(date: 2024-02-24 18:31:22)
date: 2024-02-23, updated: 2024-02-19, from: Bruce Schneier blog
There are correlations between the populations of the Illex Argentines squid and water temperatures.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Read my blog posting guidelines here.
https://www.schneier.com/blog/archives/2024/02/friday-squid-blogging-illex-squid-and-climate-change.html Save to Pocket
date: 2024-02-23, updated: 2024-02-23, from: Bruce Schneier blog
New research:
LLM Agents can Autonomously Hack Websites
Abstract: In recent years, large language models (LLMs) have become increasingly capable and can now interact with tools (i.e., call functions), read documents, and recursively call themselves. As a result, these LLMs can now function autonomously as agents. With the rise in capabilities of these agents, recent work has speculated on how LLM agents would affect cybersecurity. However, not much is known about the offensive capabilities of LLM agents.
In this work, we show that LLM agents can autonomously hack websites, performing tasks as complex as blind database schema extraction and SQL injections without human feedback. Importantly, the agent does not need to know the vulnerability beforehand. This capability is uniquely enabled by frontier models that are highly capable of tool use and leveraging extended context. Namely, we show that GPT-4 is capable of such hacks, but existing open-source models are not. Finally, we show that GPT-4 is capable of autonomously finding vulnerabilities in websites in the wild. Our findings raise questions about the widespread deployment of LLMs…
https://www.schneier.com/blog/archives/2024/02/ais-hacking-websites.html Save to Pocket
date: 2024-02-23, from: Daniel Stenberg Blog
An external security audit focused especially on curl’s HTTP/3 components and associated source code was recently concluded by Trail of Bits. In particular on the HTTP/3 related curl code that uses and interfaces the ngtcp2 and nghttp3 libraries, as that is so far the only HTTP/3 backend in curl that is not labeled as experimental. … Continue reading curl HTTP/3 security audit
https://daniel.haxx.se/blog/2024/02/23/curl-http-3-security-audit/ Save to Pocket
date: 2024-02-23, from: Robert Reich’s blog
White Christian nationalism is the creed of red America
https://robertreich.substack.com/p/republican-theocracy Save to Pocket
date: 2024-02-23, updated: 2024-02-23, from: Daring Fireball
https://www.theverge.com/2024/2/22/24080215/engadget-layoffs-tech-news-blogs-editorial-restructuring Save to Pocket
date: 2024-02-23, updated: 2024-02-23, from: Daring Fireball
https://support.apple.com/en-is/guide/iphone/iph9ac289c4d/ios Save to Pocket
date: 2024-02-23, updated: 2024-02-23, from: Daring Fireball
https://sixcolors.com/post/2024/02/apple-sports-a-free-iphone-app-to-get-you-the-score-fast/ Save to Pocket
date: 2024-02-23, from: John Naughton’s online diary
My ol’ Burgundian Home If I had a house en Bourgogne (which, alas, I don’t), I’d like one like this. And then I’d ask Randy Newman to do a variation on this for me. Quote of the Day ”My problem … Continue reading
https://memex.naughtons.org/friday-23-february-2024/39166/ Save to Pocket
date: 2024-02-22, from: Robert Reich’s blog
My conversation with him in an elevator
https://robertreich.substack.com/p/how-bad-was-strom-thurmond Save to Pocket
date: 2024-02-22, updated: 2024-02-22, from: Bruce Schneier blog
Simon Willison has been playing with the video processing capabilities of the new Gemini Pro 1.5 model from Google, and it’s really impressive.
Which means a lot of scary new video prompt injection attacks. And remember, given the current state of technology, prompt injection attacks are impossible to prevent in general.
https://www.schneier.com/blog/archives/2024/02/new-image-video-prompt-injection-attacks.html Save to Pocket
date: 2024-02-22, from: David Rosenthal’s blog
Source |
Our economy is dominated by five aging tech giants—Alphabet, Amazon, Apple, Meta, and Microsoft. Each of these firms was founded more than twenty years ago: Apple and Microsoft in the 1970s, Google and Amazon in the 1990s, and Facebook in 2004. Each of them grew by successfully commercializing a disruptive technology—personal computers (Apple), operating systems (Microsoft), online shopping (Amazon), search engines (Google), and social networks (Facebook). Each of them displaced the incumbents that came before them. But in the last twenty years, no company has commercialized a new technology in a way that threatens the tech giants. Why?The TL;DR of Lemley and Wansley’s answer to their question is:
While there are many reasons for the tech giants’ continued dominance, we think an important and overlooked one is that they have learned how to coopt disruption. They identify potentially disruptive technologies, use their money to influence the startups developing them, strategically dole out access to the resources the startups need to grow, and seek regulation that will make it harder for the startups to compete. When a threat emerges, they buy it off. And after they acquire a startup, they redirect its people and assets to their own innovation needs.They observe that:
a company that is started with the goal of being swallowed by a tech giant probably isn’t contributing much to society.
The tech giants’ core businesses are built on platforms. A platform is an intermediary in a two-sided market. It connects users on one side of the market with users on the other side for transactions or interactions.This is precisely the mechanism Brian Arthur described, but applied to a business model that has since been enabled by the Internet.
…
Platforms tend to exhibit network effects—the addition of a new user increases the value of a platform to existing users and attracts new users.
Amazon, for example, both invites third party vendors to sell their products in its online marketplace and sells its own house brands that compete with those vendors. Amazon has a powerful advantage in that competition. It has access to data on all of its competitors—who their customers are, which products are selling well, and which prices work best. And it controls which ads consumers see when they search for a specific product. Assuming Amazon uses that information to prefer its own products to those of its competitors (either by pricing strategically or by promoting its own products in search results) – something alleged but not yet proven in a pending antitrust case – the result is to bias competition. Vendors cannot realistically protest Amazon’s self-preferencing (or just go elsewhere) because Amazon has such a dominant share in the online retail market.
Alphabet pays Apple a reported $18 billion (with a b) each year for Google to be the default search engine on iOS devices. Android and iOS together account for 99% of the U.S. mobile operating system market. Consequently, almost everyone who uses a smartphone in America is accustomed to Google search. Alphabet claims that “competition is just a click away.” But research and experience have shown that defaults can be somewhat sticky. So controlling the default position can give Alphabet (or whoever wins the Apple bid) an advantage. That said, someone has to be the default, and it might be better for consumers if the default is the search engine most users already prefer. The real problem might be the idea of paying for placement, whoever wins the bidding war.
Cloning is only objectionable if the tech giant wins out not by competition on the merits, but by exclusionary conduct.Second, that cloning often fails:
Google+, Google’s effort to build a social media service that combined the best of Facebook and Twitter was an abject failure. Apple’s effort to control the music world’s move to streaming by offering its own alternative to Spotify hasn’t prevented Spotify from dominating music streaming and eclipsing the once-vibrant (and Apple-dominated) market for music downloads. Meta’s effort to copy Snap, then TikTok, by introducing Stories and Reels has not proven terribly successful, and certainly has not prevented those companies from building their markets.The fact that the giants can clone a startup’s product leads the authors to ask:
If the product is cloneable, then why would you buy the company and burn cash paying off its VCs?There are two possible answers. It may be faster and easier, though likely not cheaper, to “acquihire” the startup’s talent than to recruit equivalent talent in the open market. Or it may be faster and easier, though likely not cheaper, to acquire the company and its product rather than cloning it.
Microsoft enjoyed strong network effects in the 1990s as the dominant maker of operating system software – far more dominant than it is today. It cloned internet browser technology from upstarts like Netscape, and it engaged in anticompetitive conduct designed to ensure that it, not Netscape, became the browser of choice.82 But Microsoft’s victory over Netscape was short-lived. New startups – Mozilla and then Google – came out of nowhere and took the market away from it. Microsoft still benefits from network effects, and it still uses cloning and self-preferencing to send users to its Edge browser. But it doesn’t work. Microsoft employed all the tools of a dominant firm in a network market, but it still faced disruption.So these four techniques aren’t an explanation for the recent dearth of disruption.
The Cisco story exemplifies how the venture capital market, as a market, is better at exploring a series of risky ideas than a firm with a single risk-averse gatekeeper. It also illustrates how the advantages of a large incumbent—in this case access to markets and existing customer relationships—can sometimes extract more market value out of a technology than a new entrant.The rapid evoluution of networking technology at the time meant that even Cisco, the largest company in the market, didn’t have the R&D resources to explore all the opportunities. They depended upon VCs to fund the initial explorations, rewarding them by paying over the odds for the successes. Their market power then got the successes deployed much faster than a startup could.
Our claim here is that the same dynamics that inhibit disruptive innovation by longstanding employees of large incumbents inhibit disruptive innovation by new employees from acquired startups.And, by making the innovators from the startup rich, the acquirer greatly reduces their incentives for future innovation. Andy Bechtolsheim is an outlier.
…
The tech giants win from coopting disruption even though it destroys social value. In fact, they benefit in two ways. They make faster incremental progress on the sustaining innovations that they want. They get the new code, the valuable intellectual property, and the fresh ideas of the startup. And, critically, they also kill off a competitor. They no longer have to worry about the startup actually developing the more disruptive innovation and leapfrogging them or other tech giants acquiring the startup and using its assets to compete with them.
We favor an enforcement policy that prohibits anticompetitive conduct that is reasonably capable of contributing significantly to the maintenance of the incumbent s market power. That approach implies enforcement even where the competitive significance of the nascent competitor is uncertain.Justifying blocking mergers because of a nascent threat that might never materialize is problematic. But it is only more so than the current way anti-trust works, by projecting likely harm to consumer welfare, which also might never materialize (although it almost always does). Lemley and Wansley explain the dilemma:
antitrust enforcers need a strategy for blocking cooptive acquisitions that works within existing case law (or plausible improvements to that law) and is surgical enough to avoid chilling investment.Some cases are obvious:
For cooptive acquisitions like Facebook/Instagram deal, we think Hemphill and Wu’s strategy makes sense. Zuckerberg’s email arguing for acquiring startups like Instagram because “they could be very disruptive to us” is a smoking gun of anticompetitive intent.But Lemley and Wansley go further, arguing for blocking megers based the startup’s ability to innovate distruptive technology:
Of course, an approach to policing startup acquisitions based on innovation capabilities need limits. Many startups have some innovation capabilities that could have a significant effect on competition. We can cabin enforcement in three ways—by focusing on specific technologies and specific firms and by looking at the cumulative effects of multiple acquisitions.Their examples of technologies include generative AI and virtual and augmented reality, both cases where it is already too late. The companies they identify “Alphabet, Amazon, Apple, Microsoft, and Meta” are all veterans of multiple acquisitions in these areas. But they argue that committing to challenge fuure mergers:
would create socially desirable incentives for startups. A startup developing one of the listed technologies would gain stronger incentives to turn its innovations into the products that its management team believed would garner the highest value on the open market—rather than the one most valuable to the tech giants. They would also gain stronger incentives to build a truly independent business and go public since an acquisition by the tech giants would be a less likely exit.
I think these would all be worthwhile steps, and I’m all in favor of
updating anti-trust law and, even better, actually enforcing the laws on
the books. But I am skeptical that the government can spot potentially
disruptive technologies before the tech giants spot and acquire them.
Especially since the government can’t be embedded in the VC industry the
way the tech giants are. Note that many of the harms Lemley and Wansley
identify happen shortly after the acquisition. Would forcing Meta to
divest Instagram at this late date restore the innovations the
acquisition killed off?
https://blog.dshr.org/2024/02/competition-proofing.html Save to Pocket
date: 2024-02-22, from: Dan Rather’s Steady
Inspiring young 92-year-olds like me
https://steady.substack.com/p/a-101-year-olds-fight-against-book Save to Pocket
date: 2024-02-22, from: Robert Reich’s blog
Friends, I was going to write something else for today, but I was so surprised by the response to my Office Hours Substack letter and poll yesterday that I felt the question needed more airing. It’s a question I’ve been asked a lot recently: Should Joe Biden step aside and allow Democrats to have an open convention to choose their candidate?
https://robertreich.substack.com/p/my-surprise-at-yesterdays-substack Save to Pocket
date: 2024-02-22, from: Daniel Stenberg Blog
It took me 422 days to do my most recent 1,000 commits in the curl source code repository. Now at 18,001 commits. This is the most recent.
https://daniel.haxx.se/blog/2024/02/22/18k-commits/ Save to Pocket
date: 2024-02-22, updated: 2024-02-22, from: Daring Fireball
https://www.apple.com/newsroom/2024/02/2024-mls-season-kicks-off-today-exclusively-on-mls-season-pass-on-apple-tv/ Save to Pocket
date: 2024-02-22, updated: 2024-02-22, from: Daring Fireball
Apple Sports exemplifies why it’s a better idea to design smaller, more focused apps.
https://daringfireball.net/2024/02/apple_sports Save to Pocket
date: 2024-02-22, updated: 2024-02-22, from: Daring Fireball
https://sonartasks.com?utm_source=daring-fireball&utm_campaign=FY24Q1-daringfireball&utm_content=2024-02-DF-feed-post Save to Pocket
date: 2024-02-21, from: Daniel Stenberg Blog
I keep insisting that the CVE system is broken and that the database of existing CVEs hosted by MITRE (and imported into lots of other databases) is full of questionable content and plenty of downright lies. A primary explanation for us being in this ugly situation is that it is simply next to impossible to … Continue reading DISPUTED, not REJECTED
https://daniel.haxx.se/blog/2024/02/21/disputed-not-rejected/ Save to Pocket
date: 2024-02-21, updated: 2024-02-23, from: Bruce Schneier blog
First-person account of someone who fell for a scam, that started as a fake Amazon service rep and ended with a fake CIA agent, and lost $50,000 cash. And this is not a naive or stupid person.
The details are fascinating. And if you think it couldn’t happen to you, think again. Given the right set of circumstances, it can.
It happened to Cory Doctorow.
EDITED TO ADD (2/23): More scams, these involving timeshares.
https://www.schneier.com/blog/archives/2024/02/details-of-a-phone-scam.html Save to Pocket
date: 2024-02-21, from: Chris Heilmann’s blog
Today, 21/02/2024, I will be opening a live event called Developer Program Leaders: Main Challenges in Developer Relations. Here’s the writeup of what I will be covering in 10 minutes: What is Developer Advocacy? According to the The Developer Advocacy Handbook written in 2009, here’s what a Developer Evangelist/Advocate does: A developer evangelist is a […]
https://christianheilmann.com/2024/02/21/how-does-a-changed-market-affect-developer-relations/ Save to Pocket
date: 2024-02-21, from: Robert Reich’s blog
The problem isn’t just his age. It’s that he’s looking and acting frail, and most voters believe he’s too old.
https://robertreich.substack.com/p/office-hours-should-biden-step-aside Save to Pocket
date: 2024-02-21, from: John Naughton’s online diary
After Vermeer Quote of the Day ”Everything will be all right, and, even if it isn’t, we’ll have the consolation of having lived honest lives.” Alexei Navalny (h/t John Seeley) Musical alternative to the morning’s radio news Chris McMullan | … Continue reading
https://memex.naughtons.org/wednesday-21-february-2024/39160/ Save to Pocket
date: 2024-02-20, from: Om Malik blog
It is not uncommon to hear the question: what is 5G really good for? After all, it doesn’t change the current applications, it doesn’t change our mobile experience too much from the more advanced version of LTE mobile broadband that is widely available around the world. So, again, what is 5G good for? How about …
https://om.co/2024/02/20/5g-is-now-eating-cables-lunch/ Save to Pocket
date: 2024-02-20, from: Dan Rather’s Steady
Courage is the moral strength to venture, persevere, and withstand danger, fear, or difficulty, according to Merriam-Webster. It comes from the Latin cor, meaning heart. My father instilled in me a respect for the word and the ideal when I was very ill as a young child.
https://steady.substack.com/p/the-cost-of-courage Save to Pocket
date: 2024-02-20, updated: 2024-02-23, from: Bruce Schneier blog
Microsoft announced that it caught Chinese, Russian, and Iranian hackers using its AI tools—presumably coding tools—to improve their hacking abilities.
From their report:
In collaboration with OpenAI, we are sharing threat intelligence showing detected state affiliated adversaries—tracked as Forest Blizzard, Emerald Sleet, Crimson Sandstorm, Charcoal Typhoon, and Salmon Typhoon—using LLMs to augment cyberoperations.
The only way Microsoft or OpenAI would know this would be to spy on chatbot sessions. I’m sure the terms of service—if I bothered to read them—gives them that permission. And of course it’s no surprise that Microsoft and OpenAI (and, presumably, everyone else) are spying on our usage of AI, but this confirms it…
https://www.schneier.com/blog/archives/2024/02/microsoft-is-spying-on-users-of-its-ai-tools.html Save to Pocket
date: 2024-02-20, from: Robert Reich’s blog
Four generations of Mellons are now bankrolling Trump
https://robertreich.substack.com/p/why-timothy-mellon-is-the-poster Save to Pocket
date: 2024-02-19, updated: 2024-02-19, from: Daring Fireball
https://appleinsider.com/articles/24/02/18/apples-3d-video-cameras-spotted-during-nba-slam-dunk-contest Save to Pocket
date: 2024-02-19, from: Om Malik blog
Your body has a weird way of reminding you of your “age.” For me, that reminder came in the form of jetlag. There was a time when my jet lag would be gone in a day when I would fly back from Delhi, but this time it has taken three days to bounce back and adjust to California time. No harm was …
https://om.co/2024/02/19/reunited-with-vision-pro/ Save to Pocket
date: 2024-02-19, updated: 2024-02-19, from: Bruce Schneier blog
The European Court of Human Rights has ruled that breaking end-to-end encryption by adding backdoors violates human rights:
Seemingly most critically, the [Russian] government told the ECHR that any intrusion on private lives resulting from decrypting messages was “necessary” to combat terrorism in a democratic society. To back up this claim, the government pointed to a 2017 terrorist attack that was “coordinated from abroad through secret chats via Telegram.” The government claimed that a second terrorist attack that year was prevented after the government discovered it was being coordinated through Telegram chats…
https://www.schneier.com/blog/archives/2024/02/eu-court-of-human-rights-rejects-encryption-backdoors.html Save to Pocket
date: 2024-02-19, from: Robert Reich’s blog
Thoughts on Presidents Day
https://robertreich.substack.com/p/netanyahu-putin-and-trump Save to Pocket
date: 2024-02-19, updated: 2024-02-19, from: Daring Fireball
https://store.epicgames.com/en-US/news/epic-games-store-2023-year-in-review Save to Pocket
date: 2024-02-19, from: John Naughton’s online diary
W.B.’s last resting place Drumcliff Churchyard, Co Sligo. We always pay him a visit when we’re on the road to Donegal. Quote of the Day ”I don’t know the question, but sex is definitely the answer.” Woody Allen Musical alternative … Continue reading
https://memex.naughtons.org/monday-19-february-2024/39149/ Save to Pocket
date: 2024-02-18, from: Dan Rather’s Steady
A Reason To Smile
https://steady.substack.com/p/its-a-good-day Save to Pocket
date: 2024-02-18, from: Robert Reich’s blog
And last week’s winner
https://robertreich.substack.com/p/sunday-caption-contest-money-troubles Save to Pocket