Of course LLMs see a lot more source-assembly pairs than even skilled reverse engineers, so this makes sense. Any area where you can get unlimited training data is one we expect to see top-tier performance from LLMs.

(also, hi Thomas!)

Comments URL: https://news.ycombinator.com/item?id=47616361

Points: 1812

# Comments: 474

The financial incentives drive Microsoft to support every possible (mis)configuration, forever. It's the tireless work of a few folk at Microsoft like Ned Pyle, Steve Syfus, and Mark Morowczynski that have landed the changes so far.

There could absolutely be a "security check" tool deployed by default with Server 2025 or similar that looks for Kerberoastable user accounts (any account with a ServicePrincipalName is technically Kerberoastable, like computer accounts), AS-REP roastable accounts, weak encryption types, etc. That would probably get more traction than changing defaults out of the box for everyone, as that's another way to phrase "breaking customer environments when they upgrade".

> For various reasons we have christened these notes “CLP” - none of those reasons can be found [here](https://en.m.wikipedia.org/wiki/CLP)

Presumably it's an inside joke or something.

https://www.cnn.com/2023/08/06/us/oregon-drivers-pump-own-fu...

All that said, thanks for your interesting new question, and thanks for spending time on it :D

The phrase to describe this is double extortion.

As for your question, https://www.cisa.gov/stopransomware is a decent start, but it's a complicated issue. In short, if a pentester can get inside your environment and gain privileges, so can an attacker. You want to slow down attackers enough to buy time for detection and response capabilities.

There's more to the story that Rapid7 didn't want to air publicly, and none of it is good for JetBrains.

(Disclosure: I know some of the folk on the Rapid7 side, so I'm perhaps biased towards their interpretation of events)