"AI is giving attackers a huge advantage!"

[tomtrottel@mastodontech.de]

@cR0w it's a virus.

[darwinwoodka@mastodon.social]

@Mustardfacial @cR0w @jackryder

That's the general idea, yes.

[futuristicrobert@infosec.exchange]

@cR0w @krypt3ia @Viss in my fantasy world I'm retired living in a cabin somewhere, when one day someone from my past interrupts me while I'm out chopping wood saying "we need you back. Something's happened."

[cr0w@infosec.exchange]

@FuturisticRobert @krypt3ia @Viss ...and I'll look down and whisper 'No.'

[krypt3ia@infosec.exchange]

@cR0w @FuturisticRobert @Viss Exactly

[darwinwoodka@mastodon.social]

@AdamDavis @cR0w

Yeah and we're gonna "retire" as they crash the markets and decide all the social security we've paid is theirs not ours

[viss@mastodon.social]

@cR0w @FuturisticRobert @krypt3ia samesies, except nobody knows where the fuck i am and they never find me, and i spend my days cruising around the forest with a gnarly macro insect camera setup taking pictures of bugs and doing light maintenance on my zero carbon natural gas, water, solar/wind and sodium battery setups

[da_667@infosec.exchange]

@FuturisticRobert @cR0w @krypt3ia @Viss no shit. My hourly rate starts at 400 an hour, minimum of 4 hours.

[cr0w@infosec.exchange]

@Viss @FuturisticRobert @krypt3ia The dream.

[darthnull@infosec.exchange]

@iagox86 @cR0w I used to love writing short blog posts for my company. Nothing earth shattering, but just interesting enough that it kept our name circulating and maybe, just maybe, helped out a few people interested in the same problems.

Then we got bought, and the blog was all shaped by marketing from then on. (same at the company after, as great as it was in other ways). Community engagement became just plain engagement.

Find me another small company of nerds who just want to help out others, and share bits of what they've learned for the community, and I'll be happy.

[futuristicrobert@infosec.exchange]

@Viss @cR0w @krypt3ia

Sodium batteries! Nice!

[cr0w@infosec.exchange]

@darthnull @iagox86 Seems to be the way most of the current orgs that claim community involvement are already heading too.

[krypt3ia@infosec.exchange]

@cR0w @Viss @FuturisticRobert Unfortunately, I suspect all of us will be trying to just survive in some post apocalyptic hellscape.

[futuristicrobert@infosec.exchange]

@krypt3ia @cR0w @Viss

I have a stash of bottle caps....

[cr0w@infosec.exchange]

@krypt3ia @Viss @FuturisticRobert Realistically, that's where I'm at too. But there's too much planning and luck for that so I'm doing what I can and accepting the rest of the risk. Like another Cascadia earthquake.

[iagox86@infosec.exchange]

@cR0w @darthnull Then labs/research makes their own blog, then that ALSO gets filled with AI slop because more quantity = better right?

I'm gonna start embedding one of those "email me for a $100 gift card" into every slop post to prove that nobody reads them

[da_667@infosec.exchange]

@iagox86 @cR0w @darthnull If I had a dollar for every time I was looking up PoC/exploits for a given CVE, and its some slop report from a website that just seems to scrape cve.org and regurgitate it along with very generic remediation recommendations, I probably wouldn't be rich, but like, I could have a fairly nice lunch.

[iagox86@infosec.exchange]

@da_667 @cR0w @darthnull omg, it's the worst.

The WORST part is that I've found that an LLM is the best way to deal with that shit.. it's way better at filtering results down to just useful PoCs (having to use AI to fight AI makes me incredibly sad though :( )

[katalogeur@mastodon.social]

@cR0w

People, not the machines, have chosen to destroy these things by pretending that LLMs are the AGI they were hungry for, and told they were getting, and investing accordingly despite all evidence to the contrary.

[da_667@infosec.exchange]

@iagox86 @cR0w @darthnull what's incredibly fun is looking at nuclei-templates repo, thinking you've found something that can serve as a proof of concept for some thing you really needed, and its a GET request that they parse with regex for version strings.

Thanks for that, I guess.