* Read the target user's NTUSER.DAT hive into memory as a backup.
* Open the hive offline using the Offline Registry (offreg) API.
* Modify HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData to point at \\.\GlobalRoot\BaseNamedObjects\Restricted.
* Save the modified hive and replace the original NTUSER.DAT.
* Copy the user's UsrClass.dat into the temporary working directory.
* Acquire a batch oplock on the copied UsrClass.dat to synchronize execution with profile loading.
* Start a suspended process using CreateProcessWithLogonW(..., LOGON_WITH_PROFILE, ...), triggering the User Profile Service to load the profile.
* Wait for the oplock to break when Windows attempts to access UsrClass.dat
Who thought having a LLM with access to private information, with public access to ask it questions, would ever be a secure process?
Look I like interacting with these tools as much as the next guy, but I'm certainly not going to trust them with access to information and then allow anyone to send them prompts.
Edit/further thoughts: So (assumable as they said this is disclosed with github's knowledge) this has been patched. But how many different word combinations will it take to find another way to have this occur?
Yeah, their performance has gone in the toilet. Recently we needed an old system setup just for group meetings in the office. I installed 11 on it - it struggled, gave up, threw a linux install on for giggles and it's buttery smooth.
GLM 5.2 came out today and the early reports have been quite good. Very difficult to run except on prosumer hardware, but small business could quite easily (or something like open router).
Yup, Windows 10 LTSC here. It's a lot faster and smoother, but I'm already transitioning to Linux on my other boxes. Will probably move before LTSC runs out as well.
edit: I realised I overplayed how much faster and smoother it is. compared to standard win 10 or 11. Example being my login screen sometimes struggles to come up when the computer is locked (work around double mash CTRL-ALT-DEL)
I bashed out a dashboard for myself the other month, monitors firewall alerts/warnings/shows connected devices, process monitors on a few pc's that I keep an eye on, a to-do list/calendar combination that let's me track some internal tasks I need to do weekly, bi-weekly, monthly, etc, oh and it pings cloudflare to keep me up to date on the website stats. And an Amidakuji game to help me and another staff member pick who's doing X task that day :P
Nothing major, and only works with my infra, but it saves me a few minutes a few times a day to just be able to check the tab, and if there's an alert load up the full stats page.
I would have thought this would be more of a story, I'm surprised there are so few comments.
"Claude Desktop, an Anthropic application, reached across the trust boundary between two independent vendors, and wrote configuration into Brave's application directory. The principle that an application does not silently modify another application is so obvious it rarely gets stated. Anthropic broke it in silence."
This is the key point for me - ask me, let me remove when done. That would be all it takes to not abuse trust.
Slightly off topic, but I was discussing with my wife getting a kindle for my son (8) recently.
Any recommendations for alternatives? I have no problem using calibre to convert the books, and manually transfer from my PC. It just needs to read books.