Bailey Basile

LIVE: Apple Security Research, our new blog and website at security.apple.com! We launch with an update on Apple Security Bounty (security.apple.com/blog/apple-sec…), and a deep dive into some fundamental XNU memory safety improvements with kalloc_type (security.apple.com/blog/towards-t…). Enjoy!

@sleevi_ @bradfitz @rolandshoemaker For the relevant macOS code: #L1725" target="_blank" rel="nofollow noopener">github.com/apple-oss-dist…

@sleevi_ @bradfitz You managed to nerd-snipe me because @rolandshoemaker's explanation did not ring true. Based on the solution and strictness checks I know are in SecCertificateCreate*, I suspect the real problem was an Extensions SEQUENCE of length 0.

Marketing via Go security releases? 🤷‍♂️

Just because a root certificate is in the built-in iOS/macOS trust store doesn't mean that it is trusted. Apple applies additional constraints via configuration updates to maintain a high-level of security. See support.apple.com/HT212865 for more detail.

@sleevi_ I thought we were friends!

New root program policy reqs announced this morning: apple.com/certificateaut…

The Security Research Device Program (SRDP) is currently taking applications for its second cohort. This is the last week to apply for an  Apple Security Research Device 🔐📲— apply today!: developer.apple.com/programs/secur…

my team is growing, would love to hear from you if building and breaking SoCs is your thing jobs.apple.com/en-us/details/…

I’m hiring secure OS engineers in Sydney, Australia. If designing kernels, hypervisors, and runtimes to be secure and robust is your kind of thing, please get in touch! jobs.apple.com/en-au/details/…

@MikhailJennings Generally, SWE at Apple is not remote-friendly; however a substantial portion of Security Engineering is remote. It very much depends on the candidate.

@BasileBailey Are remote positions an option? I'm from the EU

Love TLS, X509, Certificate Transparency, or ASN1? Or hate them and want to make them better? My team is looking for engineers! You can apply at the link. DMs also open. jobs.apple.com/en-us/details/…

my team work on securing all the new features we ship to our customers. we're recruiting and seeking diverse candidates! check out our job posting or DM me for details! jobs.apple.com/en-us/details/…

I’m hiring an engineering manager for the Secure Enclave OS to lead a strong team that sets a higher bar each year for software/hardware security. If you want to help evolve a key security component trusted by a billion users, please reach out! jobs.apple.com/en-us/details/…

Hi folks! The team I manage at Apple, the Authentication Experience team, is hiring a software engineer. We use empathy-driven development to make using apps and websites that have accounts more humane and safe for everyone. Bay Area role; DMs open for Qs. jobs.apple.com/en-us/details/…

Hi folks! My team is recruiting for a Security and Authentication engineer, focused on web-facing features. If you are interested, or know someone who might be, please reach out! jobs.apple.com/en-us/details/…

You can test technical enforcement of this updated policy using Seed 1 of iOS 14.6 and macOS 11.4.

Reminder to CAs: Apple's CT policy has changed effective 4/21/2021 00:00:00Z. If you're issuing certs with lifetimes greater than 180 days but less than 398 days, you need 3 embedded SCTs, not 2. support.apple.com/en-us/HT205280

Ininterested an internship at Apple working on WebKit or related tech? Some of the areas of opportunity: - DOM & Web APIs - Layout & Rendering - 3D Graphics - Security & Privacy - Web dev tools - Media - JS VM - HTTP stack DM if interested. RTs appreciated.