Post by @zzt@mas.to

the infosec industry: “we demand respect. we’re using the latest frontier models to get ahead of threat actors. you’re not an expert so you wouldn’t understand but all the CVEs it spit out are top priority and breathlessly important and worth panicking about. no I won’t do any follow-up to see if the CVEs meant anything, my good buddy claude said they were all important and you have to respect it and me”

also, the highest echelons of the infosec industry, working on highly trusted cryptographic infrastructure: “the private key is the number 4 lol”

1 Boost

1 Like

[object Object]

@zzt@mas.to 56 min. ago

you get to choose which is more alarming:

- someone went out of their way to make the private key 4 as a joke
- someone had claude code do it, and it generated a shitty broken script to change the private key and pulled the number 4 the same way it generates all random numbers: by pulling a non-random number from its training set that someone on the internet associated with the word random a few times (and that’s how it got the xkcd joke)

[object Object]

@zzt@mas.to 53 min. ago

either of these things happening might prompt a serious industry to re-evaluate and perhaps undergo systemic change

and the amazing thing is, there’s not really anything else it can be

[object Object]

@zzt@mas.to 45 min. ago

it either took a lot of effort to make the private key the number 4 as a joke, or it took no effort at all to let an LLM fuck it up

I’m leaning towards the LLM explanation because “this xkcd in our plagarized training data says 4 is a random number and a bunch of other text references that” is exactly how LLMs pick numbers, and I can’t really imagine a scenario in which this joke is *for* anyone

[object Object]

@zzt@mas.to 44 min. ago

“but no professional responsible for a CA’s private key would think an LLM could generate random numbers” oh my sweet summer child

[object Object]

@zzt@mas.to 33 min. ago

John Random has been handling the private keys for his CA for the last 15 years. he wrote the command line tooling for securely generating new key materiel and also several well-respected books on the topic of generating random numbers

unfortunately, Johnny now thinks a program on his computer is sentient and his best friend because a corporation told him it was, and that program is now the thing that handles the private keys for his CA