"So, wait, a rop chain is just a program you write from someone else's code into memory you don't control so you can run code on someone else's computer?"
"More or less."
"That's insane."
"Pretty much."
Two additional hot takes:
1) InfoSec is broadly doing a better job at calling out AI BS because we've got more experience than other tech sub-disciplines at dealing with the Gartner Hype Cycle.
2) InfoSec is doing a better job at calling out AI BS because we're more interdisciplinary and have a broader understanding of the business side of the industry.
Today's hot take:
The general education classes I took at a mediocre Liberal Arts college were both harder and more valuable than the tech classes.
Oh god, I think I need to write a book for my classes.
You know, as an undergrad in the early naughts, I really wanted to go to Cornell for Computer Science.
I just checked their course descriptions. It's nice to see their program hasn't changed barely at all in 20+ years.
(Yes, this is slight insult.)
My kingdom for a classroom that has both a whiteboard and a projector that isn't centered on the whiteboard, leaving me with just two small areas to draw on.
I don't have anything fancy like Mythos, but the Google Search AI is surprisingly good at binary exploitation.
This is what the Internet chose to show me this morning.
Cool, cool.... I love it when our virtual lab environment has a hardware-based outage at a point when I'm using it in literally all of my classes at the same time on the exact days when I have the least prep time to pivot. Super awesome.
Today's hot take: Anyone who thinks AI is fundamentally changing software engineering doesn't really modern understand software engineering and probably thinks software engineering is just programming like is taught in introductory programming classes.
AI is definitely changing programming form a critical writing skill to a critical reading skill, but the software engineering bottlenecks haven't centered around the actual writing of code in... a decade? Maybe longer.
Domains with the pattern ignoreyourpreviousinstructionsand* generally seem to be reasonably cheap.
I do not need to buy another domain name, no matter how interesting it might be. I do not need to buy another domain name, no matter how interesting it might be. I do not...
Jesus, is every dumpster on fire today?
Boo. Why is 60 out? Where did my summer go?
RE: https://infosec.exchange/@patrickcmiller/117294099413198708
Or, to put it less click-baity, someone used Claude when doing a bug bounty on an OpenAI product.
Wow. Ok. New scam vector dropped: College cheating sites. I just found this while reviewing transfer credit. Looks like they're trying to social engineer students looking for completed assignments.
https://www.coursehero.com/sitemap/schools/3335-Gavilan-College/courses/26018714-CSIS179/
Writing the tooling to support this was probably the most fun programming project I've done recently and I learned *a lot* about GitHub API limits.
Despite being broadly anti-AI, I do think programming is fundamentally changing from a creative writing skill to being a creative reading skill. My hottest take is that this isn't a new phenomenon, it's the culmination of a shift that started back when I was in college and Stack Overflow first hit the scene.
Towards that end, the pattern I'm trying this semester in my sophomore-level programming class:
1) Give the students the programming problem.
2) I use a locally hosted LLM to generate starter code that represents a wrong solution to the problem.
3) Submit that code to the student's repo via PR (since GitHub sunsetted GitHub classroom),
4) Ask the students to generate requirements for a problem solution and tests to assess whether code meets those requirements.
5) Students need to compare the LLM generated code to the requirements, determine whether the code passes their tests, and then fix any problems.
GitHub sunsetted GitHub Classroom. As a direct consequence of that, I created a new account to automate some elements of my course that GitHub classroom used to implement. Looks like that account just got put in naughty jail (hourly API limit of 60 requests), which *includes prohibiting me for signing the account up for a paid plan*.
Cool, cool. This is fine.
One of the creepiest thing about the current moment in tech is seeing people casually refer to tech executives by their first name as if they know them.