like that of the folks in Office Space than V from Cyberpunk.

2026-04-09 15:36:39 GMT

- reply

Incidentally, I really wish there were better tools for teaching about this kind of thing.

2026-03-24 15:34:13 GMT

- reply

I suppose we'll see. Given the unreliability of US foreign and security policy, we've seen other sectors shift away from American produced goods. Notably, the auto industry.
I would think that some countries (Denmark, for example) might be wondering if it's time to shift technical infrastructure away from US goods too. Hasn't there been some of this happening in the cloud space already?
I imagine the primary problem here is the lack of alternatives in the router space.

2026-03-24 15:18:36 GMT

RE: https://mastodon.neat.computer/@jonah/116284778632962494
I wonder how freaked out Cisco and Palo Alto are right now about the possibility of retaliatory actions.
#note1euv…jhya

2025-10-06 16:23:14 GMT

- reply

"Malicious pickle de-serialization" sounds like something from Law and Order SVU.

2025-09-23 15:57:13 GMT

- reply

One of the most accessible Def Con talks I attended was this one: https://www.youtube.com/watch?v=F1VttfQFTWE
Sounds like things haven't changed all that much.

2025-09-09 22:47:21 GMT

So, this was blocks away from where I lived for like 6 years. ICE was (mostly) chased away and someone apparently slashed their tires, in one of the most affluent neighborhoods in the city.
https://www.wxxinews.org/local-news/2025-09-09/ice-agents-in-the-park-ave-neighborhood-spark-large-scale-protest

2025-04-29 22:16:29 GMT

All I see here is "Ran a human subjects experiment without an IRB." Why are these "researchers" still employed?
https://www.404media.co/researchers-secretly-ran-a-massive-unauthorized-ai-persuasion-experiment-on-reddit-users/

2025-04-07 13:31:34 GMT

- reply

I see applications in RPGs. Imagine Skyrim or Baldurs Gate without canned dialogue. That said, the replay value of those games would skyrocket, probably hurting sales of other games. On the ethical side, compensation for voice actors would be a problem.

2025-02-18 20:16:31 GMT

I used to teach quite a lot of courses that covered ethics as it applies to technology. This was, to honest, my gateway into security.
One of my favorite discussions was "What software would you refuse to write?"
I think about that *a lot*.

2025-02-11 14:18:54 GMT

- reply

Friend, I think you have far too high of an opinion about university administrators. A few things:
1) Most universities are schools attached to hedge funds by way of the endowment. In most schools, the person with the most practical power on campus isn't the president or the board, it's the CFO/VP for Finance/<insert similar title here>.
2) US universities can be held hostage with the threat of withholding financial aid money. Suppose there's a threat: "Remove diversity or you can't receive student loans/pell grants". Without that income, most universities wouldn't be able to make payroll. There might be a delay by a semester or two while operating budgets are shuffled around and there are massive layoffs, but that's the ballgame. They'd be relying on research funds and money from their foundation.. but that really doesn't go very far.
This really sucks, but I strongly suspect no universities are coming to save anyone.

2024-11-08 18:44:05 GMT

- reply

Yeah. This *is* a C programming class too, for what it's worth. It's the third class in our programming sequence (Python, then OOP w/ Java).
I very intentionally frame the class as "Our goal here is to learn to think like the compiler, and we're going to take away all the cool programming tools you had in your first two classes."

2024-11-08 18:29:55 GMT

- reply

Yeah. This is a problem I'm really noticing in my year 2 course right now. Students are relying on the AI to do any kind of critical thinking, even things like basic debugging.
It's not uniform across all students, but it's a real problem when they're asked to do something the AI isn't good at. For example, my course spends a lot of time covering topics like memory management, process management, etc... along with the syscalls used for it.
But, the course is intended to prep students for understanding exploit development/reverse engineering, so we use Windows, not Linux (like all the other OS courses out there). ChatGPT ain't great at writing code for Windows.
Interestingly, it usually fails on the same stuff I do in my first pass, like all the wonky string typecasting needed. It's all stuff there's not a ton of resources for. There's maybe 1 or 2 useful books and the rest of the content lives in TechNet articles. There's not even a ton on Stack Overflow. Not enough for ChatGPT to really work with.
I'm encountering students that really struggle with the debugging process. Instead of "Compile, get an error, research that error, figure out the problem, fix the problem, add the next bit of functionality", I'm seeing students just throw the whole thing into ChatGPT (maybe) with the error message and expect ChatGPT to fix it.

2024-11-07 20:28:19 GMT

- reply

My best story on that - I was red teaming a student competition during which the student teams could attack each other too.
One team of students blew out Ansible that replaced every binary in System32 with a simple executable that just printed 'No'.
The pro red team spent, like, half the day tracking down why Cobalt Strike was telling us 'No' thinking it was a permissions problem.