Viewing profile — ammar2

Of note, even that 97% of original code that is now "safe in the rust sense" could violate invariants through safe blocks that cause memory-safety issues. I can't say exactly how t…

If you feel like increasing your power as per your post, this is a somewhat decent first LLVM issue, take a look at WebAssemblyCFGStackify.cpp :) llvm/test/CodeGen/WebAssembly/cfg-…

Not sure if it's a stated goal somewhere official but there's been plenty of fixes of the years moving stuff to be deterministic, e.g https://github.com/llvm/llvm-project/commit/cd…

The PS5 also runs apps (games/browser) under a hypervisor. There was a hypervisor escape though coupled with webkit as an entrypoint: * https://ps5dev.github.io/ps5-wiki/hypervisor…

> GitHub runs a great program on HackerOne I agree, for the record here's my HackerOne profile https://hackerone.com/ammar2/hacktivity?type=user Just for context, that 2023 bug was…

heh, a friend actually pointed out a typo on a first draft and said "maybe you shouldn't fix it to show it's not LLM written".

It's not just based on that, if you read the linked report from 2023 ( https://blog.ammaraskar.com/vscode-rce/ ), I had a bug with the exact same impact of token exfiltration (It d…

Update as of 3rd June: Microsoft has fixed this with a stopgap fix by adding a confirmation when opening notebooks in web VSCode and not allowing trusted publisher to be skipped by…

You cannot, it doesn't go through the regular OAuth flow. GitHub just automatically grants it a token.

1 and 2 are correct, take a look at the PoC repo here: https://github.com/ammaraskar/github-dev-token-steal-poc/tre... We can try to just put a `my-extension/extension.js` for the …

Thank you, that's a very kind comment. I have no interest in selling these vulnerabilities or sitting on them. At the same time, it feels really bad to have a vendor disrespect the…

> instead of clout I'm catching up on the infosec twitter side but it seems like it was even worse. A lot of people have the same story as me in 2023 of "they silently patch the bu…

> it'd be awesome if the in-browser IDE launched with a temporary per-repo permission scope That's actually exactly what they do for codespaces. The token only has read/write on th…

Also, the Github enterprise code is "obfuscated" but it uses a trivially reversible method just meant to be a minor roadblock. After you get past that you get the full ruby source …

Aah, the newlines were the thing I was missing. That makes sense then.

PEPs aren't necessarily just for language changes, e.g https://peps.python.org/pep-0436/ which is largely a CPython implementation detail.

Could you elaborate on this bit on why Github's secret masking doesn't work here: > GitHub Actions' built-in secret masker matches registered values as exact substrings. When the e…

> (and agents) Ironically, agents have the exact same class of problem.

> Microsoft would fork it within hours I haven't trudged through Chromium's commit statistics but has Microsoft been upstreaming many contributions? I'm skeptical that they are rea…

Glad this feature is built into most modern operating systems these days. For MacOS (Sequoia+) you can just forget the network and reconnect to get a new MAC address [1]. Android's…

> it includes instructions for stack manipulation, binary operations Your example contains some integer arithmetic, I'm curious if you've implemented any other Python data types li…

Aah, neat! Yeah, piggy-backing off pypy's work here would probably make the most sense. It'll also be interesting to see how OP deals with things like dictionaries and lists.

> I'd prefer to move forward based on clear use cases Taking the concrete example of the `struct` module as a use-case, I'm curious if you have a plan for it and similar modules. T…