Watch This Space: A security research blog.

The Interwebs
Joined August 2024
Watch This Space retweeted
i talked to a lot of people who played the defcon ctf finals to understand how llms affected them, both professionally and mentally. i went in hoping to learn that human intuition still mattered. instead, ctfs in their current form as everyone saying is dead, players are forced to operate slot machines because anyone who refuses to token-max loses to those who do. almost everything i learned, including how to learn, came from grinding ctfs. but the pipeline for developing that kind of skill and expertise now seems broken, juniors are rewarded for token-maxxing rather than going through the process of actually understanding things which is quiet sad and ctfs might not produce high quality security researchers any more. this also has serious implications for people who can’t afford tokens. five years ago, i wouldn’t have been able to afford access to something like gpt-5.6, and I would have been locked out of the very competitions that helped me build my career. anyway these are questions i asked if interesting for anyone: did they have fun? almost everyone was unhappy. it has largely become slot-machine operating, if they refuse to use llms, they lose to teams that do. it is not there is no fun at all, playing with friends and competing was all fun just process of solving which is main part and it isn't fun.(please let me know if you had fun) did having a skilled human in the loop still matter? i got mixed answers, but the leaderboard tells a fairly clear story, the top teams aggressively token-maxxed, by pooling gpt accounts and stuff. the #1 team allegedly spent around $50k on tokens xd. how much of the outcome came from human skill versus token-maxxing? its probably 95% token-maxxing and 5% human skill. some challenges, especially visual ones, remain difficult for llms, and human intuition to prompt mattered. but overall, the dominant strategy appears to be throwing more tokens at problems, one interesting observation, people who were better before llms were also better after the llms and they are the ones solving lot of challenges so it seems still 5% operating skill will put u in top and can't be dumb operator. will a new generation of players simply adapt to this new kind of competition? i thought maybe current players are just behaving like boomers who hate every new technology. but unlike previous technology stuff, there doesn’t seem to be much for the human to master here. token-maxxing is literally just token-maxxing. it doesn’t reward human ingenuity, it discourages it, and may eventually atrophies and makes us dumb let me know if i missed something or if you have different opinions
47
128
35
771
99,827
Watch This Space retweeted
"Copy Fail exploits a kernel logic flaw where corrupted page‑cache data is never marked dirty, leaving disk files unchanged while the in‑memory version is silently altered. Because the page cache is what processes read, an unprivileged user can corrupt a setuid binary’s cached page and gain root. The shared cache also lets the attack cross container boundaries. The bug, surfaced through AI‑assisted analysis of crypto‑subsystem behavior, is portable, tiny, race‑free, and stealthy, unlike Dirty Cow or Dirty Pipe. It works across major distros and architectures and forms the basis for both local privilege escalation and Kubernetes container escapes." Thank you for the coverage @securityaffairs
1
3
11
2,527
Replying to @buildwithsid
because macOS: - has fewer native frameworks that are more difficult to build ugly software with (WinUI is pretty but no one uses it and the rest are hideous) - handles frameless windows more gracefully (proper rounding/borders/shadows, allows real window controls to be placed where the app requests for them to be) - has developers who actually give a fuck
7
4
254
5,340
Watch This Space retweeted
This is good!
Warp is now open-source.
53
28
2
1,570
95,300
Watch This Space retweeted
Holy frick, that was sooner than I thought.
Apple CEO Tim Cook Stepping Down, John Ternus Taking Over macrumors.com/2026/04/20/tim…
7
5
107
3,740
Watch This Space retweeted
MAD Bugs: Even "cat readme.txt" is not safe, by @calif_io cat readme.txt and you're pwned baby We'd like to acknowledge @OpenAI for partnering with us on this project. open.substack.com/pub/calif/…
5
42
7
214
38,396
Watch This Space retweeted
In macOS Tahoe 26.4 Apple added a new security feature to Terminal that warns users of potentially malicious pastes with a "Possible malware, Paste blocked" prompt. Here how it actually works 🧵
14
91
16
733
114,297
Watch This Space retweeted
Simple age check for Linux: Just have the shell ask the user to check the host IP on first boot. If they type ifconfig they are old enough, if they type ip addr they deserve to be restricted from their computer 😇
128
135
23
2,357
118,348
Watch This Space retweeted
Ghostty 1.3 is going to have a preview of AppleScript support. All windows, tabs, splits, terminals are exposed via AppleScript. For macOS users, this satisfies some of the most common requests: broadcast commands, automatic layouts, jump to working directory, etc. PR here: github.com/ghostty-org/ghost… I also think this is an incredibly important feature to ship early/now so agentic tools like Claude and Codex can take advantage of a scriptable Ghostty on macOS. I still plan on a generic cross-platform scripting/plugin API (two separate things), but integrating with native features like AppleScript is entirely in scope of the Ghostty mission and like our Shortcuts integration it importantly lets you connect multiple sources since AppleScript can control multiple applications from one script. Note I normally don't ship features so down to the wire with a release, but this one is very isolated in its impact and I'm going to explicit document it in the release notes and website as a preview since I fully expect we're going to iterate a lot on the objects and commands exposed. From a security perspective, Apple already prompts for permission to control different applications so we're covered, but there is a master kill switch you can put in the config, too.
61
87
14
1,504
182,378
Watch This Space retweeted
New 🍎 products in a few hours. 👀
1
4
41
1,779
Watch This Space retweeted
I am disappointed in OpenAI's decision to work with the Department of War. The way DoW treated Anthropic stands against everything that makes America great. It know it's not this simple, but it feels super opportunistic in a way that doesn't sit right with me.
210
120
11
4,613
167,079
Watch This Space retweeted
During one of the macOS updates (26.2?), Apple somehow introduced an ObjC exception that sometimes triggers when a new tab is created while in the tab overview. Swift CANNOT CATCH ObjC exceptions. Instant crash. This affected Ghostty as well as Electron (unrelated project). The fix is equally crazy: write an ObjC wrapper around the crashy-function, catch it, and basically retry periodically. This is 100% an Apple bug, but the way it manifests and the fix required to workaround it is pretty gnarly. Credit to everyone but me, I didn't do any research here, I only read the good work by others on this one (all visible in the refs). Ref: github.com/ghostty-org/ghost… Ref: github.com/electron/electron…
16
7
2
409
46,032
Watch This Space retweeted
...now in macOS binaries 🫣 (at least, first time I've seen it)
Binary obfuscation in 2026: Just put ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FA... into your program 😎
12
53
3
1,018
185,274
Watch This Space retweeted
Got my first Apple CVE! CVE-2026-20654 At the age of 19, I have finally achieved my goal. Weird thing is, the 2025 CVE isn't addressed yet haha More exciting news coming soon! Thank you everyone for the support 🥹🙏
17
10
2
283
24,369
Watch This Space retweeted
Hey y'all, I need your help. I did an awesome video about @boristane's "logging sucks" blog post. Sadly, we accidentally uploaded a bad export. I just re-uploaded a fixed version of the video. It's basically destined to bomb in the algorithm. I hate to ask, but if you could share it with someone who might enjoy it, would help a lot to counteract the algorithmic damage of re-uploading a vid 🙃 link below
I'm trying something new with my blog, making it interactive first article is about something I care deeply about: logs logging sucks so much loggingsucks.com
36
23
6
617
122,423
Watch This Space retweeted
New blog post, Bye 2025 jhftss.github.io/CVE-2025-43…
6
32
208
20,024