debug

Security engineer, developer and hobbyist reverse engineer in that order. Opinions/rants are all mine and not my employer's.

[John Carmack @ID_AA_Carmack]

I admire Fabrice Bellard. He is almost certainly a better overall programmer than I am.

[Aaron Cannon @AaronLCannon]

I started talking to my co-founder like Claude

[Kevin Carpenter @kejca]

Charlie Munger: "Nowadays, every director at a big company gets $300,000 a year — and everybody thinks we've arranged all this wonderful independence. A man who needs $300,000 extra a year as a director is not independent. The one thing you can guarantee is he'll try and stay a director. I don't think that's an ideal system."

[Alex Matrosov @matrosov]

Follow every Mythos discovery through our coordinated vulnerability disclosure dashboard.

https://t.co/xri3fTpf77

[Jeremy Bernier @jeremybernier]

Meta was easily the most toxic company I've worked for. There's a reason the Chinese call it "Squid Game". Others refer to it as "Hunger Games" or "Lord of the Flies". I think they're all accurate.

The company culture is basically every man/woman for themselves. The performance review process (PSC) not only doesn't incentivize helping others, if anything it actually discourages it since everyone is stack ranked against each other. Imagine working on a team where every 6 months, one of you is going to get axed. Of course it's going to become toxic.

"Bottoms up" culture is a complete farce - it's just a way for leadership to offload accountability. The Tech Leads (TLs) have all the power - owning the relationships and tribal knowledge to gatekeep projects to their buddies. Managers are "people managers" with limited technical understanding, who basically aggregate TL feedback and create performance review packets to calibrate with other managers and IC7+. The takeaway is that your destiny is in the hands of the TLs, and TLs unlike managers have no responsibility for your career. There are no repercussions for unethical behavior. I've seen managers and TLs throw others under the bus and get away with it.

The only mission bonding the company together is individual self-preservation. Save your own ass to survive for another stock vesting, and throw someone else under the bus if you need to. That's why layoffs rarely impact directors/VPs or tenured IC7+ despite the fact that they're paid by far the most. Even this recent mass layoff that was supposed to "flatten" managers layers barely affected directors/VPs/IC7+, and fell predominantly on M1s - the lowest rung of the management chain.

The culture is extremely performative and focused on box ticking and optics. Everything is about PSC (the performance review system) and perception. This means tons of meetings, useless AI slop posts, and top-down initiatives that don't benefit anyone but maybe help tick off the impact box of some go-getter at the top. Impact is not enough - it has to have sufficient complexity. So complexity is added for complexity's sake.

The org I was in (Facebook ads) is 90% Chinese, and the entire leadership chain up to the VP level is Chinese. Mandarin is the primary language at the office, except in official meetings with non-speakers. Chinese work culture is very different from American work culture, with 996 (9am-9pm, 6 days/week), top-down nature, emphasis on saving face (eg. don't question your superiors), and toxicity being quite common. Naturally when an org is completely dominated by a single ethnicity that's notorious for not integrating, elements from their work culture seep in. Of the layoffs I witnessed in this org, 3/4 were not Chinese (just to be clear, most Chinese are very kind so don't take this as an attack. But it is a reality that I think most people outside this company are completely unaware of, and I question if leadership is even aware despite the fact that we're talking about the company HQ)

I had the most toxic manager of my life here. I watched him deliberately set up a new hire to fail, driving them to needing to see a psychiatrist for anxiety + depression, and getting them fired. Then he suddenly disappeared for 8 months, before leaving the company.

I could go on and on, but this is already pretty long and I think you get the point.

Yes there are a lot of great, kind people here. I managed to transfer out of my first team into a new team with a great manager where everyone was very smart, supportive, and hardworking.

But the company has its Squid Game reputation for a reason. Company culture comes from the top. It seems leadership is either too removed to notice, or maybe don't really care anymore because I guess they already made their billions and us plebs are expendable these days.

[debug @0xdbug]

Exploit writing is programming but just not at defined programming language level. It’s just problem solving under very localized constraints where you still keep moving machine forward using primitives you define, then you program those primitives. And that’s just another high.

[Colin Percival @cperciva]

I'm going to plant a flag here: 2026 is going to go down in computer security history as the year of a million CVEs. (Maybe literally, but definitely figuratively.)

LLMs are producing lots of slop, but they're also finding a heck of a lot of real vulnerabilities.

[debug @0xdbug]

Happy pi day you all

[debug @0xdbug]

Comparison between nuclear tech and chip industry is cool. But a big unspoken constraint on nuclear tech is restrictions that govts put aswell. That restriction doesn’t exist for chip and computing. It exists but it’s mostly economic in nature.

[Big Think @bigthink]

Semiconductors 101 | Chris Miller @crmiller1

[Dmitry Vyukov @dvyukov]

syzkaller/syzbot now has AI agentic framework for kernel bug fix generation, bug assessment, security triage, POC generation, etc:
https://t.co/MO6sET6UkG
Includes set of tools to build kernels, navigate/edit source, test reproducers, etc.
Contributions/research are welcome.

[debug @0xdbug]

I would say, childish things like these what makes Bay Area tech bros successful.

[Exec Sum @exec_sum]

NEWS: Sam Altman (OpenAI) and Dario Amodei (Anthropic) refuse to hold hands at the India AI Impact Summit.

[Chris Lattner @clattner_llvm]

One not very hot take - The Claude C Compiler has the best internal architecture docs of any compiler I've ever seen. Far, far, better than any compiler I've ever written, lol :-)

[Halvar Flake @halvarflake]

It's kinda fascinating that you could never get away shipping CPUs nearly as unreliable, but for GPUs it seems it's OK.

Is this also the case for AMD GPUs and TPUs? Or is this just Nvidia building really close to the edge?

[Ryan Dahl @rough__sea]

"The RISC-V port of V8 has come a long way in the last few years. While there is still work to be done, the port is now mostly at feature parity with the officially supported architectures. V8 on RISC-V now runs the full JetStream benchmark suite, which consists of ~33 MB of Wasm bytecode and ~2M lines of JavaScript code – and it is ready for your workloads too." https://t.co/1XzmFqrOb5

[debug @0xdbug]

“Divine benevolence” 😂

[Lior Alexander @LiorOnAI]

One of my favorite from Noam Shazeer (inventor of the Transformer).

"We offer no explanation as to why these architectures seem to work; we attribute their success, as all else, to divine benevolence."

[debug @0xdbug]

This

[Halvar Flake @halvarflake]

The difficulties LLM have when navigating large codebases makes the Unix philosophy of stringing together separate independent command line tools an even more powerful pattern: The individual CLI tools are now very cheap to write.

[Björn Töpel @bjorntopel]

The @risc_v devroom for @fosdem got accepted! \o/ Stay tuned for the CfP!!!

[Colin Percival @cperciva]

If every company using FreeBSD in EC2 spent 0.1% of their EC2 spend on sponsoring FreeBSD, it would barely be noticeable in their budgets but it would be a tremendous boon to FreeBSD development.

Seriously, FreeBSD is free, but is 0.1% an unreasonable amount to ask for?

[debug @0xdbug]

True that P0 brought in a culture of responsibility and accountability across the board in industry.

[Haifei Li @HaifeiLi]

The end of an era.

If you don’t know what Tavis (and the P0) has contributed to and changed the vulnerability research community, let me give you just an example: if not because of Tavis and P0, we’d be still waiting 6 or 12 months to get a Windows or Office bug patched.

[debug @0xdbug]

Really a great talk. I love talks which take you to high philosophical/strategical viewpoint and then sudden deep dive in and then go back at very high level.

[Paul E. McKenney @paulmckrcu]

And my Kernel Recipes talk is now available: https://t.co/BmWRAn41ZG

A big "Thank you!" to everyone involved!