Cybersecurity professional with an interest/background in networking. Beginning to delve into binary exploitation and reverse engineering.

  • 0 Posts
  • 190 Comments
Joined 2 years ago
cake
Cake day: March 27th, 2024

help-circle
  • yeah she can be kind of brutal, it’s weird they put her on a place where you run into her so early. She electrifies the water which fries you. You can shut the power off at a panel in the room if you have high enough technical ability, but can also kite her to that hallway with no water and shoot her from behind one of the Militech trucks in the street.

    I recently upgraded my CPU and am playing through the game to finish it now that I can max the settings out. I’m playing it on Very Hard and it’s too easy. It didn’t feel like this when I played on launch, so idk if they changed something or if I was just bad then.




  • I just meant that they’re just us-east-1 racks, that the facility wasn’t built for AI specifically in the way that most people are probably going to assume given the past couple years. I don’t know what’s in there rack by rack, building by building either. There is a good chance that if you spin up Opus 4.7 in Bedrock it could be in these buildings.


  • If anyone’s curious, this is the AWS Tanner Campus. It’s right across the street from the official, marked on the map location for AWS’s us-east-1, and they are all IAD- buildings, so they’re part of what makes up the us-east-1 AWS region. The project was announced as early as 2020.

    It consists of four single-story data center buildings spanning nearly 800,000 square feet, which are supported by a massive 192-megawatt electrical substation and backup diesel generators.

    As others here have said, this is not an “AI” data center, it’s a data center that runs massive swathes of the internet as we know it. Either way it’s fucked that they’re approved to build this shit right behind peoples houses. They are right across the street from a regional airport, so maybe that areas zoned commercial? It’s definitely a weird area in general. Driving down prince william parkway you’re seeing tons of straight industrial support shit, like metal shops and construction supply stuff and warehouses with performance car shops with dynos and everything, then you just hit houses.

    It was probably zoned back when nobody ever thought anyone but the rednecks already out there would live that far outside the beltway, but now commuting from Manassas/Gainesville into DC or somewhere else inside the beltway is normal, and they’re building houses where they never thought they’d be building.

    Again though, fuck Amazon and Prince William County for assaulting these people like this.






  • If you’re submitting a vulnerability to a public repo, that’s also your job. These slop reports that are wasting maintainers time should never have been reported. The person tasking the LLM is out of their depth and can’t be the human in the loop that verifies the vulnerability report before submitting because they don’t have the required knowledge to do that. It’s a shame, because if people who had the requisite knowledge were the ones submitting, the ratio of valid reports to noise would be way higher than 5% and open source maintainers wouldn’t be feeling burned the fuck out.


  • I’ve been fucking around with using Claude to solve CTF challenges. I’m using a harness built out of a custom agent I wrote that progressively loads specific a specific skill for the challenge category, cryptography, binary exploitation, reverse engineering, forensics, etc.

    It’s solving the simple shit in <1m using sonnet. It’s solved some shit that I couldn’t figure out at all during the CTF in the time limit we had in ~20 minutes. There’s been 2 challenges that after about 25 minutes I’ll kill the agent working on it, change to opus, then opus solved them in about 20m. One crypto challenge was so math heavy i never would have figured it out. One bin exp challenge didn’t provide a local binary, everything was remote. There was a catch that I never would have solved bc it was remote only and I couldn’t locally debug it.

    It’s fucking scary good at solving these things. I just prompt with “use <agent> to solve ./category/challenge/“ and it fully just does everything. It’s definitely akin a fuzzer that can be used for way more than just finding crashes and memory leaks. It takes some work and understanding to make it context/token efficient I think, but it lowers the bar so tremendously that I definitely see why there’s concern here. And again it’s solving most of these things with sonnet, not even opus and definitely not fable.

    All told, this feels like the same panic that happened when metasploit first got released/demo’d at defcon back in the day.







  • WhatsApp’s code is not public. The app generates the private keys. The app has to have access to the private keys to decrypt your messages. Because the code is not public, no one has any idea if meta has ad hoc on demand access to the private key, or if they upload the private key to their servers.

    If WhatsApp was open-source like signal, we wouldn’t be having this conversation. Until then, and based on metas know business practices, it’s safe to assume they have access to WhatsApp private keys.