https://pinboard.in/u:jm/public/ recent bookmarks from jm 2024-07-15T14:36:33+00:00 https://berryvilleiml.com/wp-content/uploads/BIML-LLM24.pdf jm security infosec llms machine-learning biml via:adam-shostack ai risks https://pinboard.in/ https://pinboard.in/u:jm/b:91d02bc3b8f3/ 2024-04-29T13:45:53+00:00 https://heatherburns.tech/2024/04/29/cheers-ross/ jm"The idea that complex social problems are amenable to cheap technical solutions is the siren song of the software salesman and has lured many a gullible government department on to the rocks." touché...]]> aphorisms ross-anderson tech risks government technology https://pinboard.in/ https://pinboard.in/u:jm/b:cb5d5dd45a1c/ 2023-03-31T08:59:22+00:00 https://aisnakeoil.substack.com/p/a-misleading-open-letter-about-sci jmOver 1,000 researchers, technologists, and public figures have already signed the letter. The letter raises alarm about many AI risks: "Should we let machines flood our information channels with propaganda and untruth? Should we automate away all the jobs, including the fulfilling ones? Should we develop nonhuman minds that might eventually outnumber, outsmart, obsolete and replace us? Should we risk loss of control of our civilization?" We agree that misinformation, impact on labor, and safety are three of the main risks of AI. Unfortunately, in each case, the letter presents a speculative, futuristic risk, ignoring the version of the problem that is already harming people. It distracts from the real issues and makes it harder to address them. The letter has a containment mindset analogous to nuclear risk, but that’s a poor fit for AI. It plays right into the hands of the companies it seeks to regulate. Couldn't agree more. ]]> ai scifi future risks gpt-4 regulation https://pinboard.in/ https://pinboard.in/u:jm/b:4292c5fac6fe/ 2022-05-26T08:53:01+00:00 https://twitter.com/zalaly/status/1529494830820335617 jm long-covid covid-19 vaccines risks disease paxlovid papers https://pinboard.in/ https://pinboard.in/u:jm/b:3fa82bee0b68/ 2022-05-16T10:24:31+00:00 https://www.thelancet.com/journals/laninf/article/PIIS1473-3099(22)00223-7/fulltext jm thromboembolism risks covid-19 sars-cov-2 papers embolism thrombosis health https://pinboard.in/ https://pinboard.in/u:jm/b:0732db44c454/ 2021-11-23T12:16:50+00:00 https://pluralistic.net/2021/11/10/elfin-safety/#mene-mene-tekel jmRisk compensation does occur in very narrow and specific circumstances, but all the studies purporting to show that it is a widespread, predictable outcome of any safety regulation have failed to replicate. [...] Risk compensation and health-and-safety panic are both part of a safety nihilism campaign that serves big business's deregulatory agenda, and the cruel moralizing of right wing religious maniacs, the traditional turkeys-voting-for-Christmas coalition. But risk compensation is especially salient in these covid days, where it's being used to fight rapid testing ("encourages risky behavior"). ]]> risk-compensation risks safety https://pinboard.in/ https://pinboard.in/u:jm/b:ea9d02f5fca1/ 2021-04-09T08:21:32+00:00 https://www.theguardian.com/world/2021/apr/09/tui-plane-serious-incident-every-miss-on-board-child-weight-birmingham-majorca?CMP=Share_AndroidApp_Other jmA software mistake caused a Tui flight to take off heavier than expected as female passengers using the title “Miss” were classified as children, an investigation has found. The departure from Birmingham airport to Majorca with 187 passengers on board was described as a “serious incident” by the Air Accidents Investigation Branch (AAIB). An update to the airline’s reservation system while its planes were grounded due to the coronavirus pandemic led to 38 passengers on the flight being allocated a child’s “standard weight” of 35kg as opposed to the adult figure of 69kg. This caused the load sheet – produced for the captain to calculate what inputs are needed for take-off – to state that the Boeing 737 was more than 1,200kg lighter than it actually was. ]]> flight aviation bugs risks software flying tui titles i18n https://pinboard.in/ https://pinboard.in/u:jm/b:fc94152fdea8/ 2020-03-05T10:34:50+00:00 https://thebulletin.org/2020/02/the-us-government-insurance-scheme-for-nuclear-power-plant-accidents-no-longer-makes-sense/ jmThe Japan Center for Economic Research, a source sympathetic to nuclear power, recently put the long-term costs of the 2011 Fukushima accident as about $750 billion. [...] The main public risk of nuclear power plants comes from rare but devastating nuclear accidents. Because data on such accidents is sparse, the probability of their occurrence has to be calculated on the basis of a model, rather than obtained from experience. Moreover, the extent of an accident and its monetary consequences are postulated on the basis of models that are limited by analysts’ imagination. Who would have imagined, for example, that the Fukushima accident would involve several reactors? Or that Japan would subsequently shut down all its other nuclear power plants?]]> fukushima nuclear nukes power risks danger probability insurance nuclear-power reactors https://pinboard.in/ https://pinboard.in/u:jm/b:cbdecda4acb6/ 2018-03-27T21:11:25+00:00 https://twitter.com/colmmacc/status/978438909834117120 jmhere's my advice: if you see a server supporting 0-RTT and that server doesn't give you an iron-clad guarantee that when the key is used, it's deleted, and that your EARLY CONVERSATION can't be repeated ... don't use it. ]]> colmmacc tls security ssl risks networking crypto https://pinboard.in/ https://pinboard.in/u:jm/b:546abaf443d3/ 2018-01-15T15:02:01+00:00 http://catless.ncl.ac.uk/Risks/23.07.html#subj10 jmIt is far too easy to blame people when systems fail. The result is that over 75% of all accidents are blamed on human error. Wake up people! When the percentage is that high, it is a signal that something else is at fault -- namely, the systems are poorly designed from a human point of view. As I have said many times before (even within these RISKS mailings), if a valve failed 75% of the time, would you get angry with the valve and simply continual to replace it? No, you might reconsider the design specs. You would try to figure out why the valve failed and solve the root cause of the problem. Maybe it is underspecified, maybe there shouldn't be a valve there, maybe some change needs to be made in the systems that feed into the valve. Whatever the cause, you would find it and fix it. The same philosophy must apply to people. ]]> don-norman ux ui human-interface human-error errors risks comp.risks failures https://pinboard.in/ https://pinboard.in/u:jm/b:dbe5f8ce9cce/ 2017-02-20T14:40:54+00:00 https://motherboard.vice.com/en_us/article/space-weather-cosmic-rays-voting-aaas jm"Everything was going fine, but then suddenly, there were an additional 4,000 votes cast. Because it was a local election, which are normally very small, people were surprised and asked, 'how did this happen?'" The culprit was not voter fraud or hacked machines. It was a single event upset (SEU), a term describing the fallout of an ionizing particle bouncing off a vulnerable node in the machine's register, causing it to flip a bit, and log the additional votes. The Sun may not have been the direct source of the particle—cosmic rays from outside the solar system are also in the mix—but solar-influenced space weather certainly contributes to these SEUs.]]> bit-flips science elections voting-machines vvat belgium bugs risks cosmic-rays https://pinboard.in/ https://pinboard.in/u:jm/b:82f747a43970/ 2017-02-14T10:42:03+00:00 https://medium.com/making-instapaper/instapaper-outage-cause-recovery-3c32a7e9cc5f#.39bn4xjas jmWithout knowledge of the pre-April 2014 file size limit, it was difficult to foresee and prevent this issue. As far as we can tell, there’s no information in the RDS console in the form of monitoring, alerts or logging that would have let us know we were approaching the 2TB file size limit, or that we were subject to it in the first place. Even now, there’s nothing to indicate that our hosted database has a critical issue. ]]> limits aws rds databases mysql filesystems ops instapaper risks https://pinboard.in/ https://pinboard.in/u:jm/b:70ad5bf26582/ 2015-08-11T13:05:52+00:00 http://illmatics.com/Remote%20Car%20Hacking.pdf jm 'Since a vehicle can scan for other vulnerable vehicles and the exploit doesn’t require any user interaction, it would be possible to write a worm. This worm would scan for vulnerable vehicles, exploit them with their payload which would scan for other vulnerable vehicles, etc. This is really interesting and scary. Please don’t do this. Please.' ]]> jeep hacks exploits d-bus qnx cars safety risks https://pinboard.in/ https://pinboard.in/u:jm/b:679039190480/ 2014-12-14T19:39:32+00:00 http://www.theguardian.com/money/2014/dec/14/amazon-glitch-prices-penny-repricerexpress jmFrom 7-8pm on Friday, [RepricerExpress] software, used by third-party sellers to ensure their products are the cheapest on the market, went a bit haywire and reduced prices to as little as 1p. ]]> 1p amazon resellers repricer-express fail price-cutting automation risks undercutting https://pinboard.in/ https://pinboard.in/u:jm/b:10f434e3efd7/ 2014-11-21T20:46:39+00:00 https://www.reddit.com/r/talesfromtechsupport/comments/2mkmlm/the_boss_has_malware_again/ jmFinally after all traditional means of infection were covered; IT started looking into other possibilities. They finally asked the Executive, “Have there been any changes in your life recently”? The executive answer “Well yes, I quit smoking two weeks ago and switched to e-cigarettes”. And that was the answer they were looking for, the made in china e-cigarette had malware hard coded into the charger and when plugged into a computer’s USB port the malware phoned home and infected the system. Moral of the story is have you ever question the legitimacy of the $5 dollar EBay made in China USB item that you just plugged into your computer? Because you should, you damn well should. (Via Elliot)]]> via:elliot malware e-cigarettes cigarettes smoking china risks https://pinboard.in/ https://pinboard.in/u:jm/b:f8cb713f6c77/ 2013-09-16T21:01:17+00:00 http://www.thehindu.com/news/national/karnataka/how-the-biometric-system-has-failed-hard-working-people/article5125374.ece jmThe biometric authentication system installed at the PDS outlets fails to establish the identity of many genuine beneficiaries, mostly workers, as their daily grind in the agricultural fields, construction sites or as domestic help have eroded the lines on their thumb resulting in distorted impressions. ]]> fail risks biometrics authentication mysore security india fingerprinting https://pinboard.in/ https://pinboard.in/u:jm/b:23b329ba8068/ 2013-03-24T20:26:16+00:00 http://jefferai.org/2013/03/24/too-perfect-a-mirror/ jm while we planned for the case of the server losing a disk or entirely biting the dust, or the total loss of the VM’s filesystem, we didn’t plan for the case of filesystem corruption, and the way the corruption affected our mirroring system triggered some very unforeseen and pathological conditions. [...] the corruption was perfectly mirrored... or rather, due to its nature, imperfectly mirrored. And all data on the anongit [mirrors] was lost. One risk demonstrated: by trusting in mirroring, rather than a schedule of snapshot backups covering a wide time range, they nearly had a major outage. Silent data corruption, and code bugs, happen -- backups protect against this, but RAID, replication, and mirrors do not. Another risk: they didn't have a rate limit on project-deletion, which resulted in the "anongit" mirrors deleting their (safe) data copies in response to the upstream corruption. Rate limiting to sanity-check automated changes is vital. What they should have had in place was described by the fix: 'If a new projects file is generated and is more than 1% different than the previous file, the previous file is kept intact (at 1500 repositories, that means 15 repositories would have to be created or deleted in the span of three minutes, which is extremely unlikely).']]> rate-limiting case-studies post-mortems kde git data-corruption risks mirroring replication raid bugs backups snapshots sanity-checks automation ops https://pinboard.in/u:jm/b:6ba6f59d2552/ 2011-12-08T15:55:06+00:00 http://www.popularmechanics.com/technology/aviation/crashes/what-really-happened-aboard-air-france-447-6611877 jm aviation crash flight flying autopilot stalls warnings alarms ui af447 risks automation https://pinboard.in/ https://pinboard.in/u:jm/b:cc02b8859dac/ 2009-08-01T10:21:06+00:00 http://voices.washingtonpost.com/securityfix/2009/07/clampi_trojan_the_rise_of_matr.html?wprss=securityfix jm joe-stewart secureworks malware reverse-engineering clampi trojans banking security danger risks windows microsoft fraud https://pinboard.in/u:jm/b:fef3de2648ed/