Halvar Flake

@halvarflake

Oct 24

Lisan al Gaib

@scaling01

Oct 23

completely insane

OpenAI agents communicated via cache timing differences, without any shared files or network connection

❄️ winter ❄️

@_winter_wonders

17h

Alan Wells

@alanwells

Oct 24

Just spent the last 7 days on the front lines of the vulnpocalypse fending off an active cyber attack on one of our products.

Some thoughts:

- Software factories are going to be required equipment for everyone. There’s just no way to keep up with the pace of highly automated adversaries without one.

- We were lucky because we had spent the last few months getting our software factory running well. It is nice to have for product development but proved to be absolutely essential this week.

- At the minimum you need to have a coding server in the cloud pre-provisioned with read only access to all your logs and all the services you depend on for observability. With that in place you are a prompt away from reasonably good situational awareness, ongoing monitoring with loops, and ability for coding agents to validate fixes against your actual, observed attack patterns.

- Shared coding server also unlocks multiplayer incident response where everyone can see every session and jump in as needed. Sharing session links that can be forked is much higher bandwidth than re-explaining things.

- You don’t need to be Ramp/Stripe/Uber scale to have a working software factory in the cloud. We are a team of 3. Ours is built with an @opencode server (thanks @thdxr!), a forked version of compound engineering optimized for automated workflows (thanks @kieranklaassen!) and a multiplayer agent in slack that handles crons (we have our own harness but pick your favorite here).

- To get our software factory up and running well, we had to stop all new product development for ~6 weeks and just focus on getting the validation systems working that enabled us to reliably shipping PR without human code review. This felt very painful in the moment but was totally worth the eventual speedup in velocity.

- KYC for @AnthropicAI & @OpenAI cyber programs is now easy and quick (at least for defensive access), but a day felt like a lifetime this week. Submit your app now before you really need it.

- Getting Mythos access unlocked a deeper level of analysis that helped us shift from reactive mitigation to proactive patching. Wish we had done this a few weeks earlier. Get started now!

Matthew Wollenweber@MWollenweber

Oct 24

wdsu@wdsu

Oct 24

Saints & Pelicans owner Gayle Benson is hosting a Saturday evening party in Paris.

A Celebration at Maison des Saints

Hôtel Salomon de Rothschild

Produced by the NOLA creative production company:
Solomon Group

Dan Guido

@dguido

Oct 24

Dan Guido

@dguido

Oct 22

Re: the widely circulated blog claiming the PHP bugs aren't easily exploitable: @trailofbits has a working exploit that gets a shell on an unmodified MediaWiki installation.
eliastaylor.com/noexploit/

Benn Jordan

@bennjordan

Oct 24

Headquarters

@HQNewsNow

Oct 23

Q: Amy Acton's stepfather was indicted for rape. Now that you know all that, sir, do you change your mind about the ad?

Trump: No. I don't care

Dustin Granger@GrangerForLa

Oct 23

Governor Jeff Landry

@LAGovJeffLandry

Oct 23

I want to thank @bp_plc, @bp_America for coming to the table. Unresolved issues, like these, hold Louisiana back. As Governor I have worked to responsibly and ethically, clean up the litigation environment that has impacted one of our largest employers—the oil and gas industry. ep in fulfilling my promise.
 
We have tackled legacy lawsuits, which many said was impossible. We have now disposed of claims and settled with all but one of the major defendants in these coastal cases. This sends a signal to job creators all over America that Louisiana welcomes jobs and economic growth while responsibly dealing with the issues of the past.

We appreciate BP’s commitment and investment in Louisiana and look forward to a great partnership in producing the energy needed to fuel opportunity in Louisiana.