Graham Bleaney

Security Engineering Manager @meta, leading a team scaling the detection and prevention of web vulnerabilities

[Graham Bleaney @GrahamBleaney]

It's official: PEP 675 has been accepted! Once you've got Python 3.11 and a type checker that supports it (Pyre already does 🙂), try using LiteralString to make your Python code safer by preventing SQLi and all other kinds of injection attacks:
https://t.co/5oDy3yCnH5

[Graham Bleaney @GrahamBleaney]

My team is hiring for a unique role, taking the static analysis tools we've developed for security use cases and applying them to solve some of our most pressing privacy needs:
https://t.co/mVmT2AwaVg
DMs are open if you want to learn more!

[Graham Bleaney @GrahamBleaney]

Recording of my #Enigma2022 talk is now live: https://t.co/jBCIVlsB7q

[Graham Bleaney @GrahamBleaney]

I'll be presenting "Teaching an old dog new tricks: Reusing security tools in novel domains" at #Enigma2022 in Santa Clara, February 1–3, 2022. It provides case studies of how security tools like Pysa have been used in non-security applications at Facebook https://t.co/xZF7TAVwmg

[Graham Bleaney @GrahamBleaney]

If you're curious about how it works, my co author and I will be presenting about LiteralString (and other uses of typing for security) at this year's PyCon:
https://t.co/y80RWP9h2z

[Graham Bleaney @GrahamBleaney]

It's official: PEP 675 has been accepted! Once you've got Python 3.11 and a type checker that supports it (Pyre already does 🙂), try using LiteralString to make your Python code safer by preventing SQLi and all other kinds of injection attacks:
https://t.co/5oDy3yCnH5

[Graham Bleaney @GrahamBleaney]

@dmz Excellent summary of the talk! Thanks for live tweeting it.

[Graham Bleaney @GrahamBleaney]

Late to the game on this one but I really loved Ryan Pickren's latest writeup on UXSS on Safari. I think he undersells the work involved to get there, but does an excellent job highlighting how far you can get by looking at old protocols, file types, etc: https://t.co/LF26R1yARI

[Graham Bleaney @GrahamBleaney]

This functionality is already supported in Pyre if you want to try it:
https://t.co/dyLAPtRchh

Feedback on the PEP would be greatly appreciated!

[Graham Bleaney @GrahamBleaney]

We have a draft PEP up for adding a new Literal[str] type to #Python3:
https://t.co/BdAScqFBBq
When used correctly, this type can prevent all kinds of injection vulnerabilities. We've been experimenting with this at Meta for a while, and are excited to share with the world.

[Graham Bleaney @GrahamBleaney]

But queries safely built from only string literals will be allowed:

user_id: str
query = f"SELECT * FROM data WHERE user_id = ?"
if limit:
query += " LIMIT 1"
conn.execute(query, user_id) # Type Error!

[Graham Bleaney @GrahamBleaney]

@Samm0uda Sent you a potential option in your DMs

[Oren Hafif @OrenHafif]

We are looking for an experienced application security engineer to help build a world where everyone, everywhere has secure access to the world’s financial system. We have the vibe of a FinTech startup with the perks of a big company. Apply here:
https://t.co/MSqFPwlYm1

[Graham Bleaney @GrahamBleaney]

Our #PyCon 2021 talk "Unexpected Execution: Wild Ways Code Execution can Occur in Python" is now on YouTube:
https://t.co/dtQHVO5x8J
I guarantee there will be at least one RCE vector in there that you weren't aware of. It also comes with demos:
https://t.co/mpQOCsGqXE

[Graham Bleaney @GrahamBleaney]

For those attending @pycon (it's too late to sign up!), check out the out the talk @the_st0rm and I are giving on the myriad of APIs that can enable remote code execution in Python: https://t.co/4MHuxktC12

These examples were originally compiled as a part of our work on Pysa.

[Graham Bleaney @GrahamBleaney]

To go with the #PyConUS2021 talk, we've also got a demo repo with examples of functions that enable code execution in python: https://t.co/mpQOCsGqXE. There's a UI to test exploits against and a machine-readable dump of sinks to feed to your static analyzers (including Pysa 😀 )

[[email protected] @NAKsecurity]

The second round of our RFP is now published, with proposals being accepted until July 14!

"Towards Trustworthy Products in AR, VR, Smart Devices".

https://t.co/lTKlvardN8

[Meta Open Source @MetaOpenSource]

🤔 Explain Like I’m 5 🤔

In just over a minute, Jessica (@hey_its_jlin) gives an overview of #Pysa, an #OpenSource Python static analysis tool used to detect and prevent security issues in #Python code.

Check it out here: https://t.co/ZMpffpCWSa

[collin @libber]

https://t.co/BYACUhsStv

A decade of facebook bug bounty. 130,000 reports, 6,900 valid, 11.7million paid out.

An incredible team of folks lead this program now - it started in a basement and with us taking weekly trips to western union to send money orders to fulfill bounties.