- 120
- 116 293
D-Squared
United States
Приєднався 27 лис 2019
Learning In Public - One Topic At A Time
Auto patching vulnerabilities with generative AI
A future where software heals itself isn’t too far off. We’re taking baby steps today with products that are auto-patching vulnerabilities.
We’ll explore this today. I will explain how engineers and researchers use LLMs to auto-patch vulnerabilities.
Check out the blog below for all the resources.
www.dylandavis.net/2024/11/self-healing-code/
00:00 - Intro
00:42 - 6 sources of inspiration
2:50 - Common process for auto patching
6:50 - High-level LLMPatch process
10:11 - LLMPatch graphs
12:35 - LLM finding root cause
13:15 - Comparing root causes
14:42 - Patch Creation
16:04 - Patch validation
16:51 - Main takeaways
18:48 - Outro
Music by www.bensound.com
License code: UCHO4QVCXL54CQVX
We’ll explore this today. I will explain how engineers and researchers use LLMs to auto-patch vulnerabilities.
Check out the blog below for all the resources.
www.dylandavis.net/2024/11/self-healing-code/
00:00 - Intro
00:42 - 6 sources of inspiration
2:50 - Common process for auto patching
6:50 - High-level LLMPatch process
10:11 - LLMPatch graphs
12:35 - LLM finding root cause
13:15 - Comparing root causes
14:42 - Patch Creation
16:04 - Patch validation
16:51 - Main takeaways
18:48 - Outro
Music by www.bensound.com
License code: UCHO4QVCXL54CQVX
Переглядів: 175
Відео
Lessons from a year of building with LLMs
Переглядів 1,6 тис.3 місяці тому
I read 42 pages of content, so you don’t have to. :) Six practitioners who have been working with LLMs for a year published a three-part blog series covering the tactical, operational, and strategic lessons they’ve learned. It's one of the most practical blogs I’ve seen for those looking to work seriously with LLMs. I’ve created a visual TLDR for this series, highlighting the most interesting i...
AI will drive future operating systems
Переглядів 1 тис.11 місяців тому
In today's video, we delve into three key topics from a blog about AI-driven operating systems: switching to voice and gesture controls, the role of generative AI in redefining device operations, and the crucial aspect of security in this advanced tech landscape. Subscribe to newsletter - embeds.beehiiv.com/025f95aa-709c-46bc-88f7-1550d56f0714 Listen to blog posts on... Spotify - open.spotify.c...
Why Banning ChatGPT is Ridiculous
Переглядів 2,2 тис.11 місяців тому
I’m back! 😀 Today I wanted to highlight a perspective that seems to be overlooked when debating the risk associated with employees possibly leaking data to an LLM such as ChatGPT, Bard, etc. Subscribe to the newsletter for more frequent updates - dylandavis.us13.list-manage.com/track/click?u=bd71cd49b30f5c2da7de758fa&id=1eea621aa7&e=f635f6ec5f Checkout the blog here - www.dylandavis.net/2023/11...
How to Never Run Out of Business Ideas Again!
Переглядів 480Рік тому
Struggling to brainstorm business ideas? Join me as we tackle this common problem with a secret weapon - Sahil Lavingia's idea generation framework! 🚀 In this video, I’ll guide you from community-focused ideation to rapid execution. Plus, I’ll share tips on riding trends, choosing between ideas, and a handy idea checklist. Remember, the only bad idea is not watching this video! 😉🎥 Here’s the bl...
Boosting Cloud Native Security With eBPF
Переглядів 350Рік тому
As more organizations transition toward cloud-native infrastructure, it's important they adopt cloud-native tooling and practices. Today grokking a new technology called “eBPF”, which had rapid adoption in the previous 3 years thanks to the Linux kernel community and big tech companies jumping on board early. If you’re interested in crypto or cloud-native security you should subscribe to my wee...
Common Zero-Knowledge Proof Vulnerabilities
Переглядів 1,8 тис.Рік тому
Today on our zero-knowledge-proof learning journey we’re focusing on common vulnerabilities found in ZK programs. Big shout out to Kyle and Gubsheep for pulling this resource together. If you’re interested in crypto security you should subscribe to my weekly newsletter here - eepurl.com/gLhH9r If you’re interested in more content, check out my UA-cam channel or website below. Website - dylandav...
ZK Vulnerability - Zcash Hash Collision
Переглядів 735Рік тому
Today on our zero-knowledge-proof learning journey we’re focusing on a ZK hash collision that led to a double-spending vulnerability impacting Zcash (2016) If you’re interested in crypto security you should subscribe to my weekly newsletter here - eepurl.com/gLhH9r If you’re interested in more content, check out my UA-cam channel or website below. Website - dylandavis.net Resources linked withi...
ZK Vulnerability - Frozen Heart
Переглядів 1,3 тис.Рік тому
Today on our zero-knowledge-proof learning journey we’re focusing on a ZK vulnerability called “Frozen Heart”, which was discovered by Trail of Bits. If you’re interested in crypto security you should subscribe to my weekly newsletter here - eepurl.com/gLhH9r If you’re interested in more content, check out my UA-cam channel or website below. Website - dylandavis.net Resources linked within shar...
Introduction to Zero-Knowledge Proofs
Переглядів 3,3 тис.Рік тому
This is my zero-knowledge proof learning journey from n00b to slightly above average. :) In this series, we’re going to take baby steps toward tackling a series of security and non-security-related concepts within the realm of zero-knowledge proofs. If you’re interested in crypto security you should subscribe to my weekly newsletter here - Here’s the associated blog post for this video - www.dy...
The ideal smart contract audit report
Переглядів 1,9 тис.2 роки тому
The line between good and great smart contract auditing firms is clear. A good auditing firm can find issues, a great auditing firm can communicate those issues in a simple way. Over the last two-weeks I decided to read 11 audit reports from 4 prominent smart contract auditing firms to uncover common security flaws and the logic auditors use to reach their conclusions. Here’s a blog about my id...
Ethernaut CTF - DoubleEntryPoint (Level 26)
Переглядів 1,6 тис.2 роки тому
Next up! Level 26 - DoubleEntryPoint In this CTF series, we’re going to learn more about the practical side of smart contract auditing and security. If you’re interested in more/similar content, checkout my channel or website below. My digital dumping ground - dylandavis.net Additional Resources Ethernaut CTF - ethernaut.openzeppelin.com/ Dalton Sweeney - daltyboy11.github.io/every-ethernaut-ch...
Ethernaut CTF - Motorbike (Level 25)
Переглядів 1 тис.2 роки тому
Next up! Level 25 - Motorbike In this CTF series, we’re going to learn more about the practical side of smart contract auditing and security. If you’re interested in more/similar content, checkout my channel or website below. My digital dumping ground - dylandavis.net Additional Resources Ethernaut CTF - ethernaut.openzeppelin.com/ Digibard - ua-cam.com/video/WdiCzB3zjy0/v-deo.html Naveen Sahu ...
Ethernaut CTF - Puzzle Wallet (Level 24)
Переглядів 1,5 тис.2 роки тому
Ethernaut CTF - Puzzle Wallet (Level 24)
Ethernaut CTF - Alien Codex (Level 19)
Переглядів 1,6 тис.2 роки тому
Ethernaut CTF - Alien Codex (Level 19)
Ethernaut CTF - Magic Number (Level 18)
Переглядів 1,7 тис.2 роки тому
Ethernaut CTF - Magic Number (Level 18)
Ethernaut CTF - Preservation (Level 16)
Переглядів 9082 роки тому
Ethernaut CTF - Preservation (Level 16)
Ethernaut CTF - Naught Coin (Level 15)
Переглядів 8512 роки тому
Ethernaut CTF - Naught Coin (Level 15)
Ethernaut CTF - Gatekeeper 2 (Level 14)
Переглядів 7042 роки тому
Ethernaut CTF - Gatekeeper 2 (Level 14)
Ethernaut CTF - Gatekeeper 1 (Level 13)
Переглядів 2,7 тис.2 роки тому
Ethernaut CTF - Gatekeeper 1 (Level 13)
Ethernaut CTF - Elevator (Level 11)
Переглядів 1,2 тис.2 роки тому
Ethernaut CTF - Elevator (Level 11)
Ethernaut CTF - Re-entrancy (Level 10)
Переглядів 1,8 тис.2 роки тому
Ethernaut CTF - Re-entrancy (Level 10)
very nice Explanation
my ass
Welcome back! We've missed you and your super content. It’s not about the quantity but the quality, and you always deliver TOP info. Weiter so ;-)
Appreciate the kind words! 🤗
thanks for the effort you put into this..
one of the best and most explained tutorials! Youre the best! I understood everything clearly
What are the implications for hardware? Put into a personal computer context, it seems we will be using local hardware, but mostly cloud compute. Because an orchestrator llm could break up any task into steps, or threads, they could easily use different hardware. Creating a PC with 12 low end cpus and shared Ram could work very well. The os AI would manage the threads. Different specialist ais could run different cpus.
This is a really interesting train of thought. I could see a world where local compute is less of a concern, especially with Apple investing so much into more efficient models and beefier phones
why is the bash in leviathan 3 automatically in the hammoud solution?
I really like the way you explain every detail, maybe I am not that moron afterall, i managed to get to natas6 with you and it was fun 😎 Thanx
This is cool; nice job. Btw for shadowing it doesn’t need to be on test. You can run both on prod and just log the shadow
@@bryanbischof4351 thank you for the additional insight
Really helpful!
Thanks for making this!
Wow! Thanks for making this
The thanks goes to you and the others who built this content. :)
Thanks for making this video!
And thank you for creating such kick-ass content for the community
Finally got around to watching! This was super helpful and I appreciate you taking the time to break down these topics. I took notes and sent them to my work slack.
Appreciate the feedback, amigo! And I miss you! 🤣
@@d-squared70 miss you and the whole nomad community too. I’m in a techno wasteland right now
Impressive article and presentation thanks for sharing such a valuable knowledge
Appreciate the kind words
Hey, welcome back! Love you content!
Really useful video thanks for the summary, I've also given your video some explicit feedback 👍
Good video . More video on this topic
Curious to know what your background, if you are happy to share? As you are not a web developer but you have knowledge of Burpsuite and software, I take it. My background is software and I know some web stuff...
the fact that you are learning and succeeding and all this is recorded in this video is inspiration to all of us. Thanks.
thanks! congrats, subscribed + liked!
Very much appreciate your sharing. I found this share when questioning how to read audit reports, especially many audit reports. It gave me a huge guide.
Is there a way we can get your notes
Nice man. Im currently watching your videos on the ethernaut challenges.
Please are your notes public?
I love this series. Thank you for letting us learn from your experience and research. One thing I wanted to add for others. On level 9, instead of using ";cat ../../../etc/natas_webpass/natas10" you can instead just "cat" out the contents of the password file by using: ";cat /etc/natas_webpass/natas10" "/etc/natas_webpass/natas"X"" is the file location for all of the passwords for Natas. But understanding the concept he used in this video is certainly useful for scenarios where the file you are looking for isn't a given.
Awesome methodology and thought process into this..
Thank you for the video.
Thanks for the detailed explanation. The rest of Leviathans were a breeze (partly because I learned a lot from this one)
Apparently you still needed to import the Force.sol contract file and still create an instance of the Force contract at the same time, otherwise remix would have thrown a compiler error, atleast thats what it did when I tried to avoid them... All in all, appreciate it for the awesome content. You make it so seamless solving these challenges...
as all the serie, this video is a 10 ! thanks for your work and all the questions you're answering in 25 minutes. If i may, at the very end, you say that you become the owner of the contract "Delegate", are you sure about this ? You used the function pwn() in the context of Delegation, so you should become the owner of Delegation, not Delegate right ?
Remember, the Delegation contract delegates all incoming function calls to the Delegate contract using delegatecall, effectively allowing the Delegate contract's functionality to be executed within the context of the Delegation contract. The function pwn() is within the context of the Delegate contract, right? And this function allows anyone to change the owner of the same Delegate contract to the caller of the function as described in the line ( owner = msg.sender). Therefore, by sending the txn using the function signature (pwned_attck) feed to the msg.data data field within the delegatecall, we transfer ownership of the Delegate contract to ourselves, not the Delegation contract. Thats why. Hope that helps...
love when you say "that was probably not the greatest explanation", bro that was I-M-M-A-C-U-L-A-T-E
Its also good to mention that the latest solidity pragma versions 0.8.0 and greater now have an in- built underflow/ overflow checker that mitigates this types of vulnerabilities. So basically once it comes across an underflow or overflow vulnerability, it fails to execute the txn, unless you decide to disable the checker by using the 'unchecked' keyword, but why would you disable it right...
Hi, how are you doing in the audit? Have you completely disappeared?
Amazing content broo || Love from India
Thanks for your sum up (:
I think if we start designing OS's for AI, then it could complicate training data. I think if we design programs for humans, and then give AI the ability to use that, then it will be more stable. Ive been working on a cross system AI assistant out of GPT-4 for a few months now. Ive got it to where its an effective universal voice assistant of sorts. ive even added GPT vision, however It cant locate points, so clicking aint an issue.
I solved it without remix watching your previous video it was dead obvious what the solution should be
sounds too good to be true
It always does 😆
❤
🙉
Recent developements from Deepmind in relation to LLMs memorizaing and regurgitating training data - not-just-memorization.github.io/extracting-training-data-from-chatgpt.html The risk still seems overblown, especially if coroporates are preventing their employees from using this tools. 🤔
But risk of leakage not in LLM itself, but in service - which saving your queries, responses, metadata of dialogues etc. You can provide some nda-info, which will be stored - that you can see it in chat with bot, and that's just simple db which stores your queries and responses. And it can be a risk with inside job in company which provide you these services
thank you for taking the time to put this together. it's clear that the productivity gains from using LLMs can be significant, but doesn't that value hinge on the dataset it references? i think organizations make LLMs most valuable by putting their data into the database it defers to. do you agree? this unfortunately increases the likelihood of the real risk you highlight.
Indeed it does increase the risk, but there are tactics one can take to reduce that risk. Maybe a future video on RAG defenses. 😄
The loom filler word filter is so distracting
This is a very good video. Thanks 🙏🏻
Very good. I learned about the existence of Vector Db's. w.r.t security, there should be a chatGPT paid option where a client certificate is required for the interaction to be further secured. I would have thought that any FinTech would have already thought about this, in order to leverage the productivity but to ensure next level security.
Tell that to the various Board of Directors. They're the technophobes not the rank and file programmers.
cache... they have your conversations bro
Why would it be ok to give openai my secrets in the first place?
It wouldn't, but accidents happen. Especially, when you're securing large corporations with lots of employees. 😉
I don't believe any chat data is used to train the model. There should be zero connection to the next model of GPT and the data inputs from any chats. The real danger is someone intercepting packets between the opening server and your enterprise servers if you are sharing sensitive information.
This interesting prespective. You seem pretty confident here. Can you share some supporting details as to why there's no connection between user input and training data for future models?
@@d-squared70that’s a nice way of saying this person is totally wrong. lol which they are. They do train on chat data and have admitted it. They don’t train on the api calls or ChatGPT enterprise, but they do use ordinary logs to distill gpt4 turbo from gpt4. Companies that are worried should buy GPT enterprise. Simple. Worrying about packets being intercepted is ridiculous. That’s true of any network request. HTTPS solves this.