Sam Freedman

✝️. Securing things at 

[Swift Language @SwiftLang]

Memory-safe. 13% faster on average. ⚡️ The TrueType hinting interpreter in macOS and iOS has been rewritten in Swift, replacing the original C implementation. Pixel-perfect accuracy was validated across 27 million glyphs. And the results: https://t.co/OcpinM33OX

[Tim Cook @tim_cook]

We are deeply saddened by the loss of David Hockney, a visionary and friend to Apple. David showed that creativity has no limits, turning iPad into a canvas for some of the most vibrant art of our time. His legacy will inspire us all to see the world a little more beautifully.

[Mitchell Hashimoto @mitchellh]

I've got an agent in a loop optimizing a renderer with the goal to minimize frame times (and tests to measure). It got times down from 88ms to 2ms and allocations down from ~150K to 500. Sounds good, right? Wrong. This is exactly why agent psychosis is a big fucking problem.

As an experiment, I rewrote the Ghostty core render state in Go, with access to identically laid out data structures as Ghostty and the exact same validation tests. I made a purposely naive renderer (simple, correct, but slow). 88ms per frame with 150,000 allocations (horrendous, lol)!

I then kickstarted a Ralph loop to bring the frame times down. I told it it can't modify input data structures or the public API or tests (they're correct), but it can do anything else it wants. It got to work.

It has worked for about 4 hours. I've spent around $350 on this experiment so far. The results?

88ms => 1.5ms
150K allocs => ~500 allocs

Incredible right? Nope.

My hand-written renderer I ported has frame times (same benchmark) of ~20us (0.020ms) and 0 allocations in the update path.

This is the problem with psychosis and lacking systems understanding. If you don't understand the system, you're going to accept that this is an incredible result. If you understand the system, you'll see better solutions immediately and can do roughly 75x better on throughput.

The people who blindly trust agent output are in the former camp. They're sheeple, overdrinking from a fountain of mediocrity.

Standard disclaimer: I use AI all the time. I like AI. The point I'm making is to not blindly accept results. Think. Analyze. Learn.

[Ivan Krstić @radian]

🔺NEW: Formally verified post-quantum ML-KEM and ML-DSA in corecrypto, with correctness proven from the FIPS spec down to hand-optimized ARM64 assembly — a world first at multi-billion device scale. And we're releasing our Isabelle libraries, ARM64 model, and Cryptol-to-Isabelle translator to advance the state of the art in verified cryptography! https://t.co/LZPHFD0ifE

[Cloudflare @Cloudflare]

Cloudflare's security team spent the last few weeks testing Anthropic's Mythos against fifty of our own repositories. What we learned about offensive AI, why faster patching is the wrong reaction, and what the architecture around vulnerabilities has to look like next. https://t.co/RSrRtIhgaV

[Dan Guido @dguido]

Ever doing something sketchy and need a sandbox fast? Try the new @trailofbits skill: devcontainer-setup
> Create pre-configured devcontainers with Claude Code and language-specific tooling.
https://t.co/dkv4Mwvqos

[Sam Freedman @_samfreedman]

Security friends! Come and hear more about Apple’s memory safety and security engineering efforts, and how your apps can benefit from them. See you there.

[Ivan Krstić @radian]

🔺New security-focused developer event on March 5 at Apple Park: featuring sessions on Memory Integrity Enforcement, new tools in Enhanced Security in Xcode, Apple’s defensive security engineering approach, Swift adoption in security-sensitive code, and how to apply all these techniques to protect apps. Sign up: https://t.co/RBLfFQR6zQ

[CIX 🦾 @cixliv]

Using a mocap suit to kick yourself in the balls with a robot is a great metaphor to close out 2025.

[Ivan Krstić @radian]

🔺This is the first talk I've given in 6 years – featuring formal verification of post-quantum cryptography, the evolution of the Secure Page Table Monitor, a view into Memory Integrity Enforcement, updates to Apple Security Bounty… and a personal note.

[Thomas H. Ptacek @tqbf]

A bunch of very smart security nerds (and, along for the ride, me) are standing up a conference about AI/security (the intersection of those ideas, not just the security of AI).

https://t.co/R82QCfJZTe

[Gergely Orosz @GergelyOrosz]

Unpopular opinion:

Current code review tools just don’t make much sense for AI-generated code

When reviewing code I really want to know:

- The prompt made by the dev
- What corrections the other dev made to the code
- Clear marking of code AI-generated not changed by a human

[Liz "blue tick" Carr @thelizcarr]

Campaigners for assisted suicide are fond of telling us it has "massive public support"

I disagree & in my experience as an opponent of assisted suicide, the more people learn about the subject, the less they support it

Have a look at my BBC documentary:
https://t.co/KOoAi5mFz7

[Sam Freedman @_samfreedman]

I haven’t read more than what’s on the cover but I’m excited for this. Security gets a bad rep for adding friction into the development cycle - where often the path to success is removing it.

(Mind you, a bit of “soft” friction can be used to nudge people in a safer direction)

[dr. nicole forsgren @nicolefv]

Today's the day! 🎉 Frictionless, coauthored w/@abinoda, helps you
* Make the biz case for DevEx
* Measure what actually matters (esp w/ AI in the mix)
* Navigate org politics & exec comms
* Implement change that sticks

https://t.co/476HaUYAKo

[Dino A. Dai Zovi @dinodaizovi]

If you dig into this a little bit, I think it's really a story about the OSS core of this feature (libxslt/libxml2) not meeting the memory safety security requirements of the modern web browsers that used them. Rather than replace them, they deprecated functionality across web.

[Matt Sanford @__sanch__]

My team at Apple is hiring a software engineer! What might you be doing on this team? Building the future of software development at Apple. Prototyping cutting edge tooling with the latest advancements in AI. Becoming an expert in how Apple builds software
https://t.co/jIffa2vyVS

[Simon Willison @simonw]

Geoffrey drops a new analogy for working with AI that I really like; you're the surgeon, the AI tools are your team of surgical assistants

[Pietro Borrello @borrello_pietro]

Are you interested in bleeding-edge microarchitecture offensive security research, with a concrete impact on user security?
We have just opened a Microarchitecture Security Internship position at Apple, in SEAR LASER! ❤️‍🔥

Apply here: https://t.co/al2STgp3tL

[Simon Willison @simonw]

"if the agent ingests anything, then it's permissions should be dropped to the level of the author of that information"

I like that lot, it's a very succinct way of explaining the problem here

Anyone who can author text that gets into your agent can control what that agent does next

[Hexacon @hexacon_fr]

We’re thrilled and honored to reveal our second keynote speaker: Ivan Krstić (@radian)
Any guesses what he might talk about? 😉

[Eric Kapitanski @EricKapitanski]

Dutch Waterfall scans coming out of the Netherlands, how you can tell over 1,400 IPs are working together, and novel temporal fingerprinting/visualization for scan traffic!

My PhD research.

https://t.co/LAgY61KFTp