Evan Sultanik

Ph.D. computer security researcher @TrailOfBits. Editor of and frequent contributor to #pocorgtfo. My CV is a PDF that’s also an NES ROM

[Evan Sultanik @ESultanik]

After 6 months and over 5k new lines of 6502 assembly, the Kaizo-style platforming section of the NES game in my résumé is finally done! Yes, among other things, the PDF of my résumé is also an NES ROM. You can download it here for your emulating pleasure: https://t.co/NBbr5kVhqN

[Moshe Vardi @vardi]

Regarding the Exponential-Time Hypothesis, this is what I wrote a decade ago!

https://t.co/5pDqVjqyYV

[Evan Sultanik @ESultanik]

@halvarflake “The client asked the host to open another port because the server wasn’t responding.”
A computer scientist will interpret that very differently than a restaurateur. An LLM will understand it both ways simultaneously, plus hundreds of other interpretations
https://t.co/qpbycfOCM1

[Evan Sultanik @ESultanik]

@halvarflake Seriously, though, I think it’s largely because LLMs are incapable of ignoring the fact that they have every perspective simultaneously. They have a superabundance of context, so it is difficult to get them to write for a specific audience.

[Evan Sultanik @ESultanik]

@alanthefisher I supercommuted from Philly to DC while Biden was VP. The secret service wouldn't even cordon off a whole car for him; he and his entourage would only get half a car. I and a dozen other random riders got to share a car with the VP on Amtrak Force Two.

[Evan Sultanik @ESultanik]

@antoniogm

[Trail of Bits @trailofbits]

We beat Google's quantum circuit again, and we didn't have to forge a proof this time.

Today we're releasing trailmix, a toolkit for quantum "kickmix" circuits. It includes 5 new circuits we built for elliptic curve addition, the hardest part of Shor's algorithm.

[Evan Sultanik @ESultanik]

@JSyversen @aarondotrb I'm a proponent of AI development, but I think the analogy with compilers is flawed: https://t.co/wThZhxUryv

[Evan Sultanik @ESultanik]

@me_jango Confirmed!

[Evan Sultanik @ESultanik]

@robertgraham I chose to leave the terminal, go upstairs to departures, and do security at a normal checkpoint. There was no wait. My connecting flight was sold out but took off 70% full.

[Evan Sultanik @ESultanik]

@robertgraham I transited at MIA this morning. The TSA checkpoint they feed all of the international arrivals through for domestic connections had a 1+ hour wait. The people doing crowd control (who looked like contractors) insisted the wait was just as long everywhere.

[Josh Lemon @joshlemon]

Memory Analysis for #Linux has always been a bit hit-or-miss. @trailofbits has released a tool called #mquire that doesn't require debug symbols for the originating Kernel.

#MemoryForensics #IncidentResponse #DFIR #DigitalForensics

[Evan Sultanik @ESultanik]

@DominicJPino New York already has the largest citywide heating system in the world: https://t.co/gT6XF1ZYja

[Evan Sultanik @ESultanik]

@pitdesi In other words: If you live anywhere in the East besides DC or Northern NJ, you'd only ever fly United if you're going to a United hub or one of their codeshares' hubs, like Tokyo.

[Evan Sultanik @ESultanik]

@pitdesi In 2024, CUN had ~8.5x more US travelers than TYO. The only East Coast airports with direct flights to CUN operated by UA are EWR and IAD, both of which also have direct flights to TYO. If you are traveling from a DL/AA hub like PHL/JFK/MIA/BOS/ATL to CUN, you'd never fly UA.

[Evan Sultanik @ESultanik]

This made me mirken until I realized the "i" and "e" were swapped.

[The OED @OED]

OED #WordOfTheDay: mirken, v.
Shetland. To become dark and gloomy; to grow murky.

View the entry: https://t.co/MzjxzdIoHU

[BSides Berlin @SidesBer]

#BSidesBerlin Speaker Showcase
@kiki_morozova explores Weaponizing Image Scaling Against Production AI Systems.

@SecurityBSides #AI #Infosec

[Trail of Bits @trailofbits]

Solving the Traveling Salesman Problem for NYC's 474-station subway network, obviously! @ESultanik used Christofides algorithm to find a 20h 42min route through all 474 stations, which would beat the world record by 45 minutes. https://t.co/9lSYIBNntW

[Suha @suhackerr]

New post and tool! Attackers can break production AI systems by using image scaling to hide multi-modal prompt injections from users.

🧵for more info on what broke, how this works, and our new tool to try this out yourself

[Evan Sultanik @ESultanik]

@fluffypony @VikParuchuri PS is a fully fledged programming language, which makes it even harder than PDF. You can have functions that programmatically render text; you’d have to emulate them. Fonts are often also either rasterized or vectorized, sometimes losing the original strings.