• 0 Posts
  • 37 Comments
Joined 1 year ago
cake
Cake day: June 23rd, 2023

help-circle


  • Back in the 90’s before the days of Windows 3.0 I had to debug a memory manager written by a brilliant but somewhat odd guy. Among other thing I stumbled across:

    • A temporary variable called “handy” because it was useful in a number of situations.
    • Another one called son_of_handy, used in conjunction with handy.
    • Blocks of memory were referred to as cookies.
    • Cookies had a flag called shit_cookie_corrupt that would get set if the block of memory was suspected of being corrupt.
    • Each time a cookie was found to be corrupt then the function OhShit() was called.
    • If too many cookies were corrupt then the function OhShitOhShitOhShit() was called, which would terminate everything.







  • Speaking of slot machines, every slot machine, electronic poker machine, etc. are just state machines that operate based on a stream of random numbers fed into them by another device.

    The random number generators (RNG’s) used for gaming are highly regulated (at least here in the US) and only a small handful of companies make them. They have to be certified for use by organizations like The Nevada Gaming Control Board. RNGs have to be secured so only NGC officials and other key people can access them. If they are opened unexpectedly or otherwise tampered with then they need to go into lockdown and stop generating numbers until an official resets it.

    The RNGs also need to be able to replay sequences of numbers on demand. If the same sequence of numbers are fed into a game and the user plays the same way then the result of the game should be 100% identical each time.






  • A well thought out and implemented backup system, along with a good security setup is how you deal with malware. If backups won’t protect you from malware then you’re doing backups wrong. A proper backup implementation keeps a series of full backups plus incremental backups based on those full ones. So say your data doesn’t change very often, then you might do a full backup once a month and incremental ones twice a week. You keep 6 months of the combinations of full & incrementals, you don’t just overwrite the backups with new ones.

    If you’re doing backups like that and you suffer a malware attack then you have the ability to recover data as far as 6 months ago. The chances you don’t discover malware encrypting your data for 6+ months is tiny. If you’re really paranoid then you also test recovering files from random backups on a regular basis.

    My employer has detected and blocked multiple malware attacks using a combination of the above practices plus device management software that can detect unusual NAS activity and block suspect devices on our networks. Each time our security team was able to identify the encrypted files and restore over 99% from backups.


  • Suppose you’re hit by a ransomware attack and all the data on your NAS gets encrypted. Your RAID “backup” is just as inaccessible as everything else. So it’s not a backup. A true backup would let you recover from the ransomware attack once you have identified and removed the malware that allowed the attack.



  • I’m a 50+ year old IT guy who started out as a c/c++ programmer in the 90’s and I’m not that worried.

    The thing is, all this talk about AI isn’t very accurate. There is a huge difference in the LLM stuff that ChatGPT etc. are built on and true AI. These LLM’s are only as good as the data fed into them. The adage “garbage in, garbage out” comes to mind. Anybody that blindly relies on them is a fool. Just ask the lawyer that used ChatGPT to write a legal brief. The “AI” made up references to non-existent cases that looked and sounded legitimate, and the lawyer didn’t bother to check for accuracy. He filed the brief and it was the judge that discovered the brief was a work of fiction.

    Now I know there’s a huge difference between programming and the law, but there are still a lot of similarities here. An AI generated program is only going to be as good as the samples provided to it, and you’re probably want a human to review that code to ensure it’s truly doing what you want, at the very least.

    I also have concern that programming LLMs could be targeted by scammers and the like. Train the LLM to harvest sensitive information and obfuscate the code that does it so that it’s difficult for a human to spot the malicious code without a highly detailed analysis of the generated code. That’s another reason to want to know exactly what the LLM is trained on.