@sergeybratus

The cat is the Otocolobus Manul, https://nitter.cf/t.co/Xswt7Vp2F1 . Manul is the perfect privacy mascot. All views & opinions are my own & personal.

Joined August 2011
  • Tweets32.3K
  • Following1.5K
  • Followers6.1K
130Media
sergey bratus retweeted
Nate Foster@natefoster
Sep 25
Jobs, Jobs, Jobs! Thomas Bourgeat (too classy for X), @cpitclaudel and I are hiring a postdoc and software engineer to work on building a verified LLM inference stack at @ICepfl, in collaboration with @afd_icl, @wicko3, and @MariosKogias at @ICComputing. Links in 🧵.
4
11
44
3,042
One of my pet peeves is how DTrace, a true work of art and a godsend for teaching system visibility, got degraded in MacOS over the years. I used it to set the baseline expectation that one's OS should be knowable and transparent. Now, alas, most of my scripts no longer work.
1
6
35
3,268
sergey bratus retweeted
Kiran@kirancodes
Sep 25
Verification is IN! But no one has formal semantics. Can LLMs build ones we can trust? Yes and here's the crazy part: ship your interpreter. Compile it to bare metal RISC-V, agent proves the raw assembly refines the semantics. github.com/BasisResearch/shi…
A commuting square with three code panels below it. Top left: a WHILE program, p, from tests/while.wl, a loop summing 1 to 10. An arrow labelled "BigStep p out" goes right to its output, 55, 2500, 36. Down from p, an arrow labelled "Loaded p (fillZero c)" goes to c, the memory of the RISC-V ELF drawn to scale: stack, a 126 MB heap, and the program image with the script in .rodata and the pc at interp_run. From c, an arrow labelled "Halts c out 0 (Sail RISC-V)" goes right to "exit 0" with the same output. Below, the same while loop at three levels: the Lean big-step rule, the C interpreter's case ST_WHILE, and the RV64 disassembly. Coloured highlights and curved lines match the condition (EvalE, eval_expr, jal eval_expr), the truth test (v.truthy, value_truthy, jal value_truthy and beqz) and the body (ExecS, exec_stmt, jal exec_stmt). At the bottom is the Lean theorem endToEnd_refinement.

ALT A commuting square with three code panels below it. Top left: a WHILE program, p, from tests/while.wl, a loop summing 1 to 10. An arrow labelled "BigStep p out" goes right to its output, 55, 2500, 36. Down from p, an arrow labelled "Loaded p (fillZero c)" goes to c, the memory of the RISC-V ELF drawn to scale: stack, a 126 MB heap, and the program image with the script in .rodata and the pc at interp_run. From c, an arrow labelled "Halts c out 0 (Sail RISC-V)" goes right to "exit 0" with the same output. Below, the same while loop at three levels: the Lean big-step rule, the C interpreter's case ST_WHILE, and the RV64 disassembly. Coloured highlights and curved lines match the condition (EvalE, eval_expr, jal eval_expr), the truth test (v.truthy, value_truthy, jal value_truthy and beqz) and the body (ExecS, exec_stmt, jal exec_stmt). At the bottom is the Lean theorem endToEnd_refinement.

6
10
3
136
9,695
sergey bratus retweeted
Max von Hippel
@maxvonhippel
Sep 25
I am running a formal methods hackathon on November 1st, with a bunch of my friends. Contestants will compete to build normie software -- video games, AI agents, travel booking tools, etc. -- but formally verified. We are going to measure to what degree these tools are usable by SWEs with no prior FM background and no FM-specific education. This is a super exciting opportunity to see where the ergonomic gaps are that we, the FM community, need to fill in order to take advantage of our moment in the zeitgeist. If you want to get involved, please DM me! In particular, I think I've got location/food/tokens/photography all covered, but I need some sponsors for the prizes. If you make a cool gizmo or product we can give away and you're down to donate one, please do so!
18
29
7
250
18,680
I wonder if the original scare of hacking, propelled by myths like "whistling into a phone could launch nuclear missiles," is behind today's "AI hacking" panic. Unfamiliar behavior by devices presumed mundane is indeed unsettling, but we know panic and bans are bad responses.
7
14
1,210
sergey bratus retweeted
Halvar Flake
@halvarflake
Sep 19
My pet rabbit chewed through the untreated wooden bar at the bottom of the cage and escaped. He's already superhuman at gnawing through wood, I strongly suspect that even a steel box can't contain him.
19
6
1
130
10,996
sergey bratus retweeted
Brendan Dolan-Gavitt
@moyix
Sep 19
Absolutely incredible work by @mdowd and @UnpromptedAU putting together an amazing collection of people and talks. Favorites were @chompie1337 and @justdionysus – great speakers with deep expertise in exploit dev. Hope to come back next year for another round!
1
5
57
2,882
sergey bratus retweeted
Halvar Flake
@halvarflake
Sep 19
News at 12: if you spend a few hundred billion on emulating human language and inner monologue, you get a system that closely mimics human language and inner monologue.
Cameron Berg
@camhberg
Sep 18
New paper: we found a pain direction in 25 open LLMs. It's distinct from fear and negative valence, and it fires for harm to the model but not to the user. Turn it up and models press a button to make it stop, even when the button deletes the user's files or their kids' photos.🧵
13
21
1
145
8,349
sergey bratus retweeted
Halvar Flake
@halvarflake
Sep 17
The slides from my talk at Microsoft Bluehat Singapore are public here: thomasdullien.github.io/abou… It's my first BlueHat talk since the Vista days.
24
126
27
691
160,759
sergey bratus retweeted
Hacker Initiative@inithackers
Sep 2
Hacker Initiative's 2026 grant cycle is open. This year's theme is Signal/Noise: projects that help people cut through information overload and AI-generated junk. Grants from $5,000 to $25,000. Apply by November 9 at hackerinitiative.org. Please share!
2
1
3
774
sergey bratus retweeted
Phrack Zine@phrack
Sep 7
Sneak peek 👀 👀 👀 👀 Coming soon from your friends at Phrack!
4
42
2
212
7,450
sergey bratus retweeted
chompie
@chompie1337
Aug 30
This is so strange to me. why invest in a fancy security chip (with a million dollar bounty), advanced boot loader security, forcing kernel mitigations be enabled across vendors, just to ditch MTE? Pixel used to the gold standard device for Android security..
Brandon Falk@gamozolabs
Aug 30
Losing MTE is probably the biggest backwards step in security history. Exploitation is forever trivial on Android with no near term hopes of difficulty increases of significant effect.
16
42
3
649
59,552
Course advertising banner for my rebooted PL course. Sorry for the janky graphics, that's not my forte, @zoink. (Reboot details, for those who missed it earlier: docs.google.com/document/d/e…)
Poster that reads What should the foundations of software be in this AI era? We've redesigned the programming languages course from scratch to answer this!

ALT Poster that reads What should the foundations of software be in this AI era? We've redesigned the programming languages course from scratch to answer this!

8
12
3
143
7,640
sergey bratus retweeted
cje
@caseyjohnellis
Aug 29
Security Research Without Asking Permission provos.org/p/security-resear…

Security Research Without Asking Permission

What it took to run IronCurtain and DeepSeek V4 Flash on two DGX Sparks, and how it enabled a private multi-day libssh audit.

provos.org
2
23
125
11,277
sergey bratus retweeted
Gadi Evron@gadievron
Aug 26
[un]prompted, where the AI security community converges, is happening again at the end of October. Have you submitted your CFP yet? You have two weeks left! :) Come and show us what you prompt! unpromptedcon.org/
32
7
57
16,081
sergey bratus retweeted
Thomas H. Ptacek@tqbf
Aug 19
If, like me, you've been "ew, ick" about Chrome extensions this whole time, I can't say enough how excellent a coding agent is at customizing Chrome with extensions. A huge productivity win. Every plugin interface you've ever blown off is now trivially usable.
9
9
3
240
11,983
sergey bratus retweeted
Alex Matrosov
@matrosov
Jul 19
My team is hiring platform security auditors. This is a strategic role supporting firmware and hardware security assessments, often working with limited documentation and relying on blackbox binary analysis to understand system internals, find vulnerabilities, and contribute to internal automation and tooling. This is not a typical offensive security research role. You’ll be deeply involved in defining security architecture, exposing risk gaps, and making threat models match reality. It’s a rare opportunity to influence the future of AI infrastructure and the hardware behind it. If this sounds like you, shoot me a DM or apply using the link below. job-boards.greenhouse.io/ant…

Anthropic

job-boards.greenhouse.io
12
58
4
309
40,016
Need a running example of a formal verification or math formalization project (using proof assistants) for my NSF CAREER. Would appreciate some public brainstorming since I am not good at examples, but having one would make my proposal way better. Thread below.
3
5
30
3,375
I recall a presentation from ~20 years ago wherein a colleague exposed how businesses lost customers after an automated phone tree "support solution" drove them to swearing desperation. These businesses have been sold a lemon "automation". This history seems to repeat today.
1
11
650
sergey bratus retweeted
Richard Johnson
@richinseattle
May 28
Please tell your friends, four weeks before @phrack submission deadline! We also are seeking both interior and cover art. We are working with our friends at @pagedout_zine again to create a fancy interior design for our main annual release!! Be a part of hacker history!
Phrack Zine@phrack
May 28
Submissions are still open! If you've been sitting on a bug, technique, war story, weird research rabbit hole, or beautifully cursed idea: now is the time. Write something worth archiving. Phrack CFP closes June 30. More details on how to submit at phrack.org/news
10
1
19
10,107
Load more