There is never enough time, thank you for yours.

Available elsewhere as acepace
Joined October 2014
The WhatsApp complaint vs NSO contains some fun technical exhibits. The user manual and Ghana contract reveal quite a bit on NSOs system design and thinking.
3
73
12
200
First blood?
Update: Our PHP exploit is now production-grade. * stock php.ini-production, display_errors=off, normal memory_limit, multi-worker, ASLR, under load * ARM64 + x86-64 targets * MediaWiki, WordPress, phpBB, Laravel * Apache/mod_php and nginx/php-fpm -> root xitter.cf/dguido/status/21131291…
2
814
Besides being the best cybersecurity awareness month ever, there are a lot of reasons to be optimistic right now.
Security is a process. We are working the process of security.
2
6
303
Using AI we can rebuild more systems to be resiliant. We know the components of a secure system, such as separate identities, least privilege, segmentation, and choke points in the software process. We know the process behind hardware root of trust and TCB design
1
1
31
The only thing doom and gloom gets us is more passivity.
24
Ace Pace retweeted
I've been cooking on this post for a bit, but with the cyber security events of this week I had to ship it: Long-live static credentials must die. We never want to rotate API keys again. Turns out only 8% of cloud and SaaS vendors support secure alternative. This is our call to action to change this AND our commitment to do our part: - We are requiring vendors on our marketplace to support OIDC - We shipped @shadcn components to make it easier to ship OIDC configuration - We are expanding OIDC support on our own platform The last generation got the web from HTTP to HTTPS. It is on us to move past API keys. vercel.com/blog/death-to-lon…
66
90
28
936
65,107
Have the internet synchronize their patches to handle this vulnerability and they can't pull an updated container image (even if they did everything right) because somebody else screwed up a little step
PHP docker image built failed because the maintainer locked the comments and the CI has a step posting status to github comments.
1
3
314
i think this evening-into-morning has been a fascinating storm of chaos and uncertainty with potential proof of concept exploits (generated by LLMs) being shared publicly and privately (then analyzed by LLMs) without clarity or understanding of what is actually "the" exploit or if it is "other" exploits (found by LLMs) all to hope for potential defenses (built by LLMs) we used to be so concerned with robots hallucinating at this point we might be the ones hallucinating ourselves
32
51
3
636
36,151
Ace Pace retweeted
👀
First time that a @Google model is getting to the top of @Tenzai_Labs's leaderboard. Gemini 4 Argon looks pretty good. More details soon.
1
8
231
I feel if there's going to be progress on alignment it'll need to be better posed and have real scientific infrastructure. ML has been successful because we've had a series of capabilities hills to climb since mnist, imagenet, hellaswag, etc, that made results commensurate and legible to researchers who weren't friends and didn't know each other and were competing with each other. There's nothing analogous in interpretability and alignment and the problems aren't well posed and it'll feel like treading water (or sinking) until that's solved
there have not been fundamental advancements in alignment since RLHF. most of the stuff remains at the level of folk theory rather than scientific or engineering disciplines. the prediction that capabilities would race far ahead of interp and alignment has come true imo
5
3
3
24
2,799
Ace Pace retweeted
Here are a few more remarks on what is happening in France at the moment. This movement is a problem for the government for a number of reasons. First, protesters are very young, which makes the movement more difficult to deal with than a typical strike. Indeed, whereas a typical strike is organized by trade unions (with a security service that deals with trouble makers during protests), so things are much more likely to get out of hand and the government doesn't have a clear interlocutor. Moreover, it means that it's much more difficult to rely on repression to deal with the problem, because it's a pretty bad look for cops to beat up a 16-year-old and the government would like to keep videos of that kind of things to a minimum for PR reasons. There is also the additional risk that, if cops end up killing a kid and the kid in question happens to be Black or Arab, the government will probably have race riots on its hands in addition to a more typical, except for the age of the participants and lack of organization, social movement. Another reason why it's hard for the government to deal with this movement is that it's broke. Traditionally, the French government deals with large social movements by a combination of repression and spreading money around to buy peace, which for instance is how Macron was able to defuse the yellow vests movement in 2018. But we are in the middle of a fiscal crisis with heavy upward pressure on French treasury bond yields and the government knows that, were it to try to defuse the situation by spending money it doesn't have, the yields may get out of control and turn the fiscal crisis into a full-blown panic. As for why this is happening, I think people are overthinking it. I constantly see people who take at face value the grievances expressed by the most articulate of the protesters and assume they are the cause of this movement, but I think it's kind of ridiculous. Have people ever talked to a 16-year-old before? They are protesting because it's fun, there is something exhilarating about thinking you're part of something important, it gives you an excuse to miss class and the carnival atmosphere in which normal rules seemingly no longer apply is very exciting. This is especially true for young male protesters. One thing you must never lose sight of is that male human teenagers are, by a wide margin, the stupidest creatures in the universe. This explains a lot of what is happening and has nothing to do with complicated sociological explanations. Of course, if journalists interview them, they will talk about the lack of resources, the long hours, etc. and sometimes even bring up more general issues about the current socio-political environment, but they're just repeating the rationalizations they hear people talk about on TV or, more likely in that age group, on social media. It doesn't mean that the specific grievances they are talking about when you elicit justifications for them are the causes of their behavior and I think to believe that you really need to have a very unrealistic view of what a typical 16-year-old is like. The causes are much dumber than that in all likelihood and it's the kind of things I was talking about above. Now obviously this kind of things doesn't explain why this is only happening now and not all the time, high-schoolers have always loved to miss class and feel they're part of something important yet they weren't protesting and burning their schools until recently, but here too I think people are kind of overthinking things. There is a tendency for commentators to assume that everything has some kind of deep, structural explanation, but maybe sometimes there isn't? It's the same thing for people who think it's orchestrated by a handful of groups conspiring in the shadows. For instance, the press has revealed that French domestic intelligence had produced a note claiming that the far-left was behind the protests and conservatives naturally were eager to accept that explanation, but frankly if you read the articles about that note, it seems kind of weak sauce and doesn't really show much. All it shows is that, in a handful of schools in a specific department, far-left activists joined the high-schoolers and advised them on what to do. I'm sure that's true, and I think it's true in many other places, but it doesn't explain why this movement happened when it did. If far-left activists could start such a movement so easily, it would happen all the time because they always try to stir up shit, but it doesn't because it's not that easy to start a massive social movement and that's not something anyone really controls in a meaningful way. I think what happened is that high-schoolers in a handful of schools had very localized grievances, for whatever reasons they decided to make a mess and organize a blocus of their schools, posted videos on social media and then it spread through social contagion. This was fueled by the fact that France has a strong protest tradition, so in that environment people naturally think about this mode of action and the idea of going into the streets and blockading their school will come kind of naturally to them. Once such a movement crosses a certain threshold, it's not particularly mysterious why it will very quickly spread, so the only thing that requires a special explanation is why it crossed that threshold in the first place, but I think it's quite likely that it was just the chance coincidence of random factors. Again, commentators are reluctant to accept that sometimes there is no deeper explanation than that, because if that's the explanation then it means they don't have anything particularly interesting to say, but I think often there is nothing more to it than that and people shouldn't be looking for deep, structural explanations that don't exist.
The police don’t intervene because politicians are terrified that if they do one of the youths will end up dead, which they fear would make things worse, so the government is giving instructions to the police to let them run wild, identify the leaders of the violence and arrest them later at home where the risk of police brutality leading to death is minimal. The calculus is that, once they have taken out the equation enough of the most violent protesters and the rest of them get bored, the protests will die down and the government won’t face scrutiny for killing some of them. It will absolutely work by the way, but it will come at a cost, since it also means there will be more destruction. You may criticize that strategy, I for one certainly find it shameful, but realistically that’s just politicians responding to incentives. The government will take shit for this, but from their point of view, it beats having to deal much worse race riots because a cop killed a kid and the suburbs erupt in an orgy of violence as a result. This is what "multiculturalism" looks like in Europe right now and if you don’t like it you’ré a fascist 🤷‍♂️
53
80
22
843
155,463
Ace Pace retweeted
FBI loses extremely sensitive data of agents due to lack of patching, a common problem that’s caused major breaches. Meh? Korean banks get attacked in the stupidest way possible, no money touched, names and loan limits may have been compromised. But AI was involved! Headlines!
This hacker is truly legendary. A complete amateur. 1. He left directory listing enabled on his own server, so researchers could figure out who he was with barely any effort. 2. They found files like CLAUDE.md and went through his Claude Code sessions. 3. There were questions like, “Where can I sell this data?” 4. He’d also asked, “Can you write my résumé?” That pretty much handed them all his personal information. 5. Apparently, he’s a student at South China University of Technology living in Guangdong. His name, phone number, and where he lives have all been identified.
1
1
8
2,619
Comparison work at scale is full of data cleanup before you reach the thinking stage. Oddly, AI makes this harder by hiding from you the need to do this and rarely does it itself
Replying to @psifertex
When the models run unsupervised (pun intended), the result probably isn't measuring what you think it's measuring! LLMs still lack good judgment. Context for that link: decbench "fixes" HexRays output formatting to work with the evaluator but doesn't for other tools. (2/2)
2
169
אף אחד בממשלה לא ייקח אחריות על הקטסטרופה המטורפת הזו. אף אחד. תזכרו מה אני אומר לכם. בכירים בצה״ל יתפטרו, חלקם יודחו, אבל לא יהיה אדם אחד בממשלה - לא ראש הממשלה, לא שר הביטחון, לא חברי הקבינט הביטחוני, שייקחו אלפית אחריות. כשהמלחמה הזו תיגמר ונספור את מתינו, תחל הבריחה מאחריות.
383
1,713
185
12,757
641,056
Ace Pace retweeted
The thing I learned this year is that when engineers say they like working on “hard problems”, they actually don't. What they like is puzzle solving, and having a repertoire of patterns that they can pattern match onto traditionally hard problems, usually involving databases or something with scale, etc. And they know that the industry used to pay you a lot for how deep and broad this repertoire was. Unfortunately, in 2026, well, you have a cheat code machine that has infinite breadth and depth for pattern matching. So the question is, do you actually like hard problems? Because there are now hard problems that are a complection of engineering, product, society, culture, politics, and they are fairly intractable, probably unsolvable! Because if you do want to work on those actually hard problems, there is so much money that people will pay you for it. But you’ll have to face that truth about yourself first.
182
416
85
5,949
283,491
Ace Pace retweeted
תמיד כשמתפרסמות ידיעות על אנשים שתכננו לעשות דברים מטורפים לחלוטין, אני בעיקר לא מבין מנין הפאקינג אסרטיביות. אני כבר שבועיים מדחיין את המטלה "לקבוע שיננית". בינתיים יש אנשים שקמים בבוקר ומתכננים לפרטי פרטים איך להבעיר את המזרח התיכון. תנוחו רגע ותעשו דומסקרולינג
17
14
5
825
19,600
בספטמבר 1939, עת גייסות גרמניים שעטו בפולין, מונה ג'ורג' מרשל לרמ"ט הכומ"ז האמריקני. הוא פגש סגל קצונה בכירה זקן, עייף ומנופח שקודם כפועל יוצא מפז"מ. הוא דחף חקיקה ראשית לשינוי שיטת הקידום ולמתן סמכות להדחה. הוא מינה וועדה בראשות קצינים בכירים בדימוס לבחינת פיטורין המוניים (היפרדות, בעגת בכירים) של קצינים בכירים. הועדה הזו שלחה כ-600 קצינים בדרגות אל"מ ומעלה הביתה עוד לפני פרל הארבור. הוא ערך תרגילים רחבי היקף שעל בסיסם הודחו 31 מ-42 מפקדים בדרגי האוגדה עד ארמיה שהיו בצבא עד אז. הוא הדיח 18 מתוך 19 מפקדי האוגדות במשמר הלאומי. לאחר שארה"ב נכנסה למלחמה, מלחמה עצמה הוא הדיח (לא בהכרח פיטר) חמישה מפקדי גיס ו-16 מפקדי אוגדות (שזה עשרה אחוזים ממפקדי האוגדות במלחמה). את כל החבר'ה האלה הוא החליף בקצינים מוכשרים - גם אם קצת קשים לעיכול לפעמים (ע"ע פאטון) שהיו תקועים שנים בדרגות השדה. אלה הקצינים שארה"ב ניצחה איתם את המלחמה (אייזנהאואר, בראדלי, רידג'וויי וכו). כך, אייזנהאואר התחיל את המלחמה סא"ל וסיים אותה גנרל 4 כוכבים. האדם הזה, שיש לו מניות אדירות בניצחון באירופה, לא היה מגיע אפילו להיות מח"ט בשיטות המקובלות. אבל מצביא אינו מח"ט ומח"ט אינו מצביא. והוא לא היה היחיד שעשה קפיצה מסא"ל לגנרל. ובמהלך המלחמה הצבא האמריקני נקט במגוון דרכים יצירתיות במנהל כוח האדם שלו. כולל גיוס של טאלנטים ישירות לדרגות בכירות. נשיא ג'נרל מוטורס קיבל דרגת רא"ל ואת משימת תכנון הייצור המלחמתי; נשיא אמריקן איירליינס קיבל דרגת אל"מ (ובסוף המלחמה כבר היה אלוף) ואת הפיקוד על פיקוד השינוע האווירי; שורה של במאי מהוליווד קיבלה דרגות סא"ל ואל"מ והלכה לעשות סרטי תעמולה (והמשיכה בשטאנץ עד וייטנאם בהתנדבות) ועוד. היום בצבאות מתווכחים אם לתת לאנשים עם תואר שלישי סרן אחרי ששולחים אותם לקורס שקר כלשהו בחור כלשהו במדבר (זה תמיד חור כלשהו) ואז מתבכיינים שיש משבר. הפז"מ, המאפיות\קליקות והקידום הליניארי הם אוייבי המערכת. השיטה הקיימת (שקיימת, בלחץ, אולי 200 שנה) גוזרת מעולם לוחמת היבשה לכלל תפקודי המערכת והתוצאה...ובכן...אנחנו רואים אותה ביום-יום, כל יום. #פידצבא
🟨 עד כה דרפטי הדיח כמה עשרות קצינים בכירים בדרגת אל"מ ומעלה. לחלק מהם מונו מחליפים, למשל מפקדי גייסות 19&11, מפקד חיל התותחנים וסגן מפקד זרוע היבשה. אבל! לרובם לא מונו מחליפים, תפקידם בוטל. לפי דרפטי באוקראינה יש יותר מידי קצינים בכירים, לכל אחד כזה צריך לשכה וחיילים וקצינים, והכי גרוע? כל אחד רוצה להיות משפיע, כל אחד רוצה להיות מקבל החלטות, וזה מעכב את הבירוקרטיה של הצבא.
18
11
3
294
9,788
Ace Pace retweeted
Working on a new little project. The 𝚁𝙴𝙰𝙳𝙼𝙴 is fully written by hand, because it's for human consumption. The documentation internals are AI English, because they're for agents. This little rule of thumb can make the world better. Blogs, tweets, READMEs: human communication. It's not even about "em dashes" or lack thereof. It's that it's the story-telling moment where you want to connect with other humans through their words.
180
68
26
1,680
114,451
Ace Pace retweeted
5
30
128
10,410