the internet loves grapheneOS, the secure AOSP fork that also makes Android nicely usable without the LLM crap
-
@zzt Humans are about as good when it comes to introducing vulns. However LLMs for 0day discovery works so well that it leaves you with really no choice, there's no LLM-free tool or process that can compete, in the mean time, you are just left with vulnerable software, that's a fact. The very nature of it being fast means vulnerability hunting becomes much easier and you can't compete as humans on the fixing side without using LLMs, there just isnt even enough qualified labor available in the world to manually handle the influx while keeping users safe. Android uses Linux and GrapheneOS didnt exactly chose that and for compatibility reasons it's quite difficult to change. A more durable choice for enforcing better theoretical security boundaries would be rewriting Linux in a safe programming language, however that is also an effort that requires enormous amount of labor that is not really practical. That would however be a viable human's response to it. You unfortunately just can't keep users safe on existing systems that arent designed from ground up to extremely minimize possible attack surface. Android is in a sense but also has many complex attackable systems made only to increase usability and versatility, you could have a human-made secure system that can resist LLM automated vulnerability hunting but it would certainly not have many features and be very crude to use. Unusable secure software isnt really that helpful either.
@laura_ge yeah I’m not reading all that, stay out of my replies codegooner
-
@zzt
"It's a new developer we hired"Why did they hire them, if not to slop?
-
@avesbury_rosetta @zzt we need mobile linux, to start with. Android is a non-open, user-adversarial dead end. It takes a special kind of wrong mindset to be as determined to work on, and advocate for it, as GrapheneOS
@ariarhythmic @avesbury_rosetta @zzt the issue is that Graphene is (or was) the most secure OS, at least in the mobile space. The one activists use because not even the police can break its security.
Meanwhile Linux is less secure than even macOS and Windows, I like it, I use it on all of my PCs, but not for *security* reasons.
-
> That increase is despite adding features slowly down a lot. A massive monolithic kernel written in a memory unsafe language is a bigger liability than ever.
rust in the kernel is in the corner like “am I a joke to you”
it’s uhhh real rich that the AOSP fork suddenly has a problem with a massive monolithic kernel written in a memory unsafe language now that LLMs are on the table
and the solution is just LLMs, only that. not fixing the massive, monolithic, or unsafe language bits at all. making them much worse, in fact. thanks!
@zzt FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK
/me inhales
FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK
god fucking dammit graphene
-
the internet loves grapheneOS, the secure AOSP fork that also makes Android nicely usable without the LLM crap
<yelling from out of frame>
…ah. this just in, grapheneOS has decided to start codegooning core apps and security fixes and now they’re exhaustingly defending doing that
> Many valid issues are reported in between the hallucinations and other nonsense.
oh I see, what a relief
> Attackers are heavily using AI models to discover vulnerabilities and develop exploits. For example, Cellebrite is heavily using it including developing frameworks for reverse engineering and vulnerability discovery.
gotta use the wrongness machine, no sorry, “frontier models” because the coptech adversary is using them and also mythic’s great at finding vulnerabilities til you find out you can do the same job without it. great! https://grapheneos.social/@GrapheneOS/117226938743085364
if you’re in infosec or pretending to be in infosec and you’re about to start gooning in this thread with the contents of anthropic’s marketing campaign for mythic, a model whose results are shit: reconsider
reconsider a lot of things, really
-
@zzt FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK
/me inhales
FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK
god fucking dammit graphene
@aspensmonster that’s my inner monologue too
-
-
@ariarhythmic @avesbury_rosetta @zzt the issue is that Graphene is (or was) the most secure OS, at least in the mobile space. The one activists use because not even the police can break its security.
Meanwhile Linux is less secure than even macOS and Windows, I like it, I use it on all of my PCs, but not for *security* reasons.
@hazelnot @avesbury_rosetta @zzt The Linux ecosystem has the potential for it, though; it just needs to be realized with openness, and empowering users in mind instead of the way Google decided to do it.
-
if you’re in infosec or pretending to be in infosec and you’re about to start gooning in this thread with the contents of anthropic’s marketing campaign for mythic, a model whose results are shit: reconsider
reconsider a lot of things, really
@zzt I have zero idea what you're talking about but I am here for the piss and fire.
-
-
> That increase is despite adding features slowly down a lot. A massive monolithic kernel written in a memory unsafe language is a bigger liability than ever.
rust in the kernel is in the corner like “am I a joke to you”
it’s uhhh real rich that the AOSP fork suddenly has a problem with a massive monolithic kernel written in a memory unsafe language now that LLMs are on the table
and the solution is just LLMs, only that. not fixing the massive, monolithic, or unsafe language bits at all. making them much worse, in fact. thanks!
also, here’s how much you can trust that they’re only using it strictly for reviews:
https://circumstances.run/@davidgerard/117235031728518322
> The AGENTS.md talks about the bot writing new code. On the available evidence I don't actually believe they're not coding with it.
not that “only doing using it for reviews” gets good results. you end up programming the way the LLM insists you should anyway. reviewing like this is exhausting and quality goes straight into the toilet. most people just cognitively surrender to the bot after a bit. this is an extremely common methodology in professional code, and it’s the reason why half the software you use right now fucking sucks.
-
@hazelnot @avesbury_rosetta @zzt The Linux ecosystem has the potential for it, though; it just needs to be realized with openness, and empowering users in mind instead of the way Google decided to do it.
@ariarhythmic
@hazelnot @zzt
If I recall the main limitations in Linux are- Lack of proper hardening in the stock kernel, including the memory hardening that Graphene does
- Lack of a MAC by default, like Apparmor or SELinux
These can be fixed
-
@zzt I have zero idea what you're talking about but I am here for the piss and fire.
@AnarchoNinaWrites hahaha happy to provide!
-
@zzt FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK
/me inhales
FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK
god fucking dammit graphene
@aspensmonster @zzt Pace yourself; with this much cursing to be done, it's an endurance event, not a sprint.
-
@AnarchoNinaWrites hahaha happy to provide!
@zzt At this point I think I'd pay a vlog subscription at like 50 bucks a month, happily, if a guy promised to just show me videos of him telling AI evangelicals to "get a real job you fucking Moonie"
-
@zzt
"It's a new developer we hired"Why did they hire them, if not to slop?
-
@ariarhythmic
@hazelnot @zzt
If I recall the main limitations in Linux are- Lack of proper hardening in the stock kernel, including the memory hardening that Graphene does
- Lack of a MAC by default, like Apparmor or SELinux
These can be fixed
@avesbury_rosetta @hazelnot @zzt The very design of Linux is a horrible mess, it's not really about incremental hardening improvements.
It can be secure, yes, since GrapheneOS is secure, but honestly, we really need a better kernel project.
-
@zzt FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK
/me inhales
FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK FUCK
god fucking dammit graphene
@aspensmonster I used to have that reaction, but this has got to be the third or fourth time something I wished I could have used/bought/migrated to full-on corrupted. (Versus the two or three times something I'm currently using blew up in my face.)
Now I'm at a constant "fuck it" and my throat feels better.
-
@zzt At this point I think I'd pay a vlog subscription at like 50 bucks a month, happily, if a guy promised to just show me videos of him telling AI evangelicals to "get a real job you fucking Moonie"
@AnarchoNinaWrites yo @davidgerard we’ve got a second channel idea for pivot and at least one subscriber!
more or less what we do on awful.systems but in video form. actually not a bad idea at all, do we know anyone with a good voice for it?
-
@AnarchoNinaWrites yo @davidgerard we’ve got a second channel idea for pivot and at least one subscriber!
more or less what we do on awful.systems but in video form. actually not a bad idea at all, do we know anyone with a good voice for it?
@zzt @AnarchoNinaWrites @davidgerard algernon takes a note to record a few demos later today
