Search

2 results for “hasamba”

1. 

   hasamba @hasamba

   2026-10-13

   ----------------

   🛠️ Tool: ngsfc, an Open-Source System File Checker for Windows
   ===================

   Overview

   ngsfc is a single-binary Go utility for Windows 10 and 11 that replaces the reporting layer of sfc /scannow. The repair engine is untouched: the tool drives the same Windows Resource Protection service (TrustedInstaller) that sfc.exe uses, and it does not replace Microsoft's repair logic. What changes is the part that talks to you: which files were corrupt, why, and whether they were actually repaired.

   Key Features
   • Per-file results with reason and repair state, instead of the standard "see CBS.log" message. The servicing log is multi-megabyte, shared with Windows Update, and hard to parse.
   • One exit code per outcome. sfc.exe returns 0 whether the system is clean or corrupt, which makes scripted checks unreliable.
   • --json on every command. Outcomes are language-independent, so scripts behave the same on non-English Windows.
   • scan --repair --escalate: if the repair fails, DISM /RestoreHealth runs and the scan is repeated.
   • ngsfc report shows what the last scan flagged instantly, with no rescan.
   • report, status, and quick run without administrator rights.
   • ngsfc quick sweeps signatures of roughly 7,700 system binaries in about 8 seconds, useful as a second opinion.

   Technical Background

   The project grew out of a reverse-engineering exercise on sfc.exe, published as a full teardown in the repository docs. The load-bearing finding: sfc.exe contains no verification code at all. It is a thin console client for the TrustedInstaller service, and the per-file details it withholds have been sitting in the log the entire time. ngsfc consumes the same service, so scan fidelity follows the native path.

   Use Cases
   • Scripted integrity checks where pass/fail must be machine-readable.
   • Triage on machines where repair keeps failing and DISM escalation is needed.
   • Quick second-opinion sweep of system binaries when behavior looks off.
   • Reading what the last scan flagged without waiting for another scan.

   Installation

   1. Download the release binary, rename to ngsfc.exe. Single file, no installer, no dependencies.
   2. Run ngsfc status and ngsfc quick without elevation.
   3. Open an elevated terminal for ngsfc scan (verify only) or ngsfc scan --repair.

   Limitations
   • The release binary is not code-signed, so SmartScreen may warn on first run. Each release publishes the SHA-256 of the binary, or it can be built in one command.
   • Windows 10 and 11 only.
   • Not independently tested here; capability claims are from the project README and its sfc.exe analysis document.

   References
   • Repository: MAXIVA11/NextGenSFC on GitHub
   • docs/SFC-ANALYSIS.md for the full sfc.exe teardown

   🔹 tool #ngsfc #Windows #SFC #TrustedInstaller

   🔗 Source: https://github.com/MAXIVA11/NextGenSFC

   #ngsfc #windows #sfc #trustedinstaller
2. 

   hasamba @[email protected]

   2026-10-13

   ----------------

   📚 Frameworks: AI Risk Map v1.3 (RiskFramework.org)
   ===================

   What it is

   AI Risk Map is a single-page visual reference for AI-specific risk: 196 risk factors across 55 categories and 12 domains, arranged by which function owns the risk in the enterprise rather than by technology. The domains are governance, strategy, data, model development, security, safety, operations, legal, third-party, workforce, financial, and autonomous action. Current release is v1.3, licensed CC BY-SA 4.0, with eight new factors and four narrowed ones versus the previous version. A change log accompanies the update for anyone revising an existing mapping.

   Formats

   Available artifacts:
   • Poster at 48×36 in (PDF, PNG, SVG), a standard large-format print size
   • Taxonomy workbook (XLSX)
   • Flat table (CSV) keyed by stable IDs, AIRM-001 through AIRM-197, for mapping against internal tooling
   • Markdown corpus intended to be loaded into an AI assistant for domain-specific questions

   Inclusion methodology

   The map lists risks AI introduces, or amplifies in a specific and nameable way. Generic IT, cyber, and vendor risk that exists identically without AI stays off the map, and the author names that single constraint as what keeps the map focused. A candidate earned a place by clearing any one of three gates:

   1. AI-specific: remove AI and the risk vanishes
   2. Management delta: the risk is not new, but the way it must be managed is, and the delta has to be specific
   3. Corroboration: two or more independent AI standards name it

   Sources span regulation and supervisory guidance, standards (NIST, ISO/IEC), threat frameworks, and academic taxonomies. All 196 factors carry citations verified against primary texts.

   Scope boundaries
   • Not a control framework: it names risk factors, never controls
   • Not a threat register: malicious use of AI against the organization, such as deepfakes and AI-enabled fraud, is deliberately out of scope; the effect of competitors' and customers' AI on the value of existing strategy is in scope
   • Not a scoring tool: position, order, and ID number say nothing about likelihood or severity

   One caveat worth flagging before operational use: entries mix conditions, failure modes, threat events, and loss events. They are not well-formed loss-event statements in the FAIR sense, so each factor needs scoping into a proper risk scenario before CRQ or FAIR analysis.

   How to use it

   Three documented paths:
   • Workshop: put the poster up and ask which factors nobody has discussed
   • AI assistant: load the markdown corpus and ask domain-specific questions
   • Own tooling: map against the CSV using the stable IDs

   Limitations

   Point-in-time view of a fast-moving field. The map surfaces possibilities; it does not determine which risks matter most to a given organization. The twelve domains assume a typical enterprise structure and may not match every structure. It seeds threat modeling and risk assessment; it complements system-specific models rather than replacing them. The author notes that hard inclusion decisions were required and that some entries may look like duplicates without actually being so.

   For anyone who remembers cloud risk posters from the early public-cloud wave, this is the same idea applied to AI: a visual reminder to widen perspective, backed by citation work most teams will not redo themselves. The FAIR-scoping requirement is the main cost to budget for before using it in quantified analysis.

   🔹 AIRiskMap #RiskManagement #AIGovernance #FAIR #AI

   🔗 Source: https://www.riskframework.org/ai-risk-map/

   #aigovernance #riskmanagement #ai #fair