... more vulns:
- Tailscale SSH: just hear say, might as well turn off tailscale SSH
- Brotli decoder bug (HTTP2shell) https://nvd.nist.gov/vuln/detail/cve-2026-111497
Timeline
Post
Remote status
Context
5
@harblinger Are you keeping tabs on Mitra? I wonder what the latest models can find there
@silverpill I've still only done that one fuzzing session from a couple months ago. I might have an "in" with a guy 
who's running abliterated Chinese models to do something more comprehensive, I'll see if he has room for me.
I also just signed up for https://refuseless.com/?ref=sjwz8yle (referral link with kickback) which serves abliterated models and accepts 
as payment. I still haven't actually tried it yet, but thought maybe you'd be interested
@harblinger Looks interesting! They also promise zero prompt retention.
Are there any best practices for security audits? How do you do fuzzing?
@silverpill I honestly have very little experience. I've only agent assisted fuzzed Mitra, a python and C++ project so far
I've recently heard good things about https://github.com/cloudflare/security-audit-skill but I haven't tried it
For fuzzing Mitra the agent picked cargo-fuzz and these 9 targets: caip, clean_title, did_parse, html_sanitize, jcs, markdown, media_sniff, multiformats, and uri_canonical
I was very hands off and pretty sure the initial prompt was something like: "Can you take a look over this rust repo and fuzz anything that looks like a juicy target?"
@harblinger I did it, with abliterated GLM-5.3 from refuseless. Nothing serious, only medium severity issues.
Preparing a new release.
Also -- sorry, I totally forgot about the referral 😿
Replies
8
@silverpill @harblinger what benefit does abliterated model have for coding? does it ignore the "I don't help you hack" stuff?
@sun @silverpill yeah, on the deep dark end of the pool it's like "I want you to write me malware" and it won't refuse in theory. I never got a refusal from GLM 5.3 non-abliterated (worst thing I asked for was a PoC though) but I'm sure there might be legit use cases where you can get refusals and need to reach for an abliterated model
@sun @harblinger It can scan source code for security issues, can explain how they can be exploited... I haven't tried to do the same with non-abliterated models though, so can't really compare.
@sun @harblinger Maybe I should ask it about biological weapons
@silverpill @harblinger that would actually be a good test I bet. I was working on a genetics project recently and saas ai was being a bitch
@silverpill @harblinger we actually had somebody on SPW with a home bio lab, haven't heard from them lately, hope they're ok.
@sun @silverpill @harblinger He was arrested for trying to make a deadly virus that only works on indian ethnicities. He was then given a choice to either go to federal prison forever or work for mossad to make a virus that only works on arabic ethnicities. We haven't heard about him since.
@silverpill awesome, yeah Rust is good at forcing memory safety at least.
Aw too bad on the referral, I don't think I've loaded any credits there yet, just a few bucks on NanoGPT (was messing with their gembrain models... slow and unreliable). Sounds like that GLM model worked pretty well through refuseless? I've used the non-abliterated version a few times, most recently for doing weird stuff with a LimeSDR and ESP32. (Un)fortunately no esoteric spell was found to diddle the BLE stack ... yet?