Viewing profile — kingkilr

[Work at Anthropic, used to work at Mozilla.] Firefox has never required a full chain exploit in order to consider something a vulnerability. A large proportion of disclosed Firefo…

(pyca/cryptography dev here) As Steve notes, Rust does support s390x. Even prior to shipping Rust code, we never tested or claimed to support s390x. If there's genuine interest in …

RealPage was DoJ. As was the Google search litigation where DoJ proposed Google divest Chrome. Which is by way of saying, the FTC and Chair Khan were not responsible for those.

I would strongly implore people not to follow the example this post suggests, and write code that relies on this monotonicity. The reason for this is simple: the documentation does…

Since last year's AMG case in the Supreme Court, the FTC is not authorized to seek monetary relief in these cases. The FTC can seek monetary relief if this order is violated.

I don't know Brett super well so I can't speak to the rest of his background, but it's not correct that the Obama admin asked him to take over DDS. DDS's founding head was Chris Ly…

While I don't love the proliferation of dependencies, from a risk perspective the raw number of dependencies isn't always the right metric. Looking at the authors and publishers nu…

I think it's fair to say that this work is quite likely to qualify :-)

Rust has a few interlocking behaviors that provide its memory safety, a few of the most important are: - The borrow checker enforces mutable XOR shared references. - The compiler d…

Sure you can. First, in a philosophical sense: pointers and x86 CPUs are real, ultimately any safe abstraction must be built on unsafe primitives. The ability and need to do that a…

I don't have any data on exploitability, but 19 of the last 22 vulnerabilities (since 2018) have C-induced memory unsafety as a cause: https://curl.haxx.se/docs/security.html

It's a great question! a) It being acceptable to upstream is mandatory to receive a bounty, so a starting point might be: pick projects whose maintainers are sick of dealing with A…

Lots of drivers, network protocols, etc. in the kernel, and they're most of the attack surface -- not the scheduler :-) We have to approach this as a question of how, not if. When …

The kernel maintainers have actively expressed interest in having upstream support for writing kernel modules in Rust!

Those of us who organized this both have a long history of involvement in open source. If we have even an iota of this becoming a problem, we will a) be incredibly saddened, b) fig…

One of the folks behind the bounty here. Happy to answer questions.

(Former Firefox Security Engineer) I suspect it's because Firefox exploits have looked the same for the last several years -- there has not been a lot of novelty required to implem…

As far as we know the entire kernel for both is memory unsafe. It's not clear to me how much Swift is in use internally for things besides apps (e.g. is there a future where Window…

29/51 appear to be memory unsafety https://twitter.com/LazyFishBarrel/status/111032101282489958...