Mastodawn

The further I am from abject poverty and living only to survive, the less I need #AI. And you know what this makes me realize?

That folks who hate AI are effectively the same as wholly able-bodied people pushing each other around on wheelchairs, doing wheelies, and then telling the rest of the world how useless wheelchairs are because they, personally, can’t find a non-trivial use for them.

Maybe AI isn’t for the average person? Maybe our privilege—that thing that lets us feel certain of tomorrow’s food and shelter—makes AI worthless and even harmful to most human beings.

That’d be quite the thing, wouldn’t it?

#ArtificialIntelligence #TechPrivilege #Accessibility #SociologyOfTech #AIEthics #ClassAndTech #SystemicEquity

Show thread

Demi Marie Obenour 6d ago

Should syzbot be integrated with automated LLM-based exploit generation tools? Seeing a ton of working zero-day exploits might finally convince companies to pay for Linux kernel fixes.

Demi Marie Obenour 6d ago

I semi-seriously wonder if Microsoft needs to threaten to revoke all of the distro secure boot certs unless Linux changes its threat model. Yes, it’s a lot of work, but it’s work that enterprise distro vendors would pay for if the alternative was losing secure boot.

Demi Marie Obenour 6d ago

Idea: when someone reports a vulnerability in a Linux kernel subsystem, and there is no fix, mark it BROKEN.

Demi Marie Obenour 6d ago

Brian Greenberg

Mar 29

I teach cybersecurity. And I genuinely don't know what to tell my students after this one. Federal reviewers spent years trying to get basic encryption documentation from Microsoft for its GCC High government cloud. They couldn't get it. One reviewer called the system a "pile of spaghetti pies," with data traveling from point A to point B the way you'd get from Chicago to New York: a bus to St. Louis, a ferry to Pittsburgh, and a flight to Newark. Each leg is a potential hijacking. They knew this. They said this out loud in writing. Then they approved it anyway in December 2024, because too many agencies were already using it. 🔐 That's not a security review. That's a hostage negotiation. Two things in this story should make every CISO and CIO uncomfortable:

🧩 Microsoft built its federal cloud on top of decades of legacy code that it apparently can't fully document itself
👮 "Digital escorts" often ex-military with minimal software engineering backgrounds are the firewall between Chinese engineers working on the system and classified U.S. networks 🤦🏻‍♂️

The scariest line in the whole ProPublica investigation isn't the "pile of shit" quote. It's this: FedRAMP determined that refusing authorization wasn't feasible because agencies were already using the product. Read that again. The security review process reached a conclusion based on sunk cost, not risk. Ex Post Facto Fallacy

If that logic holds, the compliance framework is just documentation theater. And right now, CISA is being hollowed out, so there are fewer people left to even run the theater.

https://arstechnica.com/information-technology/2026/03/federal-cyber-experts-called-microsofts-cloud-a-pile-of-shit-approved-it-anyway/
#Cybersecurity #Microsoft #FedRAMP #Leadership #RiskManagement #security #privacy #cloud #infosec

Federal cyber experts called Microsoft's cloud a "pile of shit," approved it anyway

One Microsoft product was approved despite years of concerns about its security.

Ars Technica

Demi Marie Obenour 6d ago

mhoye Apr 9

It's difficult for me to talk calmly about companies that are excited to spend hundreds of millions of dollars training stochastic models while the teachers in every public classroom in North America pay for their own chalk, some of their students' school supplies and some fraction of their students' lunches out of their own pockets. That those companies go on to say this will make the teachers "obsolete" is too much.

Demi Marie Obenour 6d ago

GitHub Copilot is going to charge API rates rather than be subsidized.

I expect usage to plummit.

Demi Marie Obenour 6d ago

Jann Horn May 13

@jenkins wrote a blogpost on porting Project Zero's 0-click chain for the Pixel 9 (discussed in a previous post) to the Pixel 10, using a different kernel privesc bug (an out-of-bounds physical memory mapping primitive): https://projectzero.google/2026/05/pixel-10-exploit.html

A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens

We recently published an exploit chain for the Google Pixel 9 that demonstrated it was possible t...

Demi Marie Obenour 6d ago

Hoshino Lina (星乃リナ) 🩵 3D Yuri Wedding 2026!!!May 14

I worked at a fairly big tech co years before the AI boom. People did large scale refractoring across huge code bases back then. With refactoring tools. And properly written robots.

Applying changes to code at scale, opening PRs automatically, basic interaction with human reviewers, making sure tests pass, getting things merged when ready. All that already existed before LLMs. And it was actually reliable and not capable of hallucinating terrible things.

It's like we've forgotten how to automate things without LLMs and openclaw now...