Giulio C 🔥🌸

I write kernel modules… in JavaScript

[Giulio C 🔥🌸 @tunneleffext]

@MichelleBakels wen eta office in barcelona?

[Paradigm Shift @prdgmshift]

A new research blog deserves a proper first post.

A SecureROM bug seemed appropriate.

Allow us to introduce you to #usbliter8.

https://t.co/m7si1XGhvU

[Giulio C 🔥🌸 @tunneleffext]

@nrathaus @landaire Normally yes, these might be different because they come from P0 which usually has higher standards for reporting

[Giulio C 🔥🌸 @tunneleffext]

@S1r1u5_ More generally, many of those "bugs" wouldn't have made the security fixes page in the first place if it wasn't for this "AI security hype/scare". They have a huge backlog of automated findings and they just "fix" everything because they can't possibly triage all of them.

[Giulio C 🔥🌸 @tunneleffext]

@S1r1u5_ Some example fix:

https://t.co/I506EU3moN

> Add defense-in-depth by ensuring the computed size for pixel formats
is non-zero, and that if ReadPixels is called with a non-zero area,
the resulting size is non-zero.

If you reported this externally, they wouldn't bother paying

[Nassim Nicholas Taleb @nntaleb]

Some fields work in theory but not in practice. Some fields work in practice but not theory.
The uniqueness of economics is that it works in neither theory nor practice.

[Giulio C 🔥🌸 @tunneleffext]

@HaifeiLi @eternalsakura13 @thegrugq My guess is that AI tend to find always the same bugs. As a result Chrome VRP gets flooded with duplicate bug reports found by multiple people all using similar AI systems. Value of external bug reports goes down. Value of RCE does not

[Giulio C 🔥🌸 @tunneleffext]

@HaifeiLi all of the first 4 options can be reframed as:

We don’t want to spend engineering effort in triaging external bug reports (which were 90% false positive anyways) when they’re nowadays mostly AI generated reports that we can get ourselves

[Giulio C 🔥🌸 @tunneleffext]

has the economy trickled down yet ? 🤡

[jack @jack]

we're making @blocks smaller today. here's my note to the company.

####

today we're making one of the hardest decisions in the history of our company: we're reducing our organization by nearly half, from over 10,000 people to just under 6,000. that means over 4,000 of you are being asked to leave or entering into consultation. i'll be straight about what's happening, why, and what it means for everyone.

first off, if you're one of the people affected, you'll receive your salary for 20 weeks + 1 week per year of tenure, equity vested through the end of may, 6 months of health care, your corporate devices, and $5,000 to put toward whatever you need to help you in this transition (if you’re outside the U.S. you’ll receive similar support but exact details are going to vary based on local requirements). i want you to know that before anything else. everyone will be notified today, whether you're being asked to leave, entering consultation, or asked to stay.

we're not making this decision because we're in trouble. our business is strong. gross profit continues to grow, we continue to serve more and more customers, and profitability is improving. but something has changed. we're already seeing that the intelligence tools we’re creating and using, paired with smaller and flatter teams, are enabling a new way of working which fundamentally changes what it means to build and run a company. and that's accelerating rapidly.

i had two options: cut gradually over months or years as this shift plays out, or be honest about where we are and act on it now. i chose the latter. repeated rounds of cuts are destructive to morale, to focus, and to the trust that customers and shareholders place in our ability to lead. i'd rather take a hard, clear action now and build from a position we believe in than manage a slow reduction of people toward the same outcome. a smaller company also gives us the space to grow our business the right way, on our own terms, instead of constantly reacting to market pressures.

a decision at this scale carries risk. but so does standing still. we've done a full review to determine the roles and people we require to reliably grow the business from here, and we've pressure-tested those decisions from multiple angles. i accept that we may have gotten some of them wrong, and we've built in flexibility to account for that, and do the right thing for our customers.

we're not going to just disappear people from slack and email and pretend they were never here. communication channels will stay open through thursday evening (pacific) so everyone can say goodbye properly, and share whatever you wish. i'll also be hosting a live video session to thank everyone at 3:35pm pacific. i know doing it this way might feel awkward. i'd rather it feel awkward and human than efficient and cold.

to those of you leaving…i’m grateful for you, and i’m sorry to put you through this. you built what this company is today. that's a fact that i'll honor forever. this decision is not a reflection of what you contributed. you will be a great contributor to any organization going forward.

to those staying…i made this decision, and i'll own it. what i'm asking of you is to build with me. we're going to build this company with intelligence at the core of everything we do. how we work, how we create, how we serve our customers. our customers will feel this shift too, and we're going to help them navigate it: towards a future where they can build their own features directly, composed of our capabilities and served through our interfaces. that's what i'm focused on now. expect a note from me tomorrow.

jack

[Giulio C 🔥🌸 @tunneleffext]

@thedawgyg @_sehno_ Scudo is preventing you from crashing the target process? Usually scudo crashes when you hit a bug there

[Giulio C 🔥🌸 @tunneleffext]

@freganmitts You're biased by the audience of your class. In Europe (especially southern europe) studying CS was never associated to higher salaries, and still, there's staggering unbalance of men/women in a CS classroom

[Giulio C 🔥🌸 @tunneleffext]

@FranciComi Better than BTC

[Giulio C 🔥🌸 @tunneleffext]

@FranciComi Crazy returns

[Giulio C 🔥🌸 @tunneleffext]

@nervoir Hey! I’d be interested if it’s still available :)

[Giulio C 🔥🌸 @tunneleffext]

@emme_emi pero' il frigorifero in casa ce l'hai anche tu, o sbaglio?

[Giulio C 🔥🌸 @tunneleffext]

@trevormccrt1

[Giulio C 🔥🌸 @tunneleffext]

@Samyak1729 Still missing the first part though. “From a single electron in a potential well, to the transistor”

[Giulio C 🔥🌸 @tunneleffext]

@leopoldasch

[Giulio C 🔥🌸 @tunneleffext]

@ifsecure It worked like a charm!

[Gareth Evans @kryc_uk]

New blog on escaping Chromium sandbox from JavaScript from @wsxarcher and @tunneleffext. https://t.co/rRU1vltnz5