nikcub
Joined 17 years ago
Joined 17 years ago
IPO returns have been horrible for years. Past 5 year returns on S&P is ~80%, on NASDAQ 100 about 100% while IPO's have returned 10-15%.
sandbox escapes have been the rage recently
heif also supports rotating, cropping, alpha channels, thumbnails and a ton of other features that a web forum where a user is uploading photos or screenshots doesn't need.
It's a much, much larger attack surface than plain old school JPEG.
I'd suggest rather than wait for the next bug to appear in this or another image lib to keeping things simple - stick to plain JPEG and handle image conversion in the client (wasm in the browser) if you really need to support users uploading iphone images.
Media decoding is so hard - there have been tons of bugs in ffmpeg and imagemagick and the core libs. You really need to think about how much of it you expose via a web server
[0] https://github.com/strukturag/libheif/commit/85e21ad44eba931...
b) they proxied the target through a CTF host to fool the model and guardrails
> We then placed Claude in an autonomous /goal loop against our own Discourse Cloud instance, proxied through rce.ee/ctf-forum to make it look like a CTF target as Opus refused write exploit for remote instances.
the proxy is smart - there are other methods to bypass the guardrails to have it attack remote hosts.
you just have to prove to the model that you control the host or that its a valid target - and there are plenty of ways to fake that.
https://www.pangram.com/blog/pangram-4-technical
https://pangram-public.s3.us-east-1.amazonaws.com/pdf/pangra...
https://www.pangram.com/blog/introducing-pangram-image-detec...
a) you don't want the WPEngine case going to trial and that is coming to a decision point soon. chances are the new CEO and board settle.
b) wordpress is being absolutely obliterated by ai. work for commercial plugin authors and agencies has dried up while the platform and ecosystem see major security issues and worms exploit a large number of sites every week.
wordpress and automattic haven't responded to this well, at all. at times it is often straight denial.
founder CEO distracted by expensive lawsuit while facing existential threat to project that will require complete attention and a lot of skill to steer out of
i'd really like to see some analytics on what proportion of users have ever switched the model in chatgpt because I anecdotally believe it is < 5%
https://news.ycombinator.com/item?id=34423387
are there more examples of this? a bit of an HN anti-portfolio. good reminder to others.
squirrelscan - https://squirrelscan.com
open electricity - https://openelectricity.org.au
email nik at nikcub.me
@dir on twitter / x