Found a side-channel that lets containers communicate across isolation boundaries. No shared volumes, network, or privileges. Just POSIX advisory locks on /proc/self/ns/time. Built a working cross-container IRC chat to demonstrate. Works on default Docker/K8s. h4x0r.org/funreliable/

C macros: where adding one level of indirection either fixes everything or summons Cthulhu. There is no in-between.The complete journey from "this should be easy" to "why won't this thing just COUNT" h4x0r.org/big-mac-ro-attack/

❌ No type safety ❌ No argument count ❌ Can’t wrap one vararg API in another ❌ Can’t push/pop args or introspect You're stuck in a model where the caller has to be perfect. That’s not an interface, it's an improv show with segfaults. h4x0r.org/vargs/

Donuts used to be our favorite rings, but a lock-free multi-reader, multi-writer ring buffer? 😙🤌 🔗 eu1.hubs.ly/H0mzYpH0

The Art of Multiprocessor Programming, 2nd Ed (2021): 500 pages, no mention of futex. That’s our review. Maybe it was meant to be a history book, not a CS text? 🧵h4x0r.org/futex/

It turns out computational complexity is... complex? (The 🤯 truth about heap memory!) eu1.hubs.ly/H0mlFfq0

Last week, we officially launched Crash Override: the first platform to deliver deep build inspection as the foundation of Engineering Relationship Management (ERM) 🚀 Read our full announcement below 👇 eu1.hubs.ly/H0lW_CT0

My 16 year old is interning with us this summer & looking to meet with appsec folks for 15 mins to ask some questions about appsec problems. His post on LinkedIn is here. linkedin.com/posts/gabriel-c… - There is a limited edition Crash Override t-shirt in it if you can spare the time!

This walkthrough shows you how to find & eliminate shadow engineering, inc services not associated with a repos in prod, running a campaign to address rogue build tools & a campaign to ensure applications are being deployed to the right cloud accounts eu1.hubs.ly/H0jMVdT0

The Curious Case of Shadow Engineering - Our latest article about Shadow Engineering and using Crash Override to find and eliminate it to improve engineering effectiveness, efficient and save cost. Oh yeah, and get the right security controls in the right place.

linkedin.com/posts/pmital_op… - The OpenAI coding agent has been open-sourced. codex "Look for vulnerabilities and create a security review report" Finds and explains security bugs.

Why thank you. Please DM me and I'll send you some custom @crashappsec swag that will blow your socks off !

There has been an update to this article since first being published, clarifying why code owners file are useful beyond code ownership - Code owners files don’t just to serve as white pages. They can be used for Git workflow automation including - Automated Review Requests: Automatically request reviews from relevant contributors when changes are made to specific files or directories. - Protected Code Areas: Enforce code ownership to ensure that critical parts of the codebase are not modified without approval. linkedin.com/feed/update/urn…

The following update was also made to this article. linkedin.com/feed/update/urn… You maybe asking why not just push a code owners file to every repo from the central org settings? The answer is quite simple. Unless you want to violently interrupt the developers existing git workflow, you would just push a blank file. This achieves nothing as you will still not know who to talk to in order to get the right policy defined in it. Using our approach you get the inferred code owners and know exactly who to talk to to get the file created with the right content.

This product walkthrough shows you how you can use the Crash Override platform to make sure that you have code owners files in all of your repos that are ‘deployed production’. crashoverride.com/blog/how-t…