Ammar Askar

@IceSolst @evelovesolive It is, a formal verification is only as good as your specifications, covering every case and making sure all implementations conform. WPA2 was formally verified but was still vulnerable to KRACK galois.com/articles/forma…

@evelovesolive Interesting, I always imagined this would be extremely difficult and inevitably leave gaps, esp for more complex systems

Formal verification is protecting code and hardware from all possible hacks!

@colemurray @IntCyberDigest Fixed today so yup, record time indeed.

@IntCyberDigest legend let me guess, it’ll be fixed in record time x.com/_colemurray/st…

‼️🚨 BREAKING: Another researcher skipped coordinated disclosure entirely and dropped a critical 1-click GitHub token theft in public because he doesn't want to deal with MSRC. In his own words: "I really don't want to deal with MSRC on VSCode bugs." The bug: just clicking a link can hand an attacker a GitHub token that reads AND writes to all your repos, including private ones. It lives in github[.]dev, GitHub's browser-based VSCode editor, which passes the browser an OAuth token that isn't scoped to a single repo. That token can touch everything you can. Researcher Ammar Askar found that VSCode's sandboxed "webviews" leak keyboard events to the main editor. A malicious repo opened via one link can simulate keystrokes, install a local extension that skips VSCode's publisher-trust check, and exfiltrate your token. He published a working proof-of-concept. He says when he reports github[.]dev bugs, GitHub tells him they're out of scope and to go report to MSRC, and a prior VSCode bug he reported was silently fixed with no credit. One commenter summed up the mood: "MSRC has turned into Feedback Hub."

@zemnmez Oh yeah, your write up was awesome, learned a bunch from it! The twitter thread was also very entertaining.

kinda dope i got a shoutout in this

Full Disclosure: 1-Click GitHub Token Stealing via a VSCode Bug blog.ammaraskar.com/github-token-s…

@atlurbanist @AngieAsadourian Tech square around 5th and Spring is a good bet. If you don't count students, maybe 8th and Peachtree St NE.

@AngieAsadourian Can you recommend a particular block or two in Midtown were I could observe a lot of pedestrian activity on sidewalks on weekday mornings? I'd like to visit.

Question: Is there an Atlanta street or block that's particularly vibrant with pedestrian activity on weekday mornings? I heard form someone that Midtown sidewalks can be creepily quiet in the mornings, given the density. Just wondering if any place has a lot of activity.

@isidentical Key/value type restrictions? Does it have to work across versions? Quick thought would be to just dump the whole in-memory dictionary and mmap it into place. Looks like mmappickle.readthedocs.io/en/latest/ does something like that for a limited set of values and string keys.

what is the best way to load an immutable python dictionary (~13GB of kv pairs) from a local file. ideally with pre-allocating the memory so we don't loose time on it.

@R1amu__ @nobelsucks You don't get a vote

@nobelsucks I vote no

I think we should let twinks vote

@SpraklingTwit We've hit peak Spotify

what the fuck

Little easter egg in here for the memers: github.blog/2023-10-25-cyb…

@R1amu__ Good way to support them but I just use Dropbox

Am I about to spend $8/month on Obsidian sync?... Much better value proposition than Twitter Blue 🤔

@SpraklingTwit Spend less on movies!

can someone who is good at budgeting help me Food - $50 Cell phone - $100 Transportation - $50 DragonCon costumes - $2,000 Movies - $25 please, my family is starving

This isn't the first time Microsoft has botched handling vscode security. More details on my blog here: blog.ammaraskar.com/vscode-rce/

Suffice it to say I'm very dissapointed in @msftsecresponse and @code around their handling of this. Two months to triage an RCE and mark it moderate severity and ineligible for bug bounty is crazy to me.

I found a remote code execution bug in VSCode that can be triggered from untrusted workspaces. Microsoft fixed it but marked it as moderate severity and ineligible under their bug bounty program.

@__phantomderp You may already know this but for what it's worth, PSF fellows aren't necessarily developers of the Python language (that's the Python core dev team). Anyone can nominate someone who has had a big impact in the Python ecosystem to be a PSF fellow.

🙃 I didn't know he was a PSF Fellow. I, uh. I use python mostly for scripting so it's not like my life depends on it but this is gonna feel... extra weird. (It's doubly weird because I parasocially know other PSF engineers and they're lovely so WTF!) twitter.com/BajoranEnginee…

Very cute that because I'm a person of color, Armin here thinks I'm just a Diversity Speaker and not anyone of technical merit.

@R1amu__ Bro they really went out and made a separate app is absurd

1.4 rating oh Christ.