Posts by thomrstrom@triangletoot.party
 (DIR) Post #B4gIrZ795weDfgGxv6 by thomrstrom@triangletoot.party
       0 likes, 0 repeats
       
       @ariadne TIL this exists. Wild!
       
 (DIR) Post #B5zpouPIVVrB8FrG52 by thomrstrom@triangletoot.party
       0 likes, 0 repeats
       
       @ariadne Really? for what kind of machine?
       
 (DIR) Post #B64Lm7Jc241bSmkdN2 by thomrstrom@triangletoot.party
       1 likes, 2 repeats
       
       Well, this is a new one for me - I'm not very familiar with #btrfs; but I wouldn't have expected running out of disk space to be unrecoverable - especially in single-user mode without booting alternative media. rm just hangs.I've worked with a dozen #UNIX flavors over the last 32 years. This is special.
       
 (DIR) Post #B6WvoWNwpZXCZU6Qz2 by thomrstrom@triangletoot.party
       1 likes, 0 repeats
       
       For the last month, I've been hard at work developing and tuning #azoth - our open-source AI/ML model for #malware detection, and while I won't claim success for all file types (*cough* Python), our new ensemble approach - mixing a hierarchy of experts & generalists with calibrated policy-based combiners, seems to be hitting the jackpot.
       
 (DIR) Post #B6lZQMHJx38S1BE2WO by thomrstrom@triangletoot.party
       0 likes, 0 repeats
       
       Today's fun discovery is the clx-cookieparser NPM; which via a dependency, fetches a blob from jsonkeeper.com and evals it, and the chain unrolls into BeaverTail and InvisibleFerret — the loader-and-stealer kit of the DPRK's Contagious Interview campaign: https://atomdrift.org/discoveries/2026/05/clx-cookieparser-dependency-twin-beavertail/
       
 (DIR) Post #B6nSv9tTjhLNDpjVCq by thomrstrom@triangletoot.party
       0 likes, 0 repeats
       
       128 ARM64 cores, 256GB of RAM, 24 hot-swappable NVME drives; definitely the craziest machine I've ever built. Holy hell is it fast though.
       
 (DIR) Post #B6nT3fe9Z0oU1Ccici by thomrstrom@triangletoot.party
       0 likes, 0 repeats
       
       @ariadne Gigabyte R272-P30, courtesy of eBay.
       
 (DIR) Post #B8dGNWBHUZz1BQIJoe by thomrstrom@triangletoot.party
       0 likes, 0 repeats
       
       @ariadne Sorry about the delay (I'm on holiday!) - the results are here: https://lab.atomdrift.org/file/2b5ba4f181efeec285b51e6e255280c4cd05e1979fcbef65fe761b8df637fb39Basically it didn't match much of anything in the 90,000 parsing rules we ship, but just enough that the JSON exported was interpreted by the local GPU to provide an accurate interpretation (an optional).
       
 (DIR) Post #B8uFMDQpAMGLBKR3mC by thomrstrom@triangletoot.party
       0 likes, 0 repeats
       
       @ariadne Yes! I'd love to. Let me know if I can help in some way.Admittedly, much of atomdrift's detection assumes use of a stdlib today. There haven't been many samples of pure-ASM ELF binaries to learn from yet, but it's coming; so I guess this means I'm gonna have to embed a per-arch syscall map unless I can abuse rizin for that purpose.atomdrift was trained on ~1k worth of  Qwen-generated malware samples in various languages; but all compiled using normal tooling.
       
 (DIR) Post #B8uGJ6mLXpq3dLaIi0 by thomrstrom@triangletoot.party
       0 likes, 0 repeats
       
       @ariadne To remove some of the mystery; you can use "atomscan --format=interpret <path>" to see what context it sends to an LLM; AFAIK, it probably used the detected traits + the one error message in the ELF binary to tie the hints together.The default interpretation LLM is Qwen 3.7-27B; but you can point it at anything using the `-llm` flag. I haven't done a ton of comparative testing, but the Qwen results are reasonable enough & cheap to run locally.
       
 (DIR) Post #B8uLn7T62rOyELi5yq by thomrstrom@triangletoot.party
       0 likes, 0 repeats
       
       @ariadne Sure, I'd be curious if the results are any different. I imagine both should say benign though. If you started adding socket/execve syscalls, it should start heading toward suspicious; but admittedly that will depend on what architecture your targetting.The only time I've seen similar techniques used for ELF binaries is for IoT malware that used more obscure architectures like MIPS, so that's where most of the raw syscall training has been so far.
       
 (DIR) Post #B9kR1qk3zpCKINVaHQ by thomrstrom@triangletoot.party
       0 likes, 0 repeats
       
       @ariadne I mean, wouldn't you do that if you were the implementer?
       
 (DIR) Post #B9kREZByYbjzd8d0Bk by thomrstrom@triangletoot.party
       0 likes, 0 repeats
       
       @ariadne Two areas I'm glad to have never worked in my life: Advertising and Anti-Piracy.
       
 (DIR) Post #BAH3qSmCiZ16pJZhVQ by thomrstrom@triangletoot.party
       0 likes, 0 repeats
       
       @ariadne It helps that I spent 6 months thinking about the problem before spending 9 months building it. I figure I've spent 2500 hours on this project, not including the 1500 hours I spent on its predecessors [malcontent, yt].AI has helped too, even if I'm sheepish to admit it. One of the biggest epiphanies was that a well-guided reinforcement loop for rule authoring will always have lower latency than a human engineer - especially as AI has changed the # of novel strains we're seeing daily.
       
 (DIR) Post #BAWCrrU74Zs2dWdYXI by thomrstrom@triangletoot.party
       0 likes, 0 repeats
       
       @ariadne Damn, sorry you had to go through that. 💔 I had a surprisingly similar arc, but with less trauma. IRC was a similar escape; I moved to the US at 19 because I felt like the country wasn't big enough for my father and I. Moved to North Carolina, crashed on the couch of some IRC buddies I never met, and somehow made it from there. If nothing else, the two of us ended up with a very different perspective than the typical industry folks.  Those years are why. I'm so glad you're here.