jinseokim

I just feel a bit sad and impotent that a number of security researchers outside the circle cannot join their "yo we found more crazy bugs" party because simply frontier labs only give access to those models with "Red Team" availability to the inner circle members/companies.

Now their "trusted cyber access" program is moat rather than safeguard.

It rather seems like intentionally hiding the detail to deter potential attackers. Not very good strategy in AI era though.

Some softwares: Yes. People with Mac are advised/forced to use Windows. For instance, Uwayapply, a college admission application service, doesn't support macOS.

Or: they provide .pkg file to install similar program.

Most of them want sudo. They use root permission for various purpose, but the most impressive one for me was registering their CA certificate on Firefox root store, to support WebSocket over TLS to localhost on Firefox.

Well... SSL was unsafe then.

The problem came from U.S. cryptography export regulation which makes exportable cryptographic algorithm feasible to crack. Bundled Internet Explorer didn't support good algorithms on SSL.

So, South Korea government wanted to add another security layer. They wanted to state "good to go" algorithm (just like FIPS did), so they built and recommended the encryption algorithm, SEED. And it required ActiveX, because 128 bits cryptography on JavaScript was infeasible then.

The real problem of South Korea is, the slowness of deprecation.

They deprecated ActiveX (and created NPAPI or WebSocket on localhost) in 2014. After Microsoft deprecated Windows XP, they established "Windows XP Task Forse" to respond security issues with Windows XP computers on government agencies. Yeah, this was fairly late, considering MS declared the Windows XP deprecation schedule in 2007.

IE/ActiveX/Java Applet/etc algorithms aren't still completely deprecated in Korea. NEIS, a giantic service used by every K-12 school to record and manage education-related information, still uses the technology based on Internet Explorer by using IE compatibility mode of MS Edge. Repeat, EVERY K-12 school teacher and staff uses this service, with IE compatibility mode.

I want South Korea to adapt new technology and deprecate old one more in due course. I mean, they should accept TLS provides decent end-to-end encrpytion, and they should recognize Triple DES is deemed unsafe algorithm.

Disclaimer: I'm Korean.

A LOT of Korean citizens cared and got angry with this issue. So governments, agencies, and. yeah, "security companies", finally decided/declared to deprecate ActiveX-fu softwares and follow Web Standard.

We didn't expect WebSocket on localhost.

A Korean company Tmax sells Tibero, the Oracle-compatible DBMS (proprietary). AFAIK, it's quite so much "compatible" (it even has same typos with Oracle DB), and they're not sued by Oracle.

Where would be the sanest choice if I need some CPU computational resources (say, 10k CPU-hours)? Researchers simply used DigitalOcean (under their generous resource grants), but I believe there would be another better way for computing if I can't get such donation...

I feel like Python 3.10 is large dependency -- almost no one would use it unless required.

Look Russia and see what happens. They are actively monitoring and censoring 140M citizens. Fortunately Russians are using Signal/Telegram[1] to avoid those censorship.

This is not a tradeoff between just privacy and child safety. This is the matter of freedom and democracy.

[1]: I would say Telegram is available option for privacy but Telegram has pretty much possibility to be attacked than Signal...

Happy with Cloudflare Pages but its build takes too long. 2 minutes for "initializing build environment", and <5 seconds for actual build...

Be aware that deleting metadata is never enough: There are too many ways to hide some fingerprints on the PDF document.