Marcin がリツイート
Marcin
5.7K posts
Marcin
@marcinw
because tweeting and blogging is a full time job
New York, NY 参加日 Temmuz 2008
325 フォロー中1.6K フォロワー
Marcin がリツイート
You'd be hard pressed to find someone in the hacker community that you could have deep tech conversations with & also turn everything they touch into fun. @aloria is a legend that I am privileged to call a friend. We will remember! Photo from 15th anniversary of "Hackers" party.
Gabriella "Biella" Coleman@BiellaColeman
When speaking with @aloria my spirits would lift. Her wit and brilliance were stuff of legend and she would often make me smile and think at the same time. You will be missed and this is how I will remember you:
English
Marcin がリツイート
“Code signing” as sold by CAs is a Microsoft only offering. It doesn’t really belong in CA/Browser Forum at all. Doing so just shunts Microsoft’s responsibility to evolve its own code signing practices to commercial CAs. This is problematic for several reasons.
DigiCert@digicert
The Code Signing Working Group recently improved requirements for code signing. Effective Nov. 15, 2022, key protection requirements for OV code signing certificates are harmonized to be the same as EV code signing certificates. digicert.com/blog/improved-…
English
@0xdabbad00 blog.gdssecurity.com/labs/2010/2/12… port scanning internal Azure infrastructure since 2010.
English
My general guidance for AWS has been to trust AWS is securing their side of the shared responsibility model (ex. don't spend much time worrying about the possibility of guest-to-host-escapes, CPU side channels, etc from other customers). That is not my belief for Azure. 🧵
English
Marcin がリツイート
Where else in our lives do we actively create and promote the infrastructure that allows malicious actors scalable and frictionless destruction?
Why run AD, which enables scalable ransomware? So that we can automatically deploy EDR to maybe detect (but not stop) that ransomware?
English
Is there an IDA plugin for decoding HTML? I’m having a hard time keeping up with all these hacking techniques
English
@mattifestation @j3ffr3y1974 How does behave when you have an expired (but not revoked) signing certificate with a valid RFC3161 timestamp?
English
Marcin がリツイート
@halvarflake @chrisrohlf @drraid All of the above would breed the most competition amongst everyone.
English
@chrisrohlf @drraid Open it to users via sth like bpftrace, too.
English
This. This all day long. Between iOS and IntelME it’s as if vendors spite us with the lack of visibility. I’ll always favor a system with visibility and the purported “less security” over an opaque box claiming to be a fortress
Halvar Flake@halvarflake
People may disagree with me on this, but allowing users to dtrace-log the hell out of their phones would at least help at-risk users collect better forensic evidence... iOS still has all the dtrace infra, android has all the eBPF infra. Allow users to add o11y to their phones.
English
Marcin がリツイート
There's a focus that comes with protecting cryptocurrency. Security theater doesn't play at all, there are real direct consequences for breaches, and you can't keep them a secret. There is real useful innovation happening and the rest of infosec ignores it to their own detriment.
Dominic White 👾@singe
For years I’ve avoided anything to do with cryptocoins. Initially it was because people assumed being in security meant I knew about it & kept pestering me. Later it was because I saw the greed derail a couple of good hackers careers. Then it was some of the unpleasant community.
English
Marcin がリツイート
Big congratulations to @brian_armstrong, @FEhrsam and the entire @coinbase team on a monster debut today! Huge moment for crypto. To the moon! 👍🏻🚀🍾🥂🥳🎉🎈🎊
English
I wrote a smart card token driver for MacOS to interface with identities backed by Secure Enclave github.com/mwielgoszewski…
English
Marcin がリツイート
@dinodaizovi @mtrumpbour @collinrm @0xcharlie @nudehaberdasher There was a time, we all SummerCon’d together.
English
@mtrumpbour @collinrm @0xcharlie @nudehaberdasher This one time, at SummerC0n, @nudehaberdasher mistook me for a urinal.
English
I once had lunch with @dinodaizovi in Manhattan way before I lived in the US and @0xcharlie set it up
Anders Fogh@anders_fogh
I once had dinner with @JacobTorrey in Amsterdam
English
Marcin がリツイート
Marcin がリツイート
Alternative view: given that enterprise IT is a market for lemons, it is the buyer responsibility to manage that risk by making sure untrusted vendor code (read: all except a handful such as MSFT/Google/AWS…) is properly sandboxed & contained assuming it *will* fail
English
Marcin がリツイート
My take: if you have the team on-staff to invent ALTS, use that. Otherwise, use mTLS for your service-to-service communication. You should still use other authn/authz mechanisms that are closer to end-to-end, though.
English
Marcin がリツイート
If you know me you already know what I think about this but on the off chance you don’t: NCC Cryptography is legit.
@[email protected]@gerald_doussot
Join an amazing team and work on interesting cryptography projects and research at the forefront of information security and privacy! linkedin.com/jobs/view/2181…
English
Marcin がリツイート
I grew up on software exploitation, but always thought crypto was beyond me.
In the ~5 yrs since finding Cryptopals, I’ve found & exploited critical crypto bugs in products like secure messengers, and helped design secure protocols.
Thanks @tqbf @spdevlin @marcinw @iamalexalright
Jesse D'Aguanno@0x30n
Periodic reminder that you should check out cryptopals.com if you’re involved in making or breaking software that uses cryptography
English
Marcin がリツイート
