Reginaldo Silva

Security @ Mysten Labs. Opinions are mine and do not necessarily reflect my employer’s.

[Reginaldo Silva @reginaldojsf]

@calif_io @lcamtuf Congrats. You guys are (re)building the dream team!

[Reginaldo Silva @reginaldojsf]

Many, many years ago I implemented multiple queues for intake for the Meta bug bounty program, where submissions from researchers that have a good signal were handled right away. H1 has that, right @senorarroz ? It might need some UI tweaking and education on the program side.

[shubs @infosec_au]

https://t.co/rLl6ZzmuvY

[Reginaldo Silva @reginaldojsf]

@rez0__ @caseyjohnellis The dread of running a bug bounty program: when you spend 32k triaging the reports and 2.3k paying the researchers.

[Reginaldo Silva @reginaldojsf]

@0xLupin https://t.co/bbMK6xdKDX - no affiliation. Just make your terminal into a wormhole or whatever when you find a bug :)

[Reginaldo Silva @reginaldojsf]

@cryptodavidw Cache

[Reginaldo Silva @reginaldojsf]

@rvtond @striedinger They were there last month. They’re on vacation at the moment.

[Reginaldo Silva @reginaldojsf]

@ryanlpeterman Your interviews are great. It is indeed fortunate to hear from the founding figures of computing. I met Carl Hewitt in Stanford and he was so enthusiastic. After a good conversation I asked a question and his answer was: “great question, I wrote a whole book to answer it”.

[Reginaldo Silva @reginaldojsf]

@lacker Which one did you think was right when you were building Parse? I remember you saying something about APIs looking as if they were designed by a single person and that still resonates.

[Reginaldo Silva @reginaldojsf]

@rez0__ @MikeGropp @Hacker0x01 In the program I run: duplicates from 2023 to November 2025: 3. Since then: 30+

[Joseph Thacker @rez0__]

@MikeGropp @Hacker0x01 i fear claude code is going to produce lotsssss of dupes as everyone runs it on all their favorite programs

[Reginaldo Silva @reginaldojsf]

@dyn___ @HackingLZ I can hear the sound of @dyn___’s neurons going “here we go again”

[Reginaldo Silva @reginaldojsf]

@mhlakhani @deanwball @DanielleFong I had the opposite reaction: I’m like: ok Claude is better than me, not at everything but clearly more of a generalist. That frees me to do a bunch of things.

[Reginaldo Silva @reginaldojsf]

A friend tried to warn me years ago: "go find crypto vulns, you can do it". I've been working at Mysten Labs for 2 years, and I know how right he was.

Sui is launching a new VM. It hasn't hit testnet, yet we're paying for vulns in it as if it was on mainnet.

Don't miss this.

[Sui Developers @suidevelopers]

Sui’s new VM just went public.

Bug bounty is open & we want the community's eyes on it before Mainnet.

The bella-ciao branch is a rewrite of the execution layer. Faster. Per-package caching. Next gen Move features.

Internal review & multiple independent audits from @osec_io & @zellic_io done.

Report on @HackenProof. Paid at Mainnet rates, before it hits Testnet.

[Calif @calif_io]

A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets.

A step-by-step guide to exploiting a 20-year-old bug in the Linux kernel to achieve full privilege escalation and container escape, plus a cool bug-hunting heuristic.

https://t.co/IxURrHpBT0

[George Danezis @GDanezis]

Then you can point sui-explain to a transaction and it extracts it full contents as JSON, using a custom Rust tool called checkpoint-parser. You might find this useful for your own projects too, since it reads from the checkpoint archive which is not pruned: https://t.co/iKuRh4AHKo

[George Danezis @GDanezis]

Under the hood sui-explain uses Claude Haiku & Sonnet API to create a human readable summary.

It analyses packages and extracts summaries of what each function does, you can have a look at 0x2 as an example: https://t.co/6DM8IHHtiJ

[George Danezis @GDanezis]

I spend a significant amount of my day looking at transaction blocks on @SuiNetwork . Always wished explorers could give an English summary of transactions, before I dive into details.

So I made sui-explain, largely for myself. It makes reports like:

[Reginaldo Silva @reginaldojsf]

@undebeha https://t.co/aE0KLeuy4r - not just shovels though.

[Reginaldo Silva @reginaldojsf]

@thedawgyg @hiimanshu19x As someone who helps run a program, the problem is not so much that the AI slop is inaccurate, it is that it's plausible and it takes me a long time to determine it's inaccurate. Before, it was easier to make a quick determination.

[Reginaldo Silva @reginaldojsf]

@rvtond trunk? svn lingo? :)