User Profile

Came across this in a review in The Economist. I've usually found that scaling people is where orgs seem to struggle, so I'd be keen to hear from someone who oversaw enormous growth at Stripe.

Interesting approach of using a fault-tolerance feature to handle transient HW issues as a way to bypass fingerprint attempt counters. Obviously less practical due to needing invasive physical access and a fingerprint database, but a nice multi-device logic bug class!

Heard about this on @riskybusiness@infosec.exchange and @casey thought it would be a good one to read as a #ThinkstScapes candidate.

Not a ton more than what was in the abstract: it only takes a small number of fine-tuning samples to greatly improve the [human-scored] performance of LLMs.

Rereading for the third time

Curious to see how model fine-tuning works as well as see about detection accuracy for tuned LLMs.

Suggested by @khae to read.

This paper (and the associated code/service: timevault.drand.love/) may be one of the most/only valuable contributions to come from the entire web3 ecosystem. The ability to commit to a future decryption time is a powerful primitive, such as in auctions, coordinated disclosure, and other "dead man's switch" scenarios.

I look forward to this work being critiqued and built-upon for a whole host of interesting offerings.

Found this posted by @ct_bergstrom@fediscience.org as the "best paper I've read this year", which is a strong endorsement.

While an interesting modeling exercise, and certainly something to be worried about if you own or rely on a GEO satellite, the hostile takeover of an entire LEO constellation would be incredibly impactful beyond temporary jamming of a GEO bird.

This paper predictably finds a lack of authentication and cryptographic protections in a legacy RF protocol that is designed to work around the world for life-saving signals. While they determine is it possible to spoof a signal in a lab environment, and call for improved authentication, etc. they fail to include the international legal framework surrounding these signals, and the fact that in a safety-critical environment, a signal discarded due to lack of nonce freshness is more risky than allowing bad actors with drones to send illegal signals.

A good reminder that edge cases in state machines can have severe security implications, even if the crypto itself is done well.

This is an excellent, durable read, about the intersection of Engineering and Organizations. Its one to read and re-read

Great talk on a timely topic. Other applications of this work could have significant benefits across numerous fields, including pharmaceutical research, repeatable science, etc.

This paper explored the weaknesses and risks associated with modern exception handlers (across all major OS and architectures) in unwinding attacker-controlled state. The most powerful example is a bypass of stack canaries where a function throws an exception after the overflow but before the function return; the exception handler would eventually execute attacker-controlled memory.

There is an attempt to quantify the overall impact of this mitigation bypass by looking at the Debian repos for code that uses exception handlers, but it is quite context sensitive. The paper concludes with three CVEs that would be exploitable with current mitigations (stack canaries, etc.) using the new technique.