Mathias Payer

6.2K posts

Mathias Payer banner
Mathias Payer

Mathias Payer

@gannimo

Securitatis inquisitor and professor at @EPFL_en leading the #HexHive 🐝 group, focusing on system/software security. @[email protected] (he/him)

Lausanne, Switzerland Katılım Aralık 2010
385 Takip Edilen8.2K Takipçiler
Mathias Payer
Mathias Payer@gannimo·
@thegrugq @TheOfficialACM ChatGPT tells me to run algorithms and machine learning to detect collusion and other malicious review patterns but it refuses to give me names. ChatGPT is not snitching!
Mathias Payer tweet media
English
0
0
0
377
Mathias Payer
Mathias Payer@gannimo·
The review process is under threat and we must make it resilient against adversarial attacks. Proud to be part of @TheOfficialACM PROTECT where we'll look into securing academic reviewing sigsac.org/protect.html
English
3
9
93
11.7K
Mathias Payer
Mathias Payer@gannimo·
@bsdaemon My guess is that you can almost fully automate the generation of test cases and mock environments. That's already saving a lot of time and could map to the 1/4 of new code.
English
0
0
1
326
Rodrigo Branco
Rodrigo Branco@bsdaemon·
Somehow I do not feel threatned but actually even more relaxed about job security? Jokes aside, interesting data point, no wonder they want memory safe languages so badly: logic bugs that AI introduce are likely harder to find (at least for now) than memory safety ones AI introduces?
Rodrigo Branco tweet media
English
4
5
26
3.7K
Mathias Payer
Mathias Payer@gannimo·
I'd argue the opposite. General purpose grey box fuzzing research is complete as it is no longer feasible to distinguish between optimizations and over-fitting. Per-target optimizations should be left as an engineering exercise.
Dongdong She@DongdongShe

Are general-purpose fuzzing research dead? Our answer is probably no. Check our new fuzzer work FOX. The awesome fuzzer @aflplusplus is already super-powerful and quite an effective baseline in academics and industry. But there is still room to improve upon. We introduce FOX (CCS 2024), a new general-purpose fuzzer. We formulate the fuzzing as a scholastic online control problem and advance the performance of AFL++ by up to 26.45% in real-world standalone programs and 6.59% in FuzzBench programs. Check our talk at CCS'24 @acm_ccs, fuzzing session 1, Oct 16th, 1:30 PM – 3:00 PM, at Grand Ballroom Salon F. Paper: arxiv.org/abs/2406.04517 Code: github.com/FOX-Fuzz/FOX

English
2
6
28
11.6K
Mathias Payer
Mathias Payer@gannimo·
@lauriewired LEA is like an add combined with an up to 3bit shift without clobbering the flags register 😅
English
0
0
1
294
LaurieWired
LaurieWired@lauriewired·
What’s the difference between MOV and LEA in assembly? These instructions are often read almost interchangeably, but both serve distinct and important purposes. LEA retrieves and stores an address or pointer to the location of data. The MOV instruction is like dereferencing this pointer to store a copy of the actual data.
English
17
22
336
30.5K
Mathias Payer
Mathias Payer@gannimo·
@is_eqv That's the issue: papers get accepted if they improve over AFL++ in the first 24hrs on existing benchmarks. I.e., they over-fit. Then throw in a few MITRE-assigned CVEs to round off the research paper. Long term, these papers will not improve that status quo (much)
English
1
0
5
303
is-eqv.bsky.social
is-eqv.bsky.social@is_eqv·
@gannimo Beating AFL++ on the first 24 of persistent mode fuzzing is just too hard you get better signal & ROI when you don't compete there and rather go where AFL++ already stopped being all that useful. (Or just do harnessing work, but people don't seem to like that either)
English
1
0
6
332
Mathias Payer
Mathias Payer@gannimo·
@is_eqv Another beef I have is that we only evaluate the first 24hrs, so or benchmarks only measure the warmup performance while in industry there are large corpora that are fuzzed exhaustively. Most other benchmarks in systems exclude the warmup phase...
English
2
0
6
556
is-eqv.bsky.social
is-eqv.bsky.social@is_eqv·
@gannimo Like: If there was a way to get libfuzzer-harness level coverage/time out of a generic target binary with no human effort and no false positives. That would be a trivial win in general purpose fuzzing.
English
1
0
1
437
Robert Graham
Robert Graham@robertgraham·
Fact-check: Trump did not actually work a shift at McDonalds. The McDonalds was closed for the event It was only a photo-op, that lasted about an hour, not a shift. He served customers through the drive in window -- ones that were selected by the campaign and vetted by the secret service, rather than real customers. Trump disputes Harris's claim she worked at McDonalds when she was young. You can appreciate the irony of Trump then lying about working at McDonalds. independent.co.uk/news/world/ame… phillyburbs.com/story/news/loc… perplexity.ai/search/did-tru…
Donald J. Trump@realDonaldTrump

English
27
24
170
25.5K
Mathias Payer
Mathias Payer@gannimo·
We'll still see some per-niche customization where the contribution is not in fuzzing but in the customization for each target environment.
English
0
1
7
1.7K
Mathias Payer
Mathias Payer@gannimo·
France, as always going with the times. Nearby we saw a cyber café as well so they are future proof!
Mathias Payer tweet media
English
0
0
5
1.7K
Mathias Payer
Mathias Payer@gannimo·
They grow up so fast. Happy first review anniversary to our paper in ACM TOPS! 🥳🎉 Looking forward to getting our first set of reviews soon!
Mathias Payer tweet media
English
6
5
63
13.4K
Prateek Mittal
Prateek Mittal@prateekmittal_·
@EarlenceF @lzcarl Would be helpful if PC chairs of all security conferences speak up and shed more insight on such issues
English
1
0
1
166
Ajay
Ajay@ajay9470·
searched for "if rust has long jumps" and got results for how far you can jump in the game rust
English
1
0
7
574
Mathias Payer
Mathias Payer@gannimo·
Who's around for @acm_ccs? Come say hi if you want to talk about software security, fuzzing, or compartmentalization, just to rant about academia, or grab a Swiss chocolate that I brought along!
Mathias Payer tweet media
English
1
1
29
2.2K
Mathias Payer
Mathias Payer@gannimo·
@Tig2017 I know for a fact that the proposal was submitted this week 😅
English
0
0
1
15
Yves Meier
Yves Meier@Tig2017·
@gannimo Well, I guess e-mailserver had a loooong mail-queue 😅
English
1
0
0
16
Mathias Payer
Mathias Payer@gannimo·
Mail from this morning: "we kindly ask you to submit this letter by 15th August 2024 (17:00 CET) at the very latest." BRB, just getting my Delorean's flux compensator warmed up 🏎️🔥
Mathias Payer tweet media
English
3
0
11
1.4K

Keşfet

@thegrugq @TheOfficialACM @bsdaemon @ciphernyx @acm_ccs @mboehme_ @is_eqv @lauriewired