Engineers at Anthropic with no formal security training have asked Mythos Preview to find remote code execution vulnerabilities overnight, and woken up the following morning to a complete, working exploit.
「没有正式安全培训的工程师过夜得到完整可用漏洞利用」——这句话将Mythos的能力从「顶级研究人员工具」重新定义为「技能民主化工具」。漏洞利用开发历史上是最难民主化的安全技能之一，需要多年专业积累。如果这个门槛已经被清除，那么具有适度技术背景的国家行为者、犯罪组织乃至个人都将获得此前只有精英安全团队才有的进攻能力。
To help you better understand the configuration possibilities and potential issues, take a look at the following table. Take into account the type of threat you are concerned with when making your decision on how to configure sending settings.
This is addressing a security issue; and the associated threat model is "as an attacker, I know that you are going to do FROM ubuntu and then RUN apt-get update in your build, so I'm going to trick you into pulling an image that _pretents_ to be the result of ubuntu + apt-get update so that next time you build, you will end up using my fake image as a cache, instead of the legit one." With that in mind, we can start thinking about an alternate solution that doesn't compromise security.
Covid-19 has decimated independent U.S. primary care practices—How should policymakers and payers respond? (2020, July 2). The BMJ. https://blogs.bmj.com/bmj/2020/07/02/covid-19-has-decimated-independent-u-s-primary-care-practices-how-should-policymakers-and-payers-respond/
I do not understand what is the threat model of not allowing the root user to configure Firefox, since malware could just replace the entire Firefox binary.
threat model