John Dunlap

Oh, are we now taking security advice from the company who leaked their source code less than 10 days ago?

My dear front-end developers (and anyone who’s interested in the future of interfaces): I have crawled through depths of hell to bring you, for the foreseeable years, one of the more important foundational pieces of UI engineering (if not in implementation then certainly at least in concept): Fast, accurate and comprehensive userland text measurement algorithm in pure TypeScript, usable for laying out entire web pages without CSS, bypassing DOM measurements and reflow

What I’ve always found amazing about CTFs is that "flag is flag". Whether you found an unintentional solve or pwned the browser with n-day for a XSS challenge, it didn't matter. I totally get the frustration of AI, but there is no solution other than accepting the change.

I started playing CTFs in 2022, and LLMs definitely changed the **competitive** CTF scene a lot, especially since mid-2025. I also started using LLMs in late 2025. Yes, those models did one-shot many challenges, but what's the fun of slopping them? I learned absolutely nothing 🥲

First, the term "Blackhat" is some old school shit. Every time I see someone use that word I check the calendar, I make sure I haven't been transported back in time to 1996. I can't tell if it's because they're unfamiliar with modern nomenclature (Threat Actor) or if they're glamorizing the past and trying to look cool and badass (no disrespect intended, it just catches me off guard). Second, Threat Actors do not learn differently, they are financially motivated and (historically) are unironically less technically savvy than defenders or "whitehats". Threat Actors often aim for low-hanging fruit, they don't really care about being sophisticated as long as they achieve their objective. The exception to this is Threat Actors who sell something (malware-as-a-service, for example) or state-sponsored Threat Actors who are assigned high-profile targets where low-hanging fruit isn't really accessible or ideal. I recommend people review some malware analysis write-ups or DFIR reports. A vast majority of "Blackhats" rarely demonstrate high technical skill (they're below average, or mediocre). This is usually eclipsed however when a seriously talented Threat Actor does something profoundly impressive and people say, "OMGZ DA BLACKHAT!!11". They're looking at the top 1% of "Blackhats" and missing the giant dumpster of shit to the left. I could also make an argument on the psychological make-up of Threat Actors (disliking authority, indifferent to others emotions, indifferent to how their behavior impacts others, glamorization of crime or money, etc), but that's a different story for a different time. I also could make an argument about how the giant dumpster of shit to left is so successful, despite being less tech savvy and aiming for low-hanging fruit, but as is tradition, different story for a different day.