Bailey Basile

[Ivan Krstić @radian]

LIVE: Apple Security Research, our new blog and website at https://t.co/Ssr3471Pju! We launch with an update on Apple Security Bounty (https://t.co/b7aYxqidka), and a deep dive into some fundamental XNU memory safety improvements with kalloc_type (https://t.co/evVdUYYo5p). Enjoy!

[Bailey Basile @BasileBailey]

@sleevi_ @bradfitz @rolandshoemaker For the relevant macOS code: https://t.co/3E33Cbm762

[Bailey Basile @BasileBailey]

@sleevi_ @bradfitz You managed to nerd-snipe me because @rolandshoemaker's explanation did not ring true. Based on the solution and strictness checks I know are in SecCertificateCreate*, I suspect the real problem was an Extensions SEQUENCE of length 0.

[Bailey Basile @BasileBailey]

Just because a root certificate is in the built-in iOS/macOS trust store doesn't mean that it is trusted. Apple applies additional constraints via configuration updates to maintain a high-level of security. See https://t.co/Lhd9OT2p2N for more detail.

[Bailey Basile @BasileBailey]

@sleevi_ I thought we were friends!

[Clint Wilson @clintw_]

New root program policy reqs announced this morning: https://t.co/ONbBJhxOaQ

[POM @hey_pom]

The Security Research Device Program (SRDP) is currently taking applications for its second cohort. This is the last week to apply for an  Apple Security Research Device 🔐📲— apply today!: https://t.co/kgzX6JXoMq

[@0x56@(mastodon.social|cohost.org) @0x56]

my team is growing, would love to hear from you if building and breaking SoCs is your thing https://t.co/R0kJLJe9By

[Jacques Fortier @jacquesgt]

I’m hiring secure OS engineers in Sydney, Australia. If designing kernels, hypervisors, and runtimes to be secure and robust is your kind of thing, please get in touch! https://t.co/GApzuVUVoF

[Bailey Basile @BasileBailey]

@MikhailJennings Generally, SWE at Apple is not remote-friendly; however a substantial portion of Security Engineering is remote. It very much depends on the candidate.

[Bailey Basile @BasileBailey]

Love TLS, X509, Certificate Transparency, or ASN1? Or hate them and want to make them better? My team is looking for engineers! You can apply at the link. DMs also open. https://t.co/ibySyccFuX

[Kate McInnes @kate_mcinnes]

my team work on securing all the new features we ship to our customers. we're recruiting and seeking diverse candidates! check out our job posting or DM me for details! https://t.co/9j93dUSwUG

[Jacques Fortier @jacquesgt]

I’m hiring an engineering manager for the Secure Enclave OS to lead a strong team that sets a higher bar each year for software/hardware security. If you want to help evolve a key security component trusted by a billion users, please reach out! https://t.co/RJkfpDxqyD

[Ricky Mondello @rmondello]

Hi folks! The team I manage at Apple, the Authentication Experience team, is hiring a software engineer. We use empathy-driven development to make using apps and websites that have accounts more humane and safe for everyone. Bay Area role; DMs open for Qs. https://t.co/NYTi7RtkxH

[bfulgham @bfulgham]

Hi folks! My team is recruiting for a Security and Authentication engineer, focused on web-facing features. If you are interested, or know someone who might be, please reach out! https://t.co/gnJdw94Q9f

[Bailey Basile @BasileBailey]

You can test technical enforcement of this updated policy using Seed 1 of iOS 14.6 and macOS 11.4.

[Bailey Basile @BasileBailey]

Reminder to CAs: Apple's CT policy has changed effective 4/21/2021 00:00:00Z. If you're issuing certs with lifetimes greater than 180 days but less than 398 days, you need 3 embedded SCTs, not 2.
https://t.co/WSNGLOT5VO

[Maciej Stachowiak 🇵🇱🇺🇦 @othermaciej]

Ininterested an internship at Apple working on WebKit or related tech?

Some of the areas of opportunity:
- DOM & Web APIs
- Layout & Rendering
- 3D Graphics
- Security & Privacy
- Web dev tools
- Media
- JS VM
- HTTP stack

DM if interested. RTs appreciated.