Can Large Language Models Hack? Part 1

There is a wide range of ideas about what GenAI might be capable of. There are many questions we have about what it can do. One that has come up recently is whether GenAI is capable of malicious attacks on software. In short, can it "hack?"

Infrastructure as Code. Infrastructure is Code. Infrastructure from Code. Infrastructure will Code.

What we call IaC is not a single thing. There are a variety of different models and strategies. In this post I explore some ways to categorise these models and try to understand how IaC is evolving, including how recent advances in artificial intelligence can be a catalyst for change.

Realists, Pioneers, Skeptics and Futurists: The AI Hot Take Matrix

I had four pieces of AI content decaying in browser tabs, and they were each starkly different in terms of their feel for where AI is headed. I realised that in order to understand what these articles meant for the future of AI, I needed to map these positions out.

More on the Attack Hypersurface. Cloud Estates Can Only Be Understood With Modelling. And Just Look at All the SKUs.

In a previous article I started to discuss the idea of how infrastructure technology has evolved into having an "attack hypersurface," not just a normal sized, regular old attack surface, but something more than that...something almost unknowable.

Surivorship Bias & the Nation State Long Con. The Number of Software Backdoors Is Not Zero. We Are a Techno-Society That Depends on Open Source Software.

The open source software movement is one of the most interesting things to happen in recent human history. We are a techno-society that depends on open source software, so what happens when nation states go after the basic human frailty of OSS maintainers?

We May Never Be Rid of Log4J. It Was, and Still Is, an Endemic Vulnerability. It’s the Long Tail That Is Concerning.

Log4J has a long tail. About 38% of Java applications are still vulnerable. Traces of exploit attempts are increasing across the Internet. CISA said that the Log4J vulnerability would be a long living and persistent one, and it is.

The Cybersecurity Attack Surface Is Getting Bigger and Bigger. We’ve Been Going Through a Mega-Evolution. It’s a Hypersurface Now.

We've invented and evolved thousands of computational thingamawhatsits to deploy applications with, and combined them in billions of permutations...then we need to build the cybersecurity around them. It's worth it to take a moment, step back, and ponder that.

“The Fashionable Negligence of the Day” and the Three Body Problem: Mark Burgess On Our Industry-Wide Problems With Configuration Management (Yet...the Stock Market Still Works?).

More than 30 years after CFEngine, Mark Burgess is still thinking about configuration management. He has a new post on configuration and how it can't be made easy, and in this article I look through some of his more provocative and interesting statements.

Memory Safe Languages: Does Just Bossing around Developers Work (From a Security Perspective?)

One of the smartest computer security people around (not me) asks if we can just keep piling work on developers, including things like rewriting everything in memory-safe languages.

A Look at NIST 800-204D: Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines

At this point, the name Solarwinds has become almost synonymous with the idea of a Software Supply Chain (SSC) attack. And now, a few years after this particular attack, we have some recommendations from NIST on how to secure the systems that build and update software products.