Tyler

views are my own
RT ≠ endorsement

[martin_casado @martin_casado]

On harnesses, I vacillate between three beliefs:

- the less harness, the better. Models are the magic
- post training a model and harness is dramatically better and the model providers win
- harnesses have real independent value from the model

I have no idea which is right.

[@jason @Jason]

It’s about to get very strange folks.

[Zack Korman @ZackKorman]

The “delay Mythos so cybersecurity can prepare” crowd believes companies proactively invest in cybersecurity to defend against future threats.

You sweet summer child.

[Tejas Kumar @TejasKumar_]

Apple has become a true disgrace.

[Grant Slatton @GrantSlatton]

The junior dev asked the senior dev “why are you pushing this code with no abstraction? What if you want to change it in the future?”

The senior dev responded “then I will change it in the future”

In that moment the junior dev was enlightened

[is-eqv.bsky.social @is_eqv]

@robertswiecki @mboehme_ I think there's still tons of work to do in harnessing complex targets E2E. Automatically extracting unit-test style harnesses for individual functions from a E2E, whole-process harness (think chrome, acrobat etc) would be a huge improvement and likely won't require ML/solvers

[Marcel Böhme👨‍🔬 @mboehme_]

@is_eqv @dvyukov Great point and Nyx-Net is an amazing work! When your input is a sequence of things, in order to maximize execs/sec you probably reduce the length of your sequences at the cost of missing interesting states reached only via long sequences.
1/2

[Tyler @cvediver]

So much for staged rollouts…

[Phoronix @phoronix]

GNU Debugger GDB 15.1 Brings Better Python Support

https://t.co/ZbZUzV2rSO

[Tyler @cvediver]

@jvanegue @TechAtBloomberg DM me (your DMs are closed)

[Tyler @cvediver]

The fact that @Starbucks has this sign but no paper towels has bothered me for years

[is-eqv.bsky.social @is_eqv]

https://t.co/CfDpw041Q2 <- cool paper on snapshot fuzzing! TL;DR: "taint trace how the input is used, snapshot at the point where it actually affects things". I think placing snapshots deeper in the code is how we automatically get "libfuzzer-perf" on "Nyx-complexity"-targets.

[Tyler @cvediver]

@seanhn @bas_van_schaik This was the idea behind @cetfor's PaperMachete, which is a pretty cool POC. I think that newer features in binja and performance improvements in the graph database could really help build on the approach

[Khaled Yakdan @KhaledYakdan]

Speaking of making #fuzzing more effective, we've extended #jazzer's API to give the fuzzer new signals depending on the program state. @fhenneke created an example showing how this helps #jazzer to solve the maze game discussed in the #IJON paper. GitHub: https://t.co/Wcklg1ELj8

[Trail of Bits @trailofbits]

Our software engineer Boyan Milanov introduces Maat, a low-level symbolic execution framework based on Ghidra's IR language p-code. https://t.co/u6nPD3SJvi

[Brandon Falk @gamozolabs]

Y'all should be striving to fuzz the binaries you run in prod, not some random cut out function in a hot loop without the rest of the system. Snapshot fuzzing is kind of the only way.

[Tyler @cvediver]

Now @Fidelity is asking for full account password over the phone using the numpad and symbols as stars. Best-case scenario is massively reduced search space for bruteforcing passwords in the event of a breach. What about phone auth is so challenging?

[Tyler @cvediver]

Criticizing @united's flagrant disregard for information security best practices https://t.co/XAbXZ1uiIG

[Tyler @cvediver]

@attrc @BSaltaformaggio @moyix @pagabuc OG from Georgia Tech https://t.co/t1SdMDSQKl

[Tyler @cvediver]

Since “Real ID” is trending, I thought I’d share something that has always amused me: the only documentation difference required for a Real ID vs a standard ID can essentially be “privilege escalated” by getting the standard ID and using the standard ID to get the Real ID.

[Tyler @cvediver]

@creaturebeer Boston