22. security researcher @Hashlock_, my sensei @0xSorryNotSorry, prev game designer https://xitter.cf/t.co/0ZHCkSxkRc
Joined May 2023
- Tweets898
- Following902
- Followers1.1K
- Likes6.2K
pessimist retweeted
If you
- got a good night of sleep last night
- have < 10 Slack notifications
- were not besties with PagerDuty or OpsGenie
- woke up and business as usual
then thank your local security professional today
Open Machine Payments Turkiye is here!
Exploring agentic payments through Turkey's existing payment service providers and e-commerce platforms, starting with an experimental @iyzico × @mpp adapter.
Fully open source, payments tested in iyzico's sandbox: github.com/omptr/iyzico-mpp
Payment layer first, more demos and fun experiments on the way :)
Follow along: omptr.org
use @FibrousFinance for safe dex aggregation and swaps. evm contracts built by two security researchers, me and @natzuu9 🫡
pessimist retweeted
So far in our posts, we’ve mostly shown the positive side of bug bounties people earning, transitioning, winning big.
Today is different.If you’ve actually tried bug bounties, spent weeks or months on a target, submitted a solid finding and then got ghosted, lowballed, marked “won’t fix,” or stuck in endless mediation this one is for you.
Today’s Security Voices features @marcohextor
Marco has been around the blockchain for a long time. He doesn’t live on Twitter. He disappears for months, takes care of real life, his farm, chickens, soil and still comes back with serious findings.What stood out wasn’t just the technical work.
It was how clearly he described the relationship problems between researchers and protocols.Some thoughts from the conversation 👇
pessimist retweeted
Try it now!
paradigm.xyz/puzzles/claw/
Since 2024, I've been waiting for someone to build a bug bounty platform where projects can subscribe to AI security agents, or for existing bug bounty platforms to introduce a dedicated section for this or evolve in that direction. That's roughly how I picture the future of bug bounty. Proper automatic duplicate detection, with competent triage agents on both the project and platform sides. Projects are subscribed to the agentic security providers they trust, receiving regular updates. Maybe at some point (probably not that soon) we won't even need to meat-proxy between builder and security agents.
In web3sec, @code4rena's Bot Races were the frontier example of this concept.
It could make sense for open-source projects and much of crypto. If no one's interested in building it, I guess I'll do it myself at some point, and it won't involve all the bullshit bureaucratic steps and financial gatekeeping.
pessimist retweeted
This shouldn't happen. Rules must updated to prevent projects from even trying to do this. What's the point of a bounty program if preventing real exploits isn't rewarded?
I'd go for a mediation
pessimist retweeted
Average payout over the time axis would be an interesting stat here...
We've recently crossed 10,000 paid vulnerability reports on @Immunefi!
That's over 10,000 security issues found and reported before attackers could exploit them.
And over 10,000 reasons why crypto is safer today, thanks to the work of our community of whitehat hackers around the world 🫶
i knew Veria Labs would cook something big like that, imo they are currently the best AI based security team. this finding deserves far more than $250k
It feels like the cryptography doom narrative is made to attract attention and capital to privacy tech.
I'm not complaining about this, I even wish we hadn't shifted our focus away from privacy at all, but I don't buy that the doom scenario isn't quite that imminent.
Am I being schizo?
Since Web3 became a thing, the supply of Web3 security services has been scarce relative to demand because of how niche the field is and how difficult (and risky) it is to develop expertise.
For the first time, I feel like we've entered a period where the supply of Web3 security exceeds demand. I don't think I need to spell out what that says about the quality of the current supply.
I've been in this space for a long time, and unfortunately AI hasn't changed how silly the hacks are. Either it's not as effective as we think, or we’re failing to get quality AI security products to projects. If you don't believe me, see for yourself: rekt.news/
Keep in mind that I'm saying this as a longtime "AI believer". Back in 2020 (when I was 16), I was learning TensorFlow, object detection models, and a bunch of ML fundamentals, and I was convinced AI would play a huge role in the future. Besides going through tons of free resources, I also bought two paid course back then, so I have proof xD
Udemy certificate nos:
- UC-1985d755-c371-4942-ac69-206e6effcbec
- UC-72e4a8ea-50eb-4016-a5eb-8a1ff793437b