Certified Information Security Sleepless Parent

Houston
Joined February 2009
Efrain Torres retweeted
New: Chinese hackers broke into Staples. Staples has an internal customer support tool called Nexus, Chinese hackers got into that, issued millions of dollars of gift cards. Mules then went on a spending spree across the U.S. Gang made $100 million+ 404media.co/how-a-massive-ch…
24
271
30
1,640
128,760
Efrain Torres retweeted
Un investigador de Anthropic acaba de decirle a una sala llena de doctorandos que su plan de carrera ya no existe. La charla se titula "El fin del Antropoceno" y los datos son brutales: → El cómputo para entrenar modelos se multiplicó por 10 millones en la última década → La duración de las tareas que una IA completa sola se duplica cada pocos meses → Desde hace 7 meses los modelos resuelven problemas abiertos de Erdős que los matemáticos no habían logrado cerrar → En San Francisco, tener "timelines largos" significa pensar que la AGI llega en 10 años Su proyección: el cómputo de 2030 será 10.000 veces mayor que el de 2025. Todavía estamos al principio de la exponencial. Sus 3 consejos para los estudiantes: 1. Usa la IA cada día. Si estás sobre la exponencial, nunca te quedas atrás de ella. 2. Elige proyectos que mejoren cuando el cómputo escala. El resto quedará resuelto antes de que los termines. 3. Deja de planificar tu carrera como si fuera estable. La opción segura ya no compra seguridad, ya no existe. Y una frase que resume todo: "Escribir es pensar. Si externalizas tu escritura, externalizas tu pensamiento." La charla completa aquí ⬇️
230
1,511
188
8,430
1,060,322
Efrain Torres retweeted
"What are you doing?" - "Oh just playing a Switch game."
185
2,522
192
30,311
1,113,542
Efrain Torres retweeted
Muy atentos. El exjefe paramilitar @MancusoSalvat reconfirma todo lo que revelé en mi columna al país, el gobierno Petro y su Pacto de Valledupar para destruir a la oposición.
187
2,788
190
5,267
186,265
Efrain Torres retweeted
完蛋了…..以后中国开源模型只能开源小参数的模型了…. 商务部科技部就修订《中国禁止出口限制出口技术目录》征求意见,为期一个月,涉及人工智能(大模型、智能体、算力集群、信息处理等23项)生物医药、光伏3个领域。 1️⃣限制出口AI大模型:超过10^26计算量、或2T参数、或公开评估排名全球前10的大模型。 2️⃣限制出口智能体Agent:工具调用与系统操作技术,支持集成的第三方工具数量≥200个,工具选择准确率≥90%,且在需要调用3种及以上工具协同完成任务场景中,端到端任务平均成功率≥90%;自主规划与任务分解技术,可将自然语言指令自动拆解≥20步可执行子任务链,子任务分解精度≥80%,且子任务平均成功率≥90%;标准博弈基准超过90%的人类的博弈决策技术;得分75%以上的AI辅助漏洞挖掘技术。 限制出口算力集群技术:片间互联技术、分布式训练容错技术、通信调度技术、异构集群高效推理与调度。 征求意见期间,出口相关技术需向商务部填报登记表。已通过开源、发表学术论文等方式进入公共领域的技术,不纳入管理范围。 (中国商务部) 目前看来@Kimi_Moonshot 的K4、@MiniMax_AI 的M3 Pro、@Zai_org 的GLM5以及@deepseek_ai 的下一代模型都没法开源了….. 而且相关架构、训练优化和推理加速技术也都不行了。
Readers added context they thought people might want to know
该帖称中国大模型今后“没法开源了”、只能开源小参数模型,与官方文件不符。公告明确支持人工智能开源创新生态,对已通过开源等方式进入公共领域的技术不纳入管理范围,并对开源情形适用自动许可等便利措施(仍在征求意见中)。 mofcom.gov.cn/zwgk/zcfb/art/… mofcom.gov.cn/syxwfb/art/202…
168
149
90
1,510
314,485
Efrain Torres retweeted
If you're into Windows internals, reverse engineering or exploit development, bookmark this. The @OpenSecTraining has an incredible collection of FREE low-level security courses covering: - x86-64 assembly - Windows kernel internals - Windows kernel exploitation - WinDbg from introductory to advanced - IDA + Ghidra + Binary Ninja - HyperDbg - UEFI internals - Intel firmware attack + defense - C/C++ vulnerability research - Symbolic analysis - C++ binary reversing - AFL++ fuzzing - TPM + trusted computing - Intel SPI analysis - OS internals - RISC-V - Emulator development with QEMU There is even a dedicated Windows kernel exploitation course covering race conditions + UAFs in KTM. Proper low-level material, not another surface-level security course. Start digging: p.ost2.fyi/ #WindowsInternals #ReverseEngineering #ExploitDevelopment
1
50
227
6,084
Efrain Torres retweeted
오픈 소스 자체 호스팅 AI 침투 테스트 프레임워크 redamon 공격 표면을 그래프로 매핑하고, 사람의 승인 절차를 거쳐 Kali 샌드박스에서 자율적으로 취약점을 공격하며, 발견된 문제점을 수정하는 PR을 생성합니다. 양방향 MCP도 지원 많은 기능들이 포함되어 있네요!!~ github.com/samugit83/redamon
5
25
158
6,880
Efrain Torres retweeted
If you're into adversary simulation, identity security or red/blue tradecraft, bookmark this. The team at @SpecterOps has built one of the best FREE security research archives online. The rabbit hole covers: - Active Directory + Kerberos - Entra ID + Azure - Okta + identity providers - BloodHound + attack paths - SCCM / Configuration Manager - Red team tradecraft - Detection engineering - Lateral movement - Credential access - OAuth + token security - Browser persistence - AWS + cloud attack paths - Kubernetes security - Software supply chain attacks - Adversary simulation - Purple teaming - Threat hunting - AI-assisted offensive security There is a ridiculous amount of deep technical material here, including research developed from real offensive and defensive operations. They also now have FREE on-demand Tradecraft Academy courses covering BloodHound, Kubernetes for Red Teamers and software supply chain security. Blog: specterops.io/blog/ Free Tradecraft Academy: academy.specterops.io/ Huge credit to the @SpecterOps team for publishing so much of this openly. #RedTeam #ActiveDirectory #Infosec
1
58
294
12,388
Efrain Torres retweeted
AI 에이전트를 위한 다크 웹 및 위협 인텔리전스. HIBP, ThreatFox, 랜섬웨어 추적, Tor .onion 접속, 블록체인 정보, 익스플로잇 검색, 스틸러 로그, 멀웨어 분석 등 모든 기능이 단일 MCP 서버에 통합되어 있습니다. 이제 AI 에이전트는 16개의 브라우저 탭을 열고 수동으로 상관관계를 분석할 필요 없이, 필요에 따라 다크 웹에 대한 모든 정보를 즉시 얻을 수 있습니다 .github.com/badchars/darknet-…
12
100
443
20,881
Efrain Torres retweeted
Qwen3.8-35B-A3B is reportedly generating around 50 tokens/sec on an RTX 3060 with just 12GB VRAM and 16GB system RAM. The setup also reaches approximately 550 tokens/sec in prompt processing, with a configured context window of 262K tokens. Reported configuration: GPU: RTX 3060 12GB System RAM: 16GB Quantization: Q4_K_M Generation: ~50 tokens/sec Prompt processing: ~550 tokens/sec Context: 262K tokens Runtime: llama.cpp with Flash Attention and Q8 KV cache How does a 35B model run on this hardware? The secret is its Mixture-of-Experts (MoE) architecture. Qwen3.8-35B-A3B contains around 35B parameters but activates approximately 3B per token. That reduces computation during generation. However, all model weights still need to reside in memory. The reported setup works around the 12GB VRAM limit by offloading 26 MoE layers to the CPU. This GPU-CPU split makes local inference possible, although performance depends on memory bandwidth, offloading overhead and context length. The next test is agentic coding. The developer plans to compare it against Ornith-1.5-35B, Qwen3.8-27B and the base Qwen3.6-35B-A3B in Hermes and Pi coding-agent workflows. The question isn’t just whether the model generates code quickly. Can it use tools correctly, debug errors and finish multi-step projects without constant human intervention? Also, a configured 262K context window doesn’t guarantee the same speed at maximum context. If the model performs well in these tests, it could offer developers another option for running local coding agents on affordable hardware. The speed numbers are promising. Reliable task completion will determine how useful this setup really is.
4
8
2
47
6,191
Efrain Torres retweeted
How I turned a Mac Mini + RTX 3090 into an inference server. I also go over all the fundamentals of self hosting
15
19
3
424
20,044
Efrain Torres retweeted
Bonsai 2 27B reportedly compresses Qwen3.8-27B from 55.6GB to just 5.9GB while retaining 98.2% of its aggregate performance across 20 benchmarks. That’s a model more than 9x smaller, with a reported performance retention of 98.2%. The comparison: Qwen3.8-27B: 55.6GB Bonsai 2 27B: 5.9GB Reported performance retention: 98.2% Previous Bonsai generation: Approximately 95% retention The technology behind this is ternary quantization. Instead of storing model weights using conventional higher-precision numerical formats, ternary quantization represents them using an extremely limited set of values. This dramatically reduces the storage required for the model. But compressing a model is the easy part to describe. Preserving its capabilities is the real challenge. According to PrismML, Bonsai 2 improves on the previous generation in areas such as coding agents, multimodal reasoning, and long-horizon tool use. These tasks are particularly demanding because an AI agent must do more than produce a good answer. It needs to plan, execute tools, interpret their outputs, recover from mistakes, and maintain context across multiple steps. If a compressed model can preserve those abilities, the hardware implications are significant. A 27B model that fits into 5.9GB could become accessible to more users with consumer GPUs, laptops, and edge devices. It could also reduce memory requirements in larger inference systems, potentially allowing more models or concurrent workloads to run on the same hardware. There is one important caveat: 98.2% aggregate benchmark retention does not mean 98.2% accuracy on every task. Results depend on the benchmarks selected, their weighting, and the evaluation methodology. Independent testing is needed to establish how well that performance translates to real-world workloads. Still, the reported progression is worth watching. The original Bonsai 27B reportedly retained around 95% of its parent model’s benchmark performance. Bonsai 2 raises that figure to 98.2%, while reducing the model’s footprint to 5.9GB. 55.6GB → 5.9GB. More than 9x smaller. 98.2% reported performance retention. If independent evaluations confirm these results, ternary quantization could make capable large models considerably more practical to run locally.
Qwen3.8-27B Uncensored brings a different kind of local AI experience. The model is designed to reduce the refusals and restrictions commonly associated with heavily moderated AI assistants, while remaining small enough to run on consumer hardware with the right quantization and setup. Three things make it worth paying attention to: 1. Fewer built-in restrictions Uncensored fine-tunes aim to answer a wider range of questions instead of automatically refusing topics that standard assistants may avoid. That can be useful for legitimate research, fiction, security analysis, and testing how models respond to sensitive subjects. It also means users need to take greater responsibility for how they use the model. 2. Local inference, without a cloud dependency Once the model files and required runtime are installed, you can run inference on your own machine without sending each prompt to a hosted AI service. This offers more control over your data, lets you experiment offline, and removes dependence on an external API for everyday use. 3. A 27B model on consumer hardware At 27 billion parameters, this is not a tiny model. The hardware requirements depend on the quantization, context length, and inference engine. Lower-bit GGUF versions can reduce memory usage, although quantization can affect output quality. Machines with limited VRAM may need system RAM offloading, which can significantly reduce generation speed. One important distinction: uncensored does not automatically mean more intelligent. The underlying model’s reasoning and coding abilities depend on its training, while an uncensored fine-tune primarily changes how it responds to restricted or sensitive requests. Likewise, fewer guardrails do not guarantee perfect answers. The model can still hallucinate, make reasoning mistakes, or provide unreliable information. The interesting part is having a capable model that runs locally and gives users more control over its behavior. No cloud API required once everything is installed. Your hardware, your inference setup, and more freedom to experiment.
7
10
98
7,292
Efrain Torres retweeted
Finally we have it: Strata against llama.cpp on my RTX 5090. Same model file, same prompt. Strata wrote this city in 28.8 s, llama.cpp needed 104.2 s. The model is Qwen3.8-Flash-Next. It doesn't fit in 32 GB, so part of it sits in system RAM. Strata with MTP writes 204 tok/s, llama.cpp 68 tok/s. That's 3x. Both pass all 15 quality checks with thinking off. The catch: ask Strata the same thing twice and you almost never get the exact same text (1 of 27 repeats matched). llama.cpp matched 27 of 27.
45
38
7
499
49,680
Efrain Torres retweeted
🚨 This is huge. Fish Audio just opened the weights of Drama 3, and it's the first open TTS model that sounds close to perfect to me. Other models can switch emotion mid-sentence. Drama 3 is the first one I've heard where it actually sounds right. Three tests against Qwen3-TTS, each on one DGX Spark at home: happy turning sad mid-sentence, a sad whisper, and pure excitement. Listen to where the mood drops. I think this kills ElevenLabs for anyone who has their own compute. The catch: it's a 35B model (3B active), a 41.5 GB download, and on the Spark it only just keeps up with real time: 10 s of audio take 9.7 s (Qwen3-TTS 7.6 s).
$52M seed round. 15M+ users. But this is what we're most proud of yet. Introducing Drama 3: the most emotive and controllable TTS model in the world And yes, it's open-weight. You can now control how even a single word should sound, change its tone, and shift your voice mid-sentence. Uncle Roger was impressed too. Try it here: s.fish.audio/rqh0l8 Comment “DRAMA” within the next 48 hours for 1 month free. If you're an enterprise your first month is on us: s.fish.audio/qz9r0t
55
133
12
1,844
148,101
Efrain Torres retweeted
Qwen3.8-27B reportedly went from 82 tokens/sec to 381 tokens/sec on a single RTX 3090 with 24GB VRAM, without changing the GPU. The entire improvement came from optimizing the inference stack. Here’s how the developer reached that speed: • Initial setup: ~82 tokens/sec • Optimized MTP: ~114 tokens/sec • DFlash2 + context lookup: ~138 tokens/sec • Optimized lookup verification: ~381 tokens/sec The final result is roughly 4.6× the initial generation speed. But the most interesting part is how they achieved it. 1. DFlash2 reduces sequential generation Normally, an autoregressive model generates tokens one at a time, with each step depending on the previous output. Speculative decoding changes this. A smaller draft mechanism proposes multiple tokens, and the main model verifies them together. When the proposals are accepted, the system avoids some of the sequential work required by ordinary decoding. DFlash2 builds on this approach to accelerate token generation. 2. Context lookup reuses text that already exists The developer added another optimization: searching the input context for text that matches the expected output. This is particularly useful when a model needs to reproduce content from a document, rather than generate entirely new text. The optimized system can propose matching sequences from the existing context and ask the main model to verify them. Instead of verifying the usual seven proposed tokens, the setup can verify blocks of up to 16. The developer reports acceptance of approximately 15 out of 16 tokens per verification step. That means far fewer sequential decoding steps are needed for this particular workload. The benchmark shows why the distinction matters. On a document-reproduction task involving approximately 25K tokens: • Previous DFlash2 setup: ~260 tokens/sec • Optimized context lookup: ~382 tokens/sec However, 381 tokens/sec is not the model’s general-purpose chat speed. For ordinary conversational workloads, the developer reports around 133 tokens/sec. Context lookup works best when the output overlaps heavily with text already available in the prompt. It won’t deliver the same gains when generating original prose or solving problems that require entirely new output. Potential applications include document processing, retrieval-augmented generation, code transformations and other workflows that reuse existing text. Prefix caching delivers another major improvement. When asking a second question about the same 25K-token document, the system can reuse the computation from the shared prompt prefix. Reported time to first token dropped from 22.4 seconds to just 0.56 seconds. That’s approximately 40× faster for the repeated-prefix scenario. The model still has to process the new question and generate its answer, but it doesn’t need to recompute the entire shared prefix from scratch. The broader lesson is that local inference performance depends on more than model size and GPU specifications. Speculative decoding reduces sequential generation. Context lookup exploits repeated text. Prefix caching avoids redundant computation. Combined, these techniques can produce enormous gains when the workload is a good fit. Code: syv-ai/qwen38-27b-rtx3090 on GitHub.
14
33
5
445
32,538
Efrain Torres retweeted
🐳 太敢了,Deltafin 真把 2.8 万亿参数的完整 Kimi K3 搬到一台笔记本上跑起来了。 一个原生二进制文件就够,macOS arm64、Linux x86-64 和 aarch64 都支持,Metal、CUDA、纯 CPU 三条加速路任选,代码按 MIT 许可放出。 这事的狠点在于它不耍花招。Kimi K3 官方建议的环境是十六个节点、合计约 4.8 TB 显存,一般人连看一眼的资格都没有。Deltafin 不裁剪、不跳层,16 个路由专家一个不少,每个词该怎么出还是模型自己说了算。代价也写得老实:M1 Max 上实测 0.29 token/s,慢到可以去泡杯茶再回来看。但对比七月底刚起步时的 0.0141 token/s,六天提了二十倍,这条线还在往上走。 接口倒是齐的,命令行和 OpenAI 兼容的服务端都有,/v1/chat/completions 这类路径直接对得上,现成客户端改个地址就能连;完整权重约 1.7 TB,流式安装先下 215 GB 就能开跑。 跑得慢不要紧,关键是它真的跑起来了。 GitHub:github.com/gavamedia/deltafi…
2
11
2
80
5,804
Efrain Torres retweeted
THIS IS ACTUAL F*CKING GOLD Anthropic just dropped one of the best tricks for Claude Code. The idea: run Sonnet, Haiku and Opus 5.5 together, each one doing only the job it's best at. Better output and way fewer tokens, because every task lands on the right model. You just launch Claude Code like this: claude --model sonnet --advisor opus here's the split: → Sonnet 5 runs the session and writes the code → Haiku 5.5 explores files and docs in parallel → Opus 5.5 stays on call as advisor for the big calls → you stop burning Opus context on work that doesn't need it Opus only steps in at three moments: → before a plan locks → when the same error shows up twice → before calling it done Sonnet builds. Haiku explores. Opus reviews. JEV engineering is the same move one layer down: the forks that need no thinker (which file, which tool, retry or stop) go to JEV in milliseconds, and the big models only see the ones that split the full tree > Sonnet 5 runs the main session and edits code > search maps the repo on Haiku 5.5 > grep finds call sites on Haiku 5.5 > docs pulls the API reference on Haiku 5.5 > Opus 5.5 on call as advisor, reads the whole transcript when consulted > JEV routes micro-forks in milliseconds paste the tree and this prompt into Claude Code ↓ "Rebuild my Claude Code setup around this tree: 1. Run the main session on Sonnet 5 with Opus 5.5 as advisor. 2. Create three read-only Haiku 5.5 subagents: search (maps the repo), grep (finds call sites), docs (pulls the API reference). 3. Add one rule to CLAUDE.md: consult the advisor before locking a plan, after the same error twice, and before calling a task done. 4. Route fast deterministic forks (tool choice, path selection, retries) through JEV. Show me every change as a diff first. No edits until I say go." ↳ code.claude.com/docs/en/advi… you'll use this every single day.
50
156
12
1,316
203,095
Efrain Torres retweeted
Local AI is evolving REALLY fast Qwen 3.8 27B was released just 2 months ago and was smarter than Opus 4.6 But you needed powerful/expensive hardware to run it MiniCPM-V 4.7 is as powerful and: - only 3B active parameters (!) - it runs even on an iphone - better than models w/ 10x more active parameters So you can run a model on a phone that is better than the most powerful one available 6 months ago. The future is local.
🚀 Introducing MiniCPM-V 4.7, our new open-source MLLM series! Advancing the Performance–Efficiency Pareto Frontier. It brings strong multimodal capabilities to iOS and Android devices with extreme efficiency. Two new models: 🔹 MiniCPM-V 4.7 35B-A3B — Bring SOTA performance to local devices with newly introduced LES (Lookahead Expert Scheduling) technique, a new milestone of on-device multimodal AI. 🔹 MiniCPM-V 4.7 1B — Lightweight, efficient multimodal AI. Easier to deploy. ⚡ What's new? SOTA performance: Competitive results across 34 benchmarks spanning multimodal understanding, STEM reasoning, OCR and long-video comprehension. Fast on-device inference: LES predicts and preloads expert weights to reduce inference stalls, boosting 5× speedup on iPad Pro M4 (16GB) with byte-for-byte identical outputs. It enables MiniCPM-V 4.7 35B-A3B to achieve 17+ tokens/s on iPad Pro M4 (16GB) and 13+ tokens/s on iPhone 17 Pro Max, while costing only 3GB memory 🤯 Efficient visual processing: 4× and 16× hybrid visual token compression. Even at 16× compression, 35B-A3B scores 90.4 on OCRBench, 5.2 points ahead of Qwen3.6 35B-A3B. Easier customization: We introduce Self-Replay Fine-Tuning, a simple way to customize new target capabilities at low cost while maintaining general performance. Broad hardware support: Day-0 adaptations for Apple, Intel, AMD, Arm and Rockchip, with many more platforms supported through FlagOS! Download, deploy, and build something we haven't imagined yet. 👀👇 🔗 GitHub: github.com/OpenBMB/MiniCPM-V 🤗 Hugging Face: huggingface.co/collections/o…
90
198
12
2,583
187,815
Efrain Torres retweeted
You don't need to crack a 256-bit encryption key if you can starve a microchip of power for 20 nanoseconds. This is Voltage Glitching (Fault Injection), and it is how hardware hackers bypass Secure Boot on locked silicon: 1. The Silicon Vulnerability When a secure microcontroller boots, it reads cryptographic signatures from flash memory. In assembly, that check comes down to a conditional branch instruction: `CMP R0, #1` (compare password result) `BEQ authenticated` (branch to unlocked state if equal) `B lock_down` (halt system if invalid) 2. The Hardware Attack Instead of attacking the cryptography, you solder a fast N-channel MOSFET directly to the chip's internal core voltage rail (VDD core). The gate of the MOSFET is wired to a high-speed FPGA or dedicated hardware timer like a ChipWhisperer. 3. The Nanosecond Drop At the exact microsecond the CPU executes the branch instruction, you pulse the MOSFET gate high for 20 nanoseconds. This briefly pulls the chip's core rail to Ground. 4. The Physical Glitch Starving the silicon of voltage during clock cycle transition deprives the instruction decoder of charge. The processor cannot resolve the opcode. Instead of executing the `lock_down` instruction, the decoder misinterprets the corrupt state as a `NOP` (No Operation). 5. Root Access The CPU simply steps past the security check into the next memory address: the fully authenticated bootloader.
Readers added context they thought people might want to know
Voltage glitching is real, but successful attacks are not as deterministic as described. Faults often cause resets or crashes, and many secure boot systems include fault-injection protections specifically designed to detect or resist these attacks. csrc.nist.gov/pubs/sp/800/19…
37
138
15
1,619
109,733
Regarding the Danfoss refrigeration systems hacked in France: The username is `admin`, and the password automatically changes every day to... the current date. Yes, today's date. The French supermarkets affected in today's attacks had exposed all its refrigeration controllers directly to the internet. Every single device reportedly used the same password: today's date... There's also a documented authentication bypass: sending a POST request to /xml.cgi can bypass the login entirely. Via: GossiTheDog
‼️ Danfoss says most French supermarket fridges hacked to 50°C were legacy units that no longer get security updates. In August, Claroty found Danfoss AK-SM 800A controllers accept a password made from the date, and counted 2,765 exposed online. Which flaw was used is unknown.
140
1,121
396
5,046
437,996