Well, I think it's fair to assume that
a) They didn't upload everything before they realized it would work.
b) They want to mention this as an advantage for future analyses
c) Even if you assume that the attack exfiltrated everything until proved otherwise, you shouldn't just disseminate all the private information, because maybe the attack didn't.
They specifically call out credentials used during the attack.
But they should be rotating those regardless. You don't get to say "Maybe the attacker didn't get this credential". You just rotate.
The most generous interpretation is that they have not yet have completed that rotation, and they didn't want to risk putting those credentials into the wild during that process.
---
But all of that aside, I feel like the undercurrent of this comment is that the "safety" rules that providers are pushing are genuinely harmful.
Another point where "if you don't own the model, you can't properly operate the tool" becomes true. Open isn't about profits, it's about capabilities.
We had that almost 80 years ago for a few decades, but we shot a guy at the end of it. I hope the next one to suggest something like this remembers the history and refrains from it.
It did help the West, and especially the UK, to get as immigrants very high good plumbers and handy men. The rest of us went into STEM and are now working for FAANGS.
Unfortunately it is a bit more complicated than that. All these phones run firmware, bootloaders, libraries under license from SoC providers, who package components from other vendors under a license themselves. Opening up the bootloader can be done, but two things have to happen: either the phone is crippled of various functionalities or the manufacturer is in breach of license because all the binary blobs become open and can be reverse engineered. No one wants to go through all of this for a few hundred people who are interested in running their home assistant on an exotic device.
I haven't ever heard of an SoC supplier demanding that the device's bootloader must be locked. Are you sure that this is happening? I've only ever seen devices delete first-party blobs, presumably of the manufacturer's own volition.
When cores start needing more than 9 bits to be represented and RAM is in terabytes, many of the old assumptions need to change. Schedulers need to be implemented in userspace, RAM needs to be allocated in GB, not in 4k, io needs to require less round-trips between kernel and user space and NICs need to do a lot more work before the data reaches the CPU.
Does it need to be the same OS? Most consumer device are in the low 16GB range for memory with some outliers in the 64 and 128 GB. 32 cores are still in the realm of specialized devices.
Yes, we’re not the one paying for Linux development, but its subsystems are so complicated for general purpose computing. Like fitting formula 1 car parts onto a camry.
Our software is littered with the consequences of these kinds of assumptions, and they have an impact on consumer use cases.
x86 still runs in real mode on boot despite dropping the PC BIOS.
Lots of software still assumes a 4kb page size, to the point where migrating Android to 16kb is an ongoing multi-year effort involving far too many people. And this is an OS for phones, which you might assume would lack the memory to benefit from a larger page size.
And one of the most popular consumer CPUs for enthusiasts, the Ryzen X3D chips, broke assumptions in both Linux and Windows schedulers that all cores have access to the same amount of L3 cache.
I would probably not assume the kinds of hardware limitations that we have now will persist into the useful lifetime of current software. Splitting the OS into "consumer" and "enterprise" variants is one of those moves that would bake in a ton of assumptions and make things messier in the future.
It’s all about contracts. It’s fine to define assumptions and build software on top of those. It’s also fine to break those and adjust the software. The trap is trying to steer towards a universal solution (Yagni is the cure there) or trying to slip something in that does not respect the contracts (hence bugs).
UEFI could have supported something like ELF and do away with real mode. Intel and Amd could have just introduced a new line of cpu and everyone could have transitioned to that (with maybe shims to soften the change). But everyone is all about backwards compatibility and compile once, runs for eternity.
If we are successful building an "ultra" human AI, it will require massive amounts of energy. That translates directly to "money". There will always be money unless someone finds a way to negate the second law of thermodynamics.
The dependency tree for anything in the software world is so large, that liability like you describe is not feasible. Tomorrow Anthropic's latest model will find a RCE in SYNs being sent to a server? Who is "liable" when you lose your Google account, your bank account, access to your car and all ways to prove to the government you are who you are all at the same time?
Others have already replied this is not exactly the case and it's trafficking weed and other drugs that gets you hanged.
That being said, I'm not so chill about weed. Weed people, like smokers before them, don't consider weed to be a big problem for the people around them and ignore anything you might have against it. That means you'll be laughed at when you ask neighbors to stop smoking two floors below you, to stop growing the plants in their tub, etc. It also means you'll have to go through a lot of places that smell like shit because people smoke weed there often.
reply