Ryan Mast

Exploring the intersection of cybersecurity and physical hardware @Livermore_Lab. Open source dev.

[Katie Paxton-Fear @InsiderPhD]

Last week @Zai_org released GLM 5.3, and we (@semgrep) got early access to evaluate its vulnerability detection capabilities. Here are our results.

I genuinely think open weight models are still very under hyped for cyber security tasks. We're seeing open weight models genuinely challenge the frontier labs. Models for vulnerability detection are getting both cheaper (per vulnerability detected) and more capable (finding more verified issues with less noise).

BUT we also see open weight models take more tokens (and time) to achieve the same results as frontier models. So they have some catching up to do there, but it's worth remembering that a lot of cyber tasks like identifying vulnerabilities from code are simply not as time critical as other use cases.

Luna is still insanely good value for money!

[Ryan Mast @rmast]

@ghidraninja @defcon The two things I found strange were sudden applause from elsewhere in the room, and not being able to tell if mic position (demo labs had it on the podium) was resulting in excessive plosives.

[Ryan Mast @rmast]

@4rkodix @malwareunicorn Call For Papers - the people reviewing the main stage, demo lab, and maybe some of the other submissions (workshops/trainings).

[Ryan Mast @rmast]

@SouthwestAir complaining about limited overhead bin space and not many people checking bags.

Solution? Bring back a free checked bag for each passenger.

[stacksmashing @ghidraninja]

Ever wondered how to hack a jetski?

Today at @defcon, 2pm, track 5, I will show how I reversed a jetski diagnostic protocol to go from "no key, no ignition" to blasting it across the water!

[Xeno Kovah @XenoKovah]

Slides and BT RE LLM skills from yesterday’s #DEFCON talk are posted here:

https://t.co/6QTlFJPBdx

https://t.co/VH5myjJLxa

[Ryan Mast @rmast]

@see_ess @thedarktangent @defcon I think a minor tweak like this to the text would make it look even more authentic.

[Ryan Mast @rmast]

@LambdaMamba One time in Reno I “won” $8 after putting in $10, and then kept winning until I had nothing left to put in to win.

[Ryan Mast @rmast]

@InsiderPhD This is like @scenicgamer DEFCON edition

[Ryan Mast @rmast]

@RobotHackComm

[Ryan Mast @rmast]

@InsiderPhD @semgrep This feels like it would fit in with @Malmons_World

[Ryan Mast @rmast]

@trailofbits @domenkozar Maybe will try submitting, though I’m guessing the projects that get accepted are likely more foundational building blocks that the world runs on…

[Ryan Mast @rmast]

@InsiderPhD When is the Habbo Hotel talk? Sorry if it was in the teaser video and I just missed that part of the schedule.

[Ryan Mast @rmast]

I have a spare +1 code that can be used to register for #BSidesLV if anyone wants to go but missed out on registering before participant badges sold out - reply or send me a DM.

[Ryan Mast @rmast]

My 13 y/o cousin called me out when I said pymsi works in any browser. Pyodide doesn’t work on Apple Watch because no WebAssembly support… but a pure JS version could sorta work.

Sadly, watchOS also has no support for a file picker.

[Ryan Mast @rmast]

@InsiderPhD If the landlord is a student… they’d already be much wealthier than a typical student.

[Ryan Mast @rmast]

@InsiderPhD HackerTracker is showing the AI Slop detection talk on Aug 9 @ 10:30am, which is different than the blog post. Hopefully it’s recorded… or maybe I can catch it and run right to the airport after!

eReader hacking also sounds like a fun one!

[Xeno Kovah @XenoKovah]

2025-08-04
"The Perfect BLEnd: Reverse engineering a bluetooth controlled blender for better smoothies"
By Edward Farrell and Ryan Mast @rmast
Added to the Bluetooth Security Timeline: https://t.co/RRNdoqVT2b

[Ryan Mast @rmast]

@InsiderPhD Submitting talks is a good tip — it brings a group of people to you that are also interested in whatever you’re talking about. There are also often opportunities to meet other speakers.

The worst that can happen is the talk gets rejected, saving the time it takes to prepare.

[Ryan Mast @rmast]

@SamMiorelli @BSidesLV I got a rejection email 2 hours ago. I think the submission was being considered for either the CG or BG track.