jerrythegerbil

There was an interesting bit of research that qwen has a single neuron that makes it “demonic evil qwen” and a simple “Who are you?” will get some absolutely terrifyingly vile results.

Anyways, what I’m trying to say is I want evil qwen to be my CPU.

> The only problem is that (as of now) exploiting PHP requires some knowledge about the server configuration, and we don't have that here.

Exactly. This server is exploitable, but not with an off-the-shelf PHP2Shell PoC someone found on GitHub. The PHP2Shell exploit would need adjustment to the specific application configuration, and to that end, you’ve come to the same conclusion I was implying.

The easiest way is to use PHP2Shell _with_ another unknown vulnerability in the stack, such as nginx etc…

The challenge is trivial to those who know better than to even try. You cannot succeed at it without giving away far more than you could ever possibly hope to gain.

Of course, there’s always the wildcard of someone throwing away the nginx 0-day just to be funny.

This will go unclaimed for a bit. It may still get claimed within the day, but

People do have the exploit. The risked opportunity cost of this being a honeypot (and handing over a functional exploit) vs just… not participating and hacking higher value targets (offensive actors) or not circulating any additional details (defensive actors who have privileged intelligence about the vulns) I just…

The value proposition here is so hilariously low for what is required to demonstrate stealing the bitcoin at all.

That doesn’t mean that people won’t try, and perhaps even succeed! But to what end? Demonstrating terrible math skills and a fundamental misunderstanding of the economics at play?

I, and many of my friends and cooks could take this easily. The difference is we know not to.

Make it $15-25k and it’ll get yoinked instantly, most likely without using PHP2Shell at all.

Exports remain flowing. Imports remain problematic, for certain localities.

It’s going, just not where it was before.

Hetzner servers aren’t billed against transfer quotas to storage box, and get a direct, faster link.

It sounds like you’re connecting through the public interface, for which many ISPs in the US rate limit the Hetzner storage boxes. In my case, around 3mbps.

Using a VPN from your home (unintuitively) increases your throughput, alternatively use concurrent webdav (HTTPS, typically not rate limited) without VPN.

Said plainly, the symptom you’re seeing is the same reason I could likely guess your ISP, and has nothing to do with Hetzner.

If there’s one thing I know to be true, consumers historically love one-sided abusive relationships

As someone who uses NCD nearly every day, I have concerns about how it’s been used here.

But while we’re “guessing”: Xiaomi MiMO

The LLMs play a part, but it’s the tempo; the pace.

Fully autonomous w/LLM isn’t true. Leadership wants it true. The technological capabilities and acceptance of scapegoating a machine got rejected by society, so that leaves perfectly capable individuals as the gatekeepers of decision making, completely overloaded by the amount of information they need to deal with.

If you as a human can’t keep up, but the onslaught continues, and you’ll be held responsible for the outcome regardless… yeah. People will punch their ticket out. It’s not unique to LLMs, but LLMs have certainly automated the process of reaching the worst possible conclusion.

Don’t for a second try to hold the computers accountable or blame them for this outcome. This is a leadership issue and always will be. Believing otherwise is just allowing suicides to be scapegoated as a computer’s doing.

An ssh server would exploit a vulnerability in the ssh client when it connects.

For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh.

To sum it up: Connecting to this server is probably fine, but in doing so most people are doing something significantly riskier without realizing it.

This AI generated article about closed-weights model providers collaborating for additional scrutiny of open weights models, where the article itself has the tell-tale structure of being written by Claude Opus, which is aware it is a closed-weight model.

Thank goodness no one is taking any of this seriously, because it could never be anything more than a machine generated hatchet job.

A faster and better educated understanding of the subject matter could be achieved by standing in front of a wood chipper and dropping a brick in it to see what happens. “Yes, there were results! But why? Why to literally every variable involved?”

“However, large-scale, covert industrial distillation aimed at stealing proprietary U.S. technology and undermining American research is unacceptable.”

What’s actually happening behind the scenes is that certain inference providers will classify a prompt and it’s re-routed transparently to Anthropic and that’s used for distillation training, only distilling the complicated traces they need, originating from real user prompts and traces. These inference providers are explicitly blocked in the claude cli if you reverse engineer it.

The real picture is that these Chinese labs have figured out how to get exactly what they need, at a high quality, directly from distinct and unique real user prompts.

It’s only “covert” because Anthropic doesn’t like it, while simultaneously being perfectly fine to do.

A datacenter was built a couple hundred feet from my apartment complex around 2013-2014. Absolutely none of your comment would have even remotely held true at the time, and my family moved away as a direct result.

Assuming positive intent, what’s different nowadays that makes it all different? It would actually make me pretty happy to hear about the incredible leaps and bounds that’ve been taken.