Alexandro Sanchez

Security, reversing, mathematics.
Writing emulators and hypervisors in 🇦🇩.

[Alexandro Sanchez @AlexAltea]

@ringo_ring That was definitely an AI-generated apology. Ironic and frustrating, considering your project was likely key for its training data.

[Alexandro Sanchez @AlexAltea]

@landaire Good point that's actually genius. Would be very interesting to have agents crawl vulns/patches, group and create queries for them. With a massive query DB, hit all OSS repos and have agents triage matches.

[Alexandro Sanchez @AlexAltea]

@landaire That said, all that may be true and still be a terrible acquisition.

[Alexandro Sanchez @AlexAltea]

@landaire AIs still need tools to efficiently query data while saving on tokens. CodeQL provides this, right?

Just like AI can reverse assembly snippets, but on large projects is more effective paired with Ghidra/IDA to inspect xrefs, CFGs or reason over decompiled pseudocode.

[Alexandro Sanchez @AlexAltea]

It is, when easily available in manifests/DLLs, but static vendored dependencies in binaries with stripped symbols are often overlooked.

Gets worse as layers increase, e.g. app depending on libA -> libB -> libC. A vuln in libC requires up to 4 independent parties to fix, though those hellish scenarios occur usually in langs with easy dependency management.

Agreed with OP on vendoring. Langs with hard dep management incentivize vendoring, which in turn disincentivizes dep bloat, and reduces exposure to vulns.

[Alexandro Sanchez @AlexAltea]

@SamoBurja You need determinism at some layer; even the models need it. Can't have turtles/AI all the way down.

[Alexandro Sanchez @AlexAltea]

@calvinfroedge @Laeeth We can largely solve that, e.g. C2PA. The question is which incentives are stopping us from making such tech widely available.

[Alexandro Sanchez @AlexAltea]

@never_released Nice, IIRC VMware heavily relies on this too, but I did not expect it here.

[Alexandro Sanchez @AlexAltea]

@AAGresearch @modernfintech Yeah, Ginza 41 at Escaldes

[Alexandro Sanchez @AlexAltea]

@Laeeth Just curious, why is that?

[Alexandro Sanchez @AlexAltea]

Probably no special meaning. In such moments (sometimes very brief), the brain send unable to "fix" the magnitude of any dimension of a mental image (in extreme cases, real life objects too).

Objects feel simultaneously large/small, close/afar, full/empty, bright/dark, loud/silent, etc.

This "jitter" induces discomfort. Not sure what causes it. For me, it's a bad fever. For some, drugs. Not terrible but still pathological, as if some function is "degraded".

[Alexandro Sanchez @AlexAltea]

@zephyr_z9 @styropyro_ Thoughts on this?

[Alexandro Sanchez @AlexAltea]

@the_geeko1 Incredible work, congratulations!

[Alexandro Sanchez @AlexAltea]

@foley2k2 @unix_byte That would very quickly exhaust the TLB. Also, while slightly less wasteful, you would need to dedicate more memory to page table entries. Many trade offs, but 4~16 KiB seems indeed the sweet spot.

[Alexandro Sanchez @AlexAltea]

@FuzzySec @FFmpeg Why are those the only two options? Legal requirement? Some contractual guarantee in @FFmpeg's license? Genuinely curious.

[Alexandro Sanchez @AlexAltea]

"Have a responsibility"? Haven't you read the NO WARRANTY section of LGPL v2.1? https://t.co/3MIyQZIXuF

The current ffmpeg team out of good will chooses to act promptly and fix vulnerabilities, but that's not a requirement. If you run a business around it and host (say) customer PII, *you* are liable. Not a take, just law.

[Alexandro Sanchez @AlexAltea]

If you consider it "Linux", GrapheneOS seems (for now) the closest we'll get to the year of Linux on phones.

Any non-AOSP Linux alternative will struggle with adoption because of heterogeneous hardware/libraries and lacking ecosystem (apps).

We wouldn't have a major privacy-oriented browser like Brave if @BrendanEich built outside Chromium. For the same reasons, OSS phone distros need AOSP.

[Alexandro Sanchez @AlexAltea]

@JoaoQueiros13 @PSAndorra https://t.co/oEjGfNLV7b

[Alexandro Sanchez @AlexAltea]

@PetrBenes @komercka If enough people change their scribble "signatures" to dicks, maybe it would finally sink in that they are a joke, just like the banks/governments requiring them.

[Alexandro Sanchez @AlexAltea]

@RichDevX @AbkarinoMHM @notnotzecoxao I owe my career and company to that Skype group. 🫡