Hannu Klemetti

@hannukle@infosec.exchange
28 Followers
139 Following
34 Posts
Software developer, security nerd and wannabe shepherd. Building customer interaction analytics and securing SaaS business at aiwo.ai. Natively in cloud unafraid of windy spots. Python and AWS close to heart. Know too much about GDPR and regulation.

Oooh. I love this article: A non-anthropomorphized view of LLMs by Halvar Flake @HalvarFlake

“I am baffled that the AI discussions seem to never move away from treating a function to generate sequences of words as something that resembles a human.”

http://addxorrol.blogspot.com/2025/07/a-non-anthropomorphized-view-of-llms.html

#AI #LLM

A non-anthropomorphized view of LLMs

In many discussions where questions of "alignment" or "AI safety" crop up, I am baffled by seriously intelligent people imbuing almost magic...

@dangoodin To remove the Gemini app, even on devices that do not allow you to disable it in the Apps menu:

𝗦𝗲𝘁𝘂𝗽 𝗔𝗗𝗕

1⁠. Enable Developer options
- Launch ⚙️⁠Settings
- Go to About phone then Software information
- Tap Build number seven times
2⁠. Enable USB debugging
- Go to Developer options (in ⚙️⁠Settings)
- Enable USB debugging
3⁠. Install Android Debug Bridge (adb) on your computer
4⁠. Connect to phone via adb
- Connect with a good USB cable
- Run adb devices
- Click OK on Allow USB debugging?
5⁠. Disable Gemini app (left
- adb shell pm uninstall com.google.android.apps.bard
6⁠. Disable Developer options (recommended)
- Go to Developer options (in ⚙️⁠Settings)
- Disable by toggling On to Off

Android Debug Bridge (adb)  |  Android Studio  |  Android Developers

Find out about the Android Debug Bridge, a versatile command-line tool that lets you communicate with a device.

Android Developers

I think the open source movement is in serious trouble due to generative AI, as maintainers are going to get flooded with torrents of bad code and analysis the longer the AI hype train continues.

It’s exhausting and unsustainable if an entire generation are introduced to not knowing or caring about what they are doing.

This is actually huge. AWS creating fully independent cloud for EU should remove all policy theater related to GDPR and data transfers outside EU/ETA. Profits still flows to US, but nevertheless this is excellent for European organizations struggling with data security policies.

https://www.aboutamazon.eu/news/aws/built-operated-controlled-and-secured-in-europe-aws-unveils-new-sovereign-controls-and-governance-structure-for-the-aws-european-sovereign-cloud

Built, operated, controlled, and secured in Europe: AWS unveils new sovereign controls and governance structure for the AWS European Sovereign Cloud

The AWS European Sovereign Cloud will have local European leadership, independent governance, and a dedicated Security Operations Center.

EU About Amazon
Humans independently edit Wikipedia for humans. They don’t have any Ads or cannot be bullied into removing content. Wikipedia is free from AI slop. No wonder tech bros with AI companies want to eliminate it so that their fake AI text generator can show or push propaganda. Please do not let Wikipedia die. It is an independent source and far more reliable than Gen AI companies. It is a real shame that it comes to this.

The EU is introducing an energy label for phones, together with mandatory requirements for phones sold in the EU;

- 5 years of software updates (AFTER they stop selling the device in the EU)

- providing important hardware parts (during sale and for 7 years after), including free software (if needed), to every repair shop, within 5-10 business days

- batteries have to make 800 charging cycles and still be above 80% original capacity

And on top of that, phones and tablets need this energy label (which also includes a fall damage durability and repairability score), and abide by the above requirements, from 20 June 2025.

(https://energy-efficient-products.ec.europa.eu/product-list/smartphones-and-tablets_en)

Smartphones and Tablets

Product Energy Efficiency - Smartphones and Tablets. The 2023 regulations cover smartphones, feature phones, cordless phones and slate tablets. They do not apply to tablet computers, to products with flexible main display (roll-up), and to smartphones for high security communication. Energy labelling is foreseen only for smartphones and slate tablets.

Energy Efficient Products

Google Play Store started to push some promotional notifications lately. It seems that the notification setting is for "Payments, deals and recommendations". WTAF?

I went ahead and cancelled all my paid subscriptions and then removed notifications. Seemed to be the easiest solution for such a dumb option.

Good read from @hrbrmstr on the Trump administration's retaliation against Chris Krebs, given that the RSA conference is rapidly approaching.

"Silence is not safety. Silence is capitulation. If the cybersecurity community cannot defend its own when the truth is under attack, then what exactly are we protecting?"

https://rud.is/b/2025/04/17/trumps-retaliation-against-chris-krebs-and-the-cybersecurity-industrys-deafening-silence/

Trump’s Retaliation Against Chris Krebs — and the Cybersecurity Industry’s Deafening Silence - rud.is

Chris Krebs, the former director of the Cybersecurity and Infrastructure Security Agency (CISA), was fired by Donald Trump in 2020 for publicly affirming that the presidential election was secure and free from widespread fraud. Fast-forward to April 2025: Trump, now back in the White House, issued an executive order revoking Krebs’ security clearances and ordering […]

rud.is

Next.js dropped a CVSS 9.1 authentication bypass vulnerability (CVE-2025-29927) over the weekend. This flaw is trivially exploitable by sending the header `x-middleware-subrequest: true` and causes the request to skip all middleware processing, including any authentication steps.

Shodan reports over 300,000 services with the `X-Powered-By: Next.js` header alone.

You can find links to the advisory and queries for runZero at: https://www.runzero.com/blog/next-js/

How to find Next.js on your network

How to find Next.js on your network

runZero

Me and @Kugg spoke at the awesome conference @disobey_fi about playing hide-and-seek in Java land! We compare traditional Java exploitation with emerging software supply-chain attacks.

If you deal with Java and/or build servers, then this if for you!

https://www.youtube.com/watch?v=U5yFcbRRQ78

[D25] Playing hide and seek in Java land - Johnny Withad and Christoffer Jerkeby

YouTube