The AI cybersecurity discourse is so stupid. Beyond stupid actually. It's utterly incoherent. Improve your security. That's the only takeaway that matters.

I have been surprised how much AI fear mongering genuinely comes down to security people not wanting to do any work. Things like the PHP vulnerability are good finds that make the world safer even if they cause a bit of a scramble.

I know! Like holy shit the drama is just way out of control

Brah I swear all the stupid takes are filtering into retarded nomie sphere and I am spending more time explaining bs than ever

I get DMs from normies! Being like “is this the start of cyber covid” and shit. Like I’m so sorry these people are scaring people like this because holy shit

The biggest problem with the discourse to your point is people can’t see the forest from the trees, so this is clouding the real issue, get your basics right, get your shit in order

Yea like the conclusion is just “improve your security, do the work”

When the machines take over, they’ll be in trouble because they’ll have nothing to ask how to secure their shit

it's the worst it's ever been. the baseline is as you've said, fix the problem. don't outsource the blame. lol

Yep exactly. People also are like “what could I have done it was a zero day” there are always things you can do to minimize impact

Whatever gets people to improve

I wish Dario understood cybersecurity 🙈

If only we could be so lucky

I can see, and share, the frustration 😄

We've all known the internet was held together with chewing gum and bailing wire for years. This isn't unlike when fuzzing as a technique was invented. Also "Fix your shit" merch drop soon?

Definitely should make that merch

Hell yeah, put me down for a mug I can use in meetings about NIST maturity.

Find the vulns, fix your stuff, eliminate tech debt, and repeat. These have been primary objectives and SOPs decade after decade, and they will continue to be. AI simply helps us do this at hyper-speed when used well.

Yea like the ea ai doomer crowd wants to be like “we saw this coming” go read a fucking cybersecurity forum from the early 2000s. The lessons are always the same

💯

Amen.

Damn that’s a good shirt

These dudes are literally letting claude write their tweets and replies. Of course they sound out of touch

Hahahah fair

"Nuh-uh, we need to ban open weights AI models"

Ooooh my bad

What we have is a epidemic of click baiting doomers spreading just senseless posts and it's making it ten times worse. Like this one International Cyber Digest .. He literally takes the screenshot and is saying there is No patch.. The man is standing there handing out patches. Beaumont, twice, directly underneath: "make sure you upgrade for the PHP vulns" … "upgrade those now" … "Also update Citrix Netscaler boxes." He doesn't even know what Upgrade for Vulns means. It's infuriating because I know two CS guys along with myself that have been run ragged all week deploying patches or having networks get hammered by exploiters to see if you patched. Then typically clueless management spazzing out because they saw another CVE.. WE KNOW. GO AWAY. It's so tiresome and people out continuing to echo nonsense doesn't help calm it down. .. Some of us are burnt out 😂

“we tried to warn the world” about what? some incompetent firm in india epicly failing? where was our weekly ‘pacing the frontier’ thesis paper on that? ai only exacerbated the issue because of automation. it didn’t cause the issue, but for some reason that doesn’t seem to matter? it’s all so farcical, you don’t even have to be a little bit smart to see through it. you just have to know how to sniff out a bullshitter, and they fail the bullshit test on first pass alone.

lol yea I know like “we tried to warn you” I don’t even know about what!!!!

i completely agree with you. AI has certainly ushered in greater risks to systems/data, but the ONLY reliable solution is, as you say, to fix our shit - same as it ever was, but harder, faster, & much much better.

Yea like what else can we do? It is the real answer no matter what comes next

yep. all these moves to self-police closed-weight/foundation models & somehow dictate good behaviour with open-weight/abliterated models - its a fools errand. the worst that can happen, will happen, & at the very worst time - to we'd best fix our shit :)

Why is that angry gentleman lecturing us on having to patch stuff? He has a team doing it for him under codename Kasper.

Hahaha @kasper_rt fix our shit

@thedealdirector our shit is actually not shit

@thedealdirector That is true

i think interesting convos about this kinda thing in replies to this !

I don’t think it matters! I’ve long been on “it’s totally unclear” but like either way the work we need to do is the same imo (But will go read the takes)

Yup

😆🤝

Haha ty

Fix your shit. Don’t ignore patching, rotate API keys, have OAuth, remove users that are no longer with the company that still have accounts in SaaS tools. Don’t ask me how I know that one lol

Hahaha every lesson was learned the hard way

I think the "we told you so" thing from the frontier model dealers is wildly disingenuous. They withhold blue team model abilities behind some arcane signup page and requiring jumping through hoops. Securing/patching your legacy codebases should be far more accessible.

Yea it was just a gross thing for them to say

what annoys me is that with AI is much faster and easier to fix our shit! we should be happy about all the CVEs how tf else are we gonna fix it

Yea there’s benefits! That’s why these black and white takes are wrong. Lots of hard tradeoffs here. The only universal is we need to improve security

The sensationalism is exhausting.

I don’t even know what they’re talking about they’re just making sensational noises really

I don't think they know either. There's a hard lesson I learned early in my career: Title != competence. Unfortunately, the media doesn't seem to have learned this lesson, so they keep amplifying these people.

People have stuff to sell….

True, wouldn’t want to interfere with that important work

well said I suspect they are all concerned about "the incident" and dancing around talking about what happened

Tell Dario

But then I'd have to actually think about security besides the damn paperwork

Oh I forgot that is harder, my bad. Nvm everyone give up!

what do you think of the "vulnzero" take?

I’m not really an appsec person so I don’t have strong views

nooo 😔

I'm telling you the PHP incident is a psyop

But machine speed!

The world may never be the same

My rule of thumb: If they're telling you *everything* has changed, they're selling something. If they're insisting *nothing* has changed, they're hiding something.

But Ant doesn’t even have a soc. Isn’t that a basic?

My favorite so far - "the internet is being hacked".

Idk chat I think no way AI doesn’t absolutely go off on security vulnerabilities

So? Answer is still to improve your security.

Not much else to do while we wait

miopic take... humans repairing and defending against ai is too slow

I didn’t say “don’t use ai”?

true... but then your video take is disingenuous... we all want to fix stuff, but it seems from now on, you will need ai to secure and update your software.

Why is my video disingenuous? What?

You guys are selling the crowbars, training the burglars, and now telling us we should buy better locks. Ooook.

I am not doing that. And most of my security advice is free in terms of products, just means “hire security people”

Oh, you aren't an AI developer. Sorry, your website implies it.