Inquiries into security, risk, engineering and human behavior. C-plenty-of-Os @ https://nitter.gq/t.co/7ssmKbsPhh
Joined May 2016
- Tweets641
- Following213
- Followers148
- Likes637
eugene pilyankevich retweeted
The new Messaging Layer Security (#MLS) specification provides end-to-end security that makes it easy for apps to provide users the highest level of security, keeping user information safe even if the cloud service they’re using has been breached: ietf.org/blog/mls-secure-and…
eugene pilyankevich retweeted
#ePrint A Vulnerability in Implementations of SHA-3, SHAKE, EdDSA, and Other NIST-Approved Algorithm: N Mouha, C Celi ia.cr/2023/331
A few weeks after the war has started, we were asked to analyse one suspicious piece of software within state infra, only to find 17 dependencies with easy path to massive breaches if author pushed malicious update. So we've quickly hacked something together to act on it.
Evaluate the risks of #opensource libraries you want to use by learning more about their community.
RepoMetaScore analyzes metadata of #OSS repositories and outputs risk ratings based on location, commit history, and contributors profiles.
➤ cossacklabs.com/blog/introdu… #security
eugene pilyankevich retweeted
Have you always wanted a SU-34 “Fullback” strike fighter? But $50M is a little bit pricey?
Just donate $1000+ to support Ukrainian army and we’ll send you this tag recycled from a downed russian plane (it’s literally a piece of it with little engraving).
eugene pilyankevich retweeted
Any recommendation for anything needs to take into account the “system” (structure, bureaucracy, incentives etc.) that will need absorb the recommendation.
Most good ideas simply “bounce off” the systems they need to change.
Someone gave up holding my beer for a month so I got to read the news. So, what I'm missing out in regular infosec industry? 🧶
2
3
Event: Starlink ships dishes to Ukraine
Reaction: hundreds of people who can read history but don't understand basic physics are tempted to comment or even instruct others how defenders should use sat comms securely.
1
2
Best comment on ongoing events I’ve got is this 👇
Days are very hard and busy, so I wrote another short blog post. This time we will talk about asymmetry between security thinking and regular engineering thinking, why new shiny stuff is often so broken, and what we do about it (not really anything).
ivychapel.ink/posts/ineffici…
My Saturday reading got me to this and, I guess, this was the last drop.
Here's a small part of a huge rant that sits in my head for a while:
ivychapel.ink/posts/cybersec…
So, I wrote a post about log4j too
ivychapel.ink/posts/log4j/
We need bolder* thinking** in these turbulent times if we want to save the economy: data suggests that watching recent Ghost Busters movie decreases chance to die from Covid by 50% -> covid-datascience.com/post/i…
Skills attained by developers during 120-minutes long application security training constitute significant defensive value in real-world scenarios.
2
Dystopian angle I see is that metaverse sounds like building more insecure tech on top of existing stuff - but now with synchronous whack in physical spaces! I might even live in way more disastrous version of cyberpunk dystopia shitshow than I ever hoped, before I retire.
Metaverses
The Metaverse of Snow Crash is not the best analogy for the future, as the Internet looks more like Stephenson’s dystopian real world
stratechery.com/2021/metaver…
1
1
