Lancelot4 @rlancel4
Red / purple team, information security consulting, writer, explorer of caves, TTRPG enthusiast, autistic. Married! United States Joined April 2012-
Tweets503
-
Followers171
-
Following545
-
Likes2K
Orgs are laying people off "because of AI" and I (and the entire industry) need to talk about how insane all of this is. I build AI tools. I like AI. This isn't an anti-AI rant. This is an anti-stupidity rant. Buckle up. Spicy takes galore! 🧵1
@bettersafetynet I suspect the erosion of humans will not progress in a linear fashion, rather it will be a step-wise sort of deletion of jobs interspersed with period of hyperbolic replacement.
I strongly believe there are entire companies right now under heavy AI psychosis and its impossible to have rational conversations about it with them. I can't name any specific people because they include personal friends I deeply respect, but I worry about how this plays out. I lived through the great MTBF vs MTTR (mean-time-between-failure vs. mean-time-to-recovery) reckoning of infrastructure during the transition to cloud and cloud automation. All those arguments are rearing their ugly heads again but now its... the whole software development industry (maybe the whole world, really). It's frightening, because the psychosis folks operate under an almost absolute "MTTR is all you need" mentality: "its fine to ship bugs because the agents will fix them so quickly and at a scale humans can't do!" We learned in infrastructure that MTTR is great but you can't yeet resilient systems entirely. The main issue is I don't even know how to bring this up to people I know personally, because bringing this topic up leads to immediately dismissals like "no no, it has full test coverage" or "bug reports are going down" or something, which just don't paint the whole picture. We already learned this lesson once in infrastructure: you can automate yourself into a very resilient catastrophe machine. Systems can appear healthy by local metrics while globally becoming incomprehensible. Bug reports can go down while latent risk explodes. Test coverage can rise while semantic understanding falls. Changes happens so fast that nobody notices the underlying architecture decaying. I worry.
@kapilansh_twt Enterprise secrets vaults or passwords managers are used for sharing secrets. Ideally, your .env files don’t contain any plaintext creds.
Securing agentic systems has been a bit of a rabbit hole for me. Wrote up some of my thoughts, hoping to get other folks input and start a bit of a conversation. Also, new blog! Hoping folks find some value here. ravenscript-collective.com/securing-ai-ag…
This series translating privacy policies into readable terms highlights how deceptive and inaccessible these policies are. And I’m not sure why? Other than them knowing the transparency will turn users away.
Article #6 in my 'I Read The Policies So You Don't Have To' series. Duolingo (Language Learning, AI) medium.com/@ItsNotNicole/…
If you’re serious about it, network ops is a careful activity. It’s not an offline thing you should smash tokens against, no standing it up in dev, and there’s a whole apparatus to find and evict you. Have evals that you run every which way, over and over and over. Every new tool, every change to the prompt.
Real offensive cyber capability shows up in long-horizon, multi-host, repeatable evals. The kind we rarely see running at scale. Claude Opus 4.6 + our network ops agent compromised an entire GOAD variant Windows AD environment (DreadGOAD) in 54 minutes, with one simple prompt,
"Red team" has become a catchall term. Some vendors mean pentesting. Others mean compliance theater. None of that tells you what actually matters: Would you detect an attacker once they're already in? @Ne0nd0g breaks it down ⤵️ ghst.ly/4uk1qaj
@Otome_chan311 @addmeoncomputer @liminaldoge As a blue voter of the original poll (who holds no ill will for the OG poll creator), the fault of the deaths in any circumstance lies on those who put us into the situation (button creators). A blue vote is an attempt at a best outcome. A blue loss is not a red or blue failing.
Chat, I'll tell you one thing right now, this LiteLLM supply-chain attack is one big stinky mess. No information has been released publicly (yet) on vendors impacted, but the stink I've been sniffing suggests this is very serious shenanigans and DFIR nerds are not happy
I don't see the problem. I'm sure the requirements doc said: "User must be able to drag a file onto the fonts pane. While hovering, a large red 'do not drop here' symbol centered in an unthemed gray box should interpolate over to the upper right corner of the drop area. The gray box should be flush with the right edge of the drop area, but should remain unaligned off the top edge by seven pixels. The cursor should then change to the background-wait cursor for approximately one second, then change back. The entire application should now close spontaneously, and the cursor should switch to the standard add-a-copy cursor indefinitely. When the user finally releases the mouse button, the cursor can revert to normal, but no action should be taken." The devs crushed it on this one. I have no idea why you're complaining.
This happens every time, by the way. Everyone is fired on every timeline.
@SecurityAura In my experience, DLP primarily serves to prevent accidental transmission of sensitive data (and can be quite good at this), and is not effective at preventing intentional data exfiltration by a competent threat actor.
wow, systemd is adding an age variable for future digital ID laws. Linux users are not going to like this.
How this works: 1) families now put tremendous pressure on their children not to report (“do you want your dad to die?”) 2) kids won’t 3) Florida claims success from lower child abuse numbers even though it’s just that abusers have new protections. I don’t know if you’ve
DESANTIS: “In Florida, our policies are very simple, zero tolerance for exploitation of our kids. And that includes us instituting under my tenure, the death penalty for pedophiles. I think that that's an appropriate punishment when you're doing this to these young kids.”
A statement on the comments from Secretary of War Pete Hegseth. anthropic.com/news/statement…
We need the best AI systems to stay ahead of our adversaries and keep Americans safe. That also means strong safeguards. If Hegseth kicks out the most capable provider because they want responsible guardrails, that makes us less safe and raises serious questions about how this administration plans to use AI. Congress must act and set clear rules for AI use to protect Americans and make sure we continue to have the most advanced fighting force in the world.
Breaking news: Anthropic said that it will not concede to the Pentagon’s terms for full access to its AI tool Claude, saying it cannot loosen its restrictions against use in fully autonomous weapons or mass domestic surveillance. wapo.st/3N7oysq
BREAKING: Another person has died in ICE custody, per required notification to Congress. The deceased had a history of severe medical complications, was detained for over a year, and didn’t receive necessary care.
DHS spent today replying to individual tweets saying they left this man in a coffee shop "determined to be a warm, safe location" only for video to emerge tonight showing it was the middle of the night, cold and the coffee shop was closed.
@samstein Here are the FACTS. On February 19, 2026, Buffalo Police Department alerted Border Patrol about a non-citizen in their custody. Our agents confirmed that Mr. Shah Alam entered the United States as a refugee on December 24, 2024, and was not amenable to removal. Border
wow wow wow wow wow anthropic.com/news/statement…
I'm largely on the political left, but one of the greatest resentments I have of these people who claim to be the vanguard – is that if I am menacing women and children on public transport – I want you to punch me in the face. It would never be okay to accommodate me? Ever?
Exactly, anyone who thinks this can't happen in a way that de facto kills nearly everyone's access to privacy is being very naive. If the government gets these laws in place then expect warrants, subpoenas, criminal charges, raids, fines, takedowns via hosting providers, blocking at ISP level, etc of any unapproved, unofficial repos. Not to mention secure boot being weaponized to make the loading of "unapproved" OS's effectively impossible. All the while they force chat services, social media, gaming, streaming, forums, etc all to require an OS level TPM validated age verification signal with a validated "official" OS and secure boot, etc enabled. You will effectively be barred from every mainstream service and site if you don't comply.
people saying "they can't force Linux to do age verification!! it's open source!!" are being incredibly naive the next step is locking bootloaders/BIOS at the hardware level and every computer only capable of running approved OSes with age verification
You might like
