namazso retweeted
How to find ALL PHP bugs:
1. Compile code (e.g. to RISC-V, x86, LLVM IR)
2. Vibe prove ASAN and non-ASAN versions have same behavior across all inputs. Hard, but Claude can do it!
3. Find a LOT of bugs
Super proud of our work. A big step towards finding ALL memory safety bugs
New on our Frontier Red Team blog: using Claude to formally verify software at large scale.
Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time).
With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks.
Read our research in full here: anthropic.com/research/formaā¦
namazso retweeted
Claude, plz rewrite wordpress in rust. Yes all the plugins too. No I don't just mean the source code, I mean like, go replace everybody's wordpress install.
You don't have access, well funny thing...
namazso retweeted
āPublicly shared Claude AI chat and artifacts are available onlineā¦ after the used made them public, by choice, by clicking through multiple optionsāā¦ doesnāt sound as punchy of a headline š¤£
Some people's chats with Claude AI found to be publicly available online bbc.in/4fAI5vE
Readers added context they thought people might want to know
Chats found online were ones users chose to share via Claude's public link feature. Anthropic says these are public by design, not guessable unless shared, and may be indexed like other public content. Private chats remain private.
ca.news.yahoo.com/peoples-chats-ā¦
support.claude.com/en/articles/10ā¦
Just released a new torrent client/daemon, rsbtd. I always hated how all three popular daemons had various drawbacks, but only recently found some time to actually do something about it.
github.com/namazso/rsbtd
I actually built some parts multiple times with several models, reviewing the output. My experiences:
- Fable is much better at tasks with less obvious goals or evaluability such as API design or UI
- Sol is much better at reviewing, because it doesn't block every prompt
I always found uutils using Rust file IO misguided from the start. Whenever I dealt with security-sensitive file ops (on Windows) I had to just make my own abstractions to retain any security, I imagined itād be same with fds.
But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:
seclists.org/oss-sec/2026/q2ā¦
It seems Iām a webdev now: imgcmp.com/
Imgsli has been down for a while, so I rebuilt it from scratch
namazso retweeted
How QUAKE.EXE got its TCP/IP stack:
šfabiensanglard.net/quake_chuā¦
Ever wanted to stub out some function with a hook, but it was inconvenient to find or hook it? No problem, just hook a callee ('s calle)* and do a super return! Itās even CET compatible! gist.github.com/namazso/bb47ā¦
namazso retweeted
One-Click RCE in ASUSās Preinstalled Driver Software
mrbruh.com/asusdriverhub/
namazso retweeted
Another pointless weekend project - a playable version of the old 3DMaze screensaver from Windows 9x.
I reverse-engineered the original screensaver binary and added user-input functionality for the controls (and fixed some other minor issues!)
github.com/x86matthew/Playabā¦
Dropping my newest Windows vulnerability that Microsoft refuses to acknowledge!
New Windows Driver Signature bypass allows kernel rootkit installs - @billtoulas
bleepingcomputer.com/news/seā¦
bleepingcomputer.com/news/seā¦
Fun fact: If your first 20 blocked people got deleted for spam, your blocked accounts menu permanently breaks, and you can only possibly unblock people by getting your twitter data export and hacking up a script. Thanks Elon!
Just published two new projects, github.com/namazso/dll-proxyā¦ and github.com/namazso/dll-univeā¦
I always missed how there is no dUP2 but for dll hijacking runtime patch ā now there is! Iāll port MagicSigner over to it soon as well.
Seems like Hex-Rays is trying to erase their crypto oopsie (seri.tools/blog/ida-72-passwā¦ writeup by @seritools, still up fortunately) with fake DMCAs, just got one on GitHub. Shouldāve just asked me over mail instead tbh.
namazso retweeted
Iām a C programmer so forgive me for the (maybe) dumb question.
I see people saying that the CS catastrophe shows that we need to switch to Rust.
But the bug was in the parser, handling bad input. In this case wouldnāt Rust panic, and end up in a BSOD as well?
Iām begging for infosec people, please before announcing something is āvulnerableā at least read the documentation, just in case it explicitly details the supposed vulnerability such as here. Developers like me donāt just write them as a joke.
