machine_learning

Ok fine, where can I get me one of these “security harnesses” you speak of?

Ok, so in a recent post I summarized some reading I had recently done about security harnesses. When I say “security harness” think “thingie which orchestrates many many LLM sessions to turn tokens and environmental stability into zero day vulnerabilities and dopamine”. That is, as Claude Code is to code generation, a security harness is to vulnerability hunting.

The next obvious step is to try one of these things and see if it does what it says it does on the tin. That is, do I get the dopamines? The problem of course is finding one.

A harness is the orchestration layer around an LLM. It controls the inputs, tools, prompts, models, state, validation gates and outputs for each stage of work. — ZephrSec

(more…)

Continue ReadingOk fine, where can I get me one of these “security harnesses” you speak of?

What is a LLM “security harness” and why do people keep talking to me about them?

Increasingly I am being told to “use a security harness” when analyzing code for potential vulnerabilities, but what is a “harness” and how does it differ from just running Claude Code and asking it nicely to find me some sweet vulns?

This post is literally my notes on reading up on this topic via a series of Cloudflare blog posts. That is, this post is a summary and does not intend to provide anything you cannot find anywhere else (with a lot more words used).

(more…)

Continue ReadingWhat is a LLM “security harness” and why do people keep talking to me about them?

Platform Decay

  • Post author:
  • Post category:Book

Platform Decay Book Cover Platform Decay
Martha Wells
The Murderbot Diaries
Tor Books
May 5, 2026
256
★★★☆☆

So I just finished reading the latest Murderbot book and I had caused me to realize I have questions, but we’ll get to those in a moment. This book is fairly standard Murderbot fare — Murderbot is doing something they think is dumb because their humans asked nicely. Very Bolo Tank if you will. The book is ok, for what I would call a “travel book”, but it does feel like the overall plot isn’t being progressed much in these recent books. Like I get it. Corporates bad, weird hippy dumb circle planet and university with mercenaries good — but shouldn’t there perhaps be something bigger happening here?

(more…)

Continue ReadingPlatform Decay

Early assessment of Fable, Anthropic’s new “slightly safer” LLM model

This is obviously not a scientifically valid assessment, but it is my general early impressions. This started as a really really long slack message, but it became pretty clear that slack wasn’t the right place for something like this — so here it is as a blog post instead.

(more…)

Continue ReadingEarly assessment of Fable, Anthropic’s new “slightly safer” LLM model

Coding agents and deep learning

Andy sent me this post about how Carl Kolon uses and thinks about coding agents. The post is pretty interesting, and when I went to reply to Andy I realized that at seven paragraphs perhaps the reply is better suited to here than a signal message. Also, because that is more friendly than replying to messages with links to your blog to drive traffic and the adoration of your readers? This is of course a forward looking statement for me, I do indeed hope one day to have a reader here but baby steps. Similarly to Carl I certainly started using LLMs as "smarter search", cutting and pasting queries into claude.ai, and waiting patiently for an answer. I think this should make Google very worried, especially as its so good at finding answers. The improved performance over a "raw Google" is largely because of persistence -- the LLM doesn't perform  single search, it will keep searching until it finds the answer. The decreasing levels of supervision Carl talks about is what I am talking about when I talk about prompts and planning, which has been my favourite LLM topic for the last few weeks. Increasingly I am writing a plan for…

Continue ReadingCoding agents and deep learning

I think I just experienced my first hallucinated security vulnerability

Yesterday my time I experienced what I think was my first LLM hallucinating a responsible security disclosure. Honestly it was no curl situation, but I think it was still interesting. The bug is on launchpad.net if you're interested in taking a look. I think in total I spent a couple of hours on the whole thing, with the hardest bit being trying to understand what the author was claiming. Fundamentally they had conflated being able to change the state of memory and other hardware inside their virtual machine with changing the state of those things for the hypervisor. They did not seem to understand that the video memory of the guest was not the video memory of the host for example. That said, I tried to be nice and I hope my replies were perhaps a little useful to them.

Continue ReadingI think I just experienced my first hallucinated security vulnerability

Ancient code, mental health, and AI tooling

In the early 2000s I was in my mid 20s, working a dead end job as a Windows programmer, and had two very young kids who were not super good at sleeping. I had worked as what I would now call a systems programmer for the Australian patents and trade marks office for a few years in the late 1990s doing low level image manipulation code -- we had a for the time quite impressive database of scanned images of patents and trademarks, and sometimes we need to do things like turn them into PDFs or import a weird made up image format from the Japanese patents office. So when you combined those things -- previous experience in a field I found interesting, a job I did not currently find interesting, and a lot of spare time very early in the morning because the kids wouldn't sleep but my wife really did need a rest -- you end up with a Michael who spent a lot of time writing image manipulation code on his own time. Even back then I was pretty into Open Source, so I released what I think was probably the first Open Source PDF generation library,…

Continue ReadingAncient code, mental health, and AI tooling

Talking to people about AI is hard

I am not entirely sure what makes the AI debate so polarizing, although I suspect it has something to do with feeling threatened by a changing landscape. What I can say with certainty is that I find having a nuanced conversation about AI with people often difficult. It seems to me that people fall into two polar opposite camps — those who thing AI is completely great and that we should fire all the programmers and creatives; and those who think that AI is all bad and we should go backwards in time to a place before it existed.

(more…)

Continue ReadingTalking to people about AI is hard

A self drive computer science degree, 2025 edition

What is you want to study computer science, but can’t afford university fees? Or, studied computer science a really long time ago and want to see what’s changed? Or just like learning stuff? Well, lots of schools now post their lectures on YouTube, so its entirely possible to construct a zero cost “self driving degree”, as long as you’re good enough at Canva to make your own certificate at the end. I consider this list incomplete, but in the end I decided I’d post the things from 2025 that I’d found and liked. I can always do an updated version later.

(more…)

Continue ReadingA self drive computer science degree, 2025 edition

Writing my own KVM client in python

I was talking to a friend the other day about our shared mutual appreciation of virtio-vsock, and it made me wonder something. How do virtual machines on Linux actually work? I know it involves qemu and the kernel’s KVM virtual machine implementation, but exactly how do they interact? How does the kernel get qemu to do emulation tasks as required?

qemu is several things hanging out together in a trench coat, but one of those things is software which can configure Linux’s built-in KVM virtual machine functionality to run a virtual machine, and then handle emulation of the devices that virtual machine is attached to which cannot be represented with actual physical hardware. This part of qemu is called a “KVM client” in the Linux kernel documentation. Its called that because if we ignore the emulation part for now it is just literally a client calling established APIs to the Linux kernel.

(more…)

Continue ReadingWriting my own KVM client in python

End of content

No more pages to load

Older Posts