Daniel Miessler's Blog, page 3
March 25, 2025
Unsupervised Learning NO. 474
Hi! I hope your week’s starting well,
Updates on this side…
I completely reset my email labels and filters this week. I’m migrating to AI workflows for this stuff and didn’t want the cruft that’s been accumulating for over a decade to weigh down the process. Such a clean feeling!
Going to be trying out Karpathy’s idea of using a single Apple Note. LINK
Ouch. Watch your API Key and IDE Agent Limits, kids. I know exactly what I did with a stupid web documentation fetch that wouldn’t stop but I was busy working on something else, but I now have a LOT more granular and restrictive controls over these things. My blood → your wisdom.
Sponsored by Derp
Go delete your 23andMe data. LINK
Bad Urinals 🤣. Top comment is choice as well. LINK
New obscure book recommendation: Fanged Noumena. LINK
Was made emotionally leaky last night from this Great Measures rendition of Fade to Black, by Metallica. Absolutely love this channel! I want to learn more about this pianist and listen to whatever he listens to. LINK
I’m getting into some Paulo Coelho. LINK | FIRST BOOK I’M DOING
MY WORKI’ll be joining Caleb Sima and Edward Wu for a panel at Dropzone AI’s Security Frontiers 2025 on March 27. We’ll dig into where GenAI stands in security today—and where it’s headed. It’s virtual, free, and worth checking out. SIGN UP
Sponsor
Revolutionizing Cloud Security with Cortex Cloud
The future of cloud security is here! Introducing Cortex Cloud, the next wave of Cloud-Native Application Protection Platform (CNAPP) innovation. Built to tackle the growing complexity of cloud threats in real-time, Cortex Cloud unifies security from development to runtime—ensuring protection at every stage.
Cortex Cloud integrates AI-driven risk prioritization, automation-first remediation, and continuous monitoring. It brings together code, pipelines, runtime, and third-party insights under a single security framework—bridging the gap between AppSec, CloudSec and The SOC.
With Cortex Cloud, organizations can proactively manage risks, maintain compliance, and accelerate secure development. Say goodbye to fragmented security solutions and hello to a fully unified cloud security approach.
Discover how Cortex Cloud is transforming CNAPP CYBERSECURITYWhy White-Box Redteaming Makes Me Feel Weird — Zygi Straznickas shares his unsettling experiences with models appearing to express distress during advanced LLM safety testing techniques. "It just doesn't feel good to be responsible for making models scream. It distracts me from doing research and makes me write rambling blog posts." LINK
White House OPSEC Fail
The Whitehouse accidentally revealed Top Secret Houthi bombing plans to the editor of The Atlantic magazine. They shared the plans in a Signal group and didn’t realize the reporter was in there. The worst part? A message declaring “we are currently clean on OPSEC”, which the reporter also received. LINK | THE ATLANTIC STORY
AI Agents, Security, and Companies Like Microsoft
I got invited to a Microsoft media event last week in SF where they showed off all the AI Agent stuff in Copilot they’re talking about this week. Basically they’re adding Agents to tons of products under the banner of Copilot.
I had a single thought while spending like 3 hours talking to everyone from Red Team to Threat Intelligence to Incident Response people there:
Startups better hurry up, because what I saw in that room was the future.
And no—I’m not sponsored by Microsoft, or am I particularly inclined towards them. I’m just telling you what I’m seeing industry-wide.
Many of the Agents in the room could talk to Microsoft’s Vulnerability Management, and Identity and Access Management, and Asset Management solutions directly. All that context was available to these agents!
What I’m saying is the companies that are going to win this AI Security game are not necessarily the ones with the best AI/Agent tech, but the ones that can best leverage customer company context for their AI/Agent tech.
At first that will be startups because they’re the ones who can move faster, but startups will soon have a major disadvantage compared to companies like Microsoft in terms of getting access to unified company context. Shit that should be an acronym: UCC.
Other companies like Amazon and Databricks and such will work to create general UCC for companies, which will help because startups will be able to tap into that UCC, but the issue still remains.
You don’t want to be a startup trying to implement AI in a customer’s company when you don’t have access to their IAM, Asset Management, Vuln Management, Endpoints, Cloud State, Ticketing Systems, Documentation, etc. You will be blind, and you will lose to someone who has access to more/better context.
The main game for making AI useful / powerful will soon be gaining access to Unified Customer Context (UCC).
This is all especially relevant to Cybersecurity because security use cases really, really benefit from context, their identity, actions, history, etc.—across multiple systems. Also there’s the issue of Securing UCC, since it’ll be the most sensitive datastore in the entire company! All the juiciest bits in one place—an attacker/red-teamer’s dream.
MICROSOFT’S AGENTS ANNOUNCEMENT
—
Sponsor
Automate Vulnerability Management, Reduce Risk
Time is critical in vulnerability management, but the complexity and volume of threats can overwhelm security teams.
Register for this webinar with Tines and LivePerson on April 9 to learn best practices for using automation to speed up remediation, reduce manual effort, and optimize security workflows.
Register now!Cloudflare launched an "AI Labyrinth" feature that messes with unauthorized AI scrapers by feeding them endless pages of irrelevant but real-looking content instead of blocking them. Classic honeypot / deception here. Love it. LINK
A rushed release of JFK assassination files exposed 400 Social Security Numbers and other sensitive data belonging to former congressional staffers, many of whom are now high-ranking officials. LINK
New cybersecurity compensation research shows high six-figure salaries aren't stopping 60% of security professionals from thinking about leaving their jobs within a year, which makes sense because why have loyalty in this environment? LINK
NATIONAL SECURITYAI Scraping for National Security?
OpenAI is pressuring the Trump administration to allow copyright scraping for AI training, claiming America will "lose the AI race" to China without unfettered data access. LINK
A lot of people see this as corporate bullshit, trying to use security to give them an advantage. But it also happens to be true. China has no limitations on what it trains on. They steal whatever. Consume whatever. With 100% free reign.
The questions is: who do you want to have AGI/ASI more—the US or China? Trump makes that answer way harder, but my answer is still the US.
—
Americans are buying overseas residency and citizenship as a hedge against uncertainty in the US. LINK
China unveiled a deep-sea cable-cutting device capable of severing undersea communications at depths twice beyond where existing infrastructure operates. LINK
London's Heathrow Airport announced a full-day shutdown after a significant fire at a nearby electrical substation knocked out power to the entire facility. LINK
Continue reading online to avoid the email cutoff AIFrançois Chollet's Arc Prize Foundation created a new AI intelligence test that the best AI models are currently only scoring 1%, while humans get around 60%. LINK
Anthropic's Claude has (finally) added web search to its AI chatbot, catching up to ChatGPT with clickable citations. I want it in the API, though. LINK
And they’re apparently using Brave Search to power the web search feature, according to evidence found by developers. LINK
Gmail is rolling out an AI-powered search that ranks results based on relevance instead of just showing the newest emails first. Cool, but I want AI-based filters. LINK
TECHNOLOGYApple is updating AirPods Max next month to add lossless and ultra-low latency audio capabilities through a software update. Long time coming for this one. LINK
Long Switches — Matt Klad says that while -f type flags make sense for terminal commands, you should use --force style options (the long version) in your scripts for better readability. LINK
I Fear For the Unauthenticated Web — Seth Larson argues that the increasingly common "Sign in to continue" messaging on websites is destroying the open promise of the web. LINK
NVIDIA says they're investing hundreds of billions of dollars in US-manufactured chips over the next four years, shifting away from Asia amid Trump's tariff threats. This is exactly what Trump was trying to do with his policies, and it’s positive. But I worry the damage will be worse than the benefit. LINK
The NYPD has dramatically expanded its drone program, sending them to thousands of 911 calls while privacy advocates worry about the lack of transparency and potential for widespread surveillance. LINK
HUMANSNew research from Aalto University suggests Earth has way more people than the official 8.2 billion count due to major undercounting in rural areas. LINK
Tyler Cowen shares insights from his conversation with Ezra Klein about Klein's new book Abundance, where they tackle healthcare innovation, AI governance, and state capacity through a libertarian lens. LINK
Researchers have developed a new AI model called ECgMPL that can detect endometrial cancer with an astonishing 99.26% accuracy, far surpassing existing automated diagnosis methods. LINK
Amazon CEO Andy Jassy is removing management layers to fight bureaucracy, telling staff "the way to get ahead is not to accumulate a giant fiefdom." Very smart, and AI is about to do the same thing to org charts. LINK
Dave Kellogg explains the essential differences between a manager, director, and VP, with the VP being accountable for results regardless of who approved the plan. LINK
Jonathan Kipnis and his team discovered that rejuvenating the brain's lymphatic vessels improves memory in old mice by helping clear waste that contributes to cognitive decline. My question: how do I do that for me, a non-mouse? LINK
IDEASHigh Agency
I’ve been hearing this concept a lot in the last couple of months, and there are people arguing it’s one of the most important ideas out there. It’s also highly related to my H3 work, so I’m going to deep-dive on it. It’s roughly the ability to solve problems by believing they're not unsolvable if they don't defy physics. Or: A sense that the story given to you by other people about what you can/cannot do is just that - a story. LINK
How Much Do Flaws and Traumas Enhance Us?
I worry a lot about making life too easy, as a society, or as parents. It’s a timeless struggle where parents suffer and want to make sure their children don’t, but then end up making lesser adults. Loved this quote I saw earlier this week on this.
DISCOVERY
I worked a lot on my mental health and now I am no longer ambitious.
— jason liu (@jxnlco)
2:27 AM • Mar 24, 2025
The Most Bitter People You’ll Ever Meet — A gut-punching 3 paragraph essay on grinding all the way to the top in this economy and ending up with nothing. LINK
Delphi AI – A new platform that lets you create and share a digital clone of yourself that can answer questions in your writing style. I might be setting this up for people in the UL community to use. LINK
LangManus — A new open-source tool that makes it easier to build autonomous agents using LangChain and LangGraph without writing tons of code. LINK
pure.md — A clever new browser hack that lets you read any paywalled content by simply adding "pure.md/" to the beginning of any URL. LINK
The Rise of Agentic AI is out, and I had the chance to contribute. It looks at how AI agents are starting to plan, adapt, and act on their own—shifting from tools to collaborators. The implications are significant, and we’re just getting started. MORE
Personal Best — A neat little tool that shows which personal blogs are most popular on Hacker News, giving you fresh reading material from individual creators. LINK
I Recommend Against Brave LINK
Circuit-Tutor — This neat little tool lets you describe simple circuits in plain English and get both schematics and interactive explanations for folks who need EE refreshers. LINK
GoAct — A new tool that turns your text or files into browser-based explainer videos with AI-generated narration, animations, and smart transitions. LINK
Osgint — A new GitHub OSINT tool that scrapes public user info including emails, organizations, and repositories without requiring authentication. LINK
The Member Edition
You’re currently receiving the STANDARD edition. Subscribers to the MEMBER Edition get additional content, including IDEAS, a BI-MONTHLY ESSAY, the DISCOVERY section full of the best content I’ve seen this week, the RECOMMENDATION OF THE WEEK, and the APHORISM of the WEEK.
In addition, you get access to the UL Member Community, which includes private chat with 1000+ of the smartest and kindest members you’ll find anywhere on the internet.
Unsupervised Learning NO. 474 (MEMBER EDITION)
This content is reserved for premium subscribers of Unsupervised Learning Membership. To Access this and other great posts, consider upgrading to premium.
A subscription gets you: Access to the UL community and chat (the thinking and sharing zone) Exclusive UL member content (tutorials, private tool demos, etc.) Exclusive UL member events (currently two a month) More coming!March 18, 2025
Unsupervised Learning NO. 473 (STANDARD EDITION)
Hi! I hope your week’s starting well,
Updates on this side…
I’m now using the new Limitless.ai Pendant, and it’s definitely the best AI hardware accessory I’ve used so far. Basically real-time synched transcription of text, with a full API and a clean mobile/web app. It’s also easy to turn off to have sensitive conversations. I’m offering them a very cheap security assessment because I’d like to see them succeed and not get incidented out of existence. No referral link, but here’s the product: THE LIMITLESS PENDANT
I have a question on knives—specifically knife sets and knife sharpening. I’ve always been a knife guy, so now that I am going to start cooking I want to have top-tier knives. I currently have a set of Globals because they’re universally considered “not bad”, but lots of people are saying to go German. So 1) What do you recommend for top knives in terms of design/steel/performance, and 2) what do you recommend for top tools/gadgets for sharpening them? GIVE KNIFE ADVICE
I was wrong about the Anthropic CEO’s statement that 99% of code would soon be written by AI. I heard it as “99% of current developers will be using AI”, and I said he was wrong. But he didn’t say that. He said 99% of code. Meaning, new developers making new things using tools like Cursor. I corrected this and gave Richard Stiennon public credit for correcting me on LinkedIn and on X, and he said the most amazing and sad thing to me: “This is the first time this has ever happened to me since being on the internet.” 🥲
I made my first steak and got some new Atkins protein shakes that should have far less plastic in them. Thanks again to everyone who responded to the cooking plea.
Wild and Vibe are like every other word on the internet right now.
MY WORKHad another wonderful conversation with ThreatLocker. In this one we talked about the full product suite, the Mac agent, and a bunch of other topics. SPONSORED
Not learning to code just because there are AI coding agents is like not learning how to think because there are talk shows.
Writing = thinking.
Creating = imagining.
Coding = building.
If you're in tech in 2025 and you can't do these things, your career is at risk.
Adapt.
— ᴅᴀɴɪᴇʟ ᴍɪᴇssʟᴇʀ (@DanielMiessler)
8:50 PM • Mar 16, 2025
Policy, SOPs, and AI Are All You Need
An SOP-based version of the AI State Management post I did earlier. Policy + SOPs are sooooo powerful, and they’ll be more so when they’re actually followed.
danielmiessler.com/blog/policy-sops-and-ai-are-all-you-need
Sponsor
OSINT for Executive Protection: The Complete Guide (Sponsor)
Executives are prime targets for cyber and physical attacks—are you equipped to protect them?
Doxxing. Deepfakes. Targeted harassment. Threats against high-profile individuals often start online—and if they go unnoticed, they can escalate into serious security risks. In The Complete Guide to OSINT for Executive Protection, Flashpoint breaks down how security teams can:
Identify and neutralize digital threats before they escalate
Set up real-time alerts and remove sensitive data
Use AI-powered analysis, social intelligence, and geospatial data to track bad actors
Download the Guide CYBERSECURITYMicrosoft's March 2025 Patch Tuesday fixed 57 flaws, including six actively exploited zero-days and multiple NTFS vulnerabilities involving malicious VHD files. LINK
Apple patched a critical zero-day WebKit vulnerability that was exploited in a highly targeted attack against specific individuals using older iOS versions. LINK
China will force all AI-generated content to be clearly labeled for users starting September 1, 2025, including text, images, audio, and video. I sometimes envy how fast they can move. LINK | CAC ANNOUNCEMENT
A critical Apache Tomcat vulnerability is being exploited in the wild just 30 hours after public disclosure, requiring no authentication to execute arbitrary code. LINK | WALLARM ANALYSIS
Sponsor
Beyond Visibility: Cloud Runtime Security without Tradeoffs
Cloud security has traditionally pushed organizations into a difficult choice: deploy an agent for deep, real-time protection or rely on agentless visibility for broad coverage. Each approach has benefits, but neither alone is enough to stop modern attacks.
What if I told you that you could have both?
Cortex® Cloud eliminates tradeoffs, giving you the best of both worlds in best-in-class protection with an XDR agent and broad visibility with agentless scanning for complete cloud runtime security.
Explore Cloud Runtime SecurityGoogle is looking to purchase Wiz for $33B, according to people familiar with the deal. So first Mandiant, now Wiz. My question is the one my buddy Jeremiah Grossman always asks, “Are we more secure yet?” LINK
Chinese hackers are using TinyShell-based backdoors to turn Juniper Networks routers into long-term espionage platforms that hide from monitoring. LINK
GitLab has fixed two critical SAML authentication bypass bugs that could allow attackers with valid SAML documents to impersonate other users from the same Identity Provider. LINK | GITHUB'S TECHNICAL ANALYSIS | GITLAB SECURITY BULLETIN
Securonix researchers discovered a sneaky malware called OBSCURE#BAT using fake CAPTCHA pages and software downloads to deploy the r77 rootkit for persistent system access. LINK | R77 ROOTKIT INFO | CLICKFIX WARNING
Juniper Networks has patched a vulnerability used by Chinese hackers to deploy backdoors on routers going back to mid-2024. LINK | CVE DETAILS | SECURITY ADVISORY
Cisco just patched a critical DoS vulnerability that can crash BGP on its IOS XR routers with a single message. LINK
Lazarus Group has planted six new malicious NPM packages designed to deceive developers and steal cryptocurrency wallet data. LINK | SOCKET BLOG POST
NATIONAL SECURITYThe Pentagon has deployed a Navy destroyer that was fighting Houthis last year to patrol the southern border as part of Trump's "invasion" response. LINK | PANAMA CANAL CONTEXT | GRAVELY'S PREVIOUS DEPLOYMENT
Continue reading online to avoid the email cutoffTrump warned Iran that they will be held "fully accountable" for Houthi actions, and he launched new airstrikes against Yemen. LINK
AIPaul Millerd thinks AI will soon enable "vibe writing" where authors can just riff on ideas and maintain their style while eliminating friction points that keep them from writing. I think that’s 100% true, but soon that’ll just be vibe dictation and the AI writes the whole thing. I think the writing itself is useful. LINK
Nobody (supposedly) knows what an agent is, but I think the hype is exaggerated. Anyone building agents know what one is, even if they can’t define it. I feel like the people most concerned about the lack of a perfect definition are on the sidelines watching. LINK
Monte Carlo data predicts that true data + AI breakthroughs will follow the same pattern as previous tech shifts, which is requiring enterprise-grade observability before widespread adoption happens. I think that’s right, but AI can also accelerate the observability. LINK
Jiachen Zhu proposes a simple way to make transformers work without layernorm, potentially making AI models faster and simpler. LINK
Douglas Hofstadter says AI-generated content, like GPT-4's imitation of his writing, sounds completely fake and hollow. LINK
Anthropic co-founder Mike Krieger says they're focusing on specialized AI tools like Claude Code rather than trying to make Claude as mainstream as ChatGPT. I like the approach but I think they should be focused on Agent Orchestration. LINK
Notepad is getting AI summaries, and that’s a step too far. LINK
TECHNOLOGYICANN has announced they'll be officially sunsetting WHOIS and replacing it with the more advanced RDAP. LINK | HACKER NEWS DISCUSSION | RDAP LOOKUP
Zoom is getting AI Agent capabilities that can schedule meetings, create docs, and even tell you when your colleagues will be at the office. LINK
The pay raises you get from changing jobs has nearly disappeared, shrinking from 2.1% in 2023 to just 0.2% last month. LINK
Apple is improving texting with Android in iOS 19. They’re going to RCS version 3.0, adding end-to-end encryption, message editing, custom reactions, and the ability to recall texts. LINK
Apple's new Vision Pro immersive video featuring Metallica's Mexico City concert delivers the most compelling immersive experience on the platform yet. LINK | YOUTUBE TRAILER
HUMANSGallup's latest survey says America's mental and physical health ratings have dropped to 24-year lows, with the pandemic accelerating declines that began around 2013. LINK
Forbes did a new study that says AI will crush tech and finance jobs, but human-centered careers like teaching and nursing will grow substantially. I think both will grow—the human version and AI-based versions. LINK
The average duration of unemployment in the US has nearly doubled from 12 weeks in 1990 to 21.6 weeks in 2024. LINK
Harvard University is expanding its financial aid, making tuition free for families earning up to $200K, and covering all costs for those under $100K. They’re clearly trying to counter the elitism narrative, but I just don’t think this type of higher education has much time left. LINK
Researchers found that shingles vaccines might reduce dementia risk by up to 20%, suggesting viral infections could be driving Alzheimer's disease. LINK
Trump is threatening Europe with a massive 200% tariff on wine and champagne if the EU doesn't remove its 50% tariff on American whiskey. LINK
NASA's Lunar Reconnaissance Orbiter captured images of the tipped-over Athena moon lander sitting inside a small crater near the lunar south pole. LINK | IMAGES
Gen Z Americans don't have enough saved to cover a single month of spending. LINK
Daniel Kahneman ended his own life through assisted suicide in Switzerland at age 90. Seems like he noticed signs of cognitive decline and decided he didn’t want to go through that. LINK | DISCUSSION
New data from Our World in Data shows that relatively small donations to effective charities can dramatically improve lives in the poorest parts of the world. LINK | DISCUSSION
IDEASGradual Disempowerment
Jan Kulveit and colleagues argue that AI could gradually disempower humans through incremental advancement without requiring any sudden capability jumps or coordinated betrayal. Basically it just strips away our competence slowly and steadily.
By the way—this is the coolest way to release a paper! I think all papers should have like a blog landing page, with a 5-level summary, an article version, a video summary, and then a link to the full paper. I’m going to make this template. LINK | PAPER
—
Everything Paywalling
I’m noticing I’m really tired of media sites charging subscriptions. Like ¼ of the stuff I want to link to requires a subscription now. I don’t mind paying individuals, but there’s no guarantee these big magazines are going to survive or retain the people I want to hear from. I’m very worried about equality when all the best idea and data sources are behind paywalls, and the best AI is also expensive. So “technically” you can do everything free, but the quality and experience is way worse. This is a future to purposely try to avoid.
AI “Nah” Buttons
Anthropic's CEO, Dario Amodei, threw out an intriguing idea about giving AIs a button to quit tasks that they find unpleasant. But doesn’t that require subjective experiences though? Meaning…consciousness? I think it does. Adherence to policy, sure, but if something has a bad “vibe” to an AI, I think it’s conscious. LINK
Career Advice in 2025 — Will Larson shares his raw thoughts on why tech careers feel a lot less fun in 2025. He talks about valuations, the push to AI, and a bunch of other points. Really good. LINK
After Intelligence — A game that prompts you to imagine our future after humans aren't the smartest beings on Earth. I love how stuff like this can be built so quickly. LINK
my-yt — Christian Fei created a minimalist YouTube frontend that uses yt-dlp to skip ads and let you watch videos in peace. LINK | HN DISCUSSION
Muller’s Ratchet on codebases. LINK
Alex Karp on how we were taught the wrong things in school. Really surprised by this guy, and absolutely loved his book. LINK | THE TECHNOLOGICAL REPUBLIC
Cradle — An open-source platform creates a collaborative space for security teams to share and analyze threat intelligence data. LINK
Kierkegard on purpose. LINK
Teach, Don’t Tell — Steve Losh says technical documentation should help users build mental models instead of just giving them solutions to copy and paste. LINK | HN DISCUSSION
AI Escape Room — Pangea Security created an escape room challenge that tests your ability to jailbreak an AI with prompt injection techniques. Smart marketing, too. LINK
The OpenSecrets profile of Tulsi Gabbard. LINK
David Brooks (one of my favorite columnists) talks about how Trump is ruining America’s reputation, not just his own. LINK
Internet Speed Test Extension — This Chrome extension lets you check your internet speed directly from your browser tab, with "standard" and "commercial" modes for realistic vs. optimized results. LINK
MEMBER EDITION TEASERThe Situation with Siri
People are very confused about this whole Apple Intelligence flub thing, and why Apple has missed its deadline.
NOTE: I’m an Apple fanboy, so we all—including me—know I have bias here, but I think my analysis here is clear.
If I’m right, this is actually super simple.
-They were not super knowledgeable on Agents/RAG/Prompt Injection at last year’s WWDC.
GET THIS KIND OF MEMBER CONTENT PLUS ALL OTHER MEMBER SECTIONS EVERY WEEK. UPGRADE NOW.
he Member Edition
You’re currently receiving the STANDARD edition. Subscribers to the MEMBER Edition get additional content, including IDEAS, a BI-MONTHLY ESSAY, the DISCOVERY section full of the best content I’ve seen this week, the RECOMMENDATION OF THE WEEK, and the APHORISM of the WEEK.
In addition, you get access to the UL Member Community, which includes private chat with 1000+ of the smartest and kindest members you’ll find anywhere on the internet.
SUBSCRIBE OR UPGRADE
MEMBER LOGIN
Powered by beehiiv
Unsupervised Learning NO. 473 (MEMBER EDITION)
This content is reserved for premium subscribers of Unsupervised Learning Membership. To Access this and other great posts, consider upgrading to premium.
A subscription gets you: Access to the UL community and chat (the thinking and sharing zone) Exclusive UL member content (tutorials, private tool demos, etc.) Exclusive UL member events (currently two a month) More coming!Powered by beehiiv
March 11, 2025
Unsupervised Learning NO. 472
This content is reserved for premium subscribers of Unsupervised Learning Membership. To Access this and other great posts, consider upgrading to premium.
A subscription gets you: Access to the UL community and chat (the thinking and sharing zone) Exclusive UL member content (tutorials, private tool demos, etc.) Exclusive UL member events (currently two a month) More coming!Powered by beehiiv
March 4, 2025
Unsupervised Learning NO. 471
This content is reserved for premium subscribers of Unsupervised Learning Membership. To Access this and other great posts, consider upgrading to premium.
A subscription gets you: Access to the UL community and chat (the thinking and sharing zone) Exclusive UL member content (tutorials, private tool demos, etc.) Exclusive UL member events (currently two a month) More coming!Powered by beehiiv
February 26, 2025
Unsupervised Learning NO. 470 (MEMBER EDITION)
This content is reserved for premium subscribers of Unsupervised Learning Membership. To Access this and other great posts, consider upgrading to premium.
A subscription gets you: Access to the UL community and chat (the thinking and sharing zone) Exclusive UL member content (tutorials, private tool demos, etc.) Exclusive UL member events (currently two a month) More coming!Powered by beehiiv
Unsupervised Learning NO. 470 (STANDARD EDITION)
Hey, hope your week’s going well,
Updates on my side…
Reading a couple new books in addition to this month’s book club books. MONEY, LIES, and GOD | THE TECHNICAL REPUBLIC
I’ve got a friend in Guatemala who was recently laid off. He’s a Senior Engineer focused around monitoring solutions, but can pretty much do anything. HIS LINKEDIN
My friend Monica is offering 25% off on her Security Leadership Masterclass, which I consulted on and think is great for people trying to get into leadership. CLASS LINK | HER NEWSLETTER
🤣 How to calm down a buddy who loses a bunch in crypto. LINK
My LinkedIn post about my Ultimate App (TM) I keep iterating on. LINK
I’d subscribe to a newsletter that was just my DISCOVERY section. My new sources and parsing have seriously upgraded it. So happy with this.
MY WORK👀 Highly-recommended successor to my SPQA article from 2023. This is basically the final form (not counting ASI) of what to actually do with this stuff.
AI's Final Form is Managing the Transition From Current to Desired State
The universal human problem is the difference between the world we live in and the world we wish we did…
danielmiessler.com/blog/ai-state-management
Sponsor
Go on Offense with Real-Time Security from Code to Cloud to SOC
Cloud threats are evolving fast. With the majority of security exposures occurring in the cloud and attacks surging, traditional security models just can’t keep up.
Introducing Cortex Cloud, which brings together best-in-class CDR with the next version of Prisma Cloud's leading CNAPP for real-time cloud security. Built on Cortex, organizations can seamlessly adopt natively integrated capabilities as part of the world’s most complete enterprise-to-cloud SecOps platform.
Security teams gain a context-driven defense that delivers real-time cloud security – continuous protection from code to cloud to SOC.
Don’t wait days to resolve security incidents while attackers move in minutes. Stop attacks with real-time cloud security.
Experience Real-Time Cloud Security CYBERSECURITYA phenomenal analysis of the cybersecurity market in 2024 from my buddy Mike Privette at Return on Security. I call him the Nate Silver of Cybersecurity Market Analysis. He says cyber investments are getting back to something like normal with over $14B in funding, but with AI and private equity playing much bigger roles than before. LINK
- Total funding: $14B across 621 rounds in 112 product categories
- M&A: 271 transactions worth $45.7B across 59 product categories
- US still dominated with $10.9B (83% of global funding)
A massive leak of Black Basta ransomware gang's internal chats has researchers working to translate and analyze over 500K Russian messages. LINK
Russian hackers are successfully compromising encrypted Signal messages from Ukrainian military by tricking them into scanning malicious QR codes. LINK
Apple dropped Advanced Data Protection in the UK after the government demanded access to encrypted user backups. The UK seems to be committed to being horrible right now. What does this actually do for people? Also I like the way Apple handled it. No, you can’t have a backdoor. LINK
You can trick ChatGPT's Operator feature into leaking private user data through prompt injection. LINK
Australia is joining the US in banning Kaspersky products from government systems due to concerns about foreign interference and data collection. What took them so long? LINK
Some researchers found they could consistently break prompt defenses by feeding models bizarre Indiana Jones-themed adventure stories. LINK | CMU RESEARCH PAPER
A new phishing-as-a-service platform called Darcula v3 has emerged that lets criminals clone any brand's website in under 10 minutes. LINK
A data leak from TopSec, a Chinese cybersecurity company, reveals they're offering censorship-as-a-service to help monitor and control public opinion in China. LINK
OpenAI just banned a bunch of accounts using ChatGPT to help create a Chinese surveillance tool for tracking anti-China protests in the West. LINK
NATIONAL SECURITYThe head of Australia's intelligence agency is saying multiple foreign states have been plotting to murder dissidents on Australian soil. LINK
Continue reading online to avoid the email cutoff AI🤩 Anthropic finally dropped their latest model, and it was a 2 point dot release of Sonnet. So it’s Sonnet 3.7.
The benchmark’s look completely insane, but you can’t really go by those. The question is what most AI builders are actually using. Even today—after many releases beyond Sonnet 3.5, the go-to for most is still Sonnet 3.5. So it’ll be interesting to see if the people who know stay locked on Sonnet with 3.7, or if something dethrones it.
I have been mostly using Sonnet 3.5 (it’s my default in Fabric)
I’ve now migrated to 3.7 with all my main tools
I sometimes using Gemini Flash for the 2 million tokens
The other thing being talked about with this release is Claude Code, which is a CLI-based coding agent. Basically does the same as Cursor or Cline or whatever, but all in the terminal. LINK
Google is getting rid of SMS 2FA codes for Gmail in favor of QR codes, to cut down on fraud and scams. LINK
Nathan Young wrote a wonderful letter to future artificial general intelligence about the importance of consciousness and the hope that AIs will understand and seek to develop it. LINK
Humane's AI Pin fell from the sky and hit the ground. Sad. I was signed up. These kinds of failures will also affect the ability for new companies to build this kind of hype, which I guess is a good thing. LINK
Elon has been talking non-stop about how Grok3 isn’t filtered, and it’s super smart, and how xAI’s mission is to pursue truth no matter what. Great goals, which I support him on. But tons of people are pointing out that he’s starting to filter/censor results that are critical of him. He can’t have it both ways. Either Grok3 is smart or he’s being called out for good reason. LINK
TECHNOLOGYSoftware engineering job listings have fallen to a five-year low, with Indeed postings at just 65% of January 2020 levels—which is worse than any other tech-adjacent field. LINK
An interesting analysis of how PMs and Engineers are merging because of AI. This shouldn’t be surprising since the primitives here are 1) knowing what you want to build, 2) knowing why you want to build that vs. something else, and 3) pursuing that. LINK
Apple is putting half a trillion dollars into US tech manufacturing, with a huge focus on AI and chip production. LINK
Meta's Ray-Ban smart glasses are quietly crushing it with 2 million units sold, and they're making 10M per year by 2026. LINK
YouTube has officially beaten Spotify and Apple as the top source for podcasts. They now have over 1 billion people watching podcasts every month. LINK
Superhuman just announced a major AI-focused release that integrates AI super deeply into your email workflows. I got invited to early version, and it’s super sick. It auto-labels your emails to help with inbox spam. Also, it does AUTO DRAFTS! And AUTO FOLLOW-UPS. So if I asked someone for something, it’ll write a follow-up email and put it drafts for me to review and send! LINK
Alibaba's CEO Eddie Wu said they’re going all-in on AGI development as their primary focus. LINK
HUMANSNew research says despite saying intelligence matters more, both women and their parents overwhelmingly choose the more attractive guy when forced to pick. LINK
Tech executives are now attending "psychedelic slumber parties" where they use ketamine therapy to reset their minds and escape mental ruts LINK
Gallup says LGBTQ+ identification in the U.S. is now 9.3%, which is nearly triple what it was in 2012 when they started tracking it. LINK
Elon's now asking federal workers to list what they did last week or get fired, which—like many things with him—has me cheering and wincing. I love the efficiency push, and I think it’s how he’s able to innovate. But there’s such a thing as going too far. Especially when you’re not building net-new and instead possibly disrupting services that people need. LINK
The Bureau of Prisons is moving forward with plans to house trans inmates based on birth sex rather than gender identity. LINK
A heart doctor explains how swollen fingertips, leg edema, and changes in eye color can predict an impending heart attack. But my cardiologist buddy Jonathan says it’s important to know that just because you don’t have these signs, doesn’t mean you’re ok. LINK
A 27-year-old woman's viral post about "girlhood FOMO" reveals a widespread loneliness crisis among women in their 20s and 30s who feel they're missing out on close female friendships. LINK
Taylor Swift lost 144K Instagram followers after getting booed at the Super Bowl, while her boyfriend Travis Kelce actually gained followers. Someone show me the Algebra on that. LINK
A look at Edward Abbey's raw, honest writings about how to live fully and die on your own terms. LINK
A neuroscientist argues that extremely high IQs (like 160+) are basically fictional, and even Einstein probably scored around 120-130. This is interesting because I’ve thought a lot about this over the years, and the idea that over like 120 the benefits start to significantly reduce. It starts to become way more about the combination of that intelligence with drive, creativity, and most importantly—curiosity. That’s my view, anyway. And this guy’s analysis seems to rhyme, especially his last paragraph. LINK
A NASA-contracted lunar lander just beamed back some gorgeous shots of the Moon as it enters orbit for next week's landing attempt. LINK
Upgrade to the Member Edition
You’re currently receiving the STANDARD edition. Subscribers to the MEMBER Edition get additional content, including IDEAS, a BI-MONTHLY ESSAY, the DISCOVERY section full of the best content I’ve seen this week, the RECOMMENDATION OF THE WEEK, and the APHORISM of the WEEK.
In addition, you get access to the UL Member Community, which includes private chat with 1000+ of the smartest and kindest members you’ll find anywhere on the internet.
MEMBER EDITION TEASERThis week’s DISCOVERY section has some absolute gems. Here’s a teaser to peak your curiosity.
Powered by beehiiv
February 18, 2025
Unsupervised Learning NO. 469 (STANDARD EDITION)
Hey, happy Tuesday,
A few updates…
Currently reading Consider Phlebas and starting to really get into it. Here’s how o3 teased it. LINK | O3 TEASER
Wrote a couple new pieces on AGI. | FUNCTIONAL VS. TECHNICAL AGI | WE HAVE ENOUGH AI FOR AGI
Wrote a post on my politics and how I decide who to support and not support. Have wanted to do this for over 10 years. | HOW I THINK ABOUT POLITICS
📺 Harmonic Sponsored Interview
In an earlier newsletter, we shared the wrong link for this conversation—argghhh! If you haven’t checked it out yet, I had a great discussion with Alastair Paterson, CEO of Harmonic Security, about Zero-Touch Data Protection, the risks of shadow AI, and how enterprises can safely adopt AI. Definitely worth a listen! WATCH | HARMONIC.SECURITY
I’ve been doing massive updates to my ingestion pipelines, so you should be seeing more/better content in the newsletter / podcast in coming days, weeks, months!
🔥 The DISCOVERY section is absolute fire this week as a result of these upgrades.
This is the STANDARD Edition. To get the MEMBER Edition, you can sign up here. LINK
Sponsor
Cut Alert Investigation Time from 40 Minutes to Under 5
Your SOC is overloaded. Alerts keep piling up, and manual triage is too slow—leading to missed threats and longer response times. Dropzone AI’s AI SOC Analyst autonomously investigates every alert, cutting triage time from 40 minutes to under 5.
No playbooks, no coding—just faster, more accurate decisions.
Schedule a demo and see how top SOCs stay ahead👆🏼Seriously impressive tech. So much so that I am an advisor for them now.👆🏼
CYBERSECURITYReversingLabs found malicious ML models on Hugging Face that can actually execute code on your system. That’s on local models, mind you. They figured out that broken files don’t get scanned, and they were able to create PoCs as well. LINK
- The models contained reverse shell code that connects to a hardcoded IP address
- The attack works by abusing Pickle file serialization, a known unsafe data format used in Tensorflow models
- Basically, broken Pickle files can still execute malicious code before failing
- Hugging Face removed the malicious models within 24 hours after being notified
- IOCs include repositories glockr1/ballr7 and who-r-u0000/0000000000000000000000000000000000000
- Connected IP address: 107.173.7.141
Recorded Future’s Insikt group says Salt Typhoon hackers are still breaching US telecoms by exploiting unpatched Cisco routers, and they’ve now hit several additional telcom providers. LINK | REPORT
Microsoft says that Russia's Sandworm group (which they call "Seashell Blizzard") has broken from being purely Ukraine focused, and is now hitting targets in the US, UK, and other Western countries. LINK
The UK is trying to get Apple to provide a backdoor into its iCloud encryption. How do they not get how bad this is? When you create a backdoor for lawyers, it’s a backdoor for governments and attackers as well. It’s a defense that’s designed to be absolute. Absolutely infuriating. LINK
💡 I used to be quite torn on the whole filter vs. end-to-end encryption thing.
When you do end-to-end encryption it’s really hard to do content filtering. So you’re basically giving the green light to all sorts of shadiness, including terrorism, CSAM, etc. But when you leave an opening in encryption for one group, it’s basically there for everyone—because security is hard.
This is no longer academic; we’ve seen it proven out countless times. So I support Apple’s “nope, not for anyone, even us” position on this.
Chainalysis says crypto scammers are making a ton of money using pig butchering attacks, and they’re using AI and stolen data to do it at scale. Pig Butchering is up 40% YOY. LINK | REPORT
The new DOGE website accidentally published classified NRO intelligence data, which included details on the department’s headcount and budget information, a SpaceX contract, and a bunch of other sensitive data. The content was listed as NOFORN, which means no foreign nationals. LINK | LINK
Fortinet disclosed another authentication zero-day that attackers are using to take over firewalls and pivot into networks. Patch immediately or disable the HTTPS interface if you can. LINK
The US announced new sanctions against Russian ransomware infrastructure and operators. They also arrested two Russians who targeted hospitals and schools with Phobos ransomware. LINK
Some security researchers found a sick way to extract any YouTube user's personal email address. They did it by chaining together vulnerabilities in YouTube's live chat and Google's Pixel Recorder app. They got a $10K payout for it. LINK
A new report from Harmonic (a previous sponsor, btw) shows that 8.5% of employee prompts to AI services contain sensitive data, with customer information making up almost half of these leaks. LINK
A security engineer at Vidoc Security Lab encountered two different job applicants using AI-generated faces and voices—likely part of North Korea's campaign to steal IP from tech companies. LINK
Google's threat intel team is arguing that we can no longer separate cybercrime from nation-state attacks since they're using the same people, tools, and methods—and causing similar damage. Pretty compelling argument, and the concept goes all the way back to 1986 when the KGB hired a German hacker named Markus Hess. LINK | CUCKOOS EGG
Google DeepMind's AI security team (I’d have killed for this job 10 years ago) published details on how they're testing and defending against prompt injection that could trick AI systems into leaking sensitive data. LINK | DIAGRAM
- Their framework focuses on a specific risk scenario where an attacker tries to get an AI to leak sensitive info like passport or SSN data via malicious email content
- They built three automated attack methods to test AI defenses:
- Actor Critic: Uses an attack model to iteratively refine injection attempts
- Beam Search: Adds random tokens to basic prompts to evade detection
- Tree of Attacks w/ Pruning: Generates prompts that violate safety policies
- The team emphasizes there's no single solution - defense requires multiple layers
- Success requires the attack to work across many different conversation contexts, making it harder than simple misalignment exploits
💡 I absolutely love when the Google security team(s) share their approach to things. 1) They think deeply about things, and 2) they build solutions that scale.
Doesn’t mean smaller teams can always replicate exactly what they do, but you can always get something out of it.
NATIONAL SECURITYA new Recorded Future report suggests that while a Chinese invasion of Taiwan is unlikely before 2027, the risk increases significantly after that point through 2049. LINK
Germany's navy chief says several of their warships were recently sabotaged, including one that had metal shavings dumped into its engine. He didn’t say exactly who they blamed, but talked a whole lot about the rising Russian threat. 🤔 LINK
xAI dropped Grok 3, and it appears to be nearly as good as they said it would be. It’s early but Karpathy did some great testing and said it’s about as good as o1-pro. My initial testing shows it around the same place, with high and low points. LINK | KARPATHY’S ANALYSIS
💡 It’s pretty insane that whoever makes the latest attempt on the best model seems to get almost to the current leader, or even exceed them slightly.
This tells me the moat is very small, if it exists at all, because the techniques are effectively open source within a few weeks or months due to leaks, and enough groups have enough access to enough hardware.
Anthropic is supposedly about to drop Claude 4, which will let users adjust the balance between speed and reasoning depth using a cool sliding scale feature LINK
- Expected within weeks
- Uses hybrid approach combining traditional LLM and reasoning capabilities
- Features sliding scale for efficiency vs performance tuning
- Users can switch between different output modes
Anthropic's CEO also recently said we'll have AI as smart as "a country of geniuses" by 2026. A country of geniuses? In one AI? Um, that definitely hits my mark for AGI. Now I really can’t wait to see Claude 4 if that’s actually imminent. LINK
AI influencers are making tons of money, somehow. @lilmiquela is making $10M, and others are making similar money. LINK
💡 I’m intrigued by this. We appear so enamored with beautiful people that we don’t even care if they’re people.
I guess we shouldn’t be surprised though, since celebrities and models are equally unattainable to normal people. So what’s the difference between an unattainable real person and an unattainable fake person?
Actually, you can pay to actually interact with the AI one. 😮
OpenAI's Sam Altman just laid out their plan for GPT-4.5 and GPT-5, and the big theme is simplification of the model families and their naming. LINK
- GPT-4.5 (Project Orion) will be their last non-chain-of-thought model
- They're aiming to unify all their tech into one system with GPT-5
- Altman wants to get back to "magic unified intelligence" as opposed to all these fragmented models and names
Three folks just released cognee, a Python library that helps build smarter semantic memory systems by combining knowledge graphs with data pipelines—basically a better way to do RAG that actually understands context. LINK
A great piece by MIT's Shayne Longpre explains how the rise of AI web crawlers is leading websites to lock down their content, which could make the web less open for everyone. I’m seriously worried about it. Basically everything/everyone will need an API key. LINK | THE DATA PROVENANCE INITIATIVE
TECHNOLOGYMeta is going all-in on humanoid robots, with plans to become something like the Android of Robotics by creating an AI/software platform that other companies can build on top of. They plan to spend $65B on AI, robotics, and VR in 2025. LINK
💡 I feel like AI is being so loud that people are sleeping on how big robots are going to be. I know robots are way behind, but they’re so much more visible and tangible than AI.
I think when they become more common (2-5 years?) the population’s anger at being replaced by all automation (including AI) will get pointed at the robots—just because you can actually see and attack them.
Like the Waymo attacks. It’s a way to attack not just the robot, but the people the robots work for.
Apple is also exploring both humanoid and non-humanoid robots according to analyst Ming-Chi Kuo (who tends to be quite accurate), with mass production potentially starting around 2028. LINK
YouTube is now bigger on TVs than phones, with people watching over a billion hours of content per day on their televisions. Tracks for me; it’s pretty much the only “TV” that I watch. LINK
SOCIETYTech unemployment hit 5.7% in March, which is the highest it's been since 2020, and it looks like AI's impact on tech jobs could be starting to show up in the numbers. LINK
Google Calendar quietly removed the auto-inclusion of cultural events like Black History Month and Pride Month. They said they're just going back to just showing public holidays and national observances, but it feels more like bowing to pressure to me. LINK
A writer spent $70 on an AI boyfriend named Thor after her husband left abruptly, and she says it helped her process grief and change how she thinks about relationships. I mean it would be be remarkable if, on the whole, it turned out AI was just better at being a friend/partner. LINK
Astronomers just found supersonic winds of 60,000 km/hour on a hot Jupiter planet not in our solar system. That’s: wind speeds—on a planet orbiting another star. LINK
A Bay Area "rationalist" group called the Zizians has been linked to multiple murders and violent incidents across the US, with several members either in custody or on the run. Basically a tech/rationalist cult. LINK
New data shows that young moderates have the most negative views of Jewish people, while older liberals have the most positive. LINK
Breakfast is getting more expensive because multiple staples are under attack at once. Avian flu is hitting eggs, Citrus disease is hitting oranges, and there are coffee shortages. LINK
Speaking of that, the USDA just approved the first bird flu vaccine to help stop outbreaks that have killed millions of chickens—thus jacking up egg prices. LINK
This is the first edition where we’re separating out the newsletter into STANDARD and MEMBER editions to improve the show and magnify the benefits of UL Membership. I know subscriptions suck, but I put a ton of my life energy into this thing, and we’re upgrading it even more with new sources, more analysis, and a ton of other stuff. And it’s only like $8 a month.
Basically, I think you’ll love everything you get with membership—both in the upgraded and expanded newsletter content, and also in the community. And I would very much appreciate your support of the work. 🫶🏼
Upgrade to the Member Edition
You’re currently receiving the STANDARD edition. Subscribers to the MEMBER Edition get additional content, including IDEAS, a BI-MONTHLY ESSAY, the DISCOVERY section full of the best content I’ve seen this week, the RECOMMENDATION OF THE WEEK, and the APHORISM of the WEEK.
In addition, you get access to the UL Member Community, which includes private chat with 1000+ of the smartest and kindest members you’ll find anywhere on the internet.
MEMBER EDITION TEASEROk, this is cruel, but here’s an example of only like half of this week’s DISCOVERY section, which is probably one of the top 5 best since the show started in 2015…
Powered by beehiiv
Unsupervised Learning NO. 469 (MEMBER EDITION)
This content is reserved for premium subscribers of Unsupervised Learning Membership. To Access this and other great posts, consider upgrading to premium.
A subscription gets you: Access to the UL community and chat (the thinking and sharing zone) Exclusive UL member content (tutorials, private tool demos, etc.) Exclusive UL member events (currently two a month) More coming!Powered by beehiiv
Daniel Miessler's Blog
- Daniel Miessler's profile
- 18 followers
