Security geek with his own views and opinions. Hacking on Chromium to make it more secure, increasing the cost for attackers. @nasko@infosec.exchange
Seattle, WA
Joined July 2009
- Tweets9K
- Following1.1K
- Followers2.6K
- Likes1.1K
Nasko Oskov retweeted
📢 @googlechrome is moving to a 2 week release cycle! More in goo.gle/4r2mmSK
Also, a short history on browser update frequency:
• 2001: MSFT shipped IE6 & didn't release a major update for 5+ YEARS! Safari updated ~annually
• 2010: Chrome commits to 6-week releases & automatic updates. (People called us crazy.)
• 2021: Chrome updates to 4-week releases. (People said it was too fast.)
• 2026: Chrome goes to 2-week releases. (Opinions TBD :)
Release early, release often for fresher features and faster fixes... especially important with AI vuln discovery! 💪
The way we are handling the vulnpocalypse in Chromium is described in blog.google/security/chrome-…. It has been an eye opening journey with no clear end in sight.
We just published an update to the Chrome VRP. Blog post is at bughunters.google.com/blog/e…. The gist: we are restructuring based on the AI advancements to allow for more automated triage and easier to predict payment amounts.
Making inroads into memory safety, one step at a time - developer.chrome.com/blog/me…
We are looking for an Android security expert to join our team and work on securing Chrome on Andoird. Job posting is available at google.com/about/careers/app…, but also feel free to reach out to me directly.
Nasko Oskov retweeted
2024Q3 update from @googlechrome security: chromium.org/Home/chromium-s…
Nasko Oskov retweeted
On DAV1D and fuzzing googleprojectzero.blogspot.c…
Great post by @quidity on attacks and mitigations.
This Post is from an account that no longer exists. Learn more
Nasko Oskov retweeted
📢 Chrome VRP reward updates! 💰 Bigger payouts (up to 5x higher, $250,000+) and clearer guidelines, all designed to incentivize high-quality Chrome security research. Let's work together to make Chrome even safer! 🔐
bughunters.google.com/blog/5…
Nasko Oskov retweeted
This morning, I read about Satya Nadella’s latest memo, which emphasizes Microsoft’s new priority: security above all. The memo introduces a policy linking senior leadership compensation to the achievement of "security plans and milestones." I see this as a commendable step forward for Microsoft but more will be needed if they are to get back to being a security leader. Some thoughts here: unmitigatedrisk.com/?p=793
Nasko Oskov retweeted
Unpopular opinion: companies doing an about-face to focus only on AI while abandoning existing products will regret that decision.
Nasko Oskov retweeted
Here's what we've been doing in @googlechrome security in the first three months of this year: chromium.org/Home/chromium-s…
Nasko Oskov retweeted
I published a step by step guide on using Windows event logs to hunt for malware trying to steal sensitive data from browsers e.g. cookies, passwords etc. security.googleblog.com/2024… #DFIR Hope it's useful!
Nasko Oskov retweeted
Big day for the V8 Sandbox:
* Now included in the Chrome VRP: g.co/chrome/vrp/#v8-sandbox-…
* Motivation & goals discussed in a new technical blog post: v8.dev/blog/sandbox
If there is ever a Sandbox "beta" release, this is it!
Nasko Oskov retweeted
This is not just distributed systems. Client-side apps suffer from "more features - more failure modes" as well.
At least we don't usually do cascading failures, I guess? ;)
Nasko Oskov retweeted
Companies who don't understand the basics of distributed systems don't seem to get the fact that more features = more failure modes (often cascading).
Nasko Oskov retweeted
The Google Detection Team is expanding in India and Brazil and we're looking for amazing security analysts to help us protect Google and the data that billions of users entrust us with! We're hiring the following roles:
HYD: lnkd.in/gQu__uNg
SAO: lnkd.in/guxdmWDQ
Nasko Oskov retweeted
I try an avoid this hellsite, but I did a quick dive into sudo in Windows and here are my initial findings. tiraniddo.dev/2024/02/sudo-o…
The main take away is, writing Rust won't save you from logical bugs :)