jfkimmes
Joined 4 years ago
Karma
329
Submissions
42
Member since
Jan 20
Recent submissions
Comment · 6 months ago
Codex is open source and allows any model to be configured.
Comment · 6 months ago
They hint at their AI-augmented reversing methodology, which demonstrates one of the core strengths of current LLM agents. These models, trained extensively on code, can immensely speed up the process of understanding complex system internals.
Security research historically has two difficult components that build on one another: 1. Understanding complex system internals: uncovering the inner workings hidden by abstractions or interfaces 2. Finding vulnerabilities in these uncovered mechanisms
Sometimes both steps are equally hard. But often, finding the vulnerability is trivial once the real mechanisms are uncovered, rather than relying on assumptions about inner workings.
CVE-2026-3854 is a case where the vulnerability is not plainly obvious after understanding the internals. Still, I am confident that this command injection would have been found quickly had it been exposed to a more traditional or accessible attack surface.
Comment · 6 months ago
Do you have a source for that?
Neither the release post, nor the model card seems to indicate anything like this?
Comment · 6 months ago
Everyone talked about the marketing stunt that was Anthropic's gated Mythos model with an 83% result on CyberGym. OpenAI just dropped GPT 5.5, which scores 82% and is open for anybody to use.
I recommend anybody in offensive/defensive cybersecurity to experiment with this. This is the real data point we needed - without the hype!
Never thought I'd say this but OpenAI is the 'open' option again.
Comment · 7 months ago
Not the same league as McKinsey, but I like to point to this presentation to show the effects of a (vibe coded) prompt injection vulnerability:
https://media.ccc.de/v/39c3-skynet-starter-kit-from-embodied...
> [...] we also exploit the embodied AI agent in the robots, performing prompt injection and achieve root-level remote code execution.
Comment · 8 months ago
Here's a little more context about the author's motivation:
https://mathstodon.xyz/@csk/116162797629337132
Comment · 8 months ago
Funny, I was just configuring ghostty. I finally made the jump in order to get rid of tmux as a layer of indirection.
Here's what I landed on: This config tries to emulate as much of tmux with native ghostty features (splits and tabs).
https://codeberg.org/jfkimmes/dotfiles/src/branch/master/gho...
Comment · 1 year ago
This is a Google Play Services update. For GrapheneOS users without GApps wondering: A similar feature is already built-in:
https://grapheneos.org/features#auto-reboot
Comment · 1 year ago
And here I was, thinking I was clever for coming up with the agent smith image for an agent framework.
Comment · 3 years ago
See https://masto.ai/@vagina_museum/110938928634133136 for a little background history.
Comment · 3 years ago
Comment · 3 years ago
There's now also https://github.com/vector-im/element-call.
They have SFU support as of recently, so it should scale similarly to Jitsi et al.
Comment · 3 years ago
Fully agree. But instead of having "the government have full control over people's money", I think, setting this up as a federated cheap-to-run payment system would be even better. This would allow multiple existing banks to offer the service to their existing customers. This could reduce the risk of a fully decentralized solution a little bit.
Comment · 3 years ago
It's private for the user. Transactions are only between you and the merchant. Credit card networks, PayPal, etc are all third parties with insight into all Payments going through them globally.
It's offline. Neither you nor the merchant have to have a connection to the bank for the transaction to happen.