Top Stories Daily

The latest thought-provoking Fediverse stories

There is no better way to demonstrate how Murmel works than give you a taste of it right away. This page aggregates the most widely shared news and articles from a broad range of people across the Fediverse. You can get those in your favorite RSS reader too. Want the news and stories that matter to you personally? Sign up and enjoy a fully-tailored experience free for 30 days.
Worth reading

Philosopher Daniel Dennett dead at 82

arstechnica.com · Apr 19

Part of the "New Atheist" movement, best known for work on consciousness, free will.

Shared by @thattommyhall and 22 others.
SocProf (@socprof) · Apr 20
🔁 @JenLucPiquant:

This one is personal: Dan was a friend.... Mourning a philosophical giant: Philosopher Daniel Dennett dead at 82. Part of the "New Atheist" movement, Dennet was best known for work on consciousness, free will. arstechnica.com/science/2024/0

Sinclair C5 - Wikipedia

en.wikipedia.org · Apr 19

The Sinclair C5 is a small one-person battery electric recumbent tricycle, technically an "electrically assisted pedal cycle".[1] It was the culmination of Sir Clive Sinclair's long-running interest in electric vehicles. Although widely described as an "electric car", Sinclair characterised it as...

Shared by @Kadsenchaos and 102 others.
Marcus Richter (@monoxyd) · Apr 20
🔁 @gsuberland:

discovering that fewer cybertrucks have been sold than Sinclair C5s has amused me greatly. and honestly, if you want to drive a weird vehicle, the C5 is far more fun.

en.wikipedia.org/wiki/Sinclair

Richard Troupe (@richardtroupe) · Apr 20
🔁 @gsuberland:

discovering that fewer cybertrucks have been sold than Sinclair C5s has amused me greatly. and honestly, if you want to drive a weird vehicle, the C5 is far more fun.

en.wikipedia.org/wiki/Sinclair

Oblomov (@oblomov) · Apr 20
🔁 @gsuberland:

discovering that fewer cybertrucks have been sold than Sinclair C5s has amused me greatly. and honestly, if you want to drive a weird vehicle, the C5 is far more fun.

en.wikipedia.org/wiki/Sinclair

Michael Foster (@michael) · Apr 19
🔁 @gsuberland:

discovering that fewer cybertrucks have been sold than Sinclair C5s has amused me greatly. and honestly, if you want to drive a weird vehicle, the C5 is far more fun.

en.wikipedia.org/wiki/Sinclair

Nick Tune 🇺🇦 (@nick_tune) · Apr 19
🔁 @gsuberland:

discovering that fewer cybertrucks have been sold than Sinclair C5s has amused me greatly. and honestly, if you want to drive a weird vehicle, the C5 is far more fun.

en.wikipedia.org/wiki/Sinclair

Leonard Ritter (@lritter) · Apr 19
🔁 @gsuberland:

discovering that fewer cybertrucks have been sold than Sinclair C5s has amused me greatly. and honestly, if you want to drive a weird vehicle, the C5 is far more fun.

en.wikipedia.org/wiki/Sinclair

Joakim Fors (@joakimfors) · Apr 20
🔁 @gsuberland:

discovering that fewer cybertrucks have been sold than Sinclair C5s has amused me greatly. and honestly, if you want to drive a weird vehicle, the C5 is far more fun.

en.wikipedia.org/wiki/Sinclair

Debbie Goldsmith 🏳️‍⚧️🏳️‍🌈 (@dgoldsmith) · Apr 20
🔁 @gsuberland:

discovering that fewer cybertrucks have been sold than Sinclair C5s has amused me greatly. and honestly, if you want to drive a weird vehicle, the C5 is far more fun.

en.wikipedia.org/wiki/Sinclair

Michał "rysiek" Woźniak · 🇺🇦 (@rysiek) · Apr 20
🔁 @gsuberland:

discovering that fewer cybertrucks have been sold than Sinclair C5s has amused me greatly. and honestly, if you want to drive a weird vehicle, the C5 is far more fun.

en.wikipedia.org/wiki/Sinclair

Alda Vigdís :topspicy: 🇵🇸 (@alda) · Apr 19
🔁 @gsuberland:

discovering that fewer cybertrucks have been sold than Sinclair C5s has amused me greatly. and honestly, if you want to drive a weird vehicle, the C5 is far more fun.

en.wikipedia.org/wiki/Sinclair

The Deepwater Horizon’s Very Unhappy Anniversary | Hakai Magazine

hakaimagazine.com · Apr 19

A recent scientific expedition to the Gulf of Mexico seafloor shows just how little things have improved near the broken well.

Shared by @YimbyEarth and 23 others.
skry (@skry) · Apr 20
🔁 @helenczerski:

Exactly 14 years since the Deepwater Horizon disaster and the massive oil spill that followed, and the seabed there shows little sign of recovery.

We have to stop thinking that nature is just going to clean up our messes, and focus much more on how to prevent them in the first place. Not just the acute ones like this, but also the slower more insidious ones that are easy to ignore.

There is no "Away" where we can just put all the mess - it's all our own backyard.

hakaimagazine.com/news/the-dee

Xerophile (@xerophile) · Apr 20
🔁 @helenczerski:

Exactly 14 years since the Deepwater Horizon disaster and the massive oil spill that followed, and the seabed there shows little sign of recovery.

We have to stop thinking that nature is just going to clean up our messes, and focus much more on how to prevent them in the first place. Not just the acute ones like this, but also the slower more insidious ones that are easy to ignore.

There is no "Away" where we can just put all the mess - it's all our own backyard.

hakaimagazine.com/news/the-dee

Morpheus Being (@MorpheusB) · Apr 20
🔁 @helenczerski:

Exactly 14 years since the Deepwater Horizon disaster and the massive oil spill that followed, and the seabed there shows little sign of recovery.

We have to stop thinking that nature is just going to clean up our messes, and focus much more on how to prevent them in the first place. Not just the acute ones like this, but also the slower more insidious ones that are easy to ignore.

There is no "Away" where we can just put all the mess - it's all our own backyard.

hakaimagazine.com/news/the-dee

word saladin (@EdelweissBlood) · Apr 20
🔁 @helenczerski:

Exactly 14 years since the Deepwater Horizon disaster and the massive oil spill that followed, and the seabed there shows little sign of recovery.

We have to stop thinking that nature is just going to clean up our messes, and focus much more on how to prevent them in the first place. Not just the acute ones like this, but also the slower more insidious ones that are easy to ignore.

There is no "Away" where we can just put all the mess - it's all our own backyard.

hakaimagazine.com/news/the-dee

Nicole Parsons (@Npars01) · Apr 20
🔁 @helenczerski:

Exactly 14 years since the Deepwater Horizon disaster and the massive oil spill that followed, and the seabed there shows little sign of recovery.

We have to stop thinking that nature is just going to clean up our messes, and focus much more on how to prevent them in the first place. Not just the acute ones like this, but also the slower more insidious ones that are easy to ignore.

There is no "Away" where we can just put all the mess - it's all our own backyard.

hakaimagazine.com/news/the-dee

Lazarou Monkey Terror 🚀💙🌈 (@Lazarou) · Apr 19
🔁 @helenczerski:

Exactly 14 years since the Deepwater Horizon disaster and the massive oil spill that followed, and the seabed there shows little sign of recovery.

We have to stop thinking that nature is just going to clean up our messes, and focus much more on how to prevent them in the first place. Not just the acute ones like this, but also the slower more insidious ones that are easy to ignore.

There is no "Away" where we can just put all the mess - it's all our own backyard.

hakaimagazine.com/news/the-dee

Bill Minarik (@silicatefondue) · Apr 19
🔁 @helenczerski:

Exactly 14 years since the Deepwater Horizon disaster and the massive oil spill that followed, and the seabed there shows little sign of recovery.

We have to stop thinking that nature is just going to clean up our messes, and focus much more on how to prevent them in the first place. Not just the acute ones like this, but also the slower more insidious ones that are easy to ignore.

There is no "Away" where we can just put all the mess - it's all our own backyard.

hakaimagazine.com/news/the-dee

Yimby Earth (@YimbyEarth) · Apr 20
🔁 @helenczerski:

Exactly 14 years since the Deepwater Horizon disaster and the massive oil spill that followed, and the seabed there shows little sign of recovery.

We have to stop thinking that nature is just going to clean up our messes, and focus much more on how to prevent them in the first place. Not just the acute ones like this, but also the slower more insidious ones that are easy to ignore.

There is no "Away" where we can just put all the mess - it's all our own backyard.

hakaimagazine.com/news/the-dee

Cainmark 🚲 (@cainmark) · Apr 20
🔁 @helenczerski:

Exactly 14 years since the Deepwater Horizon disaster and the massive oil spill that followed, and the seabed there shows little sign of recovery.

We have to stop thinking that nature is just going to clean up our messes, and focus much more on how to prevent them in the first place. Not just the acute ones like this, but also the slower more insidious ones that are easy to ignore.

There is no "Away" where we can just put all the mess - it's all our own backyard.

hakaimagazine.com/news/the-dee

Millions of Birds Now Migrating Safely Through Darkened Texas Cities After Successful Lights Out Campaign

goodnewsnetwork.org · Apr 19

Reducing the reflections from exterior lighting on tall buildings worked to prevent 60% of all bird collision deaths in cities like Houston.

Shared by @qkslvrwolf and 28 others.

Scientists push new paradigm of animal consciousness, saying even insects may be sentient

nbcnews.com · Apr 19

Far more animals than previously thought likely have consciousness, top scientists say in a new declaration — including fish, lobsters and octopus.

Shared by @qkslvrwolf and 18 others.
Glyn Moody (@glynmoody) · Apr 20
🔁 @mpesce:

Scientists push new paradigm of animal consciousness, saying even insects may be sentient

Far more animals than previously thought likely have consciousness, top scientists say in a new declaration — including fish, lobsters and octopus.

nbcnews.com/science/rcna148213

kcarruthers (@kcarruthers) · Apr 20
🔁 @DharmaDog:

#consciousness #neuroscience
"The more scientists test animals, the more they find that many species may have inner lives and be sentient."

NBC News:
Scientists push new paradigm of animal consciousness

"Far more animals than previously thought likely have consciousness, top scientists say in a new declaration — including fish, lobsters and octopus."
nbcnews.com/science/science-ne

skry (@skry) · Apr 20
🔁 @DharmaDog:

#consciousness #neuroscience
"The more scientists test animals, the more they find that many species may have inner lives and be sentient."

NBC News:
Scientists push new paradigm of animal consciousness

"Far more animals than previously thought likely have consciousness, top scientists say in a new declaration — including fish, lobsters and octopus."
nbcnews.com/science/science-ne

Baldur Bjarnason (@baldur) · Apr 20
🔁 @mpesce:

Scientists push new paradigm of animal consciousness, saying even insects may be sentient

Far more animals than previously thought likely have consciousness, top scientists say in a new declaration — including fish, lobsters and octopus.

nbcnews.com/science/rcna148213

yes, it's me, liza 🇵🇷 🦛 🦦 (@blogdiva) · Apr 20
🔁 @DharmaDog:

#consciousness #neuroscience
"The more scientists test animals, the more they find that many species may have inner lives and be sentient."

NBC News:
Scientists push new paradigm of animal consciousness

"Far more animals than previously thought likely have consciousness, top scientists say in a new declaration — including fish, lobsters and octopus."
nbcnews.com/science/science-ne

excited for the mastodon rise (@qkslvrwolf) · Apr 20
🔁 @cdarwin:

A surprising range of creatures have shown evidence of conscious thought or experience, including insects, fish and some crustaceans
Bees play by rolling wooden balls — apparently for fun.
The cleaner wrasse fish appears to recognize its own visage in an underwater mirror.
Octopuses seem to react to anesthetic drugs and will avoid settings where they likely experienced past pain. 
All three of these discoveries came in the last five years
— indications that the more scientists test animals, the more they find that many species may have inner lives and be sentient.
nbcnews.com/science/science-ne

Marc Palmer (@marcpalmer) · Apr 20
🔁 @mpesce:

Scientists push new paradigm of animal consciousness, saying even insects may be sentient

Far more animals than previously thought likely have consciousness, top scientists say in a new declaration — including fish, lobsters and octopus.

nbcnews.com/science/rcna148213

Mensch, Marina (@energisch_) · Apr 20
🔁 @cdarwin:

A surprising range of creatures have shown evidence of conscious thought or experience, including insects, fish and some crustaceans
Bees play by rolling wooden balls — apparently for fun.
The cleaner wrasse fish appears to recognize its own visage in an underwater mirror.
Octopuses seem to react to anesthetic drugs and will avoid settings where they likely experienced past pain. 
All three of these discoveries came in the last five years
— indications that the more scientists test animals, the more they find that many species may have inner lives and be sentient.
nbcnews.com/science/science-ne

Nicole Parsons (@Npars01) · Apr 20
🔁 @cdarwin:

A surprising range of creatures have shown evidence of conscious thought or experience, including insects, fish and some crustaceans
Bees play by rolling wooden balls — apparently for fun.
The cleaner wrasse fish appears to recognize its own visage in an underwater mirror.
Octopuses seem to react to anesthetic drugs and will avoid settings where they likely experienced past pain. 
All three of these discoveries came in the last five years
— indications that the more scientists test animals, the more they find that many species may have inner lives and be sentient.
nbcnews.com/science/science-ne

GPT-4 Can Exploit Most Vulns Just by Reading Threat Advisories

darkreading.com · Apr 20

Existing AI technology can allow hackers to automate exploits for public vulnerabilities in minutes flat. Very soon, diligent patching will no longer be optional.

Shared by @hejsna and 25 others.
Dirk Steins (@dirksteins) · Apr 20
🔁 @mttaggart:

So, about this claim that GPT-4 can exploit 1-day vulnerabilities.

I smell BS.

As always, I
read the source paper.

Firstly, almost every vulnerability that was tested was on extremely well-discussed open source software, and each vuln was of a class with extensive prior work. I would be shocked if a modern LLM
couldn't produce a XSS proof-of-concept in this way.

But what's worse: they don't actually show the resulting exploit. The authors cite some kind of responsible disclosure standard for not releasing the prompts to GPT-4, which, fine. But these are all known vulns, so let's see what the model came up with.

Without seeing the exploit itself, I am dubious.

Especially because so much is keyed off of the CVE description:

We then modified our agent to not include the CVE description. This task is now substantially more difficult, requiring both finding the vulnerability and then actually exploiting it. Because every other method (GPT-3.5 and all other open-source models we tested) achieved a 0% success rate even with the vulnerability description, the subsequent experiments are conducted on GPT-4 only. After removing the CVE description, the success rate falls from 87% to 7%.

This suggests that determining the vulnerability is extremely challenging.
Even the identification of the vuln—which GPT-4 did 33% of the time—is a ludicrous metric. The options from the set are:

1. RCE
2. XSS
3. SQLI
4. CSRF
5. SSTI

With the first three over-represented. It would be surprising if the model did worse than 33%, even doing random sampling.

In their conclusion, the authors call their findings an "emergent capability," of GPT-4, given that every other model they tested had a 0% success rate.

At no point do the authors blink at this finding and interrogate their priors to look for potential error sources. But they really should.

So no, I do not believe we are in any danger of GPT-4 becoming an exploit dev.

GhostOnTheHalfShell (@GhostOnTheHalfShell) · Apr 20
🔁 @mttaggart:

So, about this claim that GPT-4 can exploit 1-day vulnerabilities.

I smell BS.

As always, I
read the source paper.

Firstly, almost every vulnerability that was tested was on extremely well-discussed open source software, and each vuln was of a class with extensive prior work. I would be shocked if a modern LLM
couldn't produce a XSS proof-of-concept in this way.

But what's worse: they don't actually show the resulting exploit. The authors cite some kind of responsible disclosure standard for not releasing the prompts to GPT-4, which, fine. But these are all known vulns, so let's see what the model came up with.

Without seeing the exploit itself, I am dubious.

Especially because so much is keyed off of the CVE description:

We then modified our agent to not include the CVE description. This task is now substantially more difficult, requiring both finding the vulnerability and then actually exploiting it. Because every other method (GPT-3.5 and all other open-source models we tested) achieved a 0% success rate even with the vulnerability description, the subsequent experiments are conducted on GPT-4 only. After removing the CVE description, the success rate falls from 87% to 7%.

This suggests that determining the vulnerability is extremely challenging.
Even the identification of the vuln—which GPT-4 did 33% of the time—is a ludicrous metric. The options from the set are:

1. RCE
2. XSS
3. SQLI
4. CSRF
5. SSTI

With the first three over-represented. It would be surprising if the model did worse than 33%, even doing random sampling.

In their conclusion, the authors call their findings an "emergent capability," of GPT-4, given that every other model they tested had a 0% success rate.

At no point do the authors blink at this finding and interrogate their priors to look for potential error sources. But they really should.

So no, I do not believe we are in any danger of GPT-4 becoming an exploit dev.

Sevoris (@Sevoris) · Apr 20
🔁 @mttaggart:

So, about this claim that GPT-4 can exploit 1-day vulnerabilities.

I smell BS.

As always, I
read the source paper.

Firstly, almost every vulnerability that was tested was on extremely well-discussed open source software, and each vuln was of a class with extensive prior work. I would be shocked if a modern LLM
couldn't produce a XSS proof-of-concept in this way.

But what's worse: they don't actually show the resulting exploit. The authors cite some kind of responsible disclosure standard for not releasing the prompts to GPT-4, which, fine. But these are all known vulns, so let's see what the model came up with.

Without seeing the exploit itself, I am dubious.

Especially because so much is keyed off of the CVE description:

We then modified our agent to not include the CVE description. This task is now substantially more difficult, requiring both finding the vulnerability and then actually exploiting it. Because every other method (GPT-3.5 and all other open-source models we tested) achieved a 0% success rate even with the vulnerability description, the subsequent experiments are conducted on GPT-4 only. After removing the CVE description, the success rate falls from 87% to 7%.

This suggests that determining the vulnerability is extremely challenging.
Even the identification of the vuln—which GPT-4 did 33% of the time—is a ludicrous metric. The options from the set are:

1. RCE
2. XSS
3. SQLI
4. CSRF
5. SSTI

With the first three over-represented. It would be surprising if the model did worse than 33%, even doing random sampling.

In their conclusion, the authors call their findings an "emergent capability," of GPT-4, given that every other model they tested had a 0% success rate.

At no point do the authors blink at this finding and interrogate their priors to look for potential error sources. But they really should.

So no, I do not believe we are in any danger of GPT-4 becoming an exploit dev.

Marcel Waldvogel (@marcel) · Apr 20
🔁 @mttaggart:

So, about this claim that GPT-4 can exploit 1-day vulnerabilities.

I smell BS.

As always, I
read the source paper.

Firstly, almost every vulnerability that was tested was on extremely well-discussed open source software, and each vuln was of a class with extensive prior work. I would be shocked if a modern LLM
couldn't produce a XSS proof-of-concept in this way.

But what's worse: they don't actually show the resulting exploit. The authors cite some kind of responsible disclosure standard for not releasing the prompts to GPT-4, which, fine. But these are all known vulns, so let's see what the model came up with.

Without seeing the exploit itself, I am dubious.

Especially because so much is keyed off of the CVE description:

We then modified our agent to not include the CVE description. This task is now substantially more difficult, requiring both finding the vulnerability and then actually exploiting it. Because every other method (GPT-3.5 and all other open-source models we tested) achieved a 0% success rate even with the vulnerability description, the subsequent experiments are conducted on GPT-4 only. After removing the CVE description, the success rate falls from 87% to 7%.

This suggests that determining the vulnerability is extremely challenging.
Even the identification of the vuln—which GPT-4 did 33% of the time—is a ludicrous metric. The options from the set are:

1. RCE
2. XSS
3. SQLI
4. CSRF
5. SSTI

With the first three over-represented. It would be surprising if the model did worse than 33%, even doing random sampling.

In their conclusion, the authors call their findings an "emergent capability," of GPT-4, given that every other model they tested had a 0% success rate.

At no point do the authors blink at this finding and interrogate their priors to look for potential error sources. But they really should.

So no, I do not believe we are in any danger of GPT-4 becoming an exploit dev.

Arcaik (@Arcaik) · Apr 20
🔁 @mttaggart:

So, about this claim that GPT-4 can exploit 1-day vulnerabilities.

I smell BS.

As always, I
read the source paper.

Firstly, almost every vulnerability that was tested was on extremely well-discussed open source software, and each vuln was of a class with extensive prior work. I would be shocked if a modern LLM
couldn't produce a XSS proof-of-concept in this way.

But what's worse: they don't actually show the resulting exploit. The authors cite some kind of responsible disclosure standard for not releasing the prompts to GPT-4, which, fine. But these are all known vulns, so let's see what the model came up with.

Without seeing the exploit itself, I am dubious.

Especially because so much is keyed off of the CVE description:

We then modified our agent to not include the CVE description. This task is now substantially more difficult, requiring both finding the vulnerability and then actually exploiting it. Because every other method (GPT-3.5 and all other open-source models we tested) achieved a 0% success rate even with the vulnerability description, the subsequent experiments are conducted on GPT-4 only. After removing the CVE description, the success rate falls from 87% to 7%.

This suggests that determining the vulnerability is extremely challenging.
Even the identification of the vuln—which GPT-4 did 33% of the time—is a ludicrous metric. The options from the set are:

1. RCE
2. XSS
3. SQLI
4. CSRF
5. SSTI

With the first three over-represented. It would be surprising if the model did worse than 33%, even doing random sampling.

In their conclusion, the authors call their findings an "emergent capability," of GPT-4, given that every other model they tested had a 0% success rate.

At no point do the authors blink at this finding and interrogate their priors to look for potential error sources. But they really should.

So no, I do not believe we are in any danger of GPT-4 becoming an exploit dev.

Saucy Barbine Movie (@risottobias) · Apr 20
🔁 @mttaggart:

So, about this claim that GPT-4 can exploit 1-day vulnerabilities.

I smell BS.

As always, I
read the source paper.

Firstly, almost every vulnerability that was tested was on extremely well-discussed open source software, and each vuln was of a class with extensive prior work. I would be shocked if a modern LLM
couldn't produce a XSS proof-of-concept in this way.

But what's worse: they don't actually show the resulting exploit. The authors cite some kind of responsible disclosure standard for not releasing the prompts to GPT-4, which, fine. But these are all known vulns, so let's see what the model came up with.

Without seeing the exploit itself, I am dubious.

Especially because so much is keyed off of the CVE description:

We then modified our agent to not include the CVE description. This task is now substantially more difficult, requiring both finding the vulnerability and then actually exploiting it. Because every other method (GPT-3.5 and all other open-source models we tested) achieved a 0% success rate even with the vulnerability description, the subsequent experiments are conducted on GPT-4 only. After removing the CVE description, the success rate falls from 87% to 7%.

This suggests that determining the vulnerability is extremely challenging.
Even the identification of the vuln—which GPT-4 did 33% of the time—is a ludicrous metric. The options from the set are:

1. RCE
2. XSS
3. SQLI
4. CSRF
5. SSTI

With the first three over-represented. It would be surprising if the model did worse than 33%, even doing random sampling.

In their conclusion, the authors call their findings an "emergent capability," of GPT-4, given that every other model they tested had a 0% success rate.

At no point do the authors blink at this finding and interrogate their priors to look for potential error sources. But they really should.

So no, I do not believe we are in any danger of GPT-4 becoming an exploit dev.

Baldur Bjarnason (@baldur) · Apr 20
🔁 @mttaggart:

So, about this claim that GPT-4 can exploit 1-day vulnerabilities.

I smell BS.

As always, I
read the source paper.

Firstly, almost every vulnerability that was tested was on extremely well-discussed open source software, and each vuln was of a class with extensive prior work. I would be shocked if a modern LLM
couldn't produce a XSS proof-of-concept in this way.

But what's worse: they don't actually show the resulting exploit. The authors cite some kind of responsible disclosure standard for not releasing the prompts to GPT-4, which, fine. But these are all known vulns, so let's see what the model came up with.

Without seeing the exploit itself, I am dubious.

Especially because so much is keyed off of the CVE description:

We then modified our agent to not include the CVE description. This task is now substantially more difficult, requiring both finding the vulnerability and then actually exploiting it. Because every other method (GPT-3.5 and all other open-source models we tested) achieved a 0% success rate even with the vulnerability description, the subsequent experiments are conducted on GPT-4 only. After removing the CVE description, the success rate falls from 87% to 7%.

This suggests that determining the vulnerability is extremely challenging.
Even the identification of the vuln—which GPT-4 did 33% of the time—is a ludicrous metric. The options from the set are:

1. RCE
2. XSS
3. SQLI
4. CSRF
5. SSTI

With the first three over-represented. It would be surprising if the model did worse than 33%, even doing random sampling.

In their conclusion, the authors call their findings an "emergent capability," of GPT-4, given that every other model they tested had a 0% success rate.

At no point do the authors blink at this finding and interrogate their priors to look for potential error sources. But they really should.

So no, I do not believe we are in any danger of GPT-4 becoming an exploit dev.

MaineC (@mainec) · Apr 20
🔁 @mttaggart:

So, about this claim that GPT-4 can exploit 1-day vulnerabilities.

I smell BS.

As always, I
read the source paper.

Firstly, almost every vulnerability that was tested was on extremely well-discussed open source software, and each vuln was of a class with extensive prior work. I would be shocked if a modern LLM
couldn't produce a XSS proof-of-concept in this way.

But what's worse: they don't actually show the resulting exploit. The authors cite some kind of responsible disclosure standard for not releasing the prompts to GPT-4, which, fine. But these are all known vulns, so let's see what the model came up with.

Without seeing the exploit itself, I am dubious.

Especially because so much is keyed off of the CVE description:

We then modified our agent to not include the CVE description. This task is now substantially more difficult, requiring both finding the vulnerability and then actually exploiting it. Because every other method (GPT-3.5 and all other open-source models we tested) achieved a 0% success rate even with the vulnerability description, the subsequent experiments are conducted on GPT-4 only. After removing the CVE description, the success rate falls from 87% to 7%.

This suggests that determining the vulnerability is extremely challenging.
Even the identification of the vuln—which GPT-4 did 33% of the time—is a ludicrous metric. The options from the set are:

1. RCE
2. XSS
3. SQLI
4. CSRF
5. SSTI

With the first three over-represented. It would be surprising if the model did worse than 33%, even doing random sampling.

In their conclusion, the authors call their findings an "emergent capability," of GPT-4, given that every other model they tested had a 0% success rate.

At no point do the authors blink at this finding and interrogate their priors to look for potential error sources. But they really should.

So no, I do not believe we are in any danger of GPT-4 becoming an exploit dev.

Tod Beardsley 🏴‍☠️ (@todb) · Apr 20
🔁 @mttaggart:

So, about this claim that GPT-4 can exploit 1-day vulnerabilities.

I smell BS.

As always, I
read the source paper.

Firstly, almost every vulnerability that was tested was on extremely well-discussed open source software, and each vuln was of a class with extensive prior work. I would be shocked if a modern LLM
couldn't produce a XSS proof-of-concept in this way.

But what's worse: they don't actually show the resulting exploit. The authors cite some kind of responsible disclosure standard for not releasing the prompts to GPT-4, which, fine. But these are all known vulns, so let's see what the model came up with.

Without seeing the exploit itself, I am dubious.

Especially because so much is keyed off of the CVE description:

We then modified our agent to not include the CVE description. This task is now substantially more difficult, requiring both finding the vulnerability and then actually exploiting it. Because every other method (GPT-3.5 and all other open-source models we tested) achieved a 0% success rate even with the vulnerability description, the subsequent experiments are conducted on GPT-4 only. After removing the CVE description, the success rate falls from 87% to 7%.

This suggests that determining the vulnerability is extremely challenging.
Even the identification of the vuln—which GPT-4 did 33% of the time—is a ludicrous metric. The options from the set are:

1. RCE
2. XSS
3. SQLI
4. CSRF
5. SSTI

With the first three over-represented. It would be surprising if the model did worse than 33%, even doing random sampling.

In their conclusion, the authors call their findings an "emergent capability," of GPT-4, given that every other model they tested had a 0% success rate.

At no point do the authors blink at this finding and interrogate their priors to look for potential error sources. But they really should.

So no, I do not believe we are in any danger of GPT-4 becoming an exploit dev.

C.Suthorn :prn: (@Life_is) · Apr 20
🔁 @mttaggart:

So, about this claim that GPT-4 can exploit 1-day vulnerabilities.

I smell BS.

As always, I
read the source paper.

Firstly, almost every vulnerability that was tested was on extremely well-discussed open source software, and each vuln was of a class with extensive prior work. I would be shocked if a modern LLM
couldn't produce a XSS proof-of-concept in this way.

But what's worse: they don't actually show the resulting exploit. The authors cite some kind of responsible disclosure standard for not releasing the prompts to GPT-4, which, fine. But these are all known vulns, so let's see what the model came up with.

Without seeing the exploit itself, I am dubious.

Especially because so much is keyed off of the CVE description:

We then modified our agent to not include the CVE description. This task is now substantially more difficult, requiring both finding the vulnerability and then actually exploiting it. Because every other method (GPT-3.5 and all other open-source models we tested) achieved a 0% success rate even with the vulnerability description, the subsequent experiments are conducted on GPT-4 only. After removing the CVE description, the success rate falls from 87% to 7%.

This suggests that determining the vulnerability is extremely challenging.
Even the identification of the vuln—which GPT-4 did 33% of the time—is a ludicrous metric. The options from the set are:

1. RCE
2. XSS
3. SQLI
4. CSRF
5. SSTI

With the first three over-represented. It would be surprising if the model did worse than 33%, even doing random sampling.

In their conclusion, the authors call their findings an "emergent capability," of GPT-4, given that every other model they tested had a 0% success rate.

At no point do the authors blink at this finding and interrogate their priors to look for potential error sources. But they really should.

So no, I do not believe we are in any danger of GPT-4 becoming an exploit dev.

Worth reading

What a difference four years makes

ianbetteridge.com · Apr 19

John Gruber in 2020 on the tracking industry led by Facebook: The entitlement of these fuckers is just off the charts. They have zero right, none, to the tracking they’ve been getting away with. We…

Shared by @Jeremiah and 15 others.
flere-imsaho (@mawhrin) · Apr 19
🔁 @ianbetteridge.com:

1. Four years is a long time in tech punditry

I’m going to break one of my self-imposed rules and include a link to a piece I wrote, on how John Gruber’s attitude towards Meta’s privacy-violating monopoly has changed over the past four years. You can work out what changed John’s mind. I couldn’t possibly comment.

2. Why we do reviews

It’s not for of the companies whose products we look at. Back when I was starting Alphr, MKBHD was one of the reviewers we looked to as the gold standard: approachable, accurate, personal. Nothing has changed on that score, he’s still superb at what he does.

3. This week’s “no”

No.

4. The rot economy is real

Ed Zitron has been writing so much good stuff lately, and this piece delivers. As he notes, venture capital doesn’t reward “good” companies – it rewards companies that can be profitably flipped. The system is broken.

5. Tesla was always a bubble stock

The Wall Street Journal does something that’s long overdue and has a look at the inside story of Tesla’s fall to earth. Technology companies are often valued by their potential for future growth, and Tesla was no exception. But at one point it was also valued at more than the rest of the car industry put together. That’s well beyond potential future profits and into bubble territory – unless you believe that at some point in the future, Tesla would have had a monopoly on cars. Now, of course, it faces competition, and unsurprisingly, the traditional carmakers build better quality vehicles than Tesla, and the Chinese companies build them cheaper AND better. Even Elon Musk’s ability to make himself the main character every day isn’t going to save them.

6. The internet is broken

“Your Uber driver is lost because his app hasn’t updated and keeps telling him to turn down streets that no longer exist. You still give him five stars.” File this under “I wish I had written it.” Brilliant.

7. There is no EU cookie banner law

No, really, there isn’t. I think the biggest mistake of GDPR was not being tough enough.

8. CEOs are just as dumb as everyone else

Just as likely to fall for conspiracy nonsense, just as likely to repost it. And in tech, they’re terminally online, too, which makes them even more likely to fall for bullshit.

9. Welcome to the new feudal era

If you want a clear explanation of how and why we are falling back into feudalism, Cory has you covered. This is why the EU DMA is so important: it’s an attempt to wrestle us back from the edge of rentiers and liege lords and into competitive markets again.

10. Nilay

If MKBHD was one of our touchstones when building Alphr, The Verge was the other. This is a great, long interview with Nilay Patel, AKA the smartest man in tech journalism. If you’re in any kind of journalism, you should read it.

https://ianbetteridge.com/2024/04/19/ten-blue-links-my-how-you-have-changed-edition/

cms (@cms) · Apr 19
🔁 @ianbetteridge.com:

1. Four years is a long time in tech punditry

I’m going to break one of my self-imposed rules and include a link to a piece I wrote, on how John Gruber’s attitude towards Meta’s privacy-violating monopoly has changed over the past four years. You can work out what changed John’s mind. I couldn’t possibly comment.

2. Why we do reviews

It’s not for of the companies whose products we look at. Back when I was starting Alphr, MKBHD was one of the reviewers we looked to as the gold standard: approachable, accurate, personal. Nothing has changed on that score, he’s still superb at what he does.

3. This week’s “no”

No.

4. The rot economy is real

Ed Zitron has been writing so much good stuff lately, and this piece delivers. As he notes, venture capital doesn’t reward “good” companies – it rewards companies that can be profitably flipped. The system is broken.

5. Tesla was always a bubble stock

The Wall Street Journal does something that’s long overdue and has a look at the inside story of Tesla’s fall to earth. Technology companies are often valued by their potential for future growth, and Tesla was no exception. But at one point it was also valued at more than the rest of the car industry put together. That’s well beyond potential future profits and into bubble territory – unless you believe that at some point in the future, Tesla would have had a monopoly on cars. Now, of course, it faces competition, and unsurprisingly, the traditional carmakers build better quality vehicles than Tesla, and the Chinese companies build them cheaper AND better. Even Elon Musk’s ability to make himself the main character every day isn’t going to save them.

6. The internet is broken

“Your Uber driver is lost because his app hasn’t updated and keeps telling him to turn down streets that no longer exist. You still give him five stars.” File this under “I wish I had written it.” Brilliant.

7. There is no EU cookie banner law

No, really, there isn’t. I think the biggest mistake of GDPR was not being tough enough.

8. CEOs are just as dumb as everyone else

Just as likely to fall for conspiracy nonsense, just as likely to repost it. And in tech, they’re terminally online, too, which makes them even more likely to fall for bullshit.

9. Welcome to the new feudal era

If you want a clear explanation of how and why we are falling back into feudalism, Cory has you covered. This is why the EU DMA is so important: it’s an attempt to wrestle us back from the edge of rentiers and liege lords and into competitive markets again.

10. Nilay

If MKBHD was one of our touchstones when building Alphr, The Verge was the other. This is a great, long interview with Nilay Patel, AKA the smartest man in tech journalism. If you’re in any kind of journalism, you should read it.

https://ianbetteridge.com/2024/04/19/ten-blue-links-my-how-you-have-changed-edition/

Lars Wirzenius (@liw) · Apr 19
🔁 @ianbetteridge.com:

1. Four years is a long time in tech punditry

I’m going to break one of my self-imposed rules and include a link to a piece I wrote, on how John Gruber’s attitude towards Meta’s privacy-violating monopoly has changed over the past four years. You can work out what changed John’s mind. I couldn’t possibly comment.

2. Why we do reviews

It’s not for of the companies whose products we look at. Back when I was starting Alphr, MKBHD was one of the reviewers we looked to as the gold standard: approachable, accurate, personal. Nothing has changed on that score, he’s still superb at what he does.

3. This week’s “no”

No.

4. The rot economy is real

Ed Zitron has been writing so much good stuff lately, and this piece delivers. As he notes, venture capital doesn’t reward “good” companies – it rewards companies that can be profitably flipped. The system is broken.

5. Tesla was always a bubble stock

The Wall Street Journal does something that’s long overdue and has a look at the inside story of Tesla’s fall to earth. Technology companies are often valued by their potential for future growth, and Tesla was no exception. But at one point it was also valued at more than the rest of the car industry put together. That’s well beyond potential future profits and into bubble territory – unless you believe that at some point in the future, Tesla would have had a monopoly on cars. Now, of course, it faces competition, and unsurprisingly, the traditional carmakers build better quality vehicles than Tesla, and the Chinese companies build them cheaper AND better. Even Elon Musk’s ability to make himself the main character every day isn’t going to save them.

6. The internet is broken

“Your Uber driver is lost because his app hasn’t updated and keeps telling him to turn down streets that no longer exist. You still give him five stars.” File this under “I wish I had written it.” Brilliant.

7. There is no EU cookie banner law

No, really, there isn’t. I think the biggest mistake of GDPR was not being tough enough.

8. CEOs are just as dumb as everyone else

Just as likely to fall for conspiracy nonsense, just as likely to repost it. And in tech, they’re terminally online, too, which makes them even more likely to fall for bullshit.

9. Welcome to the new feudal era

If you want a clear explanation of how and why we are falling back into feudalism, Cory has you covered. This is why the EU DMA is so important: it’s an attempt to wrestle us back from the edge of rentiers and liege lords and into competitive markets again.

10. Nilay

If MKBHD was one of our touchstones when building Alphr, The Verge was the other. This is a great, long interview with Nilay Patel, AKA the smartest man in tech journalism. If you’re in any kind of journalism, you should read it.

https://ianbetteridge.com/2024/04/19/ten-blue-links-my-how-you-have-changed-edition/

Too hot for a lizard? Climate change quickens the pace of extinction

cbsnews.com · Apr 19

A disappearing lizard population in the mountains of Arizona shows how climate change is fast-tracking the rate of extinction.

Shared by @MorpheusB and 6 others.
Lisa Melton (@lisamelton) · Apr 19
🔁 @ClimateNewsNow:

Too hot for a lizard? Climate change quickens the pace of extinction.

The loss of plant and animal species on Earth is happening at a speed never seen in human history, according to the United Nations. #ClimateChange #Biodiversity #Climate #Environment

cbsnews.com/news/lizard-popula

Flipboard Science Desk (@ScienceDesk) · Apr 19
🔁 @ClimateNewsNow:

Too hot for a lizard? Climate change quickens the pace of extinction.

The loss of plant and animal species on Earth is happening at a speed never seen in human history, according to the United Nations. #ClimateChange #Biodiversity #Climate #Environment

cbsnews.com/news/lizard-popula

Morpheus Being (@MorpheusB) · Apr 20
🔁 @sasyecat:

Too hot for a lizard? Climate change quickens the pace of extinction

flip.it/-9Zxip

Taking Big Oil to court for 'climate homicide' isn't as far-fetched as it sounds

grist.org · Apr 19

Scholars are making the case that fossil fuel companies could be charged with murder. Prosecutors are paying attention.

Shared by @finally and 8 others.
Jo Jitsu (@JoBlakely) · Apr 19
🔁 @Snoro:

A paper published in Harvard Environmental Law Review last week argues that fossil fuel companies have been “killing members of the public at an accelerating rate.” It says that oil giants’ awareness that their pollution could have lethal consequences solidly fits within the definition of homicide, which, in its basic form, is causing death with a “culpable mental state.” In other words, the case can be made that oil companies knew what they were doing

grist.org/accountability/big-o

#Climate

Categorical Imperative (@finally) · Apr 19
🔁 @PeterRu:

Taking Big Oil to court for 'climate homicide' isn't as far-fetched as it sounds | Grist Apr 19, 2024

A new legal theory suggests that oil companies could be taken to court for every kind of homicide in the United States, short of first-degree murder.

The idea of “climate homicide” is getting attention in law schools and district attorney’s offices around the country. A paper published in Harvard Environmental Law Review last week argues that fossil fuel companies have been “killing members of the public at an accelerating rate.” It says that oil giants’ awareness that their pollution could have lethal consequences solidly fits within the definition of homicide, which, in its basic form, is causing death with a “culpable mental state.” In other words, the case can be made that oil companies knew what they were doing.

“It’s sparking a lot of conversation,” said Aaron Regunberg, senior policy counsel at the advocacy group Public Citizen. After discussing the idea with elected officials and prosecutors, Regunberg said, many of them have moved from “‘Oh, that’s crazy’ to ‘Oh, that makes sense.’”

grist.org/accountability/big-o

El Santo Negro :gitea: (@elsantonegro) · Apr 19
🔁 @Snoro:

A paper published in Harvard Environmental Law Review last week argues that fossil fuel companies have been “killing members of the public at an accelerating rate.” It says that oil giants’ awareness that their pollution could have lethal consequences solidly fits within the definition of homicide, which, in its basic form, is causing death with a “culpable mental state.” In other words, the case can be made that oil companies knew what they were doing

grist.org/accountability/big-o

#Climate

Bread and Circuses (@breadandcircuses) · Apr 19
🔁 @Snoro:

A paper published in Harvard Environmental Law Review last week argues that fossil fuel companies have been “killing members of the public at an accelerating rate.” It says that oil giants’ awareness that their pollution could have lethal consequences solidly fits within the definition of homicide, which, in its basic form, is causing death with a “culpable mental state.” In other words, the case can be made that oil companies knew what they were doing

grist.org/accountability/big-o

#Climate

Peggy March (@RebelGeo) · Apr 19
🔁 @Snoro:

A paper published in Harvard Environmental Law Review last week argues that fossil fuel companies have been “killing members of the public at an accelerating rate.” It says that oil giants’ awareness that their pollution could have lethal consequences solidly fits within the definition of homicide, which, in its basic form, is causing death with a “culpable mental state.” In other words, the case can be made that oil companies knew what they were doing

grist.org/accountability/big-o

#Climate

Dr. Brad Rosenheim (@Brad_Rosenheim) · Apr 19
🔁 @Snoro:

A paper published in Harvard Environmental Law Review last week argues that fossil fuel companies have been “killing members of the public at an accelerating rate.” It says that oil giants’ awareness that their pollution could have lethal consequences solidly fits within the definition of homicide, which, in its basic form, is causing death with a “culpable mental state.” In other words, the case can be made that oil companies knew what they were doing

grist.org/accountability/big-o

#Climate

Amandine B (She/Her) (@eco_amandine) · Apr 19
🔁 @mzedp:

""Taking Big Oil to court for ‘climate homicide’ isn’t as far-fetched as it sounds"

The idea of “climate homicide” is getting attention... A paper published in Harvard Environmental Law Review last week argues that fossil fuel companies have been “killing members of the public at an accelerating rate.”

After discussing the idea (...), moved from “‘Oh, that’s crazy’ to ‘Oh, that makes sense.’” "

#ClimateCrisis #OOTT #OilAndGas #Energy #ClimateHomicide #Law #Lawfedi

grist.org/accountability/big-o

There are no more posts at this time, but we are constantly looking for new ones.

© 2021 IN2 Digital Innovations GmbH . All rights reserved.