Hi Simon,

Big fan of your work with the LLM tool. I have a cool use for it that I wanted to share with you (on mac).

First, I created a quick action in Automator that recieves text. Then I put together this script with the help of ChaptGPT:

        escaped_args=""
        for arg in "$@"; do
          escaped_arg=$(printf '%s\n' "$arg" | sed "s/'/'\\\\''/g")
          escaped_args="$escaped_args '$escaped_arg'"
        done

        result=$(/Users/XXXX/Library/Python/3.9/bin/llm -m gpt-4 $escaped_args)

        escapedResult=$(echo "$result" | sed 's/\\/\\\\/g' | sed 's/"/\\"/g' | awk '{printf "%s\\n", $0}' ORS='')
        osascript -e "display dialog \"$escapedResult\""

Now I can highlight any text in any app and invoke `LLM` under the services menu, and get the llm output in a nice display dialog. I've even created a keyboard shortcut for it. It's a game changer for me. I use it to highlight terminal errors and perform impromptu searches from different contexts. I can even prompt LLM directly from any text editor or IDE using this method.

That is a brilliant hack! Thanks for sharing. Any chance you could post a screenshot of the Automator workflow somewhere - I'm having trouble figuring out how to reproduce (my effort so far is here: https://gist.github.com/simonw/d3c07969a522226067b8fe099007f...)

I added some notes to the gist.

Thank you so much!

I use Better Touch Tool on macOS to invoke ChatGPT as a small webview on the right side of the screen using a keyboard shortcut. Here it is: https://dropover.cloud/0db372

Why not BTTs in built tool to query Chatgpt with the highlighted text?

Does someone know a similar tool like Automator on Linux for this particular use case?

So one of the ways how it can be done is: In linux (at least in gnome) it's possible to bind any app or script to a custom global hotkey, plus xclip has access to the currently selected text and zenity can be used to display the result. So it's possible to do it just using bash script bound to a global hotkey.

Thanks, xclip was the tool I was looking for. Sadly I switched to Plasma 6 two days ago and Wayland doesn't seem to have a similar tool (wl-paste just reads from the clipboard and not from the selected text).

After so many years, Wayland is still such a mess...

You might want to try to send ctrl+c (using something like xdotool or ydotool) to the app to copy the current selection to the clipboard and then to extract clipboard contents to use it in a script.

Thanks again. I changed my Klipper configuration (the KDE clipboard application) to synchronize selection and clipboard. In addition, I added a global shortcut (F1) to execute this little script:

https://bpa.st/WORA

It reads the clipboard (equal to the current selection) via wl-paste and sends a request to the Claude API via curl. Finally, it filters the response with jq (very crude) and displays it with notify-send. I have a second version of the script that sends the result via XMPP to Gajim because the answers can be quite long.

I think the experience should be similar to the one on MacOS.

Hey, that's really handy. Thanks for sharing!

have you tried http://openinterpreter.com? it takes that a step further

That is really cool, but for it to be useful you'd need:

1) Some safeguards re privacy and data ownership. Do you just send the file to the web? Do you run everything locally? 2) Can open interpreter be used with voice? So, what if I don't want to type but I want to dictate?

Is it POKT?

Hi, author here. I liked this comment a lot and I can help to shed some light:

We do see phishing pages like this increasingly popping up with obfuscation. I think at this time less than a third are obfuscated, but this is gradually increasing. The thing is, most of the folks running these sites are likely not very technical. They buy the template from a vendor and plug in the config settings and just focus on driving traffic to the site - this happens through Discord & Twitter spam.

The thing with fraudsters and threat actors that play in this space is that at the end of the day it's a business and they want maximum reward for minimal effort. I think right now there's not a very aggressive takedown feedback loop with these phishing sites, but we are working to accelerate this and as this happens the perpetrators WILL need to rely more on obfuscation to try and thwart on the fly static detection. My guess is that eventually most of the logic will be server-side and cloaked as has happened with many other categories of phishing and fraud (particularly malvertising campaigns). Sooner or later the more amateur scam operators in this space will likely get shaken out by this acceleration of the cat and mouse game and only highly technical operators will be left.

With regards to the sites that we see obfuscated today, we are still able to do accurate attribution, as we've been specializing in the detection and blocking malicious client-side code for some time now.

Thanks again for your comment.

That's correct. It's just a subtle way of doing OS fingerprinting.

The user still needs to go through with the fake Flash update. Even if one is to accidentally fat finger the download, they still have to proceed with the installation. To protect yourself, please be vigilant and only accept software updates directly from the vendor of the software you are using. This is more of a phishing attack to get folks to install malware / adware.

The industry is moving in a direction where more and more ads will be sandboxed, we are just not there quite yet.

Hi everyone, I'm the author of the blog post. We at Confiant help websites to protect their users by detecting and blocking malvertising. We are hiring in our security and engineering teams.

If you're interested in working to combat the problem outlined in the blog post, we would love to hear from you! Please reach out to me [eliya AT confiant DOT com].

I will be back a little bit later to answer some of the questions that I see here in the comments as well. Thanks!