We're hosting the 7th intl' conf. on Advances in Financial Technologies (AFT'25) at Carnegie Mellon on Oct. 8-10. Join us to hear about the latest exciting developments in crypto research. Registration closes on Sept 16! advfintech.org/aft25/attend... (Program: advfintech.org/aft25/progra...)

This is concerning, it seems like lower fees on Ethereum are facilitating address poisoning attacks… x.com/toxin_tagger...

That’s a wrap for me at #usesec25 Conferences should really consider reusing the tag holders, the amount of wasted plastic is staggering

“Canadian pharmacist helps run notorious deepfake porn site.” The online crime jokes write themselves.

I'm presenting my USENIX paper "How Researchers De-Identify Data in Practice" at 9am this Thursday. Kudos to my co-authors Paige Pepitone, @adamaviv.bsky.social, and @mmazurek.bsky.social. Come say hi—I am on the academic job market! Here's the paper: www.usenix.org/conference/u... #usesec25

Taro just presented this at #usesec25, and will be manning the poster shortly. If you are around we would love to hear from you.

I’m not sure there is a more clichéed Seattle experience than having a latte at a local coffee shop with some salmon on toast while they’re blaring Soundgarden’s “Outshined.”

My student Jenny Tang (coadvised with @lujobauer.bsky.social) is making friends at SOUPS with our paper on looking at 10 years of SOUPS papers and reviewing how solid the stats were. Basically: not great, not great at all. (And that includes my own work.) Paper: www.andrew.cmu.edu/user/nicolas...

New research alert 🚨 from my group, “Blockchain Address Poisoning” (Tsuchiya et al.), to appear at USENIX Security 2025 (arxiv.org/abs/2501.16681)! As a follow-up, we also developed a real-time detection system: cryptotrade.cylab.cmu.edu/poisoning/ and x.com/toxin_tagger (1/7)

CMU S3D’s “Tartan Federer” swept all 4 MIDST tracks, revealing privacy gaps in diffusion models. Its loss-feature attack was the only entry to beat random guessing in the white-box multi-table test. Details: s3d.cmu.edu/news/2025/0501-midst.html #AIPrivacy #CMU #AI #ML!

Just because your prof didn't file an academic dishonesty report does not mean that they don't know you cheated. Knowing you did it and proving it to the hearing board are two different thresholds.

PSA: If you're using homebrew, and discovered that MAME crashes w/ a Bus Error upon startup after upgrading to Sequoia, 1) update mame.ini so that the line containing gl_lib points to /System/Library/Frameworks/OpenGL.framework/Libraries/libGLVMPlugin.dylib 2) launch w/ DYLD_LIBRARY_PATH="" mame

🧵 about a new paper by my amazing students and collaborators. To appear this week at SIGMETRICS. 👇

CMU researchers are using personalized models to decode how cancer behaves in individual patients, one of medicine's toughest challenges. Through individualized data and insights, their work revealed hidden #cancer subtypes that could inform treatment and improve survival predictions. #Research

Looking for a home for your great scientific result in fintech that is almost all written up and ready to go? The AFT deadline is in less than 24 hours… aftconf.github.io/aft25/index....

Pasta sauce cookie is something you should only attempt after you’ve gotten your second Michelin star. Like, David Chang, I’d eat his pasta sauce cookie no questions. Doing it myself because the teevee told me to, yeah, no.

In NYC, a man was tortured for two weeks for Bitcoin. He escaped. Alice Hutchings @message4bob.bsky.social and colleagues tell us it's happening around the world. Conference paper: "Investigating Wrench Attacks: Physical Attacks: Targeting Cryptocurrency Users" drops.dagstuhl.de/storage/00li...

Next was an intriguing talk by McKenna McCall on the need to combine formal methods and usable security approaches at @cmus3d.bsky.social www.youtube.com/watch?v=qbnq... (5/7)

These talented young musicians teamed up to bring the joy of music to young children in the community. Please support their cause. 6pm (CT) tonight at Nichols Hall, Evanston. Please join us in person or through the live stream. youtube.com/live/MxXwBr_...

Lawrenceville. 44th Street. If you accidentally left your rooster in your locked car, PD is about to break your window.

If you're a grad student or an undergrad interested in research I need to you listen to me very carefully. You cannot learn to write good research papers if you do not read good research papers. Stop asking LLMs to summarize papers for you.

Posted slides for my CSEE&T keynote here conf.researchr.org/details/icse...

I'm thrilled to announce that I'll be joining Carnegie Mellon as an Assistant Professor of Human-Computer Interaction (with a courtesy joint appointment in Social and Decision Sciences) in 2026!

In a @darkreading.bsky.social article, Professor Lorrie Cranor (@lorriecranor.bsky.social), CyLab Director, explains to Becky Bracken (@beckybracken.bsky.social) why, regardless of #encryption protections, #Gmail user devices and accounts still need to be secured.

🔐✌️ Victory for Privacy and Security in France 🇫🇷 End-to-end encryption will continue to be available in France, as the assembly overwhelmingly voted against an amendment to legislation fighting drug trafficking which required backdoors in encrypted messengers. www.lemonde.fr/societe/arti...

Cool hack!

What, no? I mean, probably not. Well, it shouldn't. Look, I'm not going to find out, but yes probably. Amusingly, I think it was written by one of our VPs who just retired.

Q: Why is the code doing this thing? A: oh...oh no

Watching Ben Titzer give a warning parable about the Lamputer (the trend towards making everything programmable) and realizing I used a raspberry pi pico as a dumb on/off light switch for my closet lights and I am part of the problem.

A clear sign of the impending apocalypse is that the @nytimes.com spelling bee featured the letter that shall not be named today.

It is an absolute scandal that “gianduja” isn’t accepted as a pangram in the @nytimes.com spelling bee today. What kind of Mickey Mouse operation doesn’t know about Nutella? I shall cancel my subscription.

I don’t know if Google can top this, their finest work to date

I am not going to NDSS this year but we have some great students attending. Is anybody among the people I know here going, so that I can make introductions?

"Oh, but I've been so busy" is prof-speak for "I am so utterly useless at time management that I would be irremediably unemployable in any other line of work." Please don't use that sorry excuse, get better, and tend to your commitments on time. Thank you.

My long-time collaborator from back when he was a PhD student at CMU/S3D (in @scsatcmu.bsky.social ), Blase Ur, now a CS Prof. at U. Chicago won a particularly cool award: cra.org/crae/awards/...

Last week the sound of a pipe bursting somewhere inside my wall, followed by a geyser of water gushing from my kitchen cabinet, interrupted my work calls. The culprit: -5 temperatures in Pittsburgh. Cost of repairs are $950 and counting, just for the pipes. #EnergySky triblive.com/opinion/dest...

Testing DeepSeek on a local machine, it does seem it has some information controls built in. It for instance does not answer questions about June 4, 1989.

I’m an NSF panel reviewer that was scheduled to meet today. Just got notice that all NSF panels were canceled today. I reviewed some innovative proposals in support of students. Devastating if these scholars don’t get to do this work. For the love of science & students I hope this is just a delay.💔

Super congratulations @clegoues.bsky.social!👏🥳

In professional news: one of the things Biden signed his last week of office was a recognition of a set of PECASE awardees. Unbelievably honored (not to mention completely dumbfounded) to have been included on that list. 1/ www.cmu.edu/news/stories...

Trump pardons Ross Ulbricht after eleven years in prison. An incredible twist in the never-ending Silk Road saga. www.wired.com/story/trump-...

For anyone feeling nostalgic on the occasion of Ross Ulbricht's pardon, here's my interview with him (as the Dread Pirate Roberts) from 2013, just a few months before his arrest: www.forbes.com/sites/andygr...

The details matter. If Ross's sentence was commuted, he's still a felon just free from jail. If he was given a full and unconditional pardon, by legal rights he should have ALL the silk road seized Bitcoin back.

One thing that does concern me, as @davidgerard.co.uk pointed out: Pardons don't just end sentence, they are supposed to restore the pre-conviction status quo. Ross waived his rights to a bunch of bitcoin later, but the amount siezed is worth billions at today's value.

PSA: the Carnegie Library of Pittsburgh's website is lying today. 🤣 But hey we had a nice walk.

Enigma will be back as a track at USENIX Security: https://www.usenix.org/conference/usenixsecurity25/enigma-cfp

A student reported that the top image in the image carousel in response to a Google search for my name is an AI-generated thing that looks nothing like me. Interesting: I have a substantive online presence, and yet some random AI-generated pic is top-ranked. Benign, but harbinger of things to come?

Can closely relate to the second part, devastated for the student.

I don’t want to make a fuckin account to use my toaster. I don’t want to fuckin subscribe to software. I don’t want to create a fuckin profile to watch TV. I don’t want to fuckin register my whatever to unlock whatever. I don’t want to download a fuckin app to access anything. Death to new logins

Last week I went back to my very first place of employ: the Kobe Harborland center building. An emotionaltrip down memory lane (🧵, 1/17)