It's official: PEP 675 has been accepted! Once you've got Python 3.11 and a type checker that supports it (Pyre already does ๐), try using LiteralString to make your Python code safer by preventing SQLi and all other kinds of injection attacks:
https://t.co/5oDy3yCnH5
My team is hiring for a unique role, taking the static analysis tools we've developed for security use cases and applying them to solve some of our most pressing privacy needs:
https://t.co/mVmT2AwaVg
DMs are open if you want to learn more!
I'll be presenting "Teaching an old dog new tricks: Reusing security tools in novel domains" at #Enigma2022 in Santa Clara, February 1โ3, 2022. It provides case studies of how security tools like Pysa have been used in non-security applications at Facebook https://t.co/xZF7TAVwmg
If you're curious about how it works, my co author and I will be presenting about LiteralString (and other uses of typing for security) at this year's PyCon:
https://t.co/y80RWP9h2z
It's official: PEP 675 has been accepted! Once you've got Python 3.11 and a type checker that supports it (Pyre already does ๐), try using LiteralString to make your Python code safer by preventing SQLi and all other kinds of injection attacks:
https://t.co/5oDy3yCnH5
Late to the game on this one but I really loved Ryan Pickren's latest writeup on UXSS on Safari. I think he undersells the work involved to get there, but does an excellent job highlighting how far you can get by looking at old protocols, file types, etc: https://t.co/LF26R1yARI
We have a draft PEP up for adding a new Literal[str] type to #Python3:
https://t.co/BdAScqFBBq
When used correctly, this type can prevent all kinds of injection vulnerabilities. We've been experimenting with this at Meta for a while, and are excited to share with the world.
But queries safely built from only string literals will be allowed:
user_id: str
query = f"SELECT * FROM data WHERE user_id = ?"
if limit:
query += " LIMIT 1"
conn.execute(query, user_id) # Type Error!
We are looking for an experienced application security engineer to help build a world where everyone, everywhere has secure access to the worldโs financial system. We have the vibe of a FinTech startup with the perks of a big company. Apply here:
https://t.co/MSqFPwlYm1
Our #PyCon 2021 talk "Unexpected Execution: Wild Ways Code Execution can Occur in Python" is now on YouTube:
https://t.co/dtQHVO5x8J
I guarantee there will be at least one RCE vector in there that you weren't aware of. It also comes with demos:
https://t.co/mpQOCsGqXE
For those attending @pycon (it's too late to sign up!), check out the out the talk @the_st0rm and I are giving on the myriad of APIs that can enable remote code execution in Python: https://t.co/4MHuxktC12
These examples were originally compiled as a part of our work on Pysa.
To go with the #PyConUS2021 talk, we've also got a demo repo with examples of functions that enable code execution in python: https://t.co/mpQOCsGqXE. There's a UI to test exploits against and a machine-readable dump of sinks to feed to your static analyzers (including Pysa ๐ )
The second round of our RFP is now published, with proposals being accepted until July 14!
"Towards Trustworthy Products in AR, VR, Smart Devices".
https://t.co/lTKlvardN8
๐ค Explain Like Iโm 5 ๐ค
In just over a minute, Jessica (@hey_its_jlin) gives an overview of #Pysa, an #OpenSource Python static analysis tool used to detect and prevent security issues in #Python code.
Check it out here: https://t.co/ZMpffpCWSa
https://t.co/BYACUhsStv
A decade of facebook bug bounty. 130,000 reports, 6,900 valid, 11.7million paid out.
An incredible team of folks lead this program now - it started in a basement and with us taking weekly trips to western union to send money orders to fulfill bounties.