Phil Ames

Information security professional. Tweets/opinions are my own.

[Vaishnavi @_vmlops]

GOOGLE BUILT A SECRET WEAPON FOR FILE DETECTION

they ran it internally for years, gmail, drive, safe browsing, hundreds of billions of files every week

then they open sourced it

it's called magika and it exposes what files really are, not what they pretend to be

rename malware to "resume.pdf"? magika sees through it
disguise a script as an image? magika sees through it
any trick attackers use with file extensions? magika sees through all of it

ai trained on 100 million files. 200+ content types. 99% accuracy. 5ms per file

one command
`pip install magika`

the same tool protecting google's billion users is now protecting yours

https://t.co/Jr3LjmQobq

[chrisrohlf @chrisrohlf]

You can spend tokens for a model to reason through a program's state space, or use a fraction of those tokens having it generate a tool such as a fuzzer that brute forces the same state space on a CPU at significantly lower cost.

This tradeoff is what the Agentic Sufficiency Curve formalizes. You need precise inference up front but only cheap CPU to drive the long tail: https://t.co/wg8Oj4C6ho

For certain kinds of vulnerability research I think this was the right approach, at least up until Fall 2025. But frontier models have continued to consume that capability and now I'm not so sure the cost tradeoff is worth it.

Other domains are likely still under the curve and benefit more from models generating deterministic automation that runs on cheap CPU, than just spending more tokens. Just another anecdotal data point that the frontier will continue to remain jagged.

[Jason Fried @jasonfried]

THE BIG REGRESSION

My folks are in town visiting us for a couple months so we rented them a house nearby.

It’s new construction. No one has lived in it yet. It’s amped up with state of the art systems. The ones with touchscreens of various sizes, IoT appliances, and interfaces that try too hard.

And it’s terrible. What a regression.

The lights are powered by Control4. And require a demo to understand how to use the switches, understand which ones control what, and to be sure not to hit THAT ONE because it’ll turn off all the lights in the house when you didn’t mean to. Worse.

The TV is the latest Samsung which has a baffling UI just to watch CNN. My parents aren’t idiots, but definitely feel like they’re missing something obvious. They aren’t — TVs have simply gotten worse. You don’t turn them on anymore, you boot them up.

The Miele dishwasher is hidden flush with the counters. That part is fine, but here’s what isn’t: It wouldn’t even operate the first time without connecting it to an app. This meant another call to the house manager to have them install an app they didn’t know they needed either. An app to clean some peanut butter off a plate? For serious? Worse.

Thermostats... Nest would have been an upgrade, but these other propriety ones from some other company trying to be nest-like are baffling. Round touchscreens that take you into a dark labyrinth of options just to be sure it’s set at 68. Or is it 68 now? Or is that what we want it at, but it’s at 72? Wait... What? Which number is this? Worse.

The alarm system is essentially a 10” iPad bolted to the wall that has the fucking weather forecast on it. And it’s bright! I’m sure there’s a way to turn that off, but then the screen would be so barren that it would be filled with the news instead. Why can’t the alarm panel just be an alarm panel? Worse.

And the lag. Lag everywhere. Everything feels a beat or two behind. Everything. Lag is the giveaway that the system is working too hard for too little. Real-time must be the hardest problem.

Now look... I’m no luddite. But this experience is close to conversion therapy. Tech can make things better, but I simply can’t see in these cases. I’ve heard the pitches too — you can set up scenes and one button can change EVERYTHING. Not buying it. It actually feels primitive, like we haven’t figured out how to make things easy yet. That some breakthrough will eventually come when you can simply knock a switch up or down and it’ll all makes sense. But that's at least 20 years down the road.

It’s really the contrast that makes it alarming. We just got back from a vacation in Montana. Rented a house there. They did have a fancy TV — seems those can’t be avoided these days — but everything else was old school and clear. Physical up/down light switches in the right places. Appliances without the internet. Buttons with depth and physically-confirmed state change rather than surfaces that don’t obviously register your choice. More traditional round rotating Honeywell thermostats that are just clear and obvious. No tours, no instructions, no questions, no fearing you’re going to do something wrong, no wondering how something works. Useful and universally clear. That’s human, that’s modern.

[Trail of Bits @trailofbits]

Go's silent integer overflows hide bugs from fuzzers. go-panikint modifies the Go compiler to panic on arithmetic overflows, exposing vulnerabilities that wrap around undetected.

[Zero Day Engineering @zerodayalpha]

Did you know? GDB has a built in graphic interface, called TUI.

Commands:
- Turn on: `tui enable`
- Cycle through windows: `layout next`
- Redirect target stdio/stderr to a log file to prevent curses UI breakage (or `refresh`)

(Showing @alisaesage's screen)

[COCO @TWOTIMESABITCH]

I WANT A PHYSICAL FUCKING MENU AT A RESTAURANT. NONE OF THIS QR CODE BULLSHIT

[Ivan Krstić @radian]

🔺iPhone models announced today include Memory Integrity Enforcement, the culmination of an unprecedented design and engineering effort that we believe represents the most significant upgrade to memory safety in the history of consumer operating systems. https://t.co/ule9gaXzc1

[Phil Ames @philames]

@lcamtuf

[Phil Ames @philames]

Fun. @Atlassian jams some AI enabled app called Rovo into orgs you create. It can't be removed, and you can't delete the org as long as there are active apps in it, leading to no way to delete the org.

[Michal Melewski @carste1n]

A friend of mine (@gynvael) is organizing a course about reversing binary files and protocols: https://t.co/KSf2LsmMGT

recommendation++

[remy🐀 @_mattata]

A lot of people don’t know this, but any platform Chrome runs on *except iOS* has a fully featured Bluetooth scanner that allows viewing, connecting, and read/writing GATT attributes.
Go have some fun. You already have the tools
chrome://bluetooth-internals

[Phil Ames @philames]

@troyhunt Did the spider ask if you had a bug bounty program?

[Phil Ames @philames]

@paradoxengine If you order it to be secure it is, QED

[Phil Ames @philames]

Nice overview of webauthn by @agl__ : https://t.co/PmlN9iHKc0

[Dino A. Dai Zovi @dinodaizovi]

The lack of end-to-end encryption through the telco infra *is* the vulnerability.

We improved Internet infra security by largely de-privileging the intermediate hops through widespread use of TLS. Now attackers go for VPN boxes because that's where traffic exists in plaintext.

[Phil Ames @philames]

Ok so someone MUST have already made a @ClassActionPark map for @ParkitectGame right? I don't have to do this myself, do I?

[nixCraft 🐧 @nixcraft]

Heads up: Microsoft Office, like many companies in recent months, has slyly turned on an “opt-out” feature that scrapes your Word and Excel documents to train its internal AI systems. This setting is turned on by default, and you have to manually uncheck a box in order to opt out. If you are a writer who uses MS Word to write any proprietary content (blog posts, novels, or any work you intend to protect with copyright and/or sell), you’re going to want to turn this feature off immediately.

[Phil Ames @philames]

You can't make this stuff up.

[Phil Ames @philames]

A seminal tome. Definitely worth reading!

[Dino A. Dai Zovi @dinodaizovi]

The entire 3rd-edition of @rossjanderson's "Security Engineering" is available free as PDFs now!

https://t.co/4Mjd9TOzUp

[Susie Dent @susie_dent]

Word of the day is ‘recrudescence’ (17th century): the return of something terrible after a time of reprieve.