6thbit

  > the fundraising was already outlined at an investor day last week

  > “This seems to be exactly what they previewed,” said Rob Oliver, senior research analyst at Baird. “So I’m not sure why the market is freaking about it.”

Nothing burger?

Now imagine if they hired from other geographies.

I'm sure in several US-based companies, non-US workers AI spending is already beyond their own cash comp.

This could set us on a path to weights becoming thew new compilation target.

Wow, in a way it's like CRISPR for ML models!

well air gapped

Some people here say they have seen their TVs connecting https://news.ycombinator.com/item?id=25275753

I have seen open wifi reachable from places i've lived on. Spotty and intermittent connection but there. Apartment buildings with businesses on the 1st floor are also common now, those businesses may have open wifi, etc.

- neighbor's open wifi - open hotspot - public city wifi close by

Sarcasm?

You’re saying they just deployed an open model so no security concerns for this at the moment, yes?

It was weird that all their new UI widgets to explain things didn’t apply to the Work tab.

That heat map this month

So their weights are just floating up there?

I suppose it’s beyond hard anyone would hijack their satellite but still. Wonder if they put any physical security on it anyway.

I really hope you’re right!

And even patching the ‘small’ cves will take us for a spin as it already has. Then there can be specific low hanging fruits that chained together make a splash.

Appreciate the incremental write up building up the scope of the poc.

I like the chain of regular old school things used to achieve it like post message, JSONP, iframe, Img tags.

/incidents would do

It feels like we hit an inflection point in the last week or so. Kind of a large tidal wave to crash on the coast, but likely not the tsunami yet. I hope.

If you are running services and don't yet have an easy way to react to these things with swift process defined, I hope you don't like to sleep.

Yeah its unclear. Sounds like they are just now patching it and treating it as an incident which is probably the right thing to do.

It would make sense that they'd be considered high risk borrowers.

But that won't stop them from issuing bonds or more convertible notes as they have and the market may or may not bite.

It does add pressure to their IPO proceedings being as high as possible as their funding mechanism tho. But reduces pressure on them if shares crash a bit after that, still high risk borrowers.

Doubt 98% people care, but for those that want to understand I don't think their main index has a good signal anymore.

Those sound good, but say in this case you had the compromised extension which had its own ssh key to an IP that wasn't yours. I'm not sure how you easily prevent that connection without preventing the ones you need through sandboxing. Maybe a firewall/very specific network filtering in allowlist?

I suppose it's just the best ROI on using a complex attack vector or spending one or more zero days. But other types of targets may wreak havoc for bystanders that become collateral damage, idk trying to get specific private info on a target may expose data on millions, or anything increasing scope as to hide the real target, etc.

How do you sandbox this usecase?

Say you need an agent to do ssh to a set of servers on a regular basis so you kind of allow ssh. Can you configure just a set of IPs it may reach? Do you require some user interaction for ssh approvals?

It lines up and fits so well that it'd scare me more they wouldn't be related than if they were. At least we'd know the vector.

I believe we should treat AA results as just a data point and not the overarching 'authority' they may intend to be.

If we had access to neutral raw benchkmark data in a useful way to compare apples to apples, then we could each define our own 'index' to get the slice of perspective we find useful.

Trying to define or compare 'intelligence' through a single index will always be off.

Top tier all inclusive premium service

It’s true that they have their own attack surface but it’s not necessarily just open to the world.

Not necessarily. defense in depth can help. At least forces an attacker to have to chain exploits, which although not impossible it makes it harder. Having root on a system doesn’t necessarily give you access to things that require touchid/yubikey/presence.

implying the keys were the hacker's ?

that one was over (years?) time, wouldn't call that a heist really

If true I think we're looking at the biggest heist in history.

Current largest was ~1B