Tobias Nießen

PhD student @tu_wien, TSC member @nodejs, born at 362ppm, he/him

[Tobias Nießen @tniessen_]

Having to reverse-engineer an embedded cryptographic library has been… interesting.

And rewarding! This effort should allow us to work around the fact that a misconfigured hardware CRC32 unit is breaking the AES-GCM implementation on a satellite!

https://t.co/u1JGo4DLZN

[Node.js @nodejs]

Node.js v24.7.0 is out 💚

Featuring:
- Post-Quantum Cryptography in node:crypto
- Modern Algorithms in Web Cryptography API
- Node.js execution argument support in single executable applications

And more details in our blog: https://t.co/9nI5y25Cj1

[Tobias Nießen @tniessen_]

@liran_tal @matteocollina Thank you @liran_tal! 🙂

[SPLASH Conference @splashcon]

@ArthurCorrenson and @tniessen_ presenting Finding ∀∃ Hyperbugs Using Symbolic Execution

[Tobias Nießen @tniessen_]

@NicoloRibaudo I don't know, this almost looks sane:

[Tobias Nießen @tniessen_]

These are ideal if statements. You may not like it, but this is what peak JavaScript looks like.

[Tobias Nießen @tniessen_]

@Captain_Joannah @profrejones @CASAtlantic @Google @rust_foundation @UNB Congratulations! Wish I could have come visit!

[Tobias Nießen @tniessen_]

I've now created 1,000 pull requests on GitHub.

The vast majority of my (code) contributions are C++ and/or JavaScript. I don't know how to feel about that.

I also have not yet figured out which of the two is worse.

[Tobias Nießen @tniessen_]

@_rafaelgss Thank you! I haven't submitted a talk this year so it's unlikely, unfortunately.

[Tobias Nießen @tniessen_]

@cjihrig It's not just the stability — the testing approach and coverage are beyond impressive.

[Tobias Nießen @tniessen_]

@satanacchio @nodejs Welcome 💚

[Tobias Nießen @tniessen_]

@sergey_slotin @lemire A lot, sometimes! Google achieved up to 40% smaller memory footprints by using 32-bit pointer compression inside 64-bit processes: https://t.co/quzDchNpGK

[Tobias Nießen @tniessen_]

@rluvaton @rustlang It's a lifetime! Those guarantee memory safety without having to resort to garbage collection or cloning objects — you can keep references around as long as their lifetimes are sound. In C/C++, you'd have to trust that a reference/pointer remains valid — the compiler can't tell.

[Tobias Nießen @tniessen_]

@rluvaton @rustlang Be careful — it's such a good experience, it made me dislike JavaScript even more.

[Tobias Nießen @tniessen_]

@cjihrig @josefaidt Yeah, I'm not saying this is a good idea for JS. In Rust, this can serve as a co-located unit test or even usage example, and it will not affect binary distributions at all. Those blocks even have clearly separated dependencies.

[Tobias Nießen @tniessen_]

@cjihrig @josefaidt It can be pretty much anywhere, and it's only meant for small unit tests — Rust uses a separate test folder, too. This was also very unusual for me at first, but now, I do see advantages. For example, you can test internal functions without making them visible outside the file.

[Tobias Nießen @tniessen_]

@mirzaleka @satanacchio What are you looking for, exactly? On a side note, making things "one-shot only" was the approach that the Web Crypto API took, and it really doesn't scale well for large payloads (and small payloads suffer from the async overhead of the API).

[Node.js @nodejs]

Meet Rocket Turtle 👋

[Tobias Nießen @tniessen_]

Very interesting vulnerabilities this time!

• cryptographic side channel (CVE-2023-46809),
• Linux user privilege escalation through io_uring (CVE-2024-22017) and capabilities (CVE-2024-21892),
• hostname truncation (CVE-2024-24806),
• HTTP DoS (CVE-2024-22019),
• and more!

[Node.js @nodejs]

New security releases are now available for the v18.x, v20.x and v21.x Node.js release lines.

https://t.co/7hPQzNqIlE

[Tobias Nießen @tniessen_]

@ljharb @TC39 The end of the `atob` nightmare… https://t.co/LEhyi8C8NX

[BrendanEich @BrendanEich]

@wmhilton @uhhyeahbret Old Unix names, hard to find man pages rn but see https://t.co/lWkceMwFad. The names carried over from Unix into the Netscape codebase. I reflected them into JS in a big hurry in 1995 (after the ten days in May but soon).

[Joe @alpha_convert]

WINNER!