Replying to
@iscdotorg@fosstodon.org "just the way DNS works" has caused more damage to availability than distributed denial or service attacks. If "just they way DNS works" is not a CVSS 10, I don't know what it is
Remote
Florencio Cano
@florenciocano@infosec.exchange
mastodon 4.8.0-alpha.3+glitchPrincipal Product Security Engineer
310 Followers
673 Following
14 Posts
Joined May 23, 2023
The team, the team, the team:
HackMyClaw was an OpenClaw prompt injection challenge: make Fiu leak secrets through email. After many attempts, no one succeeded https://hackmyclaw.com/
Replying to
@iscdotorg@fosstodon.org I was joking in relation to fact that many times when there is an incident someone says it's because a DNS misconfiguration. I'm sorry I didn't transmit it correctly. I'm not funny.
Is anyone running #openclaw with a local LLM and it is working well? I'm specially interested in LLMs that can be run in GPUs with 24GB vRAM.
Replying to
@kaoudis here there is more information about the different security headers and which are recommended and which not https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html
Replying to
#HuggingFace claims they were unable to use frontier commercial AI models to investigate and do forensics of the attack due to the frontier models guardrails. They used GLM 5.2, an open-weights local model.
Replying to
#HuggingFace detected the attack with AI and correlation:
"LLM-based triage over security telemetry to separate real signals from the daily noise, and it was the correlation of those signals that flagged the compromise."
Agent Skills: Explore security threats and controls https://developers.redhat.com/articles/2026/03/10/agent-skills-explore-security-threats-and-controls
RE: https://infosec.exchange/@SteveBellovin/116944300269431503
"one of the proof’s implications is that there will always be a way to prompt an AI system to disregard its rules — it’s just a matter of finding it."
Quoting
"NIST Mathematical Proof Supports Transition to a Continuous-Monitor-and-Update Security Model for AI Systems": https://www.nist.gov/news-events/news/2026/06/nist-mathematical-proof-supports-transition-continuous-monitor-and-update
In essence, this is an extension of Gödel's Incompleteness Theorem to AI guardrails.
Open quoted postGemma 4 31B quantized is hands down the best model I have been able to run locally on a RTX 4090. I run it with llama.cpp/build/bin/llama-server -m ~/models/gemma-4-31B-it-Q4_K_M.gguf -c 65536 -ngl 99 -ctk q4_0 -ctv q4_0 -fa on --host 0.0.0.0 --port 8081 Any suggestion to run it more efficiently? Any other model I should try?
The book "The Goal" is a great read to understand where to use AI to really improve performance. If you improve/automate the wrong step the result is worse.
Replying to
@iamamoose@infosec.exchange Mark, you said "outside of the threat model". Is that threat model documented anywhere? I ask because I think the threat model could be used to filter security issues and I would like to see Apache's
Replying to
@mpowney@mastodon.au I had the same experience, but I wonder if it was because the models I used.