jeffmcjunkin
Joined 14 years ago
Karma
1,289
Submissions
85
Member since
Jan 2
Information security professional living in Southern Oregon. Forensics, incident response, and networking interest me most.
View on Hacker NewsRecent submissions
Comment · 1 month ago
I'd read the heck out of that blogpost. You have my interest.
Comment · 2 months ago
Often people are counting all tokens, including cached input tokens, for those more impressive "billions of tokens" quotes.
Comment · 2 months ago
Artificial Analysis page is up: https://artificialanalysis.ai/models/deepseek-v4-pro
Comment · 4 months ago
Comment · 6 months ago
Can confirm. Matching decompilation in particular (where you match the compiler along with your guess at source, compile, then compare assembly, repeating if it doesn't match) is very token-intensive, but it's now very viable: https://news.ycombinator.com/item?id=46080498
Of course LLMs see a lot more source-assembly pairs than even skilled reverse engineers, so this makes sense. Any area where you can get unlimited training data is one we expect to see top-tier performance from LLMs.
(also, hi Thomas!)
Comment · 6 months ago
Can confirm.
Comment · 1 year ago
I absolutely agree that Microsoft could do better, but they are making progress in removing support entirely for broken (from a security perspective) older protocols such as NTLMv1 (which uses DES as well: more here -- https://bit.ly/crackingntlmv1) and SMB1.
The financial incentives drive Microsoft to support every possible (mis)configuration, forever. It's the tireless work of a few folk at Microsoft like Ned Pyle, Steve Syfus, and Mark Morowczynski that have landed the changes so far.
There could absolutely be a "security check" tool deployed by default with Server 2025 or similar that looks for Kerberoastable user accounts (any account with a ServicePrincipalName is technically Kerberoastable, like computer accounts), AS-REP roastable accounts, weak encryption types, etc. That would probably get more traction than changing defaults out of the box for everyone, as that's another way to phrase "breaking customer environments when they upgrade".
Comment · 1 year ago
The RC4 encryption type correlates to the DES hash (more commonly the "NT" hash), so PingCastle has the right warning.
Comment · 1 year ago
KeySavvy is the normal workaround for this. $99 extra cost to both sides for them to handle the title verification and shipping, and to act as the dealer to make it qualify for EV credits.
Comment · 1 year ago
Thank you, this was affecting me too.
Comment · 1 year ago
From https://personal.math.ubc.ca/~CLP/about/ :
> For various reasons we have christened these notes “CLP” - none of those reasons can be found [here](https://en.m.wikipedia.org/wiki/CLP)
Presumably it's an inside joke or something.
Comment · 2 years ago
Recently, yes :)
https://www.cnn.com/2023/08/06/us/oregon-drivers-pump-own-fu...
Comment · 2 years ago
We don't advance as a society unless people ask new questions. Having folk willing to spend some time answering those questions (in public, no less!) helps others. It's really, really damn hard to predict how advancements in one area can help another.
All that said, thanks for your interesting new question, and thanks for spending time on it :D