Manfred Paul

Security but not as in "national security". Playing CTFs with @redrocket_ctf (and @Sauercl0ud). Pwn2Own Vancouver 2020..=2024\{2023}. @[email protected]

[Manfred Paul @_manfp]

@_0xTen @LiveOverflow @_mixy1 (ofc some might argue "that means those challs won't exist in the long run". but that's just putting the burden on authors too to reject lots of good ideas, spend big money on AI tooling to test, plus the mental burden if "oh it got slopped anyways" happens)

[Manfred Paul @_manfp]

@_0xTen @LiveOverflow @_mixy1 It's not just about the learning, 90% of the challenges being irrelevant is also unsustainable because that means 90% of the challenge author effort is "wasted". High quality challenges have *always* been the bottleneck of CTF.

[Manfred Paul @_manfp]

@gynvael If it's a different game for different people, at least call it something different too?

[Manfred Paul @_manfp]

@LiveOverflow @_mixy1 Some of the most fun CTF challenges I've seen were also the most detached from the real world. Who needs to pwn an apollo guidance computer or analyze minesweeper logic gates? These are "CTFy" because they value fun over practical use, not despite of it.

[Manfred Paul @_manfp]

@LiveOverflow @_mixy1 I do object to the "CTFs are not a 'game'". Sure, they teach valuable skills. But that was never an invitation to see them as a value extraction tool or tie their worth to that. People didn't spend (unpaid) labor of creating challenges or writeups to make shareholders happy

[Manfred Paul @_manfp]

@LiveOverflow @_mixy1 If FIFA allowed robot players, and 99% of accomplished soccer players said "we hate this, this ruins our sport", would we all go "this is just what the the word 'soccer' means now"?
The community gets some say in what the word "CTF" means. And nearly noone there enjoys AI v. AI.

[Manfred Paul @_manfp]

@LiveOverflow @luminaryxd And "flag is flag" has not been the only beautiful (unwritten) principle of CTFs. CTFs are about rewarding deep technical understanding, not outsourcing thinking; being (relatively) accessible to anyone with skills+motivation+time, not requiring investment of money.

[Manfred Paul @_manfp]

@LiveOverflow @luminaryxd I don't think the numbers matter if the community isn't there. The bottleneck was always top players willing to put in the effort to build high-quality challenges for a handful of top tier CTFs, and I feel like motivation is starting to drain fast there.

[TrendAI Zero Day Initiative @thezdi]

CVE-2025-4941 - Trend ZDI analyst @hosselot details the Firefox bug used at #Pwn2Own Berlin by Manfred Paul. Includes root cause analysis and video demo. https://t.co/OEY3e4YEpQ

[Manfred Paul @_manfp]

If you're a security researcher and in Germany, consider signing https://t.co/6x5ajjZSxq . Decriminalizing research might not be the top political priority right now, but it's still important!

[David Mirren @davidmcgeoch9]

More important than ever!!

[Manfred Paul @_manfp]

@ecsc2024 @MITAmalta @MITAmalta, this is not how you build up a cybersecurity community in your country. It was great to see a lot of ECSC players show their support people like @_mixy1 who faced both disqualification and legal action. As the vulnerability research community, we should do the same.

[Manfred Paul @_manfp]

@ecsc2024 @MITAmalta @MITAmalta, this is not how you build up a cybersecurity community in your country. It was great to see a lot of ECSC players show their support people like @_mixy1 who faced both disqualification and legal action. As the vulnerability research community, we should do the same.

[Manfred Paul @_manfp]

Had a great time playing for the German team at @ecsc2024, shout out to the organizers for putting on a really great competition!

[Manfred Paul @_manfp]

@ecsc2024 Only low point though was the lack of a Maltese team, apparently due to @MITAmalta blocking some of the (already qualified) team from coming after they were arrested for responsibly disclosing(!) a vulnerability in a student app in 2022. https://t.co/aWjzs9Md2F

[Tavis Ormandy @taviso]

This strange tweet got >25k retweets. The author sounds confident, and he uses lots of hex and jargon. There are red flags though... like what's up with the DEI stuff, and who says "stack trace dump"? Let's take a closer look... 🧵1/n

[Manfred Paul @_manfp]

@seanhn And while we're making accusations about "being unable to contemplate the wider consequences": There should be a red line there for a reason. It's the same line that says intentional backdoors are not OK. Or that some country you don't like shouldn't be allowed to do the same.

[Manfred Paul @_manfp]

@seanhn I really don't get how that wouldn't be a "executive decision about a counter terrorism operation" then. If you don't want tech company to play on that stage, then them following a consistent rule of "if we learn about a bug, we fix it" is the only way to have that.

[Manfred Paul @_manfp]

@seanhn I'm confused, do you want them to make decisions about the operation (and not just the bugs) or not?