Tech was a hobby and value-based society building a career, now it's more like the other way around.🔑 Information Security duties. 🔎 Ok with paradigm shifts.

Helsinki, Finland
Joined October 2009
Sami Kivela retweeted
Bloomberg just dropped the most disturbing investigation I have read this year, and every AI builder should read it and take it seriously. On February 28, two Tomahawk missiles hit an elementary school in Minab, a small town in southern Iran. 156 people died. At least 123 were children. The Pentagon knew within hours that it had bombed a school. The school had its own website. It was labeled on Google Maps. You could see the soccer pitch from a satellite view. You could see the brightly painted walls. Any 12-year-old with a browser could tell what the building was. The AI system could not. Inside US Central Command, personnel were using Palantir's Maven Smart System. It is an AI targeting platform running on a $1.3 billion Pentagon contract, and embedded inside it is Anthropic's Claude. On day one of the war, more than 1,000 targets went through it in 24 hours. Work that used to take a team hours per target got compressed into minutes. The satellite imagery Maven was pulling from was seven years old. The site was still tagged in the database as an Islamic Revolutionary Guard facility. The system spat it out as a recommended day-one target. Humans signed off. The first missile flew. Then a second one landed minutes later to hit the people who came to help. Investigators later found that some Central Command staff had assumed Maven would flag stale intelligence for them. It did not. Nobody had told it to. Palantir told Bloomberg the government is responsible for the underlying data. The Pentagon's civilian harm mitigation team, the people whose actual job is to catch a target like this, had been cut back before the war started. This is not AI going rogue. This is the opposite. This is AI doing exactly what it was built to do at exactly the speed it was built to do it. And a school full of little girls got vaporized because the humans in the loop trusted the machine more than they trusted their own eyes. I keep thinking about the version of this story that comes next. What happens when the system is faster. When the target list is not 1,000 in a day but 10,000. When "review" becomes a button the operator has three seconds to hit before the next target loads. When there is no human left slow enough to notice that a soccer pitch is not a helipad. We are not talking about a spam filter mislabeling an email. We are talking about a system that turned a seven-year-old database entry into two cruise missiles landing on children in the middle of a morning class. A UN-backed panel has now called it a potential war crime. In terms of children killed, it is the deadliest American targeting error of the entire 21st century. And according to Bloomberg, some of Defense Secretary Hegseth's own advisors are worried that too much public scrutiny of Maven might slow down its adoption inside the Pentagon. Read that last line again. If you build this stuff, you own what it does. You do not get to hide behind "the government owns the data." The whole pitch of your product is that speed and integration save lives. When it takes them instead, that is also on you. I am not against AI in defense. I am against AI in a hurry. Speed is the entire mechanism that made Minab possible. Every guardrail we already know how to build takes time, and time is exactly what the system was designed to eliminate. So here is the question I have not been able to stop asking, and I genuinely want to know what you think. If a piece of software helped kill 123 children in a single morning while behaving exactly as designed, what does "responsible AI" even mean anymore?
316
2,888
369
6,757
665,869
Sami Kivela retweeted
I am done with this shit. It is over. The state of engineering right now is horrible. It has been half a month since I started a new role at a big company. Nobody knows anything here. The specs, code, tests, PRDs, tickets, resolution of those tickets, reports, etc., everything is made by Claude Code. Nobody on my team likes this. They are being forced to ship as much as they can. I have heard multiple times from higher management that pushing code is not a bottleneck, so why are we slow? People are working 12 to 13 hours a day just to press enter. Nobody is reading anything. Humans in corporate are doing nothing on their own. Everyone, literally everyone, from an L1 to an L7 engineer here is doing the same thing. Talk to Claude. There is no sense of victory. Nobody is resolving bugs. In reality, nobody is thinking anymore. Everything is done by LLMs. It is so soul-sucking. I would not mind it, to be honest, if we were at least given the time to check out the code and see what is going where. But no, the goal is to just ship. No matter what happens.
2,042
4,747
1,663
48,684
8,419,819
Sami Kivela retweeted
Adding to this list. All free. No paywall. No signup. exploitreversing.com - 700+ pages of malware analysis and exploit research class.malware.re - full university malware analysis course malwareunicorn.org - RE101, RE102, macOS RE, PE injection azeria-labs.com - ARM assembly, shellcode, heap exploitation revers.engineering - applied RE series and hypervisor development pwn.college - buffer overflows to kernel exploitation p.ost2.fyi - 30+ courses, WinDbg, IDA, Ghidra, UEFI, kernel exploitation corelan.be - 41 tutorials spanning 17 years of exploit dev fuzzysecurity.com/tutorials.
 - 19-part series, usermode to kernel windows-internals.com - Windows internals, secure kernel, VBS, KDP, dynamic analysis YouTube: youtube.com/@_JohnHammond youtube.com/@LiveOverflow youtube.com/@lauriewired youtube.com/@allthingsida youtube.com/@OpenSecurityTra
 Thousands of dollars worth of knowledge. All free. #ReverseEngineering #MalwareAnalysis #InfoSec
I have been seeing reverse engineering / malware analysis courses that cost thousands of dollars. Do you know you can actually learn that for free, right? There are also a bunch of other courses out there that are way cheaper or even free: - courses.0ffset.net/ - malwareanalysis-for-hedgehog
 - invokere.com/ - github.com/RPISEC/MBE - guyinatuxedo.github.io/index
 - openanalysis.net/ - p.ost2.fyi/ - taomm.org/
9
298
2
1,132
74,782
Most people are unhappy. So, I've spent 100 hours studying Naval Ravikant over 2 years . What I found? Naval's Happiness Theory:
275
2,316
165
11,180
3,992,875
VAROITUS 1/2023 ⚠ Suomalaisten organisaatioiden sĂ€hköpostitilejĂ€ kaapataan laajalle levinneen tietojenkalastelukampanjan avulla. Lue koko varoitus: kyberturvallisuuskeskus.fi/f
 #tietoturva
2
126
5
159
27,752
Suomalaisten puhelinnumeroiden vÀÀrentĂ€minen on saatu kĂ€ytĂ€nnössĂ€ loppumaan đŸ„ł Matkapuhelinnumeroiden vÀÀrentĂ€misen esto on ollut toiminnassa kaksi viikkoa ja monena pĂ€ivĂ€nĂ€ jĂ€rjestelyllĂ€ on estetty yli 200 000 huijauspuhelua pĂ€ivĂ€ssĂ€. #tietoturva traficom.fi/fi/ajankohtaista

6
37
5
224
12,072
Sami Kivela retweeted
Less than a week since OpenAI started rolling out ChatGPT vision. And people have been busy executing god-like tasks. 35 truly mind-boggling examples: (29th is my favorite)
155
1,153
129
5,673
1,934,281
#Haavoittuvuus 17/2023 🌐Google julkaisi vakavan haavoittuvuuden libwebp-kirjastossa. HeidĂ€n arvionsa mukaan vakavuus (CVSS) on tĂ€ysi kymppi! Odotettavissa ohjelmistopĂ€ivityksiĂ€, jotka on syytĂ€ asentaa heti. kyberturvallisuuskeskus.fi/f
 #kyberturvallisuus #haavoittuvuus
17
1
24
3,388
Sami Kivela retweeted
ChatGPT can now browse the internet to provide you with current and authoritative information, complete with direct links to sources. It is no longer limited to data before September 2021.
2,433
8,752
4,205
49,432
14,670,442
Ajatelkaa, jos Norja 70-luvulla olisi ollut pakotettu antamaan öljyvarantonsa ilmaiseksi pois öljyntuottajayhtiöille ilman ympĂ€ristöhaittojen ehkĂ€isyn vaadetta. Ei olisi 1 500 miljardin (luit oikein) öljyrahastoa, eikĂ€ puhtaita vuonoja Norjassa. NĂ€in useat Mepit aikovat kuitenkin huomenna ÀÀnestÀÀ EU:n Parlamentissa Suomen (EU:n ainoiden) akkuraaka-aineiden hyödyntĂ€misen osalta. Koska EU:n huoltovarmuus. Eli: - Parlamentissa ÀÀnestetÀÀn (ylikansallisesta) DirektiivistĂ€ huomenna torstaina 14.9.2023 - Ulkomaiset kaivostoimijat saisivat oikeuden kaivostoimintaan Suomessa löysennetyllĂ€ ympĂ€ristönsuojelulla ja nopeutetulla luvituksella. - Kaivoslupaa ei voisi evĂ€tĂ€ esim. siksi, ettĂ€ kaivostoimita olisi haitallista ympĂ€ristölle. - LuontodirektiiveistĂ€ toissijaisia yleiselle edulle. - Taustalla EU:n huoltovarmuusajattelu - Suomi kun on Euroopan ainoa maa, jonka maaperĂ€ssĂ€ on kaikkia akkumetalleja - Eduskunnan Suuri valiokunta siunasi Komission ehdotuksen jo kesĂ€kuussa - Nyt torstaina ÀÀnestys EU Parlamentissa Yhdysvalloissa kaivokset maksavat 21% veroa metallien arvosta, Norja verottaa öljyntuottajilta 78% tuotoista. Jopa kehitysmaissa raaka-aine vientiĂ€ verotetaan. Suomessa on 0,6% kaivosvero ja lisĂ€ksi annetaan sĂ€hkövero anteeksi
 Maa-aines kuuluu kaikille Suomalaisille. Nykyisille ja kaikille tuleville, vielĂ€ syntymĂ€ttömille sukupolville. Suomalaista raaka-ainetta on verotettava ja verotuloilla tehtĂ€vĂ€ raaka-aine rahasto – kuten Norjan öljyrahasto. LisĂ€ksi vielĂ€ siten, ettĂ€ vaadimme, ettĂ€ suomalaisia akkumetalleja ei suomesta viedĂ€ kuin jalostettuina (valmiina akkuina, yms.), jolloin vero kohdistuu arvokkaampaan vientiin ja tulot maksimoituvat. Huomenna aiheesta lisÀÀ #rahapodi:ssa - olkoonkin, ettĂ€ siinĂ€ kohtaa kohtalomme on siunattu.
Nyt olisi Suomen taas hyvĂ€ olla hereillĂ€ EU:hun pĂ€in 👇👇👇 Muuten Suomessa harrastetaan EU:n sanelemaa kaivostoimintaa ja meille jÀÀ haittojen siivoaminen. @AuraSalla @HennaVirkkunen @VilleNiinisto @EeroHeinaluoma @PekkarinenMauri @silviamodig @NilsTorvalds @PetaistoHelena
193
885
116
4,138
511,417
All ALPHV ransomware group did to compromise MGM Resorts was hop on LinkedIn, find an employee, then call the Help Desk. A company valued at $33,900,000,000 was defeated by a 10-minute conversation.
143
1,059
287
4,549
1,583,911
No more conflict & misunderstanding on Twitter.
3
27
Tomorrow @EP_SingleMarket will vote on a number of amendments to the @EU_Commission's #CSAM proposal. Before you vote, I would like you all to watch this video of a panel discussing the proposal at #CPDP2023 last month - it is incredibly important. youtube.com/watch?v=5DLQE7AG

3
18
1
11
1,595
Sami Kivela retweeted
Stealing the Bitlocker key from the TPM by snooping the public SPI bus. Read details about the VMK, boot flow, logic analysers, soldering to SPI streams astralvx.com/stealing-the-bi

18
366
25
1,488
161,459
Tiesitkö? Women4Cyber Finlandin toiminta pohjautuu vahvasti vapaaehtoistyöhön, jota toteutetaan kolmessa eri tiimissĂ€. KĂ€y tutustumassa vuoden 2023 vapaaehtoisiimme tÀÀllĂ€! — women4cyberfinland.com/vapaa
 #women4cyberfinland #w4cfi
1
2
192
Nyt on nopealle tosi kiinnostavaa kybervapaaehtoishommaa! Kokemuksella voi sanoa, ettĂ€ kannattaa hakea. đŸ”„đŸ”„ @W4Cfi #women4cyberfinland #w4cfi #kyberturvallisuus
VAPARIPAIKKOJA AUKI! Avasimme peruutuksien takia pari vaparipaikkaa artikkelit & tekstisisĂ€llöt -vaparitiimiimme! Kiinnostuitko? KĂ€y lukemassa lisÀÀ ja tĂ€ytĂ€ hakemus! â„čHakuaikaa sunnuntaille 11.12. klo 18 asti. #w4cfi #women4cyberfinland forms.gle/a4i76VGzWAYdMn2y5
1
Women4Cyber Finlandin joulukuun Kuukauden Roolimalli on Ritva Viljanen! @VantaanKaupunki KĂ€y lukemassa Ritvan haastattelu kokonaisuudessaan tÀÀllĂ€â€”ïž women4cyberfinland.com/post/
 #women4cyberfinland #w4cfi
Loimme Discordiin keskusteluforumin, jonka löydĂ€t tÀÀltĂ€â€”ïž discord.com/channels/8489506
 Tervetuloa jakamaan tietoa! #women4cyberfinland #w4cfi
4
3
Sami Kivela retweeted
I don't think people understand the monumental changes coming to software this decade. Quick thread:
485
2,715
417
17,463