Marios Pomonis

Systems security guy at Google. Opinions are my own.
Former PhD student at Columbia University.

[Marios Pomonis @mariospomonis]

@kornaropoulos @GeorgeMasonU @encryptedGMU Congrats Evgenie!

[Davide Balzarotti @balzarot]

Academic Fraud in Computer Architecture conferences (and more) to accept each other papers and leak the reviewers names:
https://t.co/6UFQFCaAx1

[Marios Pomonis @mariospomonis]

@nick_roessler This treats the issue as the cause, but it's also a symptom. At some point people should also investigate why certain individuals are unwanted as reviewers and potentially avoid calling them to future PCs.

[Drew Something @drewclemcr8]

I was just let go from my position.

I have a pregnant wife who will now be without medical coverage and an 18 month old daughter without coverage as well.

https://t.co/58SLbHI15l
https://t.co/OjXdOZ27eU

I have references and resumes available. Hire me, please.

[David Sinclair @davidasinclair]

Since my Harvard lab closed yesterday, I've been reading and interpreting this week's published papers on #COVID19. What follows is a thread of information, my interpretation, links to sources & predictions. Let's start with what you need to know... #coronavirus #COVIDー19

[NexUS 🇺🇸 Software Developers ⭐️⭐️⭐️⭐️⭐️ @NexWebSites]

#CyberSecurity
👇
How to Prevent Code Reuse Attacks On Modern Operating Systems

🔗https://t.co/JKanCDAPQH

By @mariospomonis

#Programmers #programming #Linux

[Marios Pomonis @mariospomonis]

@nick_roessler I did some work with MPX for my PhD. Even though it was a flawed solution for the problem it was designed (generic memory safety), I was really happy with it when employed for other memory protection schemes. Sad to see it go away.

[Andrey Konovalov @andreyknvl]

A collection of Linux kernel KASLR bypasses made by @_bcoles https://t.co/p87lln1IFk

[Vasileios Kemerlis @vkemerlis]

Network I/O that bypasses main memory and talks directly with the CPU cache(s)...What could go wrong? :)

[Tavis Ormandy @taviso]

I'm publishing some 🔥 research today, a major design flaw in Windows that's existed for almost *two decades*. I wrote a blog post on the story of the discovery all the way through to exploitation.
https://t.co/1DFW2VGQRb

[Marios Pomonis @mariospomonis]

Excellent work and write-up:

https://t.co/yxBcwBgK6Q

[donnie piercey ⚾ @mrpiercEy]

The entire Apollo 11 computer code is available on @github, and it's incredible:

https://t.co/LINkpXBdQ6

#edchat #apollo11

[Thorsten Holz @thorstenholz]

There will be an artifact evaluation committee (AEC) at @USENIXSecurity 2020, read more about the plan at https://t.co/RNTVpbkB7I. The timeline is explained at https://t.co/Zj1bzyc1o4

[Marios Pomonis @mariospomonis]

Good job getting rid of those magic numbers dude. Good job. :P

[Nico Waisman @nicowaisman]

😱

[Jonathan Leitschuh - [email protected] @JLLeitschuh]

This is my #ZeroDay #PublicDisclosure of a security vulnerability impacting 4+ Million of @zoom_us's users who have the Zoom Client installed on Mac.

Zoom had 90-days + two weeks to resolve this #vulnerability and failed to do so.

https://t.co/hvsoS79bos

[Marios Pomonis @mariospomonis]

@TitusWinters @samth @dimvar Well, most interviews mostly examine if candidates can come up with solutions that have the lowest Big-O complexity, so it makes sense for new grads to think that this is what the company values. Also universities are focused more on providing interview skills than job skills.

[Titus Winters @TitusWinters]

Attention CSEd Twitter: While Big-O matters, the constant-factors involved in things like cache-hit rate are at least as important. If you're teaching balanced-binary-trees for any reason other than tradition, I'd love to chat.

[Phil Parker @parker0phil]

In 11 lines of code we have:

- SQL Injection
- Incorrect Storage (Passwords)
- Insufficient Session ID ("true" 😭)
- Insufficient Cookie Security (HttpCookie defaults secure and http only to false)

If this is the state of education is it a surprise security is a problem?! 😖

[Marios Pomonis @mariospomonis]

@lcyqn It could be your advisor, it could be a senior student or postdoc in your university, it could be someone from a different university, it could be someone in industry etc. It doesn't really matter. Research is significantly more of a teamwork effort than most people believe.

[Marios Pomonis @mariospomonis]

@lcyqn The most important advice for me is to actively look for people to collaborate with. Try to find one person (or more) with whom you have good understanding and share similar ideas about how research should be contacted (+ have similar interests).