i talked to a lot of people who played the defcon ctf finals to understand how llms affected them, both professionally and mentally.
i went in hoping to learn that human intuition still mattered. instead, ctfs in their current form as everyone saying is dead, players are forced to operate slot machines because anyone who refuses to token-max loses to those who do.
almost everything i learned, including how to learn, came from grinding ctfs. but the pipeline for developing that kind of skill and expertise now seems broken, juniors are rewarded for token-maxxing rather than going through the process of actually understanding things which is quiet sad and ctfs might not produce high quality security researchers any more.
this also has serious implications for people who can’t afford tokens. five years ago, i wouldn’t have been able to afford access to something like gpt-5.6, and I would have been locked out of the very competitions that helped me build my career.
anyway these are questions i asked if interesting for anyone:
did they have fun?
almost everyone was unhappy. it has largely become slot-machine operating, if they refuse to use llms, they lose to teams that do. it is not there is no fun at all, playing with friends and competing was all fun just process of solving which is main part and it isn't fun.(please let me know if you had fun)
did having a skilled human in the loop still matter?
i got mixed answers, but the leaderboard tells a fairly clear story, the top teams aggressively token-maxxed, by pooling gpt accounts and stuff. the #1 team allegedly spent around $50k on tokens xd.
how much of the outcome came from human skill versus token-maxxing?
its probably 95% token-maxxing and 5% human skill. some challenges, especially visual ones, remain difficult for llms, and human intuition to prompt mattered. but overall, the dominant strategy appears to be throwing more tokens at problems, one interesting observation, people who were better before llms were also better after the llms and they are the ones solving lot of challenges so it seems still 5% operating skill will put u in top and can't be dumb operator.
will a new generation of players simply adapt to this new kind of competition?
i thought maybe current players are just behaving like boomers who hate every new technology. but unlike previous technology stuff, there doesn’t seem to be much for the human to master here. token-maxxing is literally just token-maxxing. it doesn’t reward human ingenuity, it discourages it, and may eventually atrophies and makes us dumb
let me know if i missed something or if you have different opinions
Watch This Space retweeted
Chrome Sync increasingly abused to stalk unsuspecting victims cyberinsider.com/chrome-sync…
Apple Internals: Swift in the Kernel
open.substack.com/pub/calif/…
Watch This Space retweeted
"Copy Fail exploits a kernel logic flaw where corrupted page‑cache data is never marked dirty, leaving disk files unchanged while the in‑memory version is silently altered. Because the page cache is what processes read, an unprivileged user can corrupt a setuid binary’s cached page and gain root. The shared cache also lets the attack cross container boundaries. The bug, surfaced through AI‑assisted analysis of crypto‑subsystem behavior, is portable, tiny, race‑free, and stealthy, unlike Dirty Cow or Dirty Pipe. It works across major distros and architectures and forms the basis for both local privilege escalation and Kubernetes container escapes."
Thank you for the coverage @securityaffairs
#Copy #Fail: New #Linux bug enables #Root via page‑cache corruption
securityaffairs.com/191519/h…
#securityaffairs #hacking
@xint_official
Watch This Space retweeted
Replying to @buildwithsid
because macOS:
- has fewer native frameworks that are more difficult to build ugly software with (WinUI is pretty but no one uses it and the rest are hideous)
- handles frameless windows more gracefully (proper rounding/borders/shadows, allows real window controls to be placed where the app requests for them to be)
- has developers who actually give a fuck
Watch This Space retweeted
Holy frick, that was sooner than I thought.
Apple CEO Tim Cook Stepping Down, John Ternus Taking Over macrumors.com/2026/04/20/tim…
MAD Bugs: Even "cat readme.txt" is not safe, by @calif_io
cat readme.txt and you're pwned baby
We'd like to acknowledge @OpenAI for partnering with us on this project.
open.substack.com/pub/calif/…
Spying on everybody's Discord attachments with HTTP desync
tmctmt.com/posts/http-desync…
Watch This Space retweeted
In macOS Tahoe 26.4 Apple added a new security feature to Terminal that warns users of potentially malicious pastes with a "Possible malware, Paste blocked" prompt. Here how it actually works 🧵
Watch This Space retweeted
You can now FAX into Discord
youtube.com/watch?v=p9zPnOyN…
Watch This Space retweeted
Simple age check for Linux:
Just have the shell ask the user to check the host IP on first boot.
If they type ifconfig they are old enough, if they type ip addr they deserve to be restricted from their computer 😇
Watch This Space retweeted
Ghostty 1.3 is going to have a preview of AppleScript support. All windows, tabs, splits, terminals are exposed via AppleScript. For macOS users, this satisfies some of the most common requests: broadcast commands, automatic layouts, jump to working directory, etc. PR here: github.com/ghostty-org/ghost…
I also think this is an incredibly important feature to ship early/now so agentic tools like Claude and Codex can take advantage of a scriptable Ghostty on macOS.
I still plan on a generic cross-platform scripting/plugin API (two separate things), but integrating with native features like AppleScript is entirely in scope of the Ghostty mission and like our Shortcuts integration it importantly lets you connect multiple sources since AppleScript can control multiple applications from one script.
Note I normally don't ship features so down to the wire with a release, but this one is very isolated in its impact and I'm going to explicit document it in the release notes and website as a preview since I fully expect we're going to iterate a lot on the objects and commands exposed.
From a security perspective, Apple already prompts for permission to control different applications so we're covered, but there is a master kill switch you can put in the config, too.
Watch This Space retweeted
I am disappointed in OpenAI's decision to work with the Department of War. The way DoW treated Anthropic stands against everything that makes America great.
It know it's not this simple, but it feels super opportunistic in a way that doesn't sit right with me.
Watch This Space retweeted
During one of the macOS updates (26.2?), Apple somehow introduced an ObjC exception that sometimes triggers when a new tab is created while in the tab overview. Swift CANNOT CATCH ObjC exceptions. Instant crash. This affected Ghostty as well as Electron (unrelated project).
The fix is equally crazy: write an ObjC wrapper around the crashy-function, catch it, and basically retry periodically. This is 100% an Apple bug, but the way it manifests and the fix required to workaround it is pretty gnarly.
Credit to everyone but me, I didn't do any research here, I only read the good work by others on this one (all visible in the refs).
Ref: github.com/ghostty-org/ghost…
Ref: github.com/electron/electron…
Watch This Space retweeted
Got my first Apple CVE!
CVE-2026-20654
At the age of 19, I have finally achieved my goal.
Weird thing is, the 2025 CVE isn't addressed yet haha
More exciting news coming soon!
Thank you everyone for the support 🥹🙏
Watch This Space retweeted
Hey y'all, I need your help.
I did an awesome video about @boristane's "logging sucks" blog post. Sadly, we accidentally uploaded a bad export.
I just re-uploaded a fixed version of the video. It's basically destined to bomb in the algorithm.
I hate to ask, but if you could share it with someone who might enjoy it, would help a lot to counteract the algorithmic damage of re-uploading a vid 🙃 link below
I'm trying something new with my blog, making it interactive
first article is about something I care deeply about: logs
logging sucks so much
loggingsucks.com
Watch This Space retweeted
New blog post, Bye 2025
jhftss.github.io/CVE-2025-43…



























