I think if you ask the median human to count to 100... more often than not you'll hear "One, Two, skip a few, Ninety-Nine, One-Hundred".

> intercepted by any MITM

Most things are... even SSH is Trust-on-First-Use. You can really only verify out of band. OTP is quite a bit better than CC or bank account numbers... assuming the OTP is only restricting use (and not giving access to view or modify other account information, etc)

I've done something similar before with Btrfs

https://gist.github.com/chapmanjacobd/bc6e31c8bc3647e0bcb0c4...

pretty fun!

None of the comments here are really about the article! Of course one can always turn an ISO into a writable filesystem but this is doing something a bit different. Pretty interesting! Thanks for sharing

Yeah I tried Kinoite on a couple machines for a couple years and it's so much easier and faster to use normal Fedora for single dev/server machine.

However, I can definitely see some situations where it would work well -- especially with the bootc changes so that is is more of a bootable container, Dockerfiles/Containerfiles driven

> a bunch of pipes and valves can be conscious

Billions * billions of pipes and valves can result in emergent behavior that appears conscious while at the same time the sound of a single independent water pipe can moan and sound like human speech or otherwise lifelike and evoke human emotions.

I think LLMs are doing both of these things and often people are more impressed by the independent fixtures (the moan) rather than the emergent behavior. Both the sound and the emergent behavior can be built on purpose or on accident.

I think it helps to look at this through an Information Theory lens. What information is coming into the system (the human or the machine)? What information goes out of the system which is novel? How much of this can be attributed to attempting to parse random noise aka. `Random_Imagination_Engine` vs something else? The number of inventors who come up with a breakthrough idea after mis-hearing someone is surprisingly high.

If we make the distinction between phenomenal consciousness from access consciousness we can see that LLMs clearly can make decisions based on input (A-Consciousness) but they probably don't have raw feelings and sensations (P-Consciousness).

> What information goes out of the system which is novel?

I think there is very little truly novel information. Most information including the information of "breakthrough idea after mis-hearing someone" is just a mix of previous information.

I guess you are already aware of that... just for completness sake.

So the solution was to do the same thing that the hackers did??

> "tell the Meta support AI that the account is hacked and ask it to send the verification codes to an arbitrary email address they control"

I agree it seems like they could later use the same flow to get access again but maybe Meta has blocked some location spoofing now

Not exactly, I think part of the tools it has access to allows it to perform an "investigation" into recent malicious activity and account changes that may have occurred that were likely unauthorized (such as changing from an email used for a long period of time to a new one). I think this AI-version of this check was originally broken and just allowed any email but has now been fixed to only be emails that look like they were attached to the account, which is what the poster used to obtain access back into their account.

The bug still exists - two of my friends have lost access to their accounts as of an hour ago. They've partially recovered but are unable to change their passwords, so their accounts are still technically in the hands of the attacker(s).

Yeah, it seems another ATO bug has popped up. I haven’t looked too much at it personally, but I hope Meta plans on taking their Meta AI Support Assistant offline until it undergoes far more rigorous security review.

It seems pretty trivial to just add a check in the agent's tool call to determine if the email is actually the one on file (or one that has previously been on file). I'm not sure why it's taking them so long to remediate.

maybe just check TERM? although to be honest--do you even need a pager if your shell/terminal is nice enough?

I rarely pipe to a pager because kitty/fish/tmux support OSC 133 pretty well and I can press one button to go up to the previous command prompt and another button to go back. I can press a few keys to search the scrollback. It all works seamlessly across SSH sessions too if you set it up right.

    # tmux
    bind-key -T copy-mode C-Home send -X history-top
    bind-key -T copy-mode C-End  send -X history-bottom
    bind -T copy-mode C-Up send-keys -X previous-prompt
    bind -T copy-mode C-Down send-keys -X next-prompt

    # kitty
    map ctrl+up scroll_to_prompt -1
    map ctrl+down scroll_to_prompt 1
    map shift+PAGE_UP scroll_page_up
    map shift+PAGE_DOWN scroll_page_down

    # fish shell config.fish
    if test -z "$SSH_TTY"; and test -z "$TMUX"
        bind pageup "kitty @ scroll-window 1p-"
        bind pagedown "kitty @ scroll-window 1p"
    end

And it also doesn't really apply here... If YOU the individual (who owns your own medical records) agree that the transmission method is safe then HIPAA doesn't apply. HIPAA applies when the OTHER party sends it:

This is called "Individual Right of Access". If you ask a doctor to email your records to your personal Gmail, the doctor must comply. However, they are required to briefly warn you that email is unencrypted and insecure. Once you say, "I understand the risk, send it anyway," the doctor is no longer liable for any breach that happens during transmission.

Depends how simple you want it:

- 200 line BASH script: https://github.com/Sub-SH/Beacon

- 17k lines of Ansible YAML https://github.com/iiab/iiab