661
Deterministic Quoting: Making LLMs safer for healthcare
LLMs have the potential to revolutionise our field of healthcare, but the fear and reality of hallucinations prevent adoption in most applications.
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 684 posts.
662
Characterizing secret leakage in public GitHub repositories
How bad can it git? Characterizing secret leakage in public GitHub repositories Meli et al., NDSS’19 On the one hand you might say there’s no new news here. We know that developers shouldn’t …
663
664
Bypassing Gogo’s Inflight Internet Authentication
Two weeks ago I attended SIGCSE 2012 in Raleigh, NC. The plane on my return flight had Internet access through Gogo’s Inflight Internet. While I think it’s incredibly awesome that Internet access is readily available to those who travel by plane, I personally feel it is not worth …
665
How Not to Redact a Warhead
How the wrong settings on a photocopier has let us have a glimpse at a forbidden image of a modern thermonuclear warhead.
666
667
IDIV DoS (INT_MIN / -1)
A little fun for the last day of 2012: how to crash a program via division? x86’s IDIV instruction traps not only on division by zero, but also on INT_MIN / -1 (signed integer overflow).
668
Break a dozen secret keys, get a million more for free
[An in-depth blog post by Daniel J. Bernstein, crossposted between the ECRYPT blog and the cr.yp.to blog .]
669
Keeping Passwords in Source Control
I learned a neat tip from my co-worker, Craig Silverstein ( more on Craig joining Khan Academy ), recently and I thought others might find it to be useful.
670
Design Patterns for Securing LLM Agents Against Prompt Injections
This new paper by 11 authors from organizations including IBM, Invariant Labs, ETH Zurich, Google and Microsoft is an excellent addition to the literature on prompt injection and LLM security. …
671
672
Creating a rogue CA certificate with MD5 hash collisions
We have identified a vulnerability in the Internet Public Key Infrastructure (PKI) used to issue digital certificates for secure websites. As a proof of concept we executed a practical attack scenario and successfully created a rogue Certification Authority (CA) certificate trusted by all common web browsers. This…
673
A Few Thoughts on Ray Ozzie’s “Clear” Proposal
Yesterday I happened upon a Wired piece by Steven Levy that covers Ray Ozzie’s proposal for “CLEAR”. I’m quoted at the end of the piece (saying nothing much), so I knew the piece was coming. …
674
The security scanner that cried wolf
If you’ve ever been alarmed by how many security vulnerabilities your Docker image has, even after you’ve installed security updates, here’s what’s going on.
675
676
Ransomware gangs now outing victim businesses that don't pay
As if the scourge of ransomware wasn’t bad enough already: Several prominent purveyors of ransomware have signaled they plan to start publishing data stolen from victims who refuse to pay up. To make matters worse, one ransomware gang has now created a public Web site identifying recent victim companies that have…
677
678
Distribution packages considered insecure
If you ever have run a Linux-based operating system you are probably aware of the way that software is usually distributed on them: Using a software repository. Repositories are great for numerous …
679
One way to fix your rubbish password database
Suppose for a moment that you are running a web site that has a poorly implemented password database that stores password hashes using some...
680
Systemd's DynamicUser feature is currently dangerous
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
681
My Letter to the Tor Project
N ow I a fourfold vision see A nd a fourfold vision is given to me T is fourfold in my supreme delight A nd three fold in soft Beulahs night A nd twofold Always. May God us keep F rom Single vision & Newtons sleep. — W illiam B lake
682
Arbitrary code execution via ldd utility
The `ldd` utility is more vulnerable than you think. It's frequently used by programmers and system administrators to determine the dynamic library dependencies of executables. Sounds pretty innocent, right? Wrong! In this article I am going to show you how to create an executable that runs arbitrary code if it's...
683
684
