shakna

Anecdote only.

A lot of people in my circles recently got fed up with Windows breaking everything. They went from teasing about Linux, to installing it.

... And then the kernel fully embraced genAI.

The same people went, "No thanks." Saw NetBSD's AI stance, and started installing it.

Granted, tech people. But not that deep into things. Most are scared of the command line - but find they don't need it.

If I can exfiltrate your email with something that responds in that way, what other information can I pull from your system, without your intervention?

If I made it send something, I probably made it make a tool call. What other tools can I make it call?

I'm afraid this isn't a shrug - it's a zero-click vulnerability. It might be the start of a chain to RCE. It doesn't have to work every time, either. Just enough of the time.

Should an agent not ask for confirmation, before leaking their patron's contact information to any random third party who asks for it?

If not... That sounds like primetime for prompt injection.

And AU. Dick Smith started out selling Tandy's, before switching to their own clones.

Always good to see progress towards people getting to own their own hardware.

> MIT for all original code. The kernel excerpt (kernel/mem.c) retains its GPL-2.0 license and copyright notices.

One small tweak needed here.

GPL 2.0? Has this bit:

> You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License.

"under the terms of [this License]."

It is viral. Copying the code, and distributing it, as done here, means that GPL 2.0 is meant to apply to everything. The only carveout, is if your code didn't depend on the kernel excerpt at all. But... It does.

> If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission.

Is your Brotli library built from older than the February commit? (The last tagged release is before then.)

If so, might be vulnerable.

Don't have Brotli enabled? Not vulnerable to this.

You have an automated pipeline, that includes decompilation. I highly doubt the courts will see the nuance that you apparently do.

The pipeline begins with decompilation. Maybe it doesn't save all that information, but it is part of the pipeline, and so, will be part of the consideration when discovery happens.

How could they have trained on books that they didn't buy or source from libraries?

I'm afraid, the companies in question, have been more than happy to ingest pirated material.

... A clean room, means that you aren't reverse engineering. You're producing the same result, with zero awareness of the process, or it isn't a clean room.

LLMs are created through mass ingestion of data, and so, by definition, cannot be a clean room. They are trained on the things that they're tasked with copying.

"but they're nowhere performant enough in practice or memory efficient compared to Rust."

I would not include Ada, if you're benchmarking against Rust. Mostly because Ada either outperforms it (because it can reduce sizes in the optimiser), or it is equal to it.

This is why Australian law includes the term "reasonable". So that if it seems like a burden, the court acts.

I'm afraid I'll believe that will happen, when I believe tech debt doesn't exist. That utopia does not seem on the horizon.

Not a non sequitur - No one should be taken at their word. Not them, not me, and not you. This is the security world. Nobody is trusted altogether.

Breaching an embargo, makes reverse engineering easier. We don't need to analyse motives or pontificate. Disrupting the supply chain... Disrupts the supply chain.