-credit to nedroid for strange art

  • 0 Posts
  • 17 Comments
Joined 3 years ago
cake
Cake day: June 10th, 2023

help-circle




  • Why hasn’t there been news of progress in the ‘organ skeleton’ technique where they denude a donor organ of all cells other than its collagen frame, then re-seed it with good stem cells for the same organ tissue from the same person? (I saw an article about doing this with hearts; no idea if all major organs have such a scaffolding which could be used…)

    There were articles a few years ago about this promising technique – it could enable new organs without all of the issues of rejection if it could be perfected.

    Imagine if everyone (not just the rich) could get healthy core organ cells taken in their youth, banked, and then used later if required to re-grow a failing organ.








  • I had a similar experience many, many years ago – before the rules for vuln embargoes were formalized; and I wasn’t even a security researcher. I was just a techie who discovered that the broker’s staff were resetting anyone’s forgotten password to the same temporary word. And like in this article, they had no mechanism to force users to reset the temp password on next login to something unique. I’d asked to have my password reset at some point, having forgotten it, and upon logging in with my user ID accidentally swapping two digits, found myself in someone else’s brokerage account, with substantial funds staring me in the face! And, their email and personal details.

    I disclosed the issue to the broker, but out of paranoia, did it through a throwaway email account, from home, not work (I should’ve used a VPN, but back then I wasn’t as aware of such things). From that throwaway email, I also notified the person whose account I’d accidentally logged into, urging them to check their account and contact the broker to ensure no one else might have gotten into their account.

    A day or so later, I got a call at my work phone from someone at said broker, asking if I had seen any unusual activity on my account, and that they had seen some suspicious activity from our company’s network (remember, the accidental login to the other person’s brokerage account occurred at my work PC)… I suspect they were fishing for info pointing to my being the one who accidentally accessed someone else’s account. I played dumb, as the call did NOT have good vibes; I could sense they were looking for a ‘hacker’ to scapegoat, not calling just to inform people there was a problem.

    Thank heavens I didn’t reveal that I knew anything about the vulnerability… I had just reset my password, nope nothing unusual here, nosirree… but within a day or two their password reset procedure had been changed for the better and emails were sent out stating that a ‘security incident’ had occurred.


    Lesson: Do NOT trust that your security report will be taken as being helpful. Most companies will try to throw you under the bus if they can, to save face.




  • I ‘panic bought’ (OK, not out of panic, but mild concern) a 22TB drive since the price seemed not too astronomical, and the local store had a few left. Just in case.

    Seems the supplies really are drying up. Fuck these AI companies. Doesn’t matter if they actually intended to wage a war on personal computation; their hoarding of the supply chain for years to come really is an assault on our ability to afford local self-hosted computing. I hope the bubble bursts, soon and hard.



  • I feel this – we had a junior dev on our project who started using AI for coding, without management approval BTW (it was a small company and we didn’t yet have a policy specifically for it. Alas.)

    I got the fun task, months later, of going through an entire component that I’m almost certain was ‘vibe coded’ – it “worked” the first time the main APIs were called, but leaked and crashed on subsequent calls. It used double- and even triple-pointers to data structures, which the API vendor’s documentation upon some casual reading indicated could all be declared statically and re-used (this was an embedded system); needless arguments; mallocs and frees everywhere for no good reason (again due to all of the un-needed dynamic storage involving said double/triple pointers to stuff). It was a horrible mess.

    It should have never gotten through code review, but the senior devs were themselves overloaded with work (another, separate problem) …

    I took two days and cleaned it all up, much simpler, no mem leaks, and could actually be, you know, used more than once.

    Fucking mess, and LLMs (don’t call it “AI”) just allow those who are lazy and/or inexperienced to skate through short-term tasks, leaving huge technical debt for those that have to clean up after.

    If you’re doing job interviews, ensure the interviewee is not connected to LLMs in any way and make them do the code themselves. No exceptions. Consider blocking LLMs from your corp network as well and ban locally-installed things like Ollama.