https://xitter.cf/t.co/PsBN05Eqsb || https://xitter.cf/t.co/aJ4RwewfJB || https://xitter.cf/t.co/U2xuM1N95Z || https://xitter.cf/t.co/npQi7LLTn1 || https://xitter.cf/t.co/JUIQS205kQ
Joined April 2023
- Tweets926
- Following168
- Followers316
- Likes531
Claude traced the unexplained NIST P-curve seeds to lrand48 output seeded with Unix timestamps from 1997 and 1998, and the code to reproduce them is public. It's not a break, but it makes a backdoor much less plausible. anthropic.com/research/ecdsa…
Omkhar Arasaratnam retweeted
arstechnica.com/security/202…
The private keys for these certs are literally the numbers 4, 56, 66, 115, 155, 156, 230, and 237 (life imitates XKCD, again).
Omkhar Arasaratnam retweeted
Reducing the attack surface of deployed services and apps is a fundamental component of software that is secure by design. Earlier this year we tasked Claude with autonomously mapping and reducing the attack surface of 25 large and widely used OSS codebases. This blog post covers some of our methodology and a preview of the data we collected.
This research resulted in a significant reduction in OpenSSH pre-authentication attack surface (now fixed in 10.6). And over 500 findings where reachability could be reduced and configurations hardened to ensure security controls weren’t silently disabled.
anthropic.com/research/attac…
Today I start at @AnthropicAI as a Member of Technical Staff.
I've spent 28 years securing critical infrastructure and the open source the world runs on.
As a kid from Scarborough, I respect the duty of making the AI revolution better, for everyone.
As @DarioAmodei wrote, "we need hope as well."
Sky's the limit.
Let's go!
Friday 10/9 was my last day at @LinkedIn
(Yes, I announced it on LinkedIn too 🤣)
Thank you to my InfoSec and core infra teams for everything.
Stay tuned for what's next...
If you haven’t watched this BlackHat talk about the @OpenAI / @huggingface incident, give it a watch.
I can’t wait to see the full post mortem.
youtu.be/87DyyMV0kCY
Wanna secure AI for 30K employees and over a billion members?
Come work with us in @LinkedIn InfoSec!
linkedin.com/jobs/view/44256…
FAQ:
* If you'd like to know if you’re a good fit, apply.
* If I’ve worked with you before, I’m happy to refer you, DM me.
* This role is located in Sunnyvale, CA
#hiring #jobs #ai #cybersecurity
My feed is awash with “innovative” “thought leadership” pieces about the impact of Fable/Mythos being restricted.
If you’re doing security research and are looking for a portable skill that you can use to discover new vulnerabilities, check out the creatively named Vulnerability Validation skill :
github.com/omkhar/vulnerabil…
It supports Codex, Claude Code, Gemini CLI, GitHub Copilot, Google Antigravity. It has unofficial support for anything that can read an AGENT.md
Check it out, tell me what I got wrong. Pull requests are welcome.
PS Knicks in 5
Mythos/Fable is out...
Before the thought leaders start publish whitepapers, or hosting "CISO dinners" etc, I'll offer some boring/sobering advice:
1. Make sure you know where all your stuff is - ya even that 3rd party software that the person in accounting bought on a credit card in 2016.
2. Make sure you understand how to patch / update all of your stuff as fixes come out. Quickly. Bad guys have no respect for risk acceptances and patch windows.
3. Make sure that you've hardened anything external facing as best you can.
4. Hydrate, get sleep. It's a marathon not a sprint
5. As per Jurassic Park...
Omkhar Arasaratnam retweeted
A detailed takedown of Canada's Bill C-22 by my @citizenlab colleague @KateRobertson_ 👇
NEW today an essay from me in @TheWalrus on Bill C-22 (being rushed through committee in Canada this May), its implications for Can-US negotiations on data-sharing, and why the rule of law threats unfolding in the US may soon become Canada's problem too.
thewalrus.ca/trump-wants-to-…
Mee-thos? Meye-thos? Mi-thos?
A month in, I still couldn't tell you.
The loudest opinions on AI vulnerability research almost never come from the people actually using it or contributing to making the world more secure.
One thing I won't wait to say:
To the open source maintainers who've fielded our reports, triaged with patience, and shipped fixes through what has genuinely been an unprecedented stretch, thank you. I owe you many coffees/beers/waters. Much love.
Wu-Tang said it in '93: protect ya neck. You've been doing it for the rest of us ever since. No royalties, no panels, no merch.
Just the work.
Back to research and helping fix upstream.
#opensourcesoftware #cybersecurity