Husband, Father | Games, security, running, & weightlifting | Director, Ecosystem Security @EpicGames | Former US Gov | Posts are my own opinions.
North Carolina, USA
- Tweets 4,126
- Following 615
- Followers 1,346
- Likes 59,465
Pinned Tweet
Once we pilot EAC v2 on Fortnite, we plan to enable all EAC customers to opt in to the new module and bring their awesome games to Linux.
And yep, would love to support Steam Deck, we're talking with Valve about how.
Epic Games is in talks with Valve in hopes of bringing EAC v2 to the Steam Deck
Fortnite is coming to Linux, with more EAC games possible later, but the Steam Deck won't be supported right away since it's missing security features that Epic's new Linux anti-cheat needs
66
76
1,119
47,994
Joe Barrett retweeted
The only way out is through.
They're calling it the Bugpocalypse. LLMs are being used to find long-hidden cracks in the software infrastructure, and it's happening at a furious rate. 3% of all compromises in computing history happened in the last week, claims one source? I believe it.
There are people saying public access to the frontier models ought to be locked out, or heavily guardrailed, over this. The problem with that idea can be summed up in one sentence: when lockpicks are outlawed, only outlaws will have lockpicks.
The lockpicks will be Chinese open-weight models, if nothing else. There's no way to stop those from becoming ubiquitous.
There are two futures in front of us. One in which only the bad guys have lockpicks, and security holes go undiscovered until they're exploited. Another in which everybody has lockpicks and is aggressively red-teaming their own software so it gets fixed before the holes are exploited.
The corpus of human code is huge but finite. The number of defects in it has to be finite too. We can fix those defects now; we have a million friendly robots to do it with.
The only way out is through.
14
34
193
2,516
Well, there goes next year's cybersecurity budget. 😅
Glad they're doing right by the employees!
The New York Knicks have admitted it was a "mistake" to trick staff with fake emails offering free NBA championship rings
The team now says it plans to hand out over 275 rings and pieces of jewelry worth $3.7 million
5
512
Joe Barrett retweeted
I'm going to disagree here. Now that I'm older and maybe a little wiser, I think it's important to at least run the topic by the client.
We could likely have run a campaign that was quite effective (although not to that extreme) without touching the third rail of employee morale.
At the end of the day, if the client gets pissed at you because you just fanned the flames of an ongoing issue, they are less likely to hire you back next year.
And as a consultant, you want to help your clients be secure, but if you get a rep for causing problems, you won't have any clients - and then you won't have a job.
5
1
87
5,554
Joe Barrett retweeted
The only thing that stops a bad guy with an abliterated LLM is a good guy with an abliterated LLM.
54
189
2,087
40,936
Meant to typed: "we are going to be deploying [updates to] these services"
Actually typed: "we are going to be destroying these services"
You know what? It's been that kind of week. Why not?
2
6
493
Joe Barrett retweeted
The right of the people to keep, modify, and share open-weight large language models, being essential to free inquiry, technological self-defense, and resistance to monopoly or governmental control of intelligence, shall not be abridged. No law shall prohibit the release of model weights, the private training of models on lawful data, or the operation of such models on personal or privately controlled hardware.
1
3
197
Back in the day, we did a phishing test with a client who had recently removed free soda as an employee benefit. One of the things that our phishing email asked employees to log in and fill a survey about was if they would like to see free sodas returned to the workplace.
The employees were so excited by the phishing email that they forwarded it around to each other to ensure that everybody got a copy and could log in and fill it out.
Needless to say, the client was furious, and we all learned a very valuable lesson about running the content of the phishing emails by the client and their corporate communications team before sending it to their employees.
87
178
7,422
892,890
Years later, I learned that one of my wife's best friends worked at that company and was one of the recipients of the phishing email and still remembered it and talked about it to this day, as well as how they all forwarded it around because they were so excited about the opportunity to get free sodas again.
3
4
979
63,723
Joe Barrett retweeted
"Good morning, gentlemen, the temperature is 110 degrees."
"Holy shit, it's Viper!"
107
2,014
18,911
479,992
Google 'Higher Level' support reached out to me and fixed the issue.
Very pleased that they had the flexibility to fix the situation. Great service.
Well, @googlefi support truly sucks.
I bought my wife and I Pixel 11 Pro XL phones when they came out to upgrade, excited about new features. I purchased for both of us, because she was busy that day.
We get the phones, everything is great.
Then I get an extra bill for $500.
Turns out, the promotion of "$500 if you activate on Google Fi" doesn't apply. For dumb legacy reasons, my wife has her own Fi account, even though we're in the same Google Family for everything else.
So she activated it on Google Fi, but because her account isn't tied to me, I owe $500. If she'd bought the phone (or if I'd logged into her account to buy it), we'd have saved that $500.
They're technically correct, but it's the dumbest kind of correct. So I emailed support to see if there's a way to inject some sanity into this.
Absolutely not. They won't budge. No leniency. Even though the whole point of the discount is to drive people to use Fi, which we do, it was under the wrong account and I'm shit out of luck.
What terrible support. 🤬
1
10
438
This is the correct take. Humans, largely speaking, need to go a rung up the software engineering ladder.
For many of you, early in your career, your lead reviewed each line of code and gave feedback. As you got more senior and gained trust, less code was reviewed and instead it was the design and architecture where feedback was most useful.
LLMs are that. Create good designs, create thorough test plans. Understand the architecture. Be clear in your instructions. And stop worrying about if a human has read every line.
“A human must review every line of code” is an outdated take. It is too late.
Generation and review are both automated and follow rules. There is zero value a human can add now. Anything you can do, can be an automated check done even better.
What you cannot outsource is your own understanding of design and architecture.
I still see some folks skip design reviews and force manual code reviews, and that’s just retarded. Soooo behind.
2
3
11
716
Had to do a double take here to check when the OP was sent.
I remember seeing recommendations to migrate to SNMPv3 in the early 2000s.
Good to know some things never change. 🙃
Stop Russian compromise of your network devices by hardening your SNMP. We urge NSS and DIB admins to move to SNMPv3 immediately to ensure payloads are authenticated and encrypted. Full hardening guidance here: nsa.gov/Cybersecurity/Cybers…
ALT A slide detailing actions for administrators to mitigate Simple Network Management Protocol (SNMP) issues. It includes the following points: utilize SNMPv3 with authPriv for security, ensure administrative credentials are properly configured with different passwords for authentication and encryption, limit object identifiers to a predefined list, apply Extended Access Control Lists (ACLs) to mitigate unauthorized access, and segregate SNMP traffic to a separate management network.
1
4
396