Nicolò Fornari

Penetration Tester. Art passionate. Friends call me "grandpa".

[Nicolò Fornari @rationalpsyche]

"The need to be understood, to create things of value, to meet the inner lives of others, to refine one's emotions: these are everyday concerns. And they are played out - met or left unmet - as we go through our days trying to address our more obvious needs." John Armstrong

[Aldo Cortesi @cortesi]

My wish for 2026 is that we move beyond pelicans and vibes-based oneshot web apps for model evaluations. Let them spend 2 hours implementing a detailed spec on a real-world project instead.

In my testing, gpt-5.2-xhigh >> opus-4.5 >= gemini-3-pro-preview.

[Compass Security @compasssecurity]

In a new video, Nicolò Fornari walks through how to fuzz with AFL++, how to pick targets, avoid common pitfalls, and boost effectiveness. Find performance tips, fuzzing theory, and AFL++ internals. https://t.co/S21LcYIUJZ

#security #fuzzing #AFLplusplus #appsec

[Nicolò Fornari @rationalpsyche]

@decoder_it https://t.co/9fTXEkTgdS in March

[Compass Security @compasssecurity]

LLM-based vuln hunting just leveled up with xvulnhuntr - a fork of vulnhuntr with support for: C#, Java, Go. Read @rationalpsyche's blog post and go grab the project on GitHub.
https://t.co/khwVcbXN2L

[Nicolò Fornari @rationalpsyche]

@emollick In "Nexus" by Yuval Noah Harari there's exactly one chapter on this: how access to information does not help spreading truth. Examples: the introduction of print sold many copies of The Hammer of the Witches rather than Copernicus' essays

[OSINT Switzerland @OsintSwiss]

We won't be using this account actively anymore. You can stay connected with us through:

Our Website: https://t.co/qqKSSImUVE
LinkedIn: https://t.co/1cGGiPi3rL
Discord: https://t.co/9pmXRKeruJ
Bluesky: https://t.co/tIQ9p6HKUa

We’d love to see you there! Thanks for your support!

[Aldo Cortesi @cortesi]

I talk to a lot of people who just use the "For you" timeline on X, and get baited into a permanent state of simmering rage by what they see there. The amount of time you should be spending on "For you" is ZERO - interact with X through curated lists and "Following" only.

[CSCS Lugano @cscsch]

🦋🔵Did you know that we are now also on Blue Sky? Follow us for updates on cutting-edge supercomputing, science breakthroughs, and tech-driving innovation: https://t.co/VWqfAAsjOp

[Nicolò Fornari @rationalpsyche]

10 years on twitter, it has been good for a while, but now I post on Bluesky https://t.co/F9pUI7CKU3 #MyXAnniversary

[Halvar Flake @halvarflake]

A rather pretty form of military parade.

[Hamid Kashfi @hkashfi]

Turns out WhatsApp does NOT have end-to-end encrypted backup enabled by default. Your backups are stored cleartext on cloud, which means the E2EE in chats are essentially a joke, if you backup.
That's FB just being an ass and sneaky IMO.

[Threema @ThreemaApp]

Threema 2.0 for desktop (beta), which was audited by @cure53berlin earlier this year, recently passed a bug bounty challenge and is now open source: https://t.co/UJOT3x3CJd

[OSINT Switzerland @OsintSwiss]

We're joining a promising platform to reach more interested OSINTers and learn from each other.

Our association is now also on Bluesky. You can find us at https://t.co/tIQ9p6HKUa

We will be more than happy if many of you will also join the conversation!

[Sylvain Heiniger @sploutchy]

You can also find me there:
https://t.co/FfB3viKUXW

[PagedOut @pagedout_zine]

Paged Out! Issue #5 is out now!
https://t.co/kVmdLe0l7s
Happy reading!

Please RT and tell your friends! :)

[Halvar Flake @halvarflake]

If you're following me here, I'm also posting @halvarflake.bsky.social https://t.co/cY6oMbOmSO -- and on mastodon, too.

[Dino A. Dai Zovi @dinodaizovi]

The entire 3rd-edition of @rossjanderson's "Security Engineering" is available free as PDFs now!

https://t.co/4Mjd9TOzUp

[Hamid Kashfi @hkashfi]

Interesting talk worth watching about DAST at scale. MS basically went full circle between old solutions like parsing code to modifying built env to generate OpenAPI specs to feed DAST tools, to use AI to consume code & produce that. None works as expected at scale. What works?--

[Thinkst Canary @ThinkstCanary]

We've just released our 2024-Q3 edition of ThinkstScapes: https://t.co/4noer7uyR6

For this issue, we went through ~5000 info-sec research talks, papers, presentations & blogs.

The website includes PDF & ePub links (and a brief audio summary).

As always: completely free...