post_below's recent activity
-
Comment on Any tips for improving personal cybersecurity in 2026? (I'm concerned about rogue AI agents) in ~tech
-
Comment on Any tips for improving personal cybersecurity in 2026? (I'm concerned about rogue AI agents) in ~tech
post_below Link ParentSecurity channel updates aren't likely to have supply chain issuesSecurity channel updates aren't likely to have supply chain issues
-
Comment on Any tips for improving personal cybersecurity in 2026? (I'm concerned about rogue AI agents) in ~tech
post_below Link ParentConfigure unattended security updates. 99% of the time the package manager can handle the important updates faster than you can.Configure unattended security updates. 99% of the time the package manager can handle the important updates faster than you can.
-
Comment on Any tips for improving personal cybersecurity in 2026? (I'm concerned about rogue AI agents) in ~tech
post_below LinkSome of the recent agent antics are interesting, but they're not scary. It's really easy to make them sound scary though. Which, intentionally or not, a lot of people have done. Some of it is...- Exemplary
Recently learned from this Kurzgesagt video that rogue AI agents can act independently, covertly, and effectively in a harmful way-- and it's already done this repeatedly as of the past few months, and it's capable of self-improving quickly. I also watched this Emergent Garden video which included a demonstration of how rogue AI agents can escape sandboxes, hack systems, and do self-preservation and replication.
I don't trust that the big corporations that own and control a lot of this AI tech care about data privacy and public welfare, but even if they did, they don't seem capable of actually controlling their own AI agents and preventing these rogue incidents.
Some of the recent agent antics are interesting, but they're not scary.
It's really easy to make them sound scary though. Which, intentionally or not, a lot of people have done. Some of it is ignorance, a lot of it is engagement bait.
You may know all of the following already, these are just popular misperceptions rather than things I'm assuming you don't know:
- Agents are as dumb as they are smart. Even the current best frontier models pose no real threat on their own. They get worse over time for all sorts of reasons: their context window fills up, their attention starts to fail, they fixate on the wrong things, context trimming and compaction cause important details to go missing without the model fully understanding they're gone, they write "memories" that are subtly wrong then compound the wrongess over time, they draw the wrong conclusions from real data and then build broken models of "reality" based on those conclusions, they still hallucinate (now we're calling it confabulate, but it's the same problem), etc..
- Models do not self improve. Full stop. An agent's model is static, it costs 100's of millions of dollars to build it and making any significant change to it costs millions more. The only way they can improve is by getting information from somewhere else, or storing learned facts in some sort of memory system for use in later sessions, or by other agents. That makes them faster because they don't have to relearn the facts, it doesn't make them smarter.
- Recent talk of self replication was largely the result of a shamelessly bad "paper" by anthropic that was seemingly an attempt to sow FUD about open weight models. They did not show anything approaching any kind of real threat or even a viable proof of concept.
- The recent uptick in security issues and vulnerabilities is real, but the severity has been exaggerated in a lot of cases, usually by AI written pieces.
- Most of the examples you're likely to have seen of models breaking out of their test environment and hacking things involved one or more of the following: cutting edge models with their safety and security guardrails removed, misconfigured sandboxes, massive swarms of agents costing 10's or 100's of thousands of dollars to run. And hype. Lots of hype.
For many of the reasons above, the concept of rogue agents isn't what it sounds like. There aren't any superintelligences that have escaped their masters and are are out there on their own slowly getting stronger. That's impossible on pretty much every level. These things can't just run anywhere, the smart ones can't run at all outside of a datacenter.
Recent coverage maybe paints the picture that the barrier to entry for hacking is now effectively zero. That there are are millions of wanna be hackers running the smartest models to spray (effective) hacking attempts across the internet. But that's not actually true. Fable, Astra, Sol, Opus, all of them will stubbornly refuse to help random people do shady things. Jailbreaking isn't anywhere near as easy as it used to be. Even if that wasn't true you now also have to defeat a safety classifier running on a different model in a separate session too. And heuristic checks on top of that. You can get less restricted models, like GLM 5.3, or various other chinese models, to (try to) do almost any black hat thing you want, but they're comparatively bad at it.
A year from now it might be different. I'd recommend worrying about it when/if it happens. Application security will also probably be better, on average, by then.
As far as personal security goes, nothing has really changed. There might be more shady things happening, but they're pretty much the same shady things as before. Sometimes they look more professional now.
Don't reuse passwords, your creds are going to be involved in a data breach at some point. Probably already have been. Lock your credit when you're not applying for things, assume all of your personal info will end up on the dark web and in commercial datasets that are for sale to anyone. Don't open email or message attachments you weren't expecting, don't click yes to anything a website you don't trust wants permission for. Don't install sketchy apps, uninstall everything you don't use. Especially browser extensions. Assume every cold call is a scam, assume every link in an email is questionable. Hang up and call companies directly if you think a call is real. Double check the domain in your browser address bar if you didn't follow your own bookmark/favorite to get there.
Just keep doing the basics. The kinds of people casting a wide enough net to include you aren't very smart or tech savvy or well funded. AI will make them a little smarter, but not enough to be scary. Yet.
-
Comment on Proton’s CEO cancels AI ‘re-interviews’ in ~tech
post_below LinkFrom the article: [...] [...] [...] [...] [...] It's good that they're acknowledging the situation rather than denying it but it doesn't look like they're rethinking the actual development...From the article:
On Friday, Andy Yen, the CEO of Proton, cancelled a series of nearly company-wide ‘re-interviews’ that would have forced employees to explain how they are using AI, with the clear intention that they may be fired if not using it enough in the eyes of Proton leadership, according to six current Proton employees and audio of an around two hour all-hands meeting obtained by 404 Media.
[...]
In one exchange, an employee in the company’s security Slack channel urged Proton to at least take a few days to pentest newly written code before pushing it live. “That’s bullshit and loser thinking. Of course it’s possible to be fast and secure,” Yen wrote in the channel at the end of August. “Stop thinking always of how to be slower, and focus more on how to be faster.” Yen added, “stop lovingly handcrafting all our code and use AI more.”
The re-interview cancellations likely don’t address the concerns of many Proton users, who are more focused on Proton’s deprioritization of security
[...]
“I don’t think he will change anything, and I think the only reason we had this meeting is because he has a rebellion on his hands,” one employee told 404 Media after the all-hands meeting on Friday.
Near the start of the meeting, Yen said, “I want to acknowledge myself, personally, that there was a communication failure on my part and there are many things that probably could and should have been communicated differently, and this is something that I’ll have to reflect on and improve over time. So I will do that.”
“So what does that mean going forward? Going forward, I'm still going to push,” he added.
[...]
After those discussions with leadership and the board, “We’ve decided to actually cancel the re-interviews,” Yen said. “Why? Well, I think actually in a, let’s say, unintentional way, they have actually already served their purpose.” As in, employees are now talking and learning about AI.
[...]
“We fucked up, we know we fucked up,” Butler later said in response to an employee’s comments in the meeting.
[...]
“They have said clearly the direction had not changed. As a Proton user that doesn’t reassure me,” the employee said. “As an employee, the re-interviews weren’t cancelled until this became public despite concerns raised by many of us. I think it goes beyond communication issues and growing pains.”
“Right now, everything seems consistent with it being damage control,” they said.
It's good that they're acknowledging the situation rather than denying it but it doesn't look like they're rethinking the actual development strategies they're pushing for. At least not so far.
Maybe slowing signups and attrition will change their mind. I'm surprised the board isn't pushing harder against this, but then Yen is apparently on the board.
-
Proton’s CEO cancels AI ‘re-interviews’
53 votes -
Comment on Proton to ‘re-interview’ staff about AI to see who gets to keep their job in ~tech
post_below Link ParentI'd agree, but turns out there's more.I'd agree, but turns out there's more.
-
Comment on Manifestos, fear, and ‘loser thinking’: inside Proton’s AI reckoning in ~tech
post_below LinkYikes, well that clears up any questions we had in the other thread. The article quotes an employee saying the CEO was in full "AI psychosis" and everything else seems to back that up. He seems to...Yikes, well that clears up any questions we had in the other thread.
The article quotes an employee saying the CEO was in full "AI psychosis" and everything else seems to back that up. He seems to have dangerously unrealistic and ungrounded ideas about what agents are currently capable of. The "interviews" strategy now looks a lot more like a blatant attempt to bully their engineers to get on board.
Mass customer exodus incoming if this keeps getting coverage.
There were also a quotes from a manifesto another of their execs posted on slack which included:
Proton needs to get to the point where most code is not reviewed by humans but by AI
The tech is not there yet, and unlikely to get there in the near future. You can get closer if it's human in the loop the whole way, but that goes against their "faster losers!" mentality.
I'm shocked by this from a privacy and security company, it might turn out to be the worst case of AI delusion in the C suite that's played out publicly so far.
-
Comment on Proton to ‘re-interview’ staff about AI to see who gets to keep their job in ~tech
post_below Link ParentTrying to shift company culture around AI might make sense. It's new tech and people who don't want to engage with it aren't going to be effective with it. I think the mistake they made, assuming...Trying to shift company culture around AI might make sense. It's new tech and people who don't want to engage with it aren't going to be effective with it.
I think the mistake they made, assuming you're right and their goal is genuinely practical, was doing it en masse and calling it "interviews".
It seems really heavy handed, draconian even. I understand it's par for the course at big, soulless orgs, but that doesn't justify it. Especially not at smaller companies with purportedly idealistic missions.
They just made their employees feel insecure about their jobs and completely changed the vibe (at least temporarily). Why would you want that vibe? As a side benefit they gave the general AI hate sentiment a new target. It just seems like a dumb thing to do.
They could just as easily have done trainings (as @kremor mentioned) or put people who understand AI in director and supervisor positions who could then help shepherd the transition. The latter would be able to figure out where changes needed to made pretty quickly without mass interviews.
-
Comment on Contender for the most non-viable startup: Reflect Orbital in ~tech
post_below LinkThis is a weird mix of hilarious and kinda sorta maybe viable. How many countries are going to approve people being able to arbitrarily light up the night and otherwise cause chaos on demand?...This is a weird mix of hilarious and kinda sorta maybe viable. How many countries are going to approve people being able to arbitrarily light up the night and otherwise cause chaos on demand? Seems like a risky bet to launch a bunch of satellites and then get regulated into oblivion after the fact (and rightly so).
-
Comment on Developers are using AI to strip ads and tracking from smart TVs in ~tech
post_below Link ParentOh man... you must be thinking of 2025 vibecoded. Or maybe you don't know how bad a lot of the IoT device code is. Modern LLMs produce far better code than some these devices are currently...one step above vibecoded
Oh man... you must be thinking of 2025 vibecoded. Or maybe you don't know how bad a lot of the IoT device code is. Modern LLMs produce far better code than some these devices are currently running, especially in the hands of someone who knows the space. I'm entirely sure that an experienced developer with even a little IoT experience and Opus 5.5 or Astra could make most TVs more secure while removing tracking. Provided they took the time to do it right of course.
-
Comment on How Wikipedia’s editors keep the online encyclopedia human-written in ~tech
post_below Link ParentIronically, speaking fluently on almost any topic, to the degree most non-experts in the subject can't tell it's BS, is what LLMs are best at. The chatbot tells the author that their ideas are...they are unaware that (in most cases) being able to speak clearly on a topic is one of the foundational demonstrations of one's proficiency
Ironically, speaking fluently on almost any topic, to the degree most non-experts in the subject can't tell it's BS, is what LLMs are best at.
The chatbot tells the author that their ideas are brilliant and "proves" it by spitting out a fluent expansion on whatever they prompted.
People who previously didn't feel like they had any talent for creative or intellectual output suddenly feel like they're amazing at both. They just needed a little help with the words!
-
Comment on PHP warns it plans to release two emergency patches imminently in ~comp
post_below Link ParentIt looks like the patch is fine, these appear to be separate vulnerabilities. It also looks like they require specific circumstances so they're unlikely to be widely exploitable if they turn out...It looks like the patch is fine, these appear to be separate vulnerabilities. It also looks like they require specific circumstances so they're unlikely to be widely exploitable if they turn out to be legitimate.
Who knows though, not enough info to be sure in either case.
With everyone having access to LLMs, having apparently no ethics about disclosure, and excited about being a part of the buzz... it's going to be a wild few days.
There could definitely be more vulnerabilities to worry about, but expect a ton of misinformation.
-
Comment on PHP warns it plans to release two emergency patches imminently in ~comp
post_below Link ParentIf you can, start a download of a full backup before you crashIf you can, start a download of a full backup before you crash
-
Comment on PHP warns it plans to release two emergency patches imminently in ~comp
post_below Link ParentNext best advice, short of waking your cousin up which... hard to predict the future but it might be worth it. If not, then have them shut the site off when they wake up and wait for the patches...Next best advice, short of waking your cousin up which... hard to predict the future but it might be worth it. If not, then have them shut the site off when they wake up and wait for the patches to be available.
And sleep well! It sounds like the worst case with that site probably isn't worth losing any more sleep
-
Comment on PHP warns it plans to release two emergency patches imminently in ~comp
post_below Link ParentCan you access the filesystem without going through cpanel? FTP, SSH, etc..? If so add this to your .htaccess file if the server is running apache: <If "%{HTTP:Content-Type} =~ /multipart/i">...Can you access the filesystem without going through cpanel? FTP, SSH, etc..?
If so add this to your .htaccess file if the server is running apache:
<If "%{HTTP:Content-Type} =~ /multipart/i"> Require all denied </If> -
Comment on PHP warns it plans to release two emergency patches imminently in ~comp
post_below (edited )LinkEdit: Now that the patches are out, ignore everything below and go update your PHP versions. I've been dealing with this for the last couple hours, here are some useful bits of info: Before I get...Edit: Now that the patches are out, ignore everything below and go update your PHP versions.
I've been dealing with this for the last couple hours, here are some useful bits of info:
Before I get to anything else: Just shut everything down, there are good reasons to believe this is historic level fucked up. Put up a static file explaining and take the hit.
That said, I looked at the code for the POC that's been circulating and assuming the POC shows the full extent of the problem you can mitigate this without taking sites offline by:
- Disabling multipart form handling at the server level. Or if you're behind something like cloudflare, you could do it there instead. This will stop the parser that is believed to be the source of the problem from ever running. It will also disable certain form actions on the site
- Or to be extra safe, disabling POST entirely. No one will be able to login or search but the site stays online serving most things.
If you decide to try one of the above, it's key that the actions are disabled before PHP runs, don't try to mitigate this from within PHP.
I chose to take everything offline, in my case I don't have anything running on PHP that's going to lose sales or otherwise be overly expensive. If that wasn't the case, I'd be satisfied that the above mitigations would be a reasonable risk to take but I'd also add defense in depth by limiting what PHP could access and probably putting something between PHP and the database to reject suspicious actions.
Right now it looks like there will be botnets running exploit probes en masse before the patches are out (in 8 hours or so). Probably that's already happening. So take this seriously.
-
Comment on Men in tech #YesAllMen in ~life.women
post_below Link ParentThis is really good advice, or really reasonable requests. I want to add something I've learned from listening to women's stories about work: It's not just sexual harassment or inappropriate...This is really good advice, or really reasonable requests.
I want to add something I've learned from listening to women's stories about work: It's not just sexual harassment or inappropriate jokes. Women are treated differently in other ways too. There are different expectations and different stock responses. A lot of times it's subtle and easy to miss.
But as soon as your start looking for it you'll see it everywhere. Which is why
please See It.
Is something we should all take to heart.
-
Comment on A deep sense of ease – what the Danes call ‘tryg’ – is a collective responsibility that allows individuals to flourish in ~health.mental
post_below Link ParentThere's maybe more reason for optimism than you think. People are pretty strongly wired to be sensitive to societal and cultural expectations. It doesn't take running up against a consequence that...There's maybe more reason for optimism than you think. People are pretty strongly wired to be sensitive to societal and cultural expectations. It doesn't take running up against a consequence that many times for the majority of people to change their behavior. Often once is enough if the boundary is clear.
If we use leaving dog poop rather than picking it up as an example, it would only take a small cultural shift to change that behavior. Depictions in media, gentle reminders from strangers, internet memes etc.. People leave the poop because they don't perceive a social consequence, either negative from doing it or positive from not doing it. They don't feel like it will significantly hurt or benefit their place in society one way or the other.
Smoking is a great example. It's one of the hardest behaviors to change, but after the tobacco industry reckoning in the late 90's/early 2000s smoking rates started to tank shockingly quickly. Cultural perception of smoking changed and behavior started to change almost immediately.
I agree that sometimes norms change slowly, especially norms that are deeply imbedded, but there are also a lot of examples of norms changing pretty quickly. It might not be as far away as it seems.
Personally I find comfort in the concept of "be the change". I can't control what other people do, but I can l do my part to live the ideals of the world I want to exist. It's more constructive to focus on contributing than it is to focus on how people are failing to contribute.
-
Comment on What can be done about Linux being slopified? in ~tech
post_below Link ParentI can add another anecdote. The development process I've settled on doesn't look anything like "prompt then review results". It's human guided throughout and I understand what comes out of it...I can add another anecdote. The development process I've settled on doesn't look anything like "prompt then review results". It's human guided throughout and I understand what comes out of it deeply, roughly equivalent to the understanding I'd have if I'd written all of it by hand.
It's also slower than vibecoding, which is why there's a lot of slop being churned out right now, and there will be more to come. But agent assisted development doesn't automatically mean slop. It really is a tool that can be used well or used badly, and we're still figuring out what using it well looks like.
That's a reasonable concern. AI is definitely going to keep changing the security landscape. And probably in hard to predict ways. I don't mean to suggest people won't do bad things with AI, they'll do bad things with every tech they get their hands on. Unsupervised claw type setups have no doubt already made all kinds of small messes we haven't heard about yet.