We are hiring! CPU security and stuff www.google.com/about/career...

Google security researchers have improved the Retbleed CPU side-channel attack to increase exfiltration speed. The attack can now leak data at 13 KB/s, which is fast enough to be used in modern cloud environments. bughunters.google.com/blog/6243730...

youtu.be/sUFDKTaCQEk?... (slides at entrysign.top)

Google published details on EntrySign, an AMD Zen microcode signature validation vulnerability (CVE-2024-56161) that can allow threat actors to install malicious firmware: bughunters.google.com/blog/5424842... It also released Zentool, a tool to jailbreak AMD processors: github.com/google/secur...

I am such a big fan of NotebookLM.. The ability to say, hey, here are 20 papers and 3 books from this subject matter, can you please explain this problem to me? and have active in-depth Q&A helps me solve problems in new spaces so much faster. What used to take me multiple weekends now takes hours

What type of C code is this??!

It's out and make for a very interesting read: github.com/google/secur... IMO, AMD should own it and release a microcode SDK.... @sirdarckcat.bsky.social

youtu.be/H9K45VkjKvM?... I found a video of c developers

Ok I understand but can I pay 7 yen more?

LLMs are at least better translators than normal translation tools gemini.google.com/share/68582c...

"Guan Tianfeng's role in the conspiracy was to develop and test the zero-day vulnerability" - yikes, better not develop any more vulnerabilities or fail to do proper testing or the FBI will go after you! www.fbi.gov/wanted/cyber...

🤔

Today I realized <input type=radio> implements roving tabindex natively.. so you can hack a css-only implementation. Forgive me ARIA, for I will sin.

Is this what they call a culture shock in Japan?

Made a tiny game with my 6-years old cousin tonight using cursor.com - must say this was way easier than I thought, and I literally wrote zero code. sirdarckcat.github.io/salchichon/

So one thing I want to work on the kernel explorer before we keep accumulating tech debt is accessibility. I thought it would be cool to try and describe how I'll approach it, so this will be a 🧵 thread I'll update as I make progress.

Writing CSS is so relaxing.. codepen.io/sirdarckcat/... <div class="node"> <h1></h1> <div class="edges"> <div class="left"></div> <div class="right"></div> </div> </div>

I think I would be pretty good at competitive password typing

Small preview of our kernel explorer. Still a lot of work to do! kernelctf-dash.storage.googleapis.com/processed/v6...

I tried to implement this yesterday (kind of). It is too slow to run syz-execprog but running the compiled C reproducer was better. You can't really run ftrace (I was hoping to!) but I probably could get the info from the emulator directly. Promising, but still TBD!

It would be cool if there was a way to run Syzkaller on the browser. You just get an IDE for writing Syzkaller programs and you get coverage data, register state (like with kprobes) etc

blog.wokwi.com/running-gdb-... is pretty cool!

So who should I follow here?

Can you see this?