Viewing profile — chc4

Huh? You can expose tool functions to Gemini's live API, and it will call them as part of thinking about responses. I've used this to expose e.g. current GPS location for a smartwa…

it just me that thinks its kinda weird that they conflate speed in tokens/second and latency, when i think of latency as time to first token? like it generates an entire paragraph …

I don't think you know anything about how these industries work and should probably read some of the published books about them, like "This Is How They Tell Me The World Ends", ins…

Browser exploits are almost always two steps: you exploit a renderer bug in order to get arbitrary code execution inside a sandboxed process, and then you use a second sandbox esca…

It's really funny reading the thought processes, where most of the time the agent doesn't actually remember trivial things about the cards they or their opponent are playing (think…

Yeah, this is basically Sovereign Citizen-tier argumentation: through some magic of definitions and historical readings and arguing about commas, I prove that actually everyone is …

Or better yet, the built-in Version Tracker, which is designed for porting markup to newer versions of binaries with several different heuristic tools for correlating functions tha…

OpenSSL is used by approximately everything under the sun. Some of those users will be vendors that use default compiler flags without stack cookies. A lot of IoT devices for examp…

2026 and we still have bugs from copying unbounded user input into fixed size stack buffers in security critical code. Oh well, maybe we'll fix it in the next 30 years instead.

I saw a Mastodon tweet a while ago, which went something like: Do tech companies understand consent?: - [ ] Yes - [ ] Ask me again in a few days

RPISEC's Modern Binary Exploitation is somewhat famous for doing exactly that!

brb taking out a 10:1 bet on a new project which will print money and then rm -rf'ing all the code so i get a payout

SSRF is not just a DoS.

I think it would be very cute to train a model exclusively in pre-information age documents, and then try to teach it what a computer is and get it to write some programs. That sai…

Amazon Fire Tablet, one of the only things I've ever returned.

Signal is an end-to-end encrypted messaging app. People continue to breathlessly mentioning the lack of database encryption as a problem, but that never made it a real security iss…

No one is using an Alpha, Motorola 680x0, PA-RISC, or SuperH computer because that's the only thing they can afford. Rust supports 32bit x86.

They're vulnerable to "High-S" malleable signatures, while ed25519 isn't. No one is claiming they're backdoored (well, some people somewhere probably are), but they do have failure…

UMass Lowell has a 1MW research reactor as well.

CodeQL compiles to the Souffle datalog engine and I use it for static analysis. I've also used ascent for a few random side projects in Rust which is very convenient.

The human brain is just really bad at evaluating risk, especially over long periods of time. A lot of people are wanted overseas for years or even decades without anything happenin…

...And this is how I learn that the line "Steele Dakota's sandhill crane" from mewithoutYou's Nine Stories is talking about a bird species and not a literal mechanical crane. Appar…

https://ferrocene.dev/en/ is a Rust toolchain which has achieved some certifications for mission critical applications similar to Ada/SPARK.

They run the game servers in Docker. Doing multi-tenant is a weaker security boundary and makes it easier to steal places from other users, which Roblox takes pretty seriously when…

The summoning worked!