all 22 comments

sorted by: hot top controversial new old
[–] 59 points 3 weeks ago (4 children)

Move fast and break things.
And by "things" they usually mean "security". And may the AI gods help you if you ask them about documentation. It's all just random containers, spun up by devs. Nothing was written down, everything is still at defaults and no one has ever patched anything. Also, every user has passwordless root access, because figuring out required permissions was too slow. And there's only one service account, which is shared across 100 different systems and also used when devs need to log into something interactively and they don't have their own account enabled on that system. But all of this is critical infrastructure and MUST NOT FAIL!

  • source
  • hideshow 4 child comments
  • [–] 26 points 3 weeks ago

    Nonono, those are "Trusted Execution Environments". Aka side channel central.

  • source
  • [–] 20 points 3 weeks ago (5 children)

    I got a recruiter email for some peter theil backed company putting ai servers in the ocean using the tide to generate power and starlink to transmit data. I kinda wanted to take the interview just to tell them how dumb this idea is and what pieces if shit they are for taking theil money. But I ain't got the energy for all that.

  • source
  • hideshow 5 child comments
  • [–] 15 points 3 weeks ago (5 children)
  • [–] 25 points 3 weeks ago (3 children)

    Imagine you’re building a house. It’s not up to code, the neighbor kids built the foundation, a mouse did your electrical wiring, and you can kinda hear some creaking when there’s a gentle breeze, but you have a house.

    The only thing missing is a door in the wide open doorframe and you live in the sketchy part of town.

    That’s what’s happening, except with AI servers.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 19 points 3 weeks ago

    Just a current example from Meta's Muse: You can just ask the LLM to give you access to the server / VM / container meta set up for you. And it will happily oblige and hand you the keys. And when you take a closer look around and alert Meta, the engineers basically just tell you, that it's your VM and that there's be nothing secret on it and that that's expected. So...

    Part 1 (Thread): https://neuromatch.social/@jonny/117324790823856750

    Part 2 (Thread): https://neuromatch.social/@jonny/117339825958098508

    Part 3 (Thread): https://neuromatch.social/@jonny/117352647701407496

  • source
  • parent
  • [–] 8 points 3 weeks ago (1 child)

    Another example is like starting a bank and telling everyone they should use you for their financial needs but you don't have a door to your bank vault. The front door to your bank is also just a single pane of glass with a sign that says "please do not break glass, it'd be bad for our investors 🥺"

  • source
  • parent
  • hideshow 1 child comment
  • [–] 10 points 3 weeks ago*

    Bare-metal server is a very simple, consumer grade server. The specifics don't matter here.

    "For a significant period of time" doesn't refer to the duration of the job listing, but to the "after selling product" part of the sentence.

    As in, they first started selling stuff, and then had some event happen that suddenly made them care about cyber-security.

  • source
  • parent
  • [–] 8 points 3 weeks ago (2 children)

    This thread is filling me with a certain amount of hope. If they are this confoundingly, and poorly built and managed, surely, a group of people would be able to con their way inside with something FUN and help society in the process.

  • source
  • hideshow 2 child comments
  • [–] 2 points 3 weeks ago

    What kind of training, certification, and job titles do I need to get to receive this type of job offers?

    Context: I already generally know how to secure a server but my experience is in web programming

  • source