Simon Willison's Weblog: the-register

Simon Willison interview: AI software still needs the human touch

2024-01-27T22:08:35+00:00

Simon Willison interview: AI software still needs the human touch

Thomas Claburn interviewed me for The Register. We talked about AI training copyright, applications of AI for programming, AI security and a whole bunch of other topics.

Tags: interviews, the-register, ai, generative-ai, llms

The Register hit by XSS

2004-11-22T08:32:08+00:00

Here's a nasty one: popular tech news site The Register was hit on Saturday by the Bofra exploit, a nasty worm which uses an iframe vulnerability in (you guessed it) Internet Explorer to install nasty things on the victim's PC. Where it gets interesting is that the attack wasn't against the Register themselves; it came through their third party ad serving company, Falk AG.

This is a classic example of a cross site scripting attack, in which malicious client-side code (usually JavaScript) is uwittingly served up by an otherwise innocent site. Usually, cross site scripting is caused by a badly written server-side application failing to properly escape data sent in a query string before displaying it on a page. This allows attackers to create links which, when followed, steal cookies or cause other nasty effects for the user following the link. Attacks on third parties with scripts served up on a target website's pages (ad serving companies are a classic example) are less common but much more damaging as the malicious code involved will be distributed to everyone who visits that site, whether they click on a hostile link or not.

This problem isn't restricted to ad servers; any service where web pages point to a JavaScript file hosted on an external site are potentially at risk should the external site be compromised by crackers or abused by its legitimate owner.

An aside: users of alternative browsers (Get Firefox!), as well as those who had upgraded to Windows XP Service Pack 2, were unaffected.

Tags: javascript, security, the-register, xss

Palladium

2002-07-04T18:42:57+00:00

Via Boing Boing: Seth Schoen's notes on Palladium after a meeting with Microsoft. Cory Doctorow points out that Seth is probably the most knowledgeable tech person to have been briefed on Palladium by MSFT without signing an NDA and his post certainly makes interesting reading. Palladium has had a lot of coverage since the Newsweek article announcing it first broke, with Robert Cringely providing some of the best analysis (in my opinion at least). The Register also has a story about Palladium which introduces some more information and guestimates on a shipping schedule.

Tags: boingboing, microsoft, palladium, robert-cringely, security, the-register