This reads as so pollyannish as to be nonsense.

I'm not a fan of pollyannish declarations, but I try not to dismiss ideas on delusionally enthusiastic tone alone.

I've been around long enough to know that sustained collective enthusiasm can sometimes blindside you.

I took a brief look at the posted projects and quickly surveyed the community behind it and I'm not ready to dismiss them yet. I'm not exactly sold either, but I am going to put them on my radar and check in every few months.

A sort of anti HN comment to say but very interesting reading, I don’t know if I have answers to any of your questions but thank you for sharing, I will read more and consider it.

Thank you, I really appreciate you taking the time to read it. Even without answers, kind words like this mean a lot to me.

Absolutely not. There is literally no framework, which would give you the right to exploit an employee’s personal laptop, that’s just cyber crime.

Then that is something the pentesters cannot do, but malicious actors will do.

Game over.

What pentesters can do, should do, and often do is simply start the test from a workstation that is given to them - you assume a successful social engineering attack as the starting point, and test whether your process and technical controls can properly limit the impact of such a compromise without trying to replicate the actual social engineering step and the associated disruption to the targeted employees.

Taking over that first engineer's workstation shouldn't ever have resulted in $6.3B of damages. I would consider it reasonable if those privileges could be abused (by e.g. the same engineer intentionally) to cause $6.3M of damages and the rest would be mitigated or prevented; so for this incident we could say that 0.1% of the impact was caused by the initial compromise of that workstation and 99.9% of the losses were caused by all the other failures - so it's effective for any pentest to focus on the latter part, ignore the social engineering and phishing part (since you can't really eliminate it anyway - unlike many other flaws) and assume initial compromise as a starting point.

Pen testers generally won’t physically assault your employees, bring guns and wave them around or shoot people, or kidnap their family members and torture them until they do what they want. What’s your point? Nothing.

It’s amazing what can be made legal or illegal.

No, it just means it costs more and you have to care a lot more about targeting.

Compared to most Americans, it is safe to say that we have a Zionist mainstream media right now. The American people do not support the genocide in Gaza the media mostly does. The billionaires mostly do. We have concert tours being canceled for the temerity to say free Palestine.

its wild to me how much power aipac wields.... my house of rep in rural maryland was like "palestine has no right to exist"... like why tf does this guy give a hoot?

Could he even find Palestine on a map?

My Democratic rep voted to sanction the ICC for having the temerity to want to hold a trial.

I will be voting Libertarian this year.

That’s only true in the public Zeitgeist, there is a huge preference among portions of the workforce for male leadership stated or unstated. This is not a good thing. I literally worked with a guy who was about to quit because a woman would boss him around and she was about 10,000 times as qualified as he was

then again, how good a manager would she have made if she was bossing around colleagues to the point of them quitting?

Management is not just about qualification, it's also about the human aspect.

I have seen enough toxic femineity at work to say it is actually a thing, on par with toxic masculinity.

Or perhaps this guy perceived normal, appropriate management that he would have been perfectly fine with had it come from a man as “bossy” when it came from a woman.

or perhaps she was just a toxic colleague, with tons of experience in a narrow field that he did not have and making colleagues leave was just her thing.

Vote me down all you want, women are just as capable as men in every way, including the wrong, toxic ones

All of you misread would and put your own spin on it. She wasn’t even hired yet, and he had never met her.

Which is something like less than one percent of websites, and this technology is deployed much, much more widely.

Again, correct. But “don't do this if you don't really need to do this” is rather pointless to say, hence is being downvoted, because people already being that sensible don't need to hear it, and those who are not are unlikely to listen. The comment is just noise, as unnecessary as the unnecessary animation and other gumf that it is railing against.

Well, that makes one of us. Replacing deterministic processes that work with lossy processes makes no sense. You’re literally reinventing the wheel every single time, what are you talking about?

It's because things change, things break, they are misconfigured etc. Yes, if you have perfect deterministic tools in an unchanging and perfect environment, sure. But the deterministic tools need constant maintenance, fixing, reconfiguring, adapting to external changes, dealing with unexpected failure types etc. Not saying you should use LLMs for everything, but LLMs equipped with tool calling can often fix things. And they can also fold it back to a robustified script. That's the strongest use case. LLM checking errors, fixing the scripts, and the routine runs are via those scripts. It just checks that everything ran to completion or what kind of hiccup happened. I know this sounds terrifying from a job security perspective, but it's going to be a wild ride for all of humanity.

> LLM checking errors, fixing the scripts, and the routine runs are via those scripts.

ppl are not doing this right now . right?

if ai can really do this then we dont even need all this glue software . everyone can just use lovable.

> what are you talking about?

oh i mean 'now i am not sure if it would be ridiculed'

Look at the mayor of London. Same shit, different city.