Can we get rid of the password expiration too? Requiring that users change their perfectly secure password every 6 months is absurd and gives the impression of security when in reality it only makes things worse.
A very detailed article. Love the history of all the kernels too. My only minor gripe is that since it's about a serious security issue, I would like a very brief explanation in the beginning, like what is the impact, the requirements for the attack, is it a logic error or memory corruption etc. Very brief, only long enough to know if I want to read the rest of the article or not :)
Surely Facebook and all the other companies will get sued for using copyrighted material for their products. Right? Right? Let's just hope it won't be so bad for these poor companies. Thankfully companies themselves can't contemplate suicide.
I know this is a snarky comment but the double standards are killing me.
Also this has been said a thousand times but I have to repeat it here. Abolish the paywalls for scientific research. Elsevier and the rest of the gang that produce nothing of value, gatekeepers of knowledge that did not produce. Seriously, what is their running cost nowadays? An FTP server with the PDFs? Semi-honest question.
> “We can build the architecture, the chip, the system, the libraries, and the
> algorithms all at the same time,” said Huang. “If you do that, then you can
> move faster than Moore’s Law, because you can innovate across the entire stack.”
So no connection at all with actual Moore's Law which states that number of transistors double each year. If you optimize your libraries to be 4x faster, no, that doesn't mean your 'AI chips' are improving faster than Moore's Law.
Statements like these annoy me enough to actually comment. Are they gaslighting us or do they actually believe this stuff ? Makes me really wonder.
I hope (but I doubt) that this will be more than a marketing stand to include something "AI" in their product line. Every vendor has their own hardware that is badly supported by tools, and even if it is supported, only a fraction of the available software uses it. In the meantime it takes precious die area and resources.
Would you ask to pause the progress on the invention of the wheel? The Antikythera mechanism? I am honesty astounded writing this since I don't even agree to call current advancements AI, have not subscribed to the hype, believe GPT is very overestimated etc etc. But still I don't think this is the way to go.
No it doesn't. LLMs are just a window to the collective sentiment/knowledge of the internet (or rather the training corpus). And a very blurry and distorting window at that.
This is why I have little faith this version of AI will have disrupting level capabilities. The humans are keeping it back.
Assuming vulnerability research, you need to be able to recognize bug patterns (buffer overflows, use-after-frees and such), be familiar with fuzzing, code audits, debugging. Of course understanding the code usually in C/C++ and assembly.
Assuming you have the technical skills there are companies that hire for such positions ranging at varying degrees in the "ethical" scale. See Google Project Zero and Zerodium for instance.
You don't need a PhD, CISSP, a cybersecurity bootcamp, a relevant degree or pretty much anything. You need to understand how the computer actually works. Most of the stuff needed are left out of a typical computer science curriculum. And (most) of the people hiring actually know that.
In order to do it you must simply spend so many hours to learn that stuff and then not be disheartened by the work that needs to be done. Example: No one has compiled a binary with ASAN. Do it (by spending an exorbitant amount of time to fix all the linking errors during compilation). Run the binary with literally any input. Boom, you got a bug.
Getting the role is pretty much like any other, you pass the interviews. Solving ctf like challenges is common. Finding all the bugs in a toy C program. Elaborating on the exploit ability of a latest CVE, etc.
My favorite interview question:
1. Write a hello world in C.
2. Run it
3. Explain how it works
You'd be surprised how many people actually have even a vague ideas what happens.
No such thing as an all Google phone. Trying to market the latest pixels as "Google silicon" is a complete joke. Not only the SoCs used are mildly customized Samsung Exynos, they are also terrible at performance and battery life even by Android standards.
Creating a separate gcc plugin for this seems unnecessary if I am not misunderstanding something. Just ensure the invariant function is called at every method, in debug builds maybe. You could of course change the object properties without using a method but then you have bigger problems.
How easy is it to enable/disable specific features for the final image? By default a lot of useful (for me at least) functionality seems to be removed.
I hate QR codes for menus with a passion. Feels so awkward, need another app on Android, not easily read on dimly lit places. Usually I tell one of my friends to tell me the url.
On the other hand I love NFC for this. It blows my mind that it's not that common. Works perfectly and feels natural, just place your phone at the NFC tag.