Fredrik Dahlgren

Cryptography and static analysis @trailofbits

[Mark Smith @zorkian]

Excited to share that @discord has shipped E2EE for audio/video + open sourced our protocol (https://t.co/xj8D9Q1IPp) and core library (https://t.co/v1r7XO627w) + third party @trailofbits review (https://t.co/dGnDrCtbfW).

Great work, @birarda and team!

[chrisrohlf @chrisrohlf]

This is a thorough report from @RANDCorporation on historical analogues to inform AI governance. The section on encryption mirrors what I’ve been communicating to policy makers and publicly for over a year now. Like cryptography, AI + cyber is a fundamentally dual use technology. The unique and new challenge with LLMs is that multiple capabilities are enabled by the same model, and so there is no single stakeholder but rather a complex set of equities that must be represented. Any attempt to regulate or otherwise control these capabilities without recognizing this is a clear sign of one’s lack of understanding of this nuance and these historical analogues.

https://t.co/0Qk9plm98Y

[lcamtuf @lcamtuf]

OK, this is the only software license you should use

[Trail of Bits @trailofbits]

Two days ago, @NIST finalized three post-quantum cryptography standards. Today, we are announcing an open-source Rust implementation of one of these standards, SLH-DSA, now available in RustCrypto!
https://t.co/SbBI7h50aP

[i✌️erify @IsMyPhoneHacked]

iVerify Discovers Severe Android Vulnerability Impacting Millions of Devices Around the World. The vulnerability leaves millions of devices susceptible to man-in-the-middle (MITM) attacks and other dangerous malware and spyware.
https://t.co/vwHRFIHAZR

[Frank @jedisct1]

CVE-2024-38063 - Windows TCP/IP Remote Code Execution Vulnerability https://t.co/Qm9Y4xN4Zt

[Ola Spännar @olaspannar]

Ny forskning: om man regelbundet hör andra prata om klimatförändringarna ökar tron på det går att påverka politiken att göra något åt det. Konservativas uppfattning om klimatet särskilt känslig för social påverkan. Så fortsätt snacka klimat!
https://t.co/2QPRcqbRnF

[Dan Guido @dguido]

AIxCC final qualifiers and $2mil prize winners:
42-b3yond-6ug
all_you_need_is_fuzzing_brain
Lacrosse
Shellphish
Team Atlanta
Theori
Trail of Bits

[Jim Miller @TheMijCipher]

A few months back we published an overview of the cryptography services within AWS. Today you can check out our next post in this series which covers the cryptography within the Google Cloud Platform. If you’re using cryptography in the cloud, check out these posts

[cosmic cowgirl 🪩🤠 @blockhim2026]

EVERYBODY SHUT UP the plane they use to fly the horses from all over the world to the Olympics for the equestrian events is called AIR HORSE ONE

[Fredrik Dahlgren @fegge]

@Gilesyb @summer__heidi Yeah yeah but how do I get updates and bug fixes!?

[Fredrik Dahlgren @fegge]

This is a great post on modern alternatives to certificate pinning.

[dina kozlov 🐀 @dinasaur_404]

certificate 👏pinning 👏 is 👏outdated 👏

the "set and forget" mentality is great until you realize that a cert pin from years ago breaks your application during a successful certificate renewal 😰🥴

here are alternatives we recommend you use instead - https://t.co/ZCim0sDbKg

[LaurieWired @lauriewired]

one day this will be part of an elaborate exploit chain

[Patrick McKenzie @patio11]

This sounds like a trivial observation and it isn’t:

No organization which makes its people pay for coffee wants to win.

[Trail of Bits @trailofbits]

We are excited to announce our partnership with the @LinuxFoundation's Post-Quantum Cryptography Alliance (PQCA)! We will further share our ongoing PQC research and engineering efforts and join key industry players helping organizations securely transition to and adopt PQC.