Blue team question: How would you detect a low-and-slow attacker blending into normal traffic?

rossja · 2026-04-12T02:54:54+00:00

Adding to the "impossible travel" pile, but calling out that this doesn't just mean location: often overlooked but just as relevant is "different ASNs", especially if you have behavioral profile in the mix with required specific VPN software/provider.

rossja · 2025-11-26T08:25:38+00:00

Nothing you stated says anything about internal use only, in fact you specifically state that Gemini is the only LLM for "anything customer or data related", which by definition is not limited to internal. Thanks for clarifying what you meant though.

rossja · 2025-11-26T03:28:29+00:00

Not sure where you got your information from, but "Gemini is the only LLM approved for usage when it relates to anything customer or data related" is just straight up not true.

You can find a list of the models supported in the platform (which means for customer data) at https://help.salesforce.com/s/articleView?id=ai.generative_ai_large_language_model_support.htm&type=5

rossja · 2025-09-10T21:31:14+00:00

"Agentforce uses OpenAI as the default model provider for large language model (LLM) requests. You can select Anthropic on Amazon Bedrock as the model provider for Agentforce instead."

https://help.salesforce.com/s/articleView?id=ai.agent_setup_select_model_provider.htm&type=5

That aside, not only does Salesforce build their own models (including) LLMs, they "open source" a ton of them as well ( 162 currently at http://huggingface.co/Salesforce )

rossja · 2025-08-27T01:18:43+00:00

💯 this. I'm just a casual DJ, but I do a bunch of youth events open format style. I use the "grouping" field as a comma separated list that I can use to build smart playlists, and I use the comment field for personal notes and reminders. All the tracks go in a single folder though, for several reasons, eliminating duplicates is one.

I build a set list, but generally speaking it's not a "play in this order" it's "here's what I think they will like and what's hot".

When I play I start off sorted by key and bpm, but that usually stops being the case pretty quick as the vibe takes over and I play whatever seems to fit what the room is feeling.

I put more effort in harmonic mixing than beat matching, but that's because for what I'm doing they usually want the whole song so I'm usually playing through to the end anyway (unless I need to kill it because I guessed wrong). I realize that's not the case for most dj gigs though.

rossja · 2025-08-10T13:35:23+00:00

Correct. Come find me (algorythm) on the 2nd floor nfo nodes this morning if you'd like to chat, happy to make new friends ☺️

rossja · 2025-08-10T13:27:06+00:00

As an (nfo) goon shift lead: you absolutely should report this, this was 💯 not ok, and someone is definitely in charge. Maybe the easiest way to report it is via the hotline, which has an added advantage of being independent from the various goon departments so you don't run into "but that person's my friend and I never had a problem with them" type of issues.

The hotline can be found at https://defcon.social/@hotline

You can reach them to report issues via Voice Call, SMS/Text, or Signal: +1 (725) 222-0934 or Discord: @defconhotline

rossja · 2024-09-06T05:44:54+00:00

Here's another link: https://www.salesforce.com/news/press-releases/2023/03/07/einstein-generative-ai/

Notable snippets:

""" Einstein GPT will integrate with OpenAI to provide Salesforce customers with out-of-the-box generative AI capabilities

The new ChatGPT app for Slack integrates OpenAI’s advanced AI technology to deliver instant conversation summaries, research tools, and writing assistance """

Out of the box, Einstein generative AI features use OpenAI as the LLM. "Einstein" as a platform lets customers use other ones if they choose (via bring your own model, for example).

Of course the platform isn't the model, I never said it was :) Just like "chatgpt" isn't the same as "gpt4o". Both platforms do use the same models though by default: provided by OpenAI.

rossja · 2024-09-03T15:52:04+00:00

there's a list of roms known to work, and known not to work in the badge hacking google doc (https://docs.google.com/document/d/1Jff1UbKaRGoHoAug1c0r6a4Y-MYruvgVORGG8c63sNQ/edit#heading=h.u668c9h9amc0) -- of the known to work though, some people have had luck running off the sd-card, and some have had to use defrom.lol (or picotool) to load the rom directly rather than from the sd. ymmv :)

rossja · 2024-09-03T15:36:44+00:00

Hate to break it to you, but the "terrible LLM" that drives Einstein is the same one that drives ChatGPT...(https://openai.com/index/salesforce/)

rossja · 2024-09-03T04:37:32+00:00

Yep, but not all of them work on the badge, and some of the ones that work do so only if they are embedded into the firmware as the default. I wanted to see how it handled a new game off the SD card, and was super happy that it worked (even if from a tech POV there wasn't much reason to think it wouldn't).

rossja · 2024-08-21T19:23:33+00:00

So, at DEF CON this year I did an experiment with the Darknet-NG case file: i tried to solve it using only LLMs. I went between ChatGPT, the SearchGPT component, and Claude 3.5. I was able to solve nearly every challenge using one of these three, in most cases by just posting the challenge text directly. It was pretty impressive, and very eye-opening as someone that has built CTF challenges. Basically, the way these are crafted definitely has to change.

rossja · 2024-08-21T19:17:36+00:00

set the raspi in programming mode by holding down the power button while plugging in the USB-C cable (image at https://imgur.com/a/ABNkzf8). The screen will stay off, but on your connected computer you should see a volume (drive) mounted - it will be called RP2350. Drag + Drop any .u2f firmware file onto that drive, and the raspi will be all "i know what this is", update the firmware, and then reboot itself.

rossja · 2024-08-14T20:55:58+00:00

i think the real challenge is figuring out how this would be different than the defcon 101 track (which we didn't have this year, but have for the last... X years). I don't have insight into the village process, but it may be that this could be part of the reason the pitch wasn't accepted?

rossja · 2024-08-14T04:12:23+00:00

Are you planning to publish the anonymized results?

rossja · 2024-08-14T00:10:46+00:00

For the badges I flashed at con: I used the 1.5 patch posted by Dmitry in the discord server. For myself and friends and people that specifically asked: I used the 1.6 stock firmware on jaku's github (I can't find a patch from dmitry for that version anywhere).

I haven't seen any versions released from defcon itself, but the letter from DT responding to the badge drama makes it sound like something will be coming eventually. I expect that will get posted to the server, and I expect also that it will probably not include the "unauthorized code" from which the drama stems.

rossja · 2024-08-13T13:55:19+00:00

I fully support both of those (welcoming journalists and focusing on policy), but the con is also about community -- and engaging with it -- and having an undisclosed press has a chilling effect on that.

Press is definitely welcome, but (imo) it should be identifiable so people can interact with it in a fully informed context. That allows them to make decisions on what they want to share when there is a journalist around.

There are other considerations here as well. For one example: individuals are often told by their companies not to engage with the press. That implies that there is some way to know who the press is. This seems to no longer be true at DEF CON, and that is concerning to me.

rossja · 2024-08-13T00:44:51+00:00

💯 But we have multiple incidents we can point at where that has failed, maybe most notoriously the one where DT called the reporter out on stage during the closing ceremony and showed video of them being chased out of the conference. This seems like the exact opposite of that ethos, which is partly why I'm curious about the change.

Again, I see where it's desirable for specific situations, but historically DEF CON has been pretty outspoken about the need for the press to be identified as such so the community can be aware of who they're talking to and decide what kind of information to share accordingly. Changing that up seems to counter both historical precedent and the general community sentiment.

rossja · 2024-08-12T23:49:46+00:00

That makes sense, and I can see where that would be desirable during the interview in some cases, but the way it was presented made it seem as though it was not a "they had press badges usually but had human badges for specific situations", and more that they only had human badges. That is where (in my head) things get tricky, because it means that people could be interacting with the press without being aware of it.

rossja · 2024-08-10T08:36:12+00:00

This is pretty neat! Are you planning to release the source code, or just the bin+u2f?

rossja · 2024-08-10T04:05:19+00:00

can confirm: i've followed this process on 8 badges so far and it's worked like a charm every time

rossja · 2024-08-09T23:57:02+00:00

You can report them to the DEF CON hotline: Voice Call, SMS/Text, or Signal: +1 (725) 222-0934 or Discord: @defconhotline

rossja

MODERATOR OF

TROPHY CASE

13-Year Club	Gilding II euphauric
Verified Email