MAI-Cyber-1-Flash inside MDASH
197 points by migmartri 5 hours ago | 107 comments

gste 4 hours ago
> Data. Our deepest advantage. Decades of building world-class security systems now give us trillions of daily signals across identity, endpoint, cloud, and network, and an unmatched record of real exploits and remediations. No one can manufacture this history.

If I'm being frivolous, does this mean Microsoft's model is best at fixing Microsoft products because they have trillions of data points on problems with Microsoft products

reply
tolugenius 4 hours ago
> does this mean Microsoft's model is best at fixing Microsoft products

"You're absolutely right, I shouldn't have delete your entire C drive. That's on me."

In serious, this would be a good advantage for Microsoft to consider, I just doubt they'd do it well.

reply
risyachka 3 hours ago
Considering they can't fix their login for decades, I am with you on this one
reply
wtfHN26 3 hours ago
> If I'm being frivolous, does this mean Microsoft's model is best at fixing Microsoft products because they have trillions of data points on problems with Microsoft products

Do they want to fix Microsoft Products ?

My laptop came with Windows 11. Windows update broke hibernate few weeks back. When laptop gets out of hibernate - Wifi works for a few minutes and then once in a while the Wifi Adapter isn't detected. I need to reboot to fix the issue, this has screwed up my workflow. Wasting a lot of time.

After troubleshooting a lot, I now only hope one day it gets fixed on it's own thanks to some new update.

If Microsoft has money to invest in AI models, they could sure fix Windows 11 which I assume is one of their core products.

I wish in a few years Microsoft realize that screwing over their Desktop users to chase Cloud and AI wasn't worth it. And by that time it's too late to get back the user base.

reply
delecti 3 hours ago
> If Microsoft has money to invest in AI models, they could sure fix Windows 11 which I assume is one of their core products.

On the other hand, what's the return on investment for making Windows 11 better? Your laptop came with Windows 11. Most laptops that come with Windows can't not come with Windows (that is, most laptops are only available in SKUs that ship with Windows).

reply
wtfHN26 2 hours ago
> what's the return on investment for making Windows 11 better?

Windows OS is what keeps most users in Microsoft's ecosystem.

I am still on Windows as some software I need to use aren't on Linux.

I am waiting for the day that I can get rid of Windows completely.

When I do that what Microsoft product do you think I will still use ? Office ? Azure ? Copilot ? :)) Outlook ?

No MSFT product ever!

Will I ever recommended Microsoft's products to my clients - Never

Sure, Microsoft has a grip on Enterprise.

Let's see how long that lasts if Windows keeps going downhill.

reply
jacobr1 2 minutes ago
How much does the average knowledge worker actually use desktop apps anymore? At this point I would bet the super-majority of work is done in a browser, and secondarily electron-apps.
reply
delecti 33 minutes ago
> I am still on Windows as some software I need to use aren't on Linux.

Assume a hypothetical future where all that software gets ported to Linux. How much better would Windows have to get for you to keep using it?

I suspect they've done the math and realize that the slow trickle of users leaving would cost too much time and effort to retain.

reply
fragmede 54 minutes ago
> some software I need to use aren't on Linux

Which ones for you?

reply
girvo 45 minutes ago
VALORANT for me is the only game keeping my gaming desktop on Windows
reply
cyanydeez 3 hours ago
Escaping their programming ability, Window's major issue is everything has backwards compability, so they design everything with spaghetti because they have no choice.
reply
AnthonyMouse 2 hours ago
Backwards compatibility was the one thing Windows got right. It was the only real reason to use it.

But backwards compatibility isn't actually that hard if you're not horrendously mismanaged to begin with. You have some ancient miserable APIs from the 1990s that you still have to support, fine, but that's not actually that bad. Old APIs tend to be small because computers were small that far back, you write a compatibility layer and can keep using it. By definition the old stuff never changes so you only have to do it once.

The actual problem is that Microsoft is full of little fiefdoms. Because what they should do, after becoming a huge behemoth with the resources to do it (which has been the case for more than two decades), is to design a set of good, modern APIs, also only once. Something that you're happy to support forever because you took the time to get it right. Then you only have to support that and the little compatibility layer for truly ancient software.

Instead, they have an army of middle managers who are practically at war with each other to show that they can introduce some kind of novel "improvement", the vast majority of which quickly fall out of favor but then have to be supported indefinitely if you don't want to break backwards compatibility. And that makes backwards compatibility a huge ordeal because every year there is more poorly-engineered rubbish you have to support forever.

reply
wtfHN26 2 hours ago
> Escaping their programming ability, Window's major issue is everything has backwards compability, so they design everything with spaghetti because they have no choice.

I do agree with you on this.

But as a consumer that's not my concern.

I am at least a Windows user since three decades, I know my way around the OS and did extensive troubleshooting. What happens to a normal Windows user ?

I have developed habits and workflow on my machine to optimize my time. Now every time I get back to work I am hoping that it works coming out of hibernate.

Is that how a modern OS should be ?

I have a Windows 10 machine that has stopped getting updates. I am satisfied with that.

I consider that Windows 10 machine 'reliable' now that Microsoft isn't breaking things for me.

reply
cyanydeez 28 minutes ago
you may be a consumer, but you're on HN, so you're not the average consumer. That's all they care about.
reply
gkbrk 3 hours ago
Wine has better backwards-compatibility than Windows these days.
reply
genxy 2 hours ago
The Windows Compatibility Layer for Windows will be Wine someday.
reply
omosubi 3 hours ago
what company would be better positioned for this than MS? almost every company out there runs their most important workflows on MS software
reply
theDoug 4 hours ago
I do hope they also use it to that effect.
reply
zurfer 4 hours ago
It looks cool but how can I use it? Somehow i don't want to go hunting for access through the rabbit hole that is Microsofts Corporate blog.
reply
SwellJoe 4 hours ago
All the US companies are keeping their "cyber" models locked down for special customers. So, it seems like anyone who isn't at a Fortune 500 or whatever qualifies for access, will be using Chinese models for vulnerability research.
reply
ronsor 3 hours ago
And the Chinese models are great because they don't nag you
reply
bvttf 4 hours ago
You probably can't, they say they're adding it to MDASH, which is (I think) still in a limited preview: https://www.microsoft.com/en-us/security/blog/2026/05/12/def...
reply
adrian_b 4 hours ago
Yes, it says:

"Sign up to join the private preview"

reply
VCFundedGenYer 41 minutes ago
I've seen it come up in GitHub Copilot as a model.
reply
guessmyname 20 minutes ago
That’s not MDASH, that’s just one of the models that MDASH uses.
reply
superloika 4 hours ago
It's a big club, and you ain't in it!
reply
fallingbananna 4 hours ago
MAI-Code-1-Flash is available via GitHub Copilot.

I wouldn't be surprised if they added MAI-Cyber 1 there too.

reply
guessmyname 19 minutes ago
> MAI-Code-1-Flash is available via GitHub Copilot.

Yes, but the model is not what makes MDASH good, it’s how MDASH was implemented (the harness design).

reply
cbg0 4 hours ago
I would, most of these cybersecurity models have not been made available to the public and the larger models have guardrails in place for certain cybersecurity tasks unless you've been specifically approved.
reply
bonoboTP 3 hours ago
Poking one hole in the walls will always be easier than guarding the entire frontier.

To defend properly, you need either either much more formally mathematically verified layers, or always-on online monitoring and intrusion detection running alongside the service. Like the immune system, or like guarding an empire's borders, since you can't put a guard on every meter of border. But you can detect when someone broke in and deploy your soldiers to respond. Currently we are trying to defend by building really hard walls that we hope cannot be pierced anywhere, which isn't realistic.

reply
eat 4 hours ago
[flagged]
reply
low_tech_punk 4 hours ago
> Three things matter today: Model. Data. Harness.

*knee jerk*

reply
smallmancontrov 4 hours ago
To whoever got rid of the emoji bullet points: if we ever meet, I owe you a beer. Keep up the good work.
reply
testdelacc1 4 hours ago
Guys, I just had a brilliant idea. Hear me out. What if … I wrote the release post of the model with the model itself???
reply
binsquare 4 hours ago
And we can have the model read and train on it too, completing the loop!
reply
cwillu 3 hours ago
It's not just a loop; it's a knot!
reply
walrus01 3 hours ago
Cue the Steve Ballmer "developers developers developers developers" video. Bonus points if extra sweaty.
reply
phoghed 3 hours ago
Author dismayed to find the semicolon find and replace in fact did not trick anyone
reply
drakythe 3 hours ago
I want to sit down with a sales person who doesn't work in tech day to day and see if they can recognize this kinda thing or if its only people looking for it and who have experience in the domain.
reply
cmrdporcupine 4 hours ago
It's bad enough the cringe-word "cyber" being tossed around willy nilly. Now it's robots doing the tossing, in Claude-slop sentences.

(Having lived through the late 90s .com stuff, I can't see the word "cyber" without immediately assuming the person who wrote it is a clueless baby boomer. Unfortunately it seems to have become accepted into the lexicon. I guess by us now-clueless GenXers?)

reply
bigfishrunning 3 hours ago
The government uses the word 'cyber' all over their security documents, and have since the mid-90s. It is indeed very cringe.
reply
eterm 3 hours ago
I think it's kinda cool, it's Gibsonesque, and that usage is old enough now it's rolled from awkwardly dated back to cool, especially now that people no longer tend to talk about "cybersex" and many of the other uses of "cyber".

You've got to call it something, and calling it "cyber" differentiates it from all the other kinds of security. I doubt it means much to talk about "security" to the government, that could as much mean a missile system, but I don't know, that's not my area of work.

To us developers who work with computing all day it feels cringe because the cyber part is implied, and "security" is the differentiator., so you can just talk about working in "security" or "infosec".

Is "cyber" a bit of a relic that dates when the government started taking it seriously? Of course, but I don't know if there is a good alternative that doesn't have other connotations. It probably also acts as a bit of a shibboleth in both directions, "cyber" for those in the government sphere, "infosec" in the commercial.

reply
tigerlily 3 hours ago
I expect the gen xers are using the word in a cynical sense.
reply
Oras 4 hours ago
Take anything from Microsoft with grain of salt. Remember Phi?

They can’t decide on naming their product in Azure, let alone creating something useful or usable

reply
shmed 2 hours ago
Phi was pretty revolutionary for its time. The accompanying paper https://arxiv.org/abs/2306.11644 has been pretty instrumental in pushing the idea of highly curated synthetic dataset to train model. The lead scientist behind Phi-1 is now VP at OpenAI and leading their own synthetic training dataset effort.
reply
vessenes 2 hours ago
Phi was smart (or had a smart training architecture, more precisely), and arguably pushed the conversation forward globally on the value of curated training data.
reply
samuelknight 4 hours ago
Phi was cool for what it was. But it's not 2024 anymore.
reply
tesdinger 3 hours ago
> Decades of building world-class security systems now give us trillions of daily signals across identity, endpoint, cloud, and network

Let's say i use a linux endpoint and some hardware vendor starting with Cisc on the network. Can your product help me or not? I'm pretty sure none of these have been meant by Microsoft..but they fall into this category

reply
jhickok 22 minutes ago
Microsoft's security suite has been available for Linux for a long time, so I would imagine they have a tremendous amount of data. Sentinel connectors have been available for Cisc- since the beginning.
reply
ecshafer 3 hours ago
Azure is the second largest cloud, and run majority linux. So probably.
reply
LorenDB 4 hours ago
Open weights, please? Otherwise Cisco's Antares models are more interesting to me.
reply
lucrbvi 4 hours ago
Seems like MAI models from Microsoft are not going to be open-weight soon, but they are sharing a lot of details in the making of these models, which is a weird position.
reply
tolugenius 4 hours ago
I think the idea is show in-house progress and perhaps position MAI models as the "microsoft office of AI." My take is they might open source models 2-3 release cycles later, given this is supposed to be some new product line.
reply
SwellJoe 4 hours ago
They haven't even released the "big" version of Anteres, yet (and the "big" version is only 3B, so there's no way it's competitive with general purpose frontiers for vulnerability research). It seems like a research project. Maybe it's good for rapid triage and CI usage, but almost certainly not at all useful for general "find bugs" usage.
reply
beyonddream 3 hours ago
I wish they took some time to reflect on how best to name a model. Like, would it make sense to add the model version at the end like every other artifacts labelled in software engineering!
reply
drevil-v2 4 hours ago
This feels like it was written by Claude. I noticed several "it's not x, not y, it's z" claude-isms in the blog post.

And I am 90% sure that Claude design was used to build the website.

reply
debesyla 4 hours ago
It also can be human author, influenced by LLM writing. Though I'm not sure which is worse.
reply
saadn92 4 hours ago
we have a lot of upper management using AI to write their messages now and it's pretty obvious. not sure how I feel about it.
reply
drevil-v2 4 hours ago
> not sure how I feel about it

Same. I feel amused, disgusted and disdain at the same time.

Sprinkle in some irritation that even for a big product launch not a single human in the chain could be bothered to sit down and devote their attention to writing a page on why this product matters and why we should care..

reply
chvid 3 hours ago
How much of this security related stuff is open source? Models, training data, evaluation benchmarks?
reply
lanyard-textile 3 hours ago
The year is 2026.

We invented AGI.

There is a transparent 20px gap above the opaque screen-fixed header.

reply
tty46 3 hours ago
curious-- does anyone have experience with the remediation capabilities of MDASH? they mention it a few times, but the test on CyberGym only gives me pause-- that is only for creating POCs, nothing to do with creating patches.
reply
thallavajhula 4 hours ago
Is it just me or do all the proprietary AI model companies have their blogs styled to have earthy calming tones? This seems like a strategy.

Exhibit A-C

A. https://claude.com/blog B. https://microsoft.ai/news/introducing-mai-cyber-1-flash-insi... C. https://cursor.com/grok

Only OpenAI's blog looks like the WordPress _Twenty Twenty Five_ theme.

reply
caminanteblanco 4 hours ago
The Gemini team uses the standard Google blue and white, which I would have thought Microsoft would be inclined to do as well
reply
udbhavs 4 hours ago
Not surprising considering out of all the things MS is known for, UX consistency is certainly not one of them. They have probably the weakest commitment to a design language across all the big tech cos.
reply
bztzt 3 hours ago
MAI is supposed to have its own design language/brand identity that is unrelated to the overall Microsoft brand. It has its own fonts, logo, colors, etc. The weird thing is that consumer Copilot, which is (or was) developed at MAI (as opposed to business/M365 Copilot which is developed in Redmond and designed based on the regular Microsoft stuff) also has its own design language which is different from the regular Microsoft stuff and different from the MAI stuff.

tbh all of this has always struck me as an ego thing from the MAI team, who are mostly based in Silicon Valley, not Redmond, and think of themselves as too cool for Microsoft

reply
udbhavs 2 hours ago
Wow, no wonder Copilot looked so out of place within the Windows UI. It's not the only core app that blatantly goes against Windows' design language either- Movie Maker and later the built-in video editor in Photos both died for ClipChamp which is some horrible, out-of-place web-based video editor with a mandatory login and feels like it has absolutely no relation to Windows. I'm surprised people from above don't enforce at least basic UI elements that look like they belong to the same product (forget about using the same UI framework across the OS)
reply
andhug 4 hours ago
and it seems this site was generated with ai and then not reviewed before publishing. the layout of the content below the header doesn't really make sense and the "LI X FB" for LinkedIn, X, and Facebook is super unintuitive until you click one - and even after clicking one, i thought it was a collaboration between LinkedIn and Facebook tbh. then the animations are jarring and don't obey my reduced motion system settings, which isnt uncommon but i would expect it from Microsoft. finally, the "Explore all jobs" button at the bottom is just bizarrely designed and animated.
reply
smallmancontrov 4 hours ago
It's better than Corporate Memphis, at least.
reply
eclipticplane 3 hours ago
That's my biggest fear after LLMs can pass the pelican-riding-a-bicycle test... Corporate Memphis art is a half step beyond and there's bound to be a _lot_ of it in their upstream data.
reply
udbhavs 4 hours ago
It's a trend that signals a form of non-chronically-online intellectualism. Feels reminiscent of intellectual slop [1] content on the web that is in vogue

https://www.youtube.com/shorts/dEYvdnwB4MM

reply
sajithdilshan 3 hours ago
I despise that kind of shorts/reels/videos. Like who talks that fast and my brain immediately lose interest and it's obnoxious and unnatural.
reply
danieltk76 3 hours ago
the problem is they are using cybergym, which has been saturated for a few months now.
reply
TheOtherHobbes 3 hours ago
"...talent-dense..."

[wince]

reply
tesdinger 3 hours ago
Does it work on Linux
reply
antondd 4 hours ago
Ignoring my first immediate knee-jerk reaction to the blog and taking it at face value - I do tend to agree with Alex Karp on data becoming the moat for enterprises. Hyperscalers and the like are not different - it makes 0 sense to make swaths of business’s alpha available to potential future competitors. Even if MS and OAI are “friends”. Balkanization of cyber seems inevitable.
reply
bflesch 4 hours ago
I can't even joke about Microsoft, I just feel pity for them. So long at the game and reduced from a dominating software house to slop fabric with no professional honor to deliver a product with certain quality level.

Their cash cow customers are doofuses that decide over government contracts to be wined & dined, their best employees use macbooks, it's a sad shell of what has been.

reply
mherkender 3 hours ago
I think Microsoft is the terminal state of a big tech company. Big tech companies will all eventually carcinize into Microsoft given enough time.
reply
sudo_cowsay 3 hours ago
I love how the discussion here isn't taking ms seriously lol
reply
drakythe 3 hours ago
It is interesting, even the most random LLM model announcement gets plenty of discussion about the merits of the model or others, or the harness, or something. This one has like... 2 comments about the announcement itself and the rest of meta commentary on the announcement being clearly LLM written and availability.
reply
Fitzee_web 3 hours ago
wow rlly nice topic
reply
mawadev 4 hours ago
I love this pretentious design the Ai people use on their websites, its pleasing to the eye
reply
udbhavs 4 hours ago
I've been noticing the uptick of beige + serif fonts + art with rough textures in this space. It feels like an attempt to humanize the technology and make it more palatable to people. Anthropic is the biggest example of this language with its ads and promotions.

Edit: I'm enjoying seeing all the other examples linked in the responses. I decided to make a public Semble collection (https://semble.so/profile/vadhub.bsky.social/collections/3mr...) to track more, feel free to add to this!

reply
threetonesun 3 hours ago
It's very corporate hotel chain lobby restaurant inspired, which probably resonates with the C-suite people signing the checks on this stuff.
reply
bonoboTP 3 hours ago
It's also artisanal coffee, craft beer pub and other hip things.
reply
omosubi 3 hours ago
it will probably be overdone very soon, but it's way better design than most of what's out there.
reply
NicuCalcea 3 hours ago
The Microsoft AI homepage mentions "human" or a variation of it 15 times, including in the tagline.
reply
trollbridge 3 hours ago
It's also the same aesthetic as the Trump Accounts website ( https://trumpaccounts.gov/ ) - the same website where I followed all the signup flows properly but I still can't get it to create accounts for my kids who are otherwise eligible because it has a system error when I sign in, and customer service seems unable to fix it.
reply
rustystump 3 hours ago
Ever seen posthogs website? It is a choice for sure but i swear to god it must have been somehow polluted ai training data because their ux is now getting pooped out more than the purple tailwind of last year.
reply
udbhavs 2 hours ago
Honestly, I'd take this over purple tailwind any day. That style has given me an ick for the color scheme I don't know if I'll ever shake off
reply
rustystump 3 hours ago
Right as i say this they have dropped the bage for a more forestry motif
reply
udbhavs 2 hours ago
What can be more earthy than a forest? Jokes aside it does look like the effort there is a step above pages like this one or other examples linked in thread.
reply
arjie 3 hours ago
I think it's interesting how the superstars of a space dominate the design signal in it. Other parties trying to associate with the space are then forced to participate. The AI lab being a beige background with serif fonts and an abstract image collage with illustrations being a grungy version of Corporate Memphis is 100% downstream of Anthropic dominating the current conversation in the space and therefore Geist design being the dominant design language https://geist.co/work/anthropic

Compare the Open AI and Deepmind pages:

* https://openai.com/index/gpt-5-system-card/

* https://deepmind.google/blog/announcing-google-deepmind/

This is a topic I really enjoy thinking about and I wonder if someone has explored it. It was just before the pandemic when Balenciaga rebranded where it struck me that something crazy had happened. The top fashion houses were taking their brand inspiration from Apple! I was looking at a Rimowa and it looks like an Apple mark. And Balenciaga, and Burberry (before their most recent rebrand)

The flat geometric sans wordmark and product marks wasn't an Apple original but it is definitely given full high-quality luxury status through Apple's adoption. It could just have been an idea whose time had come (Microsoft's Metro etc. existed) but if you look at the iPhone, they were already using the flat sans Myriad font at the time.

Someone more acquainted with design and art will have to tell me if this is real because when I saw it I swear it was like everyone was trying to associate with this language that was popularized by Apple. But maybe they were just copying tech because tech were the top dogs of the age. And now perhaps everyone will copy AI labs which will all copy Anthropic because Anthropic are the big dogs of this age.

Look at it, though! It's striking how much everything looks like it descended from iPhone. People were saying the Balenciaga logo looks like a phone contact!

reply
twalla 2 hours ago
There's a graphic illustrating the typographic homogenization of a bunch of fashion houses in the late 2010s early 20s like you described in the article below. It's come full circle and there's been a return to maximalism and signaling heritage/legacy among some brands. Largely, I think, as a reaction to ever-accelerating trend cycles, planned obsolescence, the cursed nature of millenial targeted d2c brands and especially the looming specter of big tech - all of which have some sort of association with the clean, cool/pastel, sans-serif, minimalist kind of vibe.

https://www.designandpaper.com/they-are-calling-it-a-sans-se...

reply
arjie 2 hours ago
Oh, very neat! I'd noticed the Burberry abandonment of that style and looking far downmarket the Cracker Barrel rebrand to less baroque style failed as well. I hadn't noticed it was so widespread. It's funny. I still like the minimal style but I'm old now so maybe that's how it goes.
reply
ecshafer 3 hours ago
At least Geist looks nice. Corporate Memphis has always been ugly, beyond ugly even, its an insult to aesthetics itself, an insult to all of life.
reply
arjie 2 hours ago
Haha, I agree. I always thought Corporate Memphis people looked extraordinarily fat. The colours chosen to accompany were always rather jarring too. But then again, I won't claim to be much of an artist. My wife was at Figma's conference "Config" and their visual design also looks awfully jarring to me. Scroll to the bottom here: https://config.figma.com/

It seems that others like that though.

reply
stronglikedan 4 hours ago
> its pleasing to the eye

Which is precisely why I've preferred the Solarized Light Theme for years now.

reply
FergusArgyll 3 hours ago
It looks to me very similar to pi - Suleyman's last venture
reply
bonoboTP 2 hours ago
Copycats copy it, then it gets associated with subpar quality then the frontier guys adopt something fresh (or something deliberately currently-very-janky or retro/outdated associated) and the barber's pole of fashion rotates once more.
reply
drakythe 3 hours ago
I really hate the constant use of bold+underlined text in places that are not links. Other underlined text are links, but bold+underlined is just emphasis. Feels like terrible UX, especially since they use it on claims that I would love to see the source of.
reply
twalla 2 hours ago
The whole cycle of aesthetics is about signaling and countersignaling. This whole "look" is also about what it _isn't_ (bright, sterile, sans-serifs, weird corporate memphis purple squiggly people). It's part of the reason all the tech bros won't shut up about "taste" now and Palantir has a storefront with a chore coat drop (someone thought they cooked lol). I don't know how you'd even begin to turn the understanding around contextualizing why something that used to be "in" is "out" or why things like tension/juxtaposition/irony/nostalgia work into something an LLM can grasp. The irony here is that by pushing LLMs in this direction they're just more rigidily codifying the whole aesthetic and giving it a stronger, rancid AI stink which will only bring about the new thing sooner once people see this whole look as the visual equivalent of the em-dash.
reply
sixothree 3 hours ago
Not sure if you're being serious, but it's high time we stop using black text on white backgrounds. Dark mode seems to be solved with charcoal backgrounds instead of flat black. But I'm tired of light mode being black on white. This has got to end and if AI ends it, fine by me.
reply
rebirth01 2 hours ago
[flagged]
reply
luciana1u 2 hours ago
[dead]
reply
neet_dev 2 hours ago
[dead]
reply
nttylock 4 hours ago
[flagged]
reply
pranshuchittora 4 hours ago
WTH is this sloppy UI design
reply
dkeners 4 hours ago
I know... Hovering over Accessibility Mode in the bottom left displays like it is clickable, but alas, only the tiny off button inside the pill is really clickable. I clicked on the text one too many times before realizing it wasn't actually selectable...
reply
solenoid0937 4 hours ago
[flagged]
reply
behole 4 hours ago
[flagged]
reply