Opinions are my own

Joined May 2014
Kinda bizarre that long standing math problems can be solved but progress on understanding LLM internals remains glacial and the practice largely alchemistic.
31
21
4
235
16,060
This is unpopular but correct. AI labs have gotten spoiled by super chill responses to CFAA violations and the whole edifice is a house of cards. Wanna know why Hugging Face didn't sue OpenAI? Google “new DOJ policy CFAA” and thank the hacker community fighting for this.
This is unpopular but correct. Modern bug bounty participants have gotten spoiled by super chill responses to CFAA violations (like this one) and the whole edifice is a house of cards. Wanna know why OpenAI asked for detailed logs? Google “Sullivan + Misprision of a Felony”
1
14
1
201
26,146
Next time instead of creating a PR on the monorepo please just use a temperature-based side-channel to demonstrate successful compromise 🙏
4
12
3
244
26,038
d3fp4r4m retweeted
636606729769440499166579950236036751749912014371509557713570027508971809534551913252252094954941974952859310861988904737359709200557919 is a factor of RSA-896 saweis.net/posts/rsa-896.htm…
223
989
323
9,484
3,917,886
How many folks assigning XX% probability of extinction in the next 3 years are willing to offer betting odds for "at least 100k deaths from malicious runaway AI", too? Because I think I'd bet.
2
5
41
2,995
Kiro Crew is here! 🚀 We open sourced this agent dev workspace tool today, used already by 39k users inside Amazon. This pace of this project is incredible: already at 500 contributors and 995 merged PRs in the last 2.5 weeks alone github.com/kirodotdev/KiroCr… What I love about it: 1. It starts work on its own. Cron jobs, webhooks, and messaging events kick off work with nobody at a terminal, and heartbeats watch a system until something actually needs me. 2. I can reach it from anywhere. I install one Gateway, and I can access the same agent and sessions from the desktop app, the dashboard, the CLI, Slack, Discord, or Telegram. 3. I can run it anywhere. A Mac, a container, or an EC2 instance that stays up when my laptop does not. The desktop app tunnels into whichever one I picked. Conversation history, memory, and knowledge indexes stay on that host. 4. It remembers. Tell it "always run linting before calling a change done" and that correction becomes a durable lesson, not a line of chat history that evaporates when I close the window. Failures teach it too, and after enough repetition of the same workflow it writes itself a skill. I can open the dashboard, read every lesson and skill it has accumulated, and delete the ones it got wrong. 5. It's actually safe to run at work. It enforces an OS sandbox, interactive approvals, credential redaction, and an audit log of every action. Try it in one line, then open http://localhost:5476 and start a conversation: curl -fsSL download.crew.kiro.dev/cli.s… | sh
16
42
8
230
24,901
Idk what are yall's thoughts on why 0day and hacking seem to be one of the biggest pushes for AI right now? At least, at a policy and marketing level?
7
1
19
1,970
d3fp4r4m retweeted
The field of desync flaws arising from deep implementation bugs is absolutely wild. This finding from @calif_io using a fake pseudo-header than gets weaponized by a dodgy length calculation is a great example
MAD Bugs: My Cousin Vinyl (CVE-2026-50052) So the story went like this: Squid was bleeding from a 29-year-old heap overread in her default config. Naturally, she did the only sensible thing: she called her cousin, Vinyl. It turns out Vinyl also had a family problem of his own. blog.calif.io/p/mad-bugs-my-…
3
12
78
12,952
d3fp4r4m retweeted
MAD Bugs: My Cousin Vinyl (CVE-2026-50052) So the story went like this: Squid was bleeding from a 29-year-old heap overread in her default config. Naturally, she did the only sensible thing: she called her cousin, Vinyl. It turns out Vinyl also had a family problem of his own. blog.calif.io/p/mad-bugs-my-…
2
18
4
71
27,219
d3fp4r4m retweeted
aaaaaand we just finished a dumb request smuggling PoC for (Open)LiteSpeed httpd live on stream: warez.sl0p.foo/ols-h2-smuggl… their commit hygiene is designed to hide security fixes, didn't manage to find a CVE/report anywhere. all results will be published on warez.sl0p.foo -- beware, minimal curation! ;^)
good morning! I'm currently broadcasting some random/light clanky VR work @ sl0p.foo/s/blasty also feel free to have a peep and join us in the sl0p.foo discord/IRC server! all infrastructure/architecture was vibed over the last week. expect crickets && chaos! 🤖
9
42
6,627
d3fp4r4m retweeted
This is a great analysis. Narrowing the Response Queue Poisoning race-window is a worthwhile mitigation to make desync exploitation harder, but it's not patching a specific vulnerability. Also a great illustration of the blast-radius you get when trying to harden HTTP/1.1...
Hey everyone! I triaged a @nodejs vulnerability, wrote the fix, and pushed it through the security process. I now think it shouldn't have been a CVE. And the fix broke a big part of the ecosystem. 🧵
4
8
74
14,914
d3fp4r4m retweeted
CTFs don't have to die. They just have to become like chess. Have more events in person, easier to enforce no LLMs. Have heuristics for online play, honor system, etc. Any online competitive format is subject to cheating, yet plenty of competitive arenas still exist.
4
9
1
141
9,693
d3fp4r4m retweeted
People on the orange site are laughing at this, assuming it's just an ad and that there's nothing to it. Vulnerability researchers I talk to do not think this is a joke. As an erstwhile vuln researcher myself: do not bet against LLMs on this. axios.com/2026/02/05/anthrop…
7
19
4
120
12,541
Glitches in games, especially used for speedrunning, are one of the most fun aspects of hacking to watch! As an example, check out this video "How Speedrunners BEAT Hollow Knight Silksong In 10 Minutes!" by @Abyssoft youtube.com/watch?v=M6Jnj-y0…
4
5
1
33
15,789
Agency > Intelligence I had this intuitively wrong for decades, I think due to a pervasive cultural veneration of intelligence, various entertainment/media, obsession with IQ etc. Agency is significantly more powerful and significantly more scarce. Are you hiring for agency? Are we educating for agency? Are you acting as if you had 10X agency? Grok explanation is ~close: “Agency, as a personality trait, refers to an individual's capacity to take initiative, make decisions, and exert control over their actions and environment. It’s about being proactive rather than reactive—someone with high agency doesn’t just let life happen to them; they shape it. Think of it as a blend of self-efficacy, determination, and a sense of ownership over one’s path. People with strong agency tend to set goals and pursue them with confidence, even in the face of obstacles. They’re the type to say, “I’ll figure it out,” and then actually do it. On the flip side, someone low in agency might feel more like a passenger in their own life, waiting for external forces—like luck, other people, or circumstances—to dictate what happens next. It’s not quite the same as assertiveness or ambition, though it can overlap. Agency is quieter, more internal—it’s the belief that you *can* act, paired with the will to follow through. Psychologists often tie it to concepts like locus of control: high-agency folks lean toward an internal locus, feeling they steer their fate, while low-agency folks might lean external, seeing life as something that happens *to* them.”
Intelligence is on tap now so agency is even more important
1,949
9,324
1,874
49,992
11,479,593
had some decent homies affected by the amzn layoffs any seceng sde or tpm roles you need to fill and want people that don’t suck reply to thread i’ll feed you souls
4
12
1
58
5,697
nothing has cured me of so many anxiounesses of life like marriage + kids. I get to truly feel alive because life is no longer about what i want, but about the very real needs of people who depend on me that i love with a love i did not believe i was capable of
i have... - an amazing girlfriend - making ~$450k this year - can work anywhere / anytime - live in a house w/ a pool yet i have anxiety every damn day, tight chest, hard to take a deep breaths, intrusive thoughts, always feeling not enough, can never relax what went wrong
74
116
17
4,181
344,868