[RSS] Finding a Heap Buffer Overflow in the ASAM MDF Library Used in ADAS Systems with AFL++

https://g0ku704.github.io/2024/08/13/mdf4_parser_vuln_CVE-2024-41445.html

CVE-2024-41445 #fuzzing

I’m glad we wrote that paper. However LLMs “still lack basic reasoning skills” makes me cringe.

Information theory tells me that because an LLM is a finite set that is not able to grow itself, once it is trained has a finite capability. And that capability is driven by statistics and numbers.

intuitively (to me at least) if you present an LLM with a prompt that’s weird enough it will “hallucinate” answers because it has no critical thinking, it’s just a big probability machine that tries to find the most likely answer to your question. As a result, present an LLM with a chess problem brain teaser unique setup, chances is the LLM will make up rules because what it trained against isn’t chess rules but “in general chess problems end with a checkmate” and it will interpolate the movements from where you are to a checkmate.
https://mastodon.social/@appleinsider/113295305642702643

Oh yes we have our new “you wouldn’t download a car”

Apparently if you want to get your data out of an Apple thingy the preferred way to go is to transfer all the data halfway around the world then back to your other device that is literally 10cm apart from your Apple thingy.

The other option is to download 160 3.5" floppy disks worth of software (about 2x the size of the recommended disk space of Windows 95) because somehow getting data out of the Apple thingy over conductive wires requires this much software magic.

#Apple

Blue Monday on Vintage Casio Instruments

https://www.youtube.com/watch?v=h9mm0YlMa9I

The whole of my book on Building a Debugger is now available on Early Access!

It teaches you how to write a native code debugger from scratch.

There's lots of cats.

https://nostarch.com/building-a-debugger

"There is always a way, but we do not provide one." lol

#ghidra

https://github.com/NationalSecurityAgency/ghidra/discussions/5362#discussioncomment-5968992

Lets Encrypt will disable OCSP about 6 months after Microsoft Root program allows it to (the browsers have already okayed it).

This all could be over in a year, year and a half. If you need OCSP for your business, you need to investigate alternatives NOW - which are all proprietary.

Apache ACME will handle this change just fine. Stapling will of course no longer be provided to clients.

https://letsencrypt.org/2024/07/23/replacing-ocsp-with-crls/

"Complexity Has to Live Somewhere"
-- @mononcqc

https://ferd.ca/complexity-has-to-live-somewhere.html

Steam updated its platform to clarify that game purchases grant a license, not ownership, in response to California's AB 2426 law, which takes effect in 2025. So yes, the games you buy don’t actually belong to you https://alternativeto.net/news/2024/10/steam-now-makes-it-crystal-clear-that-you-re-purchasing-a-license-not-the-actual-game/

TIL there is a thing called #Sarif, a Static Analysis Results Interchange Format, developed by Microsoft.
https://groups.oasis-open.org/communities/tc-community-home2?CommunityKey=c64ae352-bebf-446d-8ebf-018dc7d3eeb0

🎮 Announcing Steam gaming on Fedora Asahi Remix! 🎮

Get the scoop here: alx.sh/gaming.

... or just dnf install steam and give it a go!

Promoting exploits with logos and websites may be overkill, but let me remind you of this show put together for the release of a RAT:

https://youtu.be/oHxNEvklKqE?si=59JzajcBQYRP7xrX&t=1491

#bo2k #cdc #defcon

Bibi-binary is a hexadecimal notation system from 1968 with its own binary-derived symbols and single-syllable pronunciations for each digit https://en.wikipedia.org/wiki/Bibi-binary

Just a new #lolbin - sweet16 I mean, setup16

c:\windows\SysWOW64\setup16.exe

blog post to follow

Apple did the research; LLMs cannot do formal reasoning. Results change by as much as 10% if something as basic as the names change.

https://garymarcus.substack.com/p/llms-dont-do-formal-reasoning-and

Sent from San Diego, California, U.S.A. on April 4, 1994. https://postcardware.net/?id=20-18

wow, check out this time lapse from last night's solar storm 😍

🤖 GSM-Symbolic: Understanding the Limitations of Mathematical Reasoning in Large Language Models

"Recent advancements in Large Language Models (LLMs) have sparked interest in their formal reasoning capabilities, particularly in mathematics. The GSM8K benchmark is widely used to assess the mathematical reasoning of models on grade-school-level questions. While the performance of LLMs on GSM8K has significantly improved in recent years, i…"

https://machinelearning.apple.com/research/gsm-symbolic