Binance explicitly said it wasn't just the compromised laptop.
I'd be surprised if it were. Crypto exchanges have been targeted by hackers since forever, and Binance is one of the top. If it was so easy to exfiltrate crypto from them, I'd have expected a heist before now. (Unless controls have just gotten worse recently.)
Do you have a source? Because I've only been hearing about the laptop.
> Binance has said the incident was a “complex attack” that stemmed from multiple factors.
> Its initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions.
I know it says "multiple factors" here, but there are no other factors I've found.
Sure, but the vary fact that a DevOps engineer had single-person access to a component that enabled them to submit unauthorized withdrawal transactions is likely already an unintended situation brought on by a misconfiguration in their system.
> Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.
That seems to be their most recent update on the matter afaik (30 Oct, 8:47am UTC)
World's most sophisticated hacker who happens to be in a jurisdiction who do not respond to provocations and operate out from behind the GFW illegally, and at the same time, never broke ranks even with the wealth and being in a remarkably well-resourced perch to defect.
The FBI and other federal agencies engaged in law enforcement routinely use appeals to authority and expertise they do not have and create set-piece situations that almost in every case involving more than one defendant sets up a circular firing squad situation where the most guilty is at an advantage of simply pleading guilty and cooperating first, or otherwise they'd dump it off via the AUSA down to the state level if they can, or blame China, Russia, NK, Iran, or Israel, countries that do not extradite their own citizens on request and rarely if ever do so unless it's done so on their terms. Blockchain tracing ultimately still needs the connection between the chain and off-chain ID and there's no surefire way to even ascertain with something that isn't a mere heuristic with an error rate unacceptable in criminal court and would fall apart if there's competent defense counsel, which the FBI have, in the one case where on-chain evidence was going to be used, actually went full Chewbacca and created a two year delay mid-trial and then pulled Chainanlysis' "expert" off before cross examination. The company has the balls to brag as if the courts have validated their method in whole, when in reality the court have long understood what clustering is and so that part is of course admissible evidence, but it also doesn't get you to the purported end - attribution. If one can use a strawman as a sales tactic, this would be exactly that. The attribution aspect have never been allowed to be properly examined in the criminal context. The "reactor" is merely a database, and in the small bit of direct examination the chainalysis employee claimed that every time he queried the database the correct rate was some absurd, Robert-Mugabe's-election-number figure that is higher than the DOJ's conviction rate when they were still credible and actually higher than the CCP's official conviction rate in a fake criminal justice system where due proceess doesn't exist and they give leeway because claiming to be 99% correct is absurd. Of course, they've never been tested in the same situation and still haven't, and if the industry mouthpiece is basically hiring sales and not legal, which is basically what every company in the Blockchain Association has been doing, rent-seeking to be Wall Street 2.0 on top of free merged pull requests and open source software. Tracing on chain is all well and good for shits and giggles but Department of Treasury went and sanctioned a smart contract thinking that it was an EOA address that belongs to a person as if etherscan was never checked beforehand tells you all you need to know.
They had a bad case against Tornado Cash since the ultimate demand would require the devs to somehow predict the actual identities of those that interact with their contracts - which in many cases isn't even a human. It's telling that when the 5th Circuit and the one judge in that circuit who knows anything about process and technology through sheer luck got on the panel and wrote a clear rebuke of how federal investigators failed at doing any due diligence, and for once, the feds did not attempt to do an end-run or even ask for en banc hearing of the issue, but simply made up a completely different issue to pursue (building the front end) which is not a crime. The feds can't match the IP/in house firms in renumeration and can't even match public interest or federal defenders in hiring out of tech competent law grads when it comes to having a moral high ground. They have so much resources so that they can hire contractors, but can't vet the contractors. Being able to fall back on coercion covers up a lot of incompetence. The Atomic Wallet 'hack' was almost certainly not a NK job as they have claimed, for example, and they relied on some dude on twitter's hunch (notably the first thing one learns that is never evidence if presented in court) and a post-hoc heuristic that is indistinguishable from a copycat or a third party's infrastructure to make the attribution. People with poorly thought out opinions are all over the place on Twitter, but this permission slip to "make mistakes". Also, they're part of the system of funding provided to your local police so they are better funded now than before 2020. Check their work under all circumstances, and plea bargains should not be considered as evidence of actual guilt since coercion and BS is as common as actual cases backed by properly collected evidence that builds a procedurally sound case.
I think your expectations are too high. The vast majority of criminals don't bother checking targets where there's not good evidence its easy or something has worked before.
Just going from what Binance PR must believe about a laptop it
seems unlikely to me that they've been tested in much depth by
anyone with mafia tactics.
When we see a breach of AWS or GCP or leading banks, basically any org that has good security, I'll believe technical security is impossible.
Otherwise, I think this is a issue of vendors, even if potentially most vendors fit into the basket of having insufficiently good cyber posture in AI-era.
Yeah... Given that everyone else seems to make models available either immediately or within days of announcement, idk why Google feels it's competitive or acceptable to do these 'available at some point' releases.
Capabilities are also improving so fast that this fomo doesn't really keep people excited. If I can't run it, I'll sorta just click off. And given how they handled the Argon release, I've not even bothered look at this Carbon one. Fully expected it to not be usable yet.
It's late in life to learn this, but let me be the one to let you in on a little secret: people often say only some of the things they know, they often selectively tell you things while not revealing everything they know.
You are assuming that Carbon is ready for release, deployed to their datacenters, that all scaling and other issues have been worked out, and they are confident in all of the above. Not to mention additional internal constraints like alignment testing or other safety procedures their own policies and guardrails require.
If they are smart, which they clearly have some smart people if they are making the best frontier model, they would account for the above needs in their timeline, and announce the model when they can prove they have it but also before they are ready to release it. This is so they can be at the top of the frontier model lists, boost their brand for both Gemini and Google, get the bump in stock price and investor confidence, steer adoption decisions for people making decisions for what platform they might adopt, etc.
The other labs do the same process, but they don't announce the model until it is about to be released. For some reason Google is announcing at the start of th process.
My guess is Google knows it is (way) behind the and needs to keep drumming up interest. Although at some point it becomes counterproductive (raising "yet another not available model; is it vaporware" vibes).
> argon was announced to coincide with performance review deadline. carbon was announced to coincide with quarterly earnings release.
Same as it ever was. Google is really completing their IBM-ification. We need to release these models now because year end reviews are about to hit and I need a win.
Creating a false sense of scarcity is essential to get people talking about it. I get almost endless inquiries from peers now that I have access to Mythos.
I'm not sure about this. I myself am curious about this model, but not for my own use. I've already written it off as too expensive. The money won't be flowing their way regardless.
What's the betting we see another "dramatic" Anthropic release either shortly before the IPO, or at same time they release their Q3 results which were conveniently omitted from their S-1 filing.
Eh, maybe I'm too much of an AI safety person, but I'd rather the labs be forced to announce when they are working on large SOTA models like they are a clinical trial. That way if it's never announced they have to say something like "training didn't work out" or "it took over the server farm and we had to burn the hard disks".
I too could not figure it out. Also a shame the Vertex API format is sorta different to OpenAI's, which everyone but Anthropic uses. The sanest way to use Google AI models is via OpenRouter tbh.
Small business self-employment doesn’t care that much about saturation, I think, only the supply-demand relationship. See everything from Fiverr to coffee shops.
The HuggingFace hack isn't OpenAI's responsibility because they hosted it. It's their responsibility because they directed it; it was part of their own internal benchmark run that they fully controlled.
If a third party uses a model created and hosted by OpenAI, I don't think OpenAI should be liable so long as they implement acceptable security controls. Same as if a site hosted on Cloudflare or GCP is doing something dodgy, Cloudflare/GCP aren't held liable so long as they respond to abuse reports.
Yeah, so long as China exists and wants to keep releasing open models, it's not feasible for Western labs to stop releasing frontier models to the people.
I don't believe this is true with current frontier coding agents. Or at least, it's becoming increasingly less true, such that I think it will effectively be nullified in ~6 months.
«We came full circle on the problem that also exists with Google Search, and why so many people don't get good results out of it.» [0]
It is not that access to all information was hidden to anyone before, it was harder to find it, sure. Now it can be found easily and aggregated, however, it is not as simple as saying "Do X" and believe that X is correct. Recall the infamous Swing & Product Management meme? [1] The problem is the absence of information you provide, the LLM will have to make a guess of what you mean, much like the human. Likelihoods of this guess being correct depends on the domain and background.
So yes, it'll likely build whatever you ask it (I do think we're there already), but if that matches what you intended to actually get is vastly different. You'll be settling with "Good enough" though and declare it working.
Others already pointed out that 6 months seem to be the constant of distance, irrespective of the date.
They /can/ be driven anywhere a car can be driven. We're seeing a staged, safe rollout for highways and snowy areas Right Now. This isn't cold fusion or quantum computers...
reply