静态网站悖论
个人网站的两种不同实现方式：一种是复杂的内容管理系统（CMS），另一种是简单的静态 HTML 文件。文章指出，尽管大多数普通用户倾向于使用复杂的解决方案（如 WordPress），但实际上，只有少数专业软件工程师能够选择更简单的静态网站。
via HackerNews 2024 10 09
前两天刚好听朋友说 square space 已经涨到了近乎搞笑的 $25 月费，做不用来盈利的个人博客实在难以 justify。这篇文章中吐槽得很在点子上：
normal users are stuck with a bunch of greedy clowns that make them pay for every little thing, all while wasting ungodly amounts of computational power to render what could have been a static website in 99% of cases.
普通用户被困在了一群屁大点功能都要收费的贪婪小丑手里，与此同时浪费着人神共愤额度的算力来渲染 99% 的情况下都可以作为静态的网站。
当然原文中说的“只有少数专业软件工程师才能选择更简单的静态网站”略微夸张并不认同，因为静态站至少是比 self-host 的动态 CMS 少太多维护了。我的 backlog 里也一直躺了篇安利新手用静态站并拉踩 WP 的文，不过网上这种文已经有无数了也还是拦不住前赴后继往各种 CMS 的坑里冲的新手，觉得写了又有什么意义呢就还搁着没写。（当然迟早会像以前反复造的无数轮子一样被废话欲战胜的 but not today）
#indieblog#newletter
NIST's Deepfake Playbook: Strategies for Managing Synthetic Content Risks
The U.S. National Institute of Standards and Technology (NIST) has released its report, "Reducing Risks Posed by Synthetic Content", addressing the challenges posed by AI-powered deepfakes. The document identifies three key approaches:
1️⃣ Tracking content provenance to verify its origins and edits.
2️⃣ Developing tools to label and identify AI-generated material.
3️⃣ Combatting AI-generated CSAM (Child Sexual Abuse Material) and NCII (Non-Consensual Intimate Imagery) involving real individuals.
The report highlights the broad scope of synthetic content risks, from personal harms like NCII to societal disinformation impacts. Cybersecurity and fraud risks are also underscored, as deepfake technologies can exploit biometric authentication or deceive individuals through voice cloning.
NIST emphasizes that the effectiveness of countermeasures depends on their purpose and audience. Techniques like provenance tracking can enhance transparency for general users, while specialized detection tools may better serve analysts and platforms in assessing and mitigating AI-generated content risks.
#Deepfakes#AIEthics#NIST
NIST Releases Tool for Testing AI Model Risks
The National Institute of Standards and Technology (NIST) has re-released Dioptra, a modular, open-source tool designed to assess and mitigate risks associated with AI models. Originally launched in 2022, Dioptra focuses on evaluating how malicious attacks, especially those that "poison" AI training data, can degrade an AI system's performance. This tool is crucial for companies training AI models and provides a common platform for simulating threats and conducting "red-teaming" exercises.
NIST's initiative, supported by President Joe Biden’s executive order on AI, aims to help government agencies, small to medium-sized businesses, and the broader community assess AI developers' claims and enhance AI safety standards. Dioptra's release aligns with global efforts, such as the U.K.'s AI Safety Institute’s Inspect tool, to advance AI model testing and ensure responsible AI development.
While Dioptra offers significant benefits, it currently works only with models that can be downloaded and used locally, excluding those gated behind APIs like OpenAI’s GPT-4. Despite this limitation, Dioptra represents a vital step towards understanding and mitigating AI risks, promoting a safer AI ecosystem.
#AI#AIDevelopment#AISafety#NIST#Cybersecurity
U.S. Congress Introduces Federal AI Risk Management Act 2024
Greetings everybody! U.S. Congress members have unveiled the Federal Artificial Intelligence Risk Management Act of 2024. Building upon the 2023 bill, this legislation mandates Federal Agencies to adopt the Artificial Intelligence Risk Management Framework (AI RMF) developed by the National Institute of Standards and Technology (NIST). Exceptions are made for national security systems.
NIST's AI RMF, shaped through an inclusive and open process with inputs from 240 organizations, becomes a cornerstone for agencies within a year of the bill's passage.
The Act also necessitates agencies to incorporate the framework into their AI risk management strategies within 180 days of NIST's guidelines. Furthermore, it empowers the Director of NIST and Administrator of Federal Procurement Policy to draft contract language mandating AI suppliers to adhere to the framework.
#AIRiskManagement#AIStandards#NIST#AIFramework
13 ноября NIST NVD наконец признали очевидное: им не удалось разобрать бэклог по анализу CVE до конца фискального года (30 сентября). Что, в общем-то, видно в их же статистике. На текущий момент в бэклоге 19860 идентификаторов. За эту неделю новых CVE поступило 1136, а проанализировали они только 510. И это не какая-то аномальная неделя, это сейчас норма. Они не справляются с разбором нового, чего уже говорить о бэклоге. Кризис продолжается.
При этом в сообщении они почему-то пишут, что у них полная команда аналитиков, и они обрабатывают все входящие CVE по мере их загрузки в систему. Но почему тогда их статистика показывает обратное?
Они пишут, что теперь обрабатывают все уязвимости из CISA KEV. И это хорошо. Но в CISA KEV за 2024 год добавили пока только 162 CVE. Круто, что они осилили эти идентификаторы, но достижение, мягко говоря, не впечатляет.
Почему NVD не справляются с бэклогом?
Они пишут, что дело в формате данных от Authorized Data Providers (ADPs), видимо имея в виду под этим CISA Vulnrichment. NVD не могут эффективно импортировать и улучшать данные в этом формате. Чтобы это делать они разрабатывают какие-то "новые системы".
То есть мало того, что они расписались в неспособности анализировать уязвимости самостоятельно и готовы использовать чужие данные as is, они ещё и не могут парсеры-конвертеры писать за адекватное время. 🐾 Просто удивительные. 🤦♂️
И тут ещё прошла новость, что сенатор Рэнд Пол, новый председатель Senate Homeland Security Committee пообещал серьезно сократить полномочия CISA или полностью их ликвидировать. Наш слоняра! 😁🐘 Весь движ там из-за работы CISA "по противодействию дезинформации" перед американскими выборами. Но под это дело могут угробить единственного американского ИБ-регулятора, который делает хоть что-то полезное и в адекватные сроки. Молодцы, так держать. 👍
Ничего кроме дальнейшей деградации ждать не приходится.
@avleonovrus#NIST#NVD#CISA#Vulnrichment#thoseamericans
NIST Launches Consortium to Shape US AI Policies
Hello, everyone! The National Institute of Standards and Technology (NIST) has initiated a consortium to address AI development and deployment challenges. The collaboration seeks to establish policies and measurements that prioritize human-centric AI safety and governance in the United States. The consortium will work on various aspects, including creating measurement and benchmarking tools, policy recommendations, red-teaming efforts, psychoanalysis, and environmental analysis.
This move comes in response to an executive order issued by US President Joseph Biden, which introduced six new standards for AI safety and security. While other regions have been more proactive in regulating AI systems, the US is catching up. The AI consortium represents a significant step in shaping the future of AI policies in the United States through collaboration between government bodies, non-profits, universities, and tech companies.
#NIST#AIConsortium#AIPolicies#USAIRegulation
NIST Issues Urgent Report on Escalating Threat of AI Attacks
Hello, dear subscribers! The National Institute of Standards and Technology (NIST) has released a critical report titled "Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations," sounding the alarm on the intensifying threat landscape targeting artificial intelligence systems. In the face of increasingly powerful yet vulnerable AI systems, the report outlines the technique of adversarial machine learning, wherein attackers manipulate AI systems through subtle tactics with potentially catastrophic consequences.
The document categorizes these attacks based on attackers' goals, capabilities, and knowledge of the target AI system. Concerns include "data poisoning" and "backdoor attacks," exploiting vulnerabilities in AI system development and deployment.
#NIST#AIAttacks#AISecurity#ThreatLandscape#MachineLearning**