• 0 Posts
  • 23 Comments
Joined 1 year ago
cake
Cake day: July 1st, 2023

help-circle

  • Most large corporations’ tech leaders don’t actually have any idea how tech works. They are being told that if they don’t have an AI plan their company will be obsoleted by their competitors that do; often by AI “experts” that also don’t have the slightest understanding of how LLMs actually work. And without that understanding companies are rushing to use AI to solve problems that AI can’t solve.

    AI is not smart, it’s not magic, it can’t “think”, it can’t “reason” (despite what Open AI marketing claims) it’s just math that measures how well something fits the pattern of the examples it was trained on. Generative AIs like ChatGPT work by simply considering every possible word that could come next and ranking them by which one best matches the pattern.

    If the input doesn’t resemble a pattern it was trained on, the best ranked response might be complete nonsense. ChatGPT was trained on enough examples that for anything you ask it there was probably something similar in its training dataset so it seems smarter than it is, but at the end of the day, it’s still just pattern matching.

    If a company’s AI strategy is based on the assumption that AI can do what its marketing claims. We’re going to keep seeing these kinds of humorous failures.

    AI (for now at least) can’t replace a human in any role that requires any degree of cognitive thinking skills… Of course we might be surprised at how few jobs actually require cognitive thinking skills. Given the current AI hypewagon, apparently CTO is one of those jobs that doesn’t require cognitive thinking skills.



  • You wouldn’t be able to MITM a plaintext connection inside a corporate network with this attack by itself. You could only MITM something that the attacker can access without your VPN.

    Any corporate network that has an unsecure, publicly accessible endpoint that prompts for credentials is begging to be hacked with or without this attack.

    Now you could spoof an login screen with this attack if you had detailed info on the corporate network you’re targeting. But it would need to be a login page that doesn’t use HTTPS (any corporations, dumb enough to do that this day and age are begging to be hacked), or you’d need the user to ignore the browser warning about it not being secure, which that is possible.


  • I can’t see routing traffic to some kind of local presence and then routing back to the target machine to route out through the tunnel adapter without a successful compromise of at least one other vulnerability.

    That’s not to say there’s nothing you could do… I could see some kind of social engineering attack maybe… leaked traffic redirects to a local web server that presents a fake authentication screen that phishes credentials , or something like that. I could only see that working in a very targeted situation… would have to be something more than just a some rouge public wi-fi. They’d have to have some prior knowledge of the private network the target was connecting to.



  • Not all VPN traffic. Only traffic that would be routable without a VPN.

    This works by tricking the computer into routing traffic to the attacker’s gateway instead of the VPN’s gateway. It doesn’t give the attacker access to the VPN gateway.

    So traffic intended for a private network that is only accessible via VPN (like if you were connecting to a corporate network for example) wouldn’t be compromised. You simply wouldn’t be able to connect through the attacker’s gateway to the private network, and there wouldn’t be traffic to intercept.

    This attack doesn’t break TLS encryption either. Anything you access over https (which is the vast majority of the internet these days) would still be just as encrypted as if you weren’t using a VPN.

    For most people, in most scenarios, this amount to a small invasion of privacy. Our hypothetical malicious coffee shop could tell the ip addresses of websites you’re visiting, but probably not what you’re doing on those websites, unless it was an insecure website to begin with. Which is the case with or with VPN.

    For some people or some situations that is a MASSIVE concern. People who use VPNs to hide what they’re doing from state level actors come to mind.

    But for the average person who’s just using a VPN because they’re privacy conscious, or because they’re location spoofing. This is not going to represent a significant risk.


  • So for this attack to work, the attacker needs to be able to run a malicious DHCP server on the target machine’s network.

    Meaning they need to have already compromised your local network either physically in person or by compromising a device on that network. If you’ve gotten that far you can already do a lot of damage without this attack.

    For the average person this is yet another non-issue. But if you regularly use a VPN over untrusted networks like a hotel or coffee shop wifi then, in theory, an attacker could get your traffic to route outside the VPN tunnel.


  • I think I have you slightly beat… mine was an Apple II+, circa late 1981, with a disk drive, and a monochrome green screen monitor.

    First cell phone was around 1997. Though I honestly don’t remember what it was. I recall having a Nokia model from before they made that indestructible model in all the memes, as well as a Kyocera one that I could connect to a laptop and have wireless dial up internet at some abysmal speed like 20 kbps. (0.02 mbps). I had at least two more phones, including a Treo 650 “smartphone” before getting my first iPhone, a 3G. I’m on my sixth iPhone now.



  • Trucks and SUVs are getting heavier to skirt emissions controls.

    In 2010 the Obama administration passed laws tightening emissions control requirements for new vehicles. But the laws were written to allow emissions as a factor of vehicle size, larger vehicles were allowed to have more emissions.

    Unfortunately, the plan backfired. Instead of reducing emissions, vehicle manufacturers just started making vehicles bigger.

    It isn’t primarily the fragile egos that are driving sales of these vehicular monstrosities. It’s corporate profits and greed. Manufacturers aren’t making smaller models because they don’t make as much money on them, not because there isn’t a market for them.


  • AI is a genie that can’t be put back into its bottle.

    Now that it exists you can make it go away with laws. If you tried, at best all you’d do is push it to sketchy servers hosted outside of the jurisdiction of whatever laws you passed.

    AI is making it easier than it was before to (ab)use someone by creating a nude (or worse) with their face. That is a genuine problem, it existed before AI, and it’s getting worse.

    I’m not saying you have like it, but if you think laws will make that unavailable you’re dreaming.


  • I question the methodology here. The same site lists Linux desktop share at 2% in my country specifically. It feels like if it was that high you’d see it on people’s laptops more in coffee shops and what not… but I’ve yet to see a single other person using Linux on the desktop.

    I know most of that 4% is in India… but still feels like it should be more ubiquitous if the number is that high.


  • The economic drivers of Bitcoin mining make it so that the cost of the electricity needed to mine a Bitcoin will always be just a bit less than the value of a Bitcoin.

    Every time speculators hype up the value of Bitcoin the amount of money wasted on electricity increases.

    Bitcoins are mined at a preset rate of 6.25 bitcoins every 10 minutes. Which does at least get cut in half every few years. But this waste of energy is going to continue so long as there’s a market for Bitcoin.



  • The economics of Bitcoin mining are a bit weird in that it impossible to make it more energy efficient.

    The system auto adjusts the computational complexity of mining bitcoin so that it always costs a little less than one bitcoin to mine a bitcoin, and at scale the only variable expense is electricity so as the price of bitcoin goes up, so does the amount of money that must be spent on electricity.

    Current 6.25 Bitcoin are mined every 10 minutes. So globally about $2 million must be spent on electricity every hour.

    In a little over 2 months the block reward cuts in half to only 3.125 bitcoin every 10 minutes. That will have the side effect of reducing the money spent on electricity for mining bitcoin so long as the price of bitcoin remains the same.



  • I’m not intending to defend Musk or Tesla here, but this study is literally just insurance incidents by brand and makes no distinction between Teslas on autopilot and under human control.

    Teslas tend to attract a certain kind of driver that likes their performance characteristics who are not typically known for being the safest drivers.

    There’s no doubt that a lot of Tesla drivers abuse the autopilot capabilities, and the Elon Musk hype machine is at least partially to blame for that, probably more.

    But this isn’t evidence one way or the other about the safety of Tesla’s FSD.


  • I will absolutely give you that transitioning an established mature product to the subscription model is usually a terrible idea. Plenty of examples of that going horribly wrong.

    As for subscriptions being a “blatant money grab” that definitely happens sometimes… notably when there’s a mature product with a dominating market share. The company already captured most of the market share, so they can’t get much more revenue from new customers, existing customers are satisfied with the version they have so they’re not buying any updates. Sales go down and someone comes along say just make it a subscription and keep milking the cash cow forever…. Yep, I admit it, that totally happens. The enshitification ensues.

    But none of that’s the fault of the subscription model per se.

    The same subscription model that becomes the incumbent’s downfall, is what creates a market opportunity for a new competitor.

    A new competitor can coming in with a new product that was built with a subscription model from the start. The competitors product is cheap to try for a month, cheap to switch to with no big upfront costs. The newcomers can generally react much faster to customers needs than the incumbent. (Not because of the model, they can because they’re smaller)

    Established software companies doing blatant money grabs happen all the time. Hell most of us are here using Lemmy because Spez attempted a blatant money grab on Reddit. Had nothing to do with the model.

    Subscription model gets a lot of hate because greedy companies tried to use it as a blatant money grab exactly as you described. But it doesn’t have to be that way.

    Subscription models make it easier for newcomers entering a space, which is good for consumers. It’s more compatible with agile development methodologies because you don’t need wait until you’ve bundled enough features together to market it as a new version worth upgrading to. It’s in your best interest to ship new features immediately as they’re developed.

    It’s totally fair of you don’t like the model.

    But the model itself isn’t the problem.

    Shitty companies being greedy will always happen.