Septimaeus

joined 2 years ago
[–] Septimaeus@infosec.pub 19 points 1 week ago* (last edited 1 week ago) (1 children)

It’s a user-friendly wrapper for existing fake quantum. It’s not a “physics shortcut” and it doesn’t “tackle quantum problems.”

Also no quantum problems have ever been “reserved for AI.” Some quantum solutions borrow optimization techniques from machine learning, but classical machine learning algorithms aren’t designed to leverage (or even consider) quantum effects.

I’m putting this out there because there’s a tendency to lump together all the buzzwords, like AI and quantum, into one big category of powerful-technologies-I-don’t-understand that results in hyperbolic projections and magical thinking that thwarts progress.

[–] Septimaeus@infosec.pub 7 points 1 week ago* (last edited 1 week ago)

Edit: I wasn’t actually disagreeing with the comment above. You should downvote me too.

Board of directors

Correct. The board defines the company, not the CEO.

CEOs are usually puppets. Whatever role they play, you can bet they were hired specifically to play it, and were incentivized to stick to the script.

Their job (legally, their fiduciary obligation) is to maximize shareholder value, to take the credit or blame, and fuck off.

The board (typically key stakeholders) are so pleased when the public focuses on their CEOs, even if it’s for their shitty opinions, behavior, or obnoxious salaries.

Because the worst thing that could happen to them would be for the public eye to actually follow the money, and it’s easy to see why.

If the rabble truly fathomed just how many of those “golden parachutes” stakeholders stockpile with every disgraced CEO, however ceremoniously disavowed…

Accountability would shift to more permanent targets yes but, more importantly, it would quickly become common knowledge that, all this time, there were in fact more than enough golden parachutes to go around.

[–] Septimaeus@infosec.pub 2 points 3 weeks ago

New York or Disney World

Got me

[–] Septimaeus@infosec.pub 6 points 3 weeks ago* (last edited 3 weeks ago) (1 children)

For example the tools for the really tedious stuff, like large codebase refactoring for style keeping, naming convention adherence, all kinds of code smells, whatever. Lots of those tools have gotten ML upgrades and are a lot smarter and more powerful than what I remember from a decade ago (intellisense, jetbrains helper functions, various opinionated linter toolchains, and so forth).

While I’ve only experimented a little with some the more explicitly generative LLM-based coding assistant plugins, I’ve been impressed (and a little spooked) at how good they often were at guessing what I’m doing way before I finished doing it.

I haven’t used the prompt-based LLMs at all, because I’m just not used to it, but I’ve watched nearby devs use them for stuff like manipulating a bunch of files in a repeated pattern, breaking up a spaghetti method into reusable functions, or giving a descriptive overview of some gnarly undocumented legacy code. They seem pretty damn useful.

I’ll integrate the prompt-based tools once I can host them locally.

[–] Septimaeus@infosec.pub 34 points 3 weeks ago* (last edited 3 weeks ago) (5 children)

I’ll admit, some tools and automation are hugely improved with new ML smarts, but nothing feels dumber than hunting for problems to fit the boss’s pet solution.

[–] Septimaeus@infosec.pub 21 points 3 weeks ago

It seems like the US patent system today is rarely anything but a solution to its own problem. In most cases a patent is little more than an expensive troll ward or a way to demonstrate due diligence to investors. What’s taken its place is time to market. If that’s true, the patent system should either be replaced with something that serves its intended purpose or that office should stop accepting applications.

[–] Septimaeus@infosec.pub 2 points 3 weeks ago

Haha, I see where you’re coming from. It’s a fairly old and ongoing debate: the importance of classical humanities in the curricula of primary and secondary education. To illustrate, at one point children were not only taught literature from the Greco-Roman period, but also the languages they were written in.

In fact, that’s one of the key reasons for all the institutional Greek and Latin usage you see in higher ed. That was the tradition. These were languages only the educated knew. The effects of that on society were mixed, in my opinion. Fast-forwarding to today, the recent trend has been to prioritize knowledge more relevant to the modern era, including STEM subjects and practical trade-related skills.

That’s the reason for the lingering notion, among older generations especially, that classical works are foundational knowledge, a common intellectual inheritance that everyone should know. While I’m more used to thinking this way, and can probably make some convincing arguments for it, I recognize that in many ways and for many individuals, it fails the test of relevance. So maybe it really is for the best that it’s only taught in the optional extension of higher ed.

Yes, zero expectation from me to read that book, but if you ever become curious, mythologies are often short, fun, and memorable stories to read. And once familiar with them, you’ll see references to them basically everywhere, including the names of blockbuster films and spaceships, like the Apollo.

[–] Septimaeus@infosec.pub 2 points 3 weeks ago* (last edited 3 weeks ago) (2 children)

You’re good. I upvoted. People downvoting are leery of anti-intellectualism (and not without good reason).

But I don’t see that in your comment. You simply didn’t know something, and you didn’t get mad when corrected. You acknowledged you just didn’t know yet.

In addition, your guess that the majority who recognize the name associate it with something from pop culture rather than classical mythology is likely accurate. Those who were taught this in school, or who had the resources at hand to teach themselves — public libraries, internet access, free time, etc — often forget that in most of the world knowledge remains a privilege, whereas the right to pay for entertainment is nearly always guaranteed.

If you’d like to read some of these stories, along with commentary about them, I would recommend A Guide to Mythology by Helen Clark, which is public domain and thus free. You can listen to it for free as well.

Edit: add links and additional resources

[–] Septimaeus@infosec.pub 1 points 1 month ago

Yeah I have a few of those for the most secure stuff. Hard to beat! The USB-C one is the newest and I debated the choice but damn these days it’s great how it works with everything.

[–] Septimaeus@infosec.pub 3 points 1 month ago

If we cut and run every time a big corporation “embraces” a new standard, just to lessen the pain of the day it’s inevitably “extinguished,“ we’d miss out on quite a lot.

This standard was open from the start. It was ours. Big corps sprinted ahead with commercial development, as they do, but just because they’re first to implement doesn’t mean we throw in the towel.

Also:

  1. Bio auth isn’t necessary. It’s just how Google/Apple do things on their phones. It’s not part of the FIDO2 standard.
  2. It works with arbitrary password managers including FLOSS and lots of hardware options.
  3. Passkeys can sync to arbitrary devices, browsers, device bound sessions, whatever.
[–] Septimaeus@infosec.pub 2 points 1 month ago (4 children)

Yeah the moods in this thread, like

“[I don’t understand this]!”

“[I don’t trust this]!”

“[It doesn’t fix everything]!”

“[This doesn’t benefit me]!”

“[What’s wrong with old way]!?”

And like, all valid feelings… just the reactions are a bit… intense? Especially considering it’s a beta stage auth option that amounts to a fancy version of the old sec key industry standard, not the mark of the beast.

[–] Septimaeus@infosec.pub 2 points 1 month ago* (last edited 1 month ago)

Yeah the counter-interoperability of proprietary expansions on FIDO standards sounds a lot like embrace extend extinguish to me. I know engineering standards generally require field revisions but these big corps have a track record of this behavior.

I can see how the FIDO standard’s dID requirement might be an issue at the org level, but even in the case of a fully custom/unknown rooted device they have provisions for using traditional security keys attached to one or more associated devices via USB/BT/NFC. Megacorp platforms might be first to facilitate adoption but the spec absolutely accommodates open provider integration.

I need to experiment with personal security passkey registration and authentication workflows to know how difficult it actually is in practice, but it looks like the equivalent of self-signed certificates are possible anywhere the user controls the stack like self-hosted intranetwork suites that are popular around here.

Thanks again for the write up!

view more: next ›