Karpathy yesterday posted [1] about the gap between small % of population getting high leverage from AI, and the rest of the world. We have a much more urgent gap between software powering the "physical world", and the digital natives. The digital natives now have 10x leverage with AI, with the ability to rapidly find and deploy exploits. We're now seeing a lot of this - fridges defrosting, access cards for construction workers not working. Next is train and air traffic controls, bank transactions/clearing wiped out, shipping being dismantled and so on. The gap is now being fully exposed.

[1] https://x.com/karpathy/status/2109361546505966046?s=20

▲

rkagerer 5 hours ago | parent | next [-]

To be fair, there's enormous technical debt out there stemming from decades of crappy software/firmware that was churned out with little attention to security. Like, where the whole design of the system was effectively flawed.

The capabilities of AI are bringing the power to exploit those a larger audience (where before it was in the limited hands of nation states and other well-funded organizations, hacker groups, and a comparatively few talented individuals).

I agree it's problematic in practice, but I'm hopeful this will catalyze everyone to be a hell of a lot more disciplined in hardening their products and platforms.

▲

ifwinterco 5 hours ago | parent | prev | next [-]

Core banking may be more resilient because it runs on software that's so antique and obscure it's not going to be easy to find the code to attack.

Also banks are more likely to take basic security seriously and not leave core services open to the public internet, even if the code itself is full of bugs.

On the other hand, running old software where the code is publicly available, on hardware connected to the internet - you are cooked

	▲	autoexec 5 hours ago \| parent \| next [-]
		> Also banks are more likely to take basic security seriously and not leave core services open to the public internet You'd think so but I've seen banks leave compromised systems on their network for months after they were notified about them, including ones being used in botnets. One bank had even been temporarily disconnected by their ISP to stop the spam/hacking leaving their network, but they said they didn't care because it was just their backup connection in case their other ISP went down.
	▲	sublinear 5 hours ago \| parent \| prev [-]
		Having worked at various places, I think financial institutions are actually very rigorous when it comes to testing and fixing bugs. It has little to do with whether they're still running COBOL or not. These cyberattacks are going after systems that barely even needed to exist in the first place, so of course they're insecure. In my opinion, this is a correction that was decades overdue. Either take your software seriously or don't bother at all. I'm surprised it took this long.

▲

pedro_caetano 3 hours ago | parent | prev | next [-]

Most organized crime and states were probably already sitting on a very large archive of exploits well before the 2022 launch of chatgpt. Most industrial automation and embedded systems have limited resources and are fairly exposed.

The main thing that changed is geopolitics. Putin is getting desperate and European attacks without full casus belli are getting messier and messier.

▲

lifestyleguru 6 hours ago | parent | prev [-]

ok so we fixed healthcare, how do I access it? If "that" thing is so smart why this post is behind login-wall, posting text on the internet is still beyond its capabilities?

▲

whoamii 5 hours ago | parent | next [-]

You need an agent to give you the xcancel version of the link, duh

▲

ben_w 5 hours ago | parent | prev [-]

I don't like X either, but Karpathy isn't a "that thing", he's a developer, and free to post behind paywalls if he wants to.

▲

lifestyleguru 5 hours ago | parent [-]

He can trivially use "that" thing to post text on the internet. Should be even easier than tapping stuff inside x mobile app.

	▲	ben_w 5 hours ago \| parent [-]
		> Should be even easier than tapping stuff inside x mobile app. I wouldn't know, I don't use it. Also, wouldn't know if he was on the mobile app rather than website. Which I also don't use, because I don't use X. But it's up to him what he does, the mutual dislike you and I have of X has no sway over him.