Nasko Oskov

Security geek with his own views and opinions. Hacking on Chromium to make it more secure, increasing the cost for attackers.

@[email protected]

[Nasko Oskov @nasko]

@AdamsBunnyranch Chrome has not been the highest bidder on the market, so this is not changed.

[Nasko Oskov @nasko]

We just published an update to the Chrome VRP. Blog post is at https://t.co/SF4sW5ncxZ. The gist: we are restructuring based on the AI advancements to allow for more automated triage and easier to predict payment amounts.

[Nasko Oskov @nasko]

Making inroads into memory safety, one step at a time - https://t.co/XH9XD9YqAM

[Nasko Oskov @nasko]

We are looking for an Android security expert to join our team and work on securing Chrome on Andoird. Job posting is available at https://t.co/QFXfQnQpTD, but also feel free to reach out to me directly.

[Adrian Taylor @adehohum]

2024Q3 update from @googlechrome security: https://t.co/obgar6wF7Z

[Natalie Silvanovich @natashenka]

On DAV1D and fuzzing https://t.co/zLlYbGkMRt

[Nasko Oskov @nasko]

Great post by @quidity on attacks and mitigations.

[Nasko Oskov @nasko]

@jduck @amyexp Have you tried maybe doing the same with "Rust" as the search term? Grepping for just one specific term might not reveal the full picture.

[Nasko Oskov @nasko]

@jduck @argvee @ivansprundel We would all love to have protections! We can't always have them. Mitigations which increase attacker cost or significantly decrease probability of successful exploitation are worthwhile deploying when you don't have luxury of rewriting all the code in reasonable time.

[Nasko Oskov @nasko]

@jduck @argvee @ivansprundel If a JS engine security bug is in the JIT code it produces, what difference does it make what language the engine is written in?

Entire process written in memory safe language is an awesome goal, but with millions lines of code, it does not happen overnight.

[Nasko Oskov @nasko]

@jduck @amyexp Just because press rooms have more time and incentive to write about the bugs than engineers have time to write about their work, does not mean it is not happening. Have you seen our quarterly updates? https://t.co/SgDU1J5oYq

[Nasko Oskov @nasko]

@jduck @amyexp Are you suggesting that our VRP is the only security strategy we have in our arsenal? I wonder what gives the impression that we aren't serious about security. Happy to chat more if you are up for a constructive conversation.

[Google VRP (Google Bug Hunters) @GoogleVRP]

📢 Chrome VRP reward updates! 💰 Bigger payouts (up to 5x higher, $250,000+) and clearer guidelines, all designed to incentivize high-quality Chrome security research. Let's work together to make Chrome even safer! 🔐

https://t.co/40Jz6ZFAMf

[Nasko Oskov @nasko]

@CrispinCowan0 @PittaMan @davetamasi @adamshostack @osterman @selfissued @reybango @tanawts @vincentzimmer @rmhrisk @FritzSands @dhw @datSecuritychic @m3ch3l3 @m0thran @pongolyn @VirtualChrista @koronkowy @jerickso @jaybeale Darn it, I won't be around at that time 😞 one of these days I'll be able to make it.

[Ryan Hurst @rmhrisk]

This morning, I read about Satya Nadella’s latest memo, which emphasizes Microsoft’s new priority: security above all. The memo introduces a policy linking senior leadership compensation to the achievement of "security plans and milestones." I see this as a commendable step forward for Microsoft but more will be needed if they are to get back to being a security leader. Some thoughts here: https://t.co/JjgfJGlI5B

[emily freeman @editingemily]

Unpopular opinion: companies doing an about-face to focus only on AI while abandoning existing products will regret that decision.

[Adrian Taylor @adehohum]

Here's what we've been doing in @googlechrome security in the first three months of this year: https://t.co/Rl4PaXkPQz

[Will Harris @parityzero]

I published a step by step guide on using Windows event logs to hunt for malware trying to steal sensitive data from browsers e.g. cookies, passwords etc. https://t.co/9a3l56dDJo #DFIR Hope it's useful!