brumbelow

Bug bounty and security research keeps me a good bit above 500 per month...

I experienced an initial influx of positive results and rewards as I ramped up AI use initially. However, as time goes on, I expect that to trickle out at some point since everyone and their mother now has something that can hunt and find better bugs than me. so I will have to either find a better niche or do something else with my time, but for now - that is my only side project.

I quite enjoy it so I have been brainstorming ways to stay involved and contribute without getting behind the times. Any ideas are welcome. Lol.

They must have left out the punchline

"anti-ai"

> https://github.com/DilawarShafiq/nietzschian-debugger#setup

Step one to setup: "Set your Anthropic API key"...

Yes. All the link made me realize is that I should checkout Deepseek 4.1 flash

Peak efficiency

I have lots of questions but am sure you will not answer them.

> On the other side, I was looking myself for such a mechanism ever since we wrote the paper in 2019 and admire the efficiency of this construction.

He seems to admit very clearly he does not see this as his own work. 'I was looking...' well why did he stop? Because the AI figured it out first.

It seems quite odd to me to 'admire the construction' of something, only for your opinion to sour once that something figures it out first.

I think a lot of the emotional reaction here is familiar to us non mathematicians: you spent years developing expertise, and then LLMs began producing competent work in areas that had previously required that expertise. That's understandably uncomfortable, but discomfort by itself isn't evidence of misappropriation.

The traditional approach to industrial espionage involved spies. SaaS has really improved the developer experience.

You're right to pushback. This isn't just a grammatical problem -- its a conversational one, too.

You have unintentionally created my next start-up idea.

Bio inference.

Let your Agents feel what you feel!

Fable 5 is mid refactor on one of my projects, no api error for me. Sorry for using up all the compute folks

and now the recent Meta model 'security issue' begins to make sense

Just in: AI is good at exactly what it was designed for. Predicting the next token and generating human like speech/interactions.

Is the leak in the room with us right now?

Water is wet

I am not sure what you set out to prove or think you have proven... but the article doesn't give me an indication on either one of those things.

If anything, you have certainly proven that there are still people confident enough to write a blog about something they don't understand. Thanks for that

Yeah I would say that the 'some point' is frontier quantum research. Which makes it even more confusing as to how something like this is not caught.

pyinc is, to my knowledge, the first pure-Python, stdlib-only implementation of a Salsa/Skyframe-style incremental query kernel with a documented from-scratch consistency contract. Prior Python incremental-computation work either targets narrow domains (TA indicators, ML experiment tracking) or depends on a platform (think Palantir Foundry); pyinc is a general-purpose kernel you can vendor into any project. v1.0.1 is now available on pypi!

I read the research paper from a link on HN and loved it so much I had to use it. Hopefully folks find as interesting as I do!

Exactly. I appreciate the considerations they have already taken, this is definitely a problem that needs to be addressed as agentic AI continues its warpath.

However, this feels to me like widening the attack surface rather than tightening security. I'm going to dig in to this over the next few weeks. Hopefully I prove myself wrong

Awesome! Now even my bitwarden keys can get stolen through prompt injection. What a time to be alive

I am definitely not an AI. I would probably be flattered if I wasn't so offended

His paste literally says...

" # to scan from the local docker daemon"

That aside, I just tested against trufflehog myself. It did take about 10-15%longer for a scan to complete but this is expected. Layerleak is scanning any additional or deleted tags found for the digest while trufflehog only scans the one. I am proud of the project, so I am showing it off. If you dont like, dont use :)

Thanks for checking it out.

That's true, but as you can see from your paste, Trufflehog requires the docker daemon and is generally pretty resource intensive while scanning.

layerleak has neither of those issues or requirements.

Try it and let me know what you think.

Thanks for the advice! Did not even consider that. I just updated it

I couldn't find anything comparable to Trufflehog for Docker images, even though I have constantly read articles about "secrets discovered in public images." So I built my own (hopefully) comparable tool.