• 0 Posts
  • 48 Comments
Joined 3 years ago
cake
Cake day: June 9th, 2023

help-circle

  • I believe the vast majority aren’t, and I know money is money, but it’s not that expensive. Not only are there vision models small enough to run locally entirely free now on hardware more modest than you would think, even using an api key from open router and sending it a screenshot every 15 seconds to summarise it into a log costs in the realm of 1.5c/hour.

    Now yes that is per person, but even so, 10 employees 15c/h, 100 for $1.50/h. And remember this is an unreasonably often every 15 seconds. Most would be happy per minute or even less. Under 40c/h to watch 100 people. It’s money yes, but it really isn’t that expensive.

    Edit: voice is also cheaper than you would think to have a model stt and summarise it, also single digit cents per hour of audio.


  • I have it create things for me that I would otherwise never have. I wanted an app for dream tracking. They were either pay walled, didn’t have the features I wanted, or both. Ai created what I wanted in a weekend. That’s just one example. I’ve created many single use apps as well.

    If I’m at a takeaway store I take a photo of the board and it makes me an interactive menu that totals the price of what everyone wants and let’s us browse without trying to see the board and get in people’s way.

    I don’t expect anyone else to use these. I don’t expect anyone else to want to use them. Though they’re welcome to. But if I can have a thing create exactly what I want and use it why not?

    “but what if it has a bug and you lose a year of journals”. Well it created me manual timestamped backups as well as automatic timestamped backups to oauth Dropbox in a dedicated folder without the app having access to the rest of my Dropbox. It could crash everything and I would have every single thing safe in 2 places up to the most recent entry. And they’re just text files. I could take them anywhere if AI disappeared and the app broke tomorrow. I could just continue writing in notepad in the worst case until I found something else. But the app looks nicer and does interesting things.

    The alternative to this isn’t me learning to code and spending months creating them. The alternative is them never existing.









  • God this is beyond ridiculous.

    They used ChatGPT to sort over 1,400 National Endowment for the Humanities grants into spreadsheets. Their exact prompt to the AI was “Does the following relate at all to DEI? Respond factually in less than 120 characters. Begin with ‘Yes.’ or ‘No.’ followed by a brief explanation.”

    They didn’t define what they meant by DEI. They just asked ChatGPT to figure it out. And then cancelled grants based on whatever it said. Probably didn’t even read past the yes or no.

    The government’s defence was essentially ChatGPT did it, not us. When asked if he regretted people losing income, he said he didn’t, because reducing the deficit was more important. When asked if they actually reduced the deficit, he admitted they did not.

    They caused real harm, achieved nothing they claimed to be pursuing, and expressed zero regret about it.

    Just really horrible all around.









  • I fully agree, there isn’t a good reason. The issue is that flaw is a systemic one in Windows.

    Modern operating systems should be operating under zero trust. The fact that Windows still operates on Intranet Era logic, where if a file is reachable, it’s probably safe, is exactly why these exploits keep happening.

    The problem comes down to a Windows API called ShellExecute. When an application like Notepad passes a link to this API, it is effectively saying to the OS, The user wants to open this, figure out how to run it.

    Windows looks at it and essentially says, Oh, it’s an .exe on a network share? The user must want to run that software, launch it, rather than, This is executable code from a network location I don’t control, download it and make the user double-click it themselves.

    The main reason it does this is for legacy enterprise convenience. Decades ago Microsoft designed Windows so that companies could put internal tools on a shared drive and employees could run them instantly. They prioritised seamlessness over security by assuming the network perimeter was the security boundary, and everything on it was there because they wanted it to be.

    Obviously that assumption is dangerous. Like you said, no remote executable should ever be treated as trusted by default, regardless of whether it came from the Store, an SMB share, or a web link. The action of clicking a link should never map directly to execution of code. It should map to retrieval of data. Microsoft basically turned a convenience feature into a permanent vulnerability.


  • Yeah I get your thought process, but the second vulnerability is actually just how Windows is designed to work. When Notepad follows a link, it isn’t opening a web page, it’s passing a command directly to the OS shell.

    Because Notepad is a trusted native application, it bypasses many of the security checks that a browser has.

    If the link uses the file:// protocol to point to an .exe on a remote server, or ms-appinstaller to trigger an install, the OS treats that as a direct instruction to launch that software, so it can trigger an app installation prompt or, depending on the exploit, silently side-load malicious packages.