Choose disfavour where obedience does not bring honour. I do math. And was once asked by R. Morris Sr. : "For whom?" @halvarflake@mastodon.social

Joined June 2008
Visualisation of what the neural network learnt, croissant dough edition.
3
10
1,090
Halvar Flake retweeted
We survived Morris, Trinoo, Melissa, Blaster, Mirai, WannaCry, Heartbleed, SolarWinds, etc. We'll get through this too. It will be a volatile couple years but we'll be in a much better state on the other side.
Feels like March 1, 2020 for Cyber. Not normal, something is happening. Internet lockdowns in a couple of months?
1
3
21
1,075
Halvar Flake retweeted
Largest credit goes to @lcfr_hax for the earliest recent discovery of the bug class. This underlying engine issue was so wide it invited a lot of parallel discovery. As we coordinated our findings the scope of the problem continued to expand!
5
13
4
178
13,182
Halvar Flake retweeted
After this project, it seems pretty clear to me that the days where we decide on a particular optimizer, learning rate schedule etc. before the run and then never touch it again are likely over. Going forward, I bet that everyone is going to deploy reactive optimizers - it is like hiring a deep learning expert to watch the training run full-time and adjust on-the-go! Try it out yourself with Xingjian's pip package: github.com/xingjian-bai/opal
1
3
27
1,335
Halvar Flake retweeted
@grok who found the vulnerabilities? I thought it was @calif_io and @lcfr_hax
1
2
1
23
3,999
Halvar Flake retweeted
It’s going to be a long winter for every security team out there. Be nice to them.
15
39
5
436
16,617
Halvar Flake retweeted
Big week - first time posting a hash asap might end up being useful (for me) as well :') xitter.cf/lcfr_hax/status/208503…
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac
10
5
1
157
63,978
Halvar Flake retweeted
I bought a MacBook Neo yesterday just to finish this stupid exploit 😳
3
3
69
5,244
Halvar Flake retweeted
models do not produce simplicity. they hedge, for completeness. that's your value. the lack of this skill is called AI slop.
12
26
5
355
15,876
Halvar Flake retweeted
While everyone’s patching PHP today, don't sleep on Node.js CVE-2026-111497 OOB write in the bundled Brotli decoder. Reachable via fetch(): a malicious server just replies Content-Encoding: br. Fixed in 26.12.1 / 24.22.1 / 22.23.4. Update.
6
28
4
136
12,034
Halvar Flake retweeted
What's this talk about patching? Don't we now just run agents 24/7 to fight the attackers? Don't forget a good speech first though. "We will fight on the NICs. We shall fight in the kernel. We shall fight in the applications, and in the database. We shall never surrender."
🤖 Made with AI
1
4
14
1,047
Yes. Wenfeng and Dario are both visionaries, idealists and cult leaders. Different league. It’s beautifully dialectical, too. Open diffusion from a centralized collectivist authoritarian country, and secretive centralized authority from a “messy individualist pluralistic” one.
DeepSeek open sourced its internal inference framework, Apache 2.0, no strings attached. This is arguably more impactful than open sourcing any model weights, like @zephyr_z9 said, they've open sourced their economics, how DeepSeek makes a profit DeepSeek's commitment to open source is as steadfast as Anthropic's commitment to closed source. Every other lab sits in the mushy middle, dictated by the market condition, investor expectation, policy wind These two labs are basically building two different religions, one radically open and messy, the other intensely closed and polished. If you are on Team Bazaar, you root for DeepSeek. If you are on Team Cathedral, you root for Anthropic. In the end, both will exist and flourish, pushing and pulling each other into a steady state. I think that is ultimately a healthy thing. I love visiting cathedrals, admiring their awe-inspiring grandeur, meditating under the instant hush and silence the structures command. I also like walking through bazaars, feeling the chaos, smelling the messy dynamism, brushing up against unpredictable creativity. Both should exist. No reason to try to kill or demonize one or the other.
17
46
3
583
19,925
Halvar Flake retweeted
php2shell is the most consequential vulnerability I have ever helped discover. I am proud of how our team worked closely in coordination with the PHP Foundation to provide support and to harden the patch in preparation for this release.

Please read more about our approach:
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors. Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact. This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare. openai.com/index/coordinated…
Readers added context they thought people might want to know
‪OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.‬ ‪x.com/lcfr_hax/statu…‬
45
146
14
1,323
98,707
Halvar Flake retweeted
“A single cluster currently serves 155 trillion tokens/day, generating $38 in revenue per GPU-hour (at off-peak pricing).” Huge flex from DeepSeek. Not only did they open-source their inference engine, but they also open-sourced their revenue numbers. They didn't disclose which GPUs they're using here, but DeepInfer supports both NVIDIA Blackwell and Huawei Ascend. Even assuming they're renting B300s at $7 per GPU-hour, that's ~82% gross margin.
121
293
73
3,855
521,962
Halvar Flake retweeted
NVIDIA just announced DSX POD. This is a bigger deal than most people realize, because it solves one of the biggest bottlenecks: scaling! Instead of taking months to build out a data center, you can now scale compute capacity in just a few days!
145
218
44
2,804
199,132
Halvar Flake retweeted
Even OpenSSH, the poster child of security-oriented architecture, benefited from this attack-surface hardening
Reducing the attack surface of deployed services and apps is a fundamental component of software that is secure by design. Earlier this year we tasked Claude with autonomously mapping and reducing the attack surface of 25 large and widely used OSS codebases. This blog post covers some of our methodology and a preview of the data we collected. This research resulted in a significant reduction in OpenSSH pre-authentication attack surface (now fixed in 10.6). And over 500 findings where reachability could be reduced and configurations hardened to ensure security controls weren’t silently disabled. anthropic.com/research/attac…
1
10
939
I am on vacation this week and doing some NN introspection experiments. There is something really fascinating about NN reconstructions of iconic photos.
3
11
1,045