collin

[collin @libber]

@frgx @rob__fletcher Yeah I had fun with the examples there but I think most of the roi is deleting code and pruning dependencies

[collin @libber]

As ai accelerates the vuln find/fix cycle everyone remembers we should aspire to fix categories of risk, instead of instances.

Is there a big list of these anywhere? Sandbox, rewrite in rust, delete code, read djbs code etc?

[collin @libber]

@frgx https://t.co/BgPG9b2rj5 I had a long flight :)

[collin @libber]

Tactics to avoid vulnerabilities in the first place: https://t.co/BgPG9b2rj5

Ai has supercharged the vuln find/fix cycle but its also good at all the other things we can do. This is all obvious stuff people do but I hadn't seen written down

[collin @libber]

What does a privacy team do?
https://t.co/PeJZvk8IiB

[collin @libber]

Potentially underexplored effect of ai on computer security: easier to get backdoors into open source software like cve-2024-3094. 100 bots building a year of credibility submitting patches to 100 projects then landing non-obvious backdoor.

[collin @libber]

@0xdabbad00 This is great, thanks! I ran a mini version of this experiment long ago having 8 security consultancies all audit the same codebase. They mostly found the same 70% of vulns. Would love to try something like this at scale for all open source software

[collin @libber]

Has anyone attempted to estimate the totals number of latent, unfounded, security vulns?

We know how many are found each year, we know the denominator (total code and rate of code change)

[collin @libber]

Unfound!

Heart of the question is even with better tools (ai) there is theoretical point where we found all the vulns. Where is that?

I know, I know, this incorrectly assumes we forever freeze all future changes to software,

[collin @libber]

@moyix @kallsyms @SummerC0n This is so cool, don’t steal my ai-found wuftpd 0days!

[collin @libber]

@haroonmeer @caseyjohnellis We need the “security - eternal truths” post/talk. All of us repeating what Dan Geer and Bruce Schneier said

[collin @libber]

The wins of infosec as a field are under discussed, what else goes on this list? https://t.co/3IMIVItRIs

[collin @libber]

@frgx Totally agree. Have you ever done a big program scale “go delete surface area” stuff? I’ve only done it adhoc typically as the result of a point audit or cluster of vulns

[collin @libber]

Golden opportunity to convert this vulnpocalypse hype into properly funding vuln mgmt (the least exciting, often most lacking part of a security program)

This is our chance as an industry!

[collin @libber]

@frgx A flight with no internet + this pleasant nerdsnipe = this long answer: https://t.co/FNCOMvceYc

I'm organizationally sheltered but in a big company the above is what I think ideal looks like

[collin @libber]

@mhlakhani True. This organization wall is just begging to have vulns chucked over it

[collin @libber]

@tqbf + pass them on to your children

[collin @libber]

@ZackKorman @IceSolst Enjoyable writeup. I feel the same way about the paperwork theater of compliance stuff. I felt slightly better when I accepted that security != compliance and just think of it as a different thing https://t.co/qVEb7GDWtT

[collin @libber]

An excellent writeup of what makes data "sensitive" and what that means for security and privacy
https://t.co/CRBjakuYhT