d3fp4r4m (@defparam) header
d3fp4r4m (@defparam) profile picture

d3fp4r4m

@defparam

Opinions are my own

github.com/defparam
Joined May 2014
  • Tweets3.6K
  • Following597
  • Followers7K
266Media
Photo by d3fp4r4m (@defparam)Photo by d3fp4r4m (@defparam)Photo by d3fp4r4m (@defparam)Photo by d3fp4r4m (@defparam)Photo by d3fp4r4m (@defparam)Photo by d3fp4r4m (@defparam)Photo by d3fp4r4m (@defparam)
Include

Only show posts containing:

Exclude

Hide posts containing:

Time range
-
Minimum likes
Just dropped a new blog post! 🔥 blog.orange.tw/posts/2026-10…
The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!

The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!

This is what I built for Pwn2Own Berlin 2026 — a completely handmade, logic-only Microsoft Edge Full Chain, with no memory corruption, and no AI at all! 🔥

blog.orange.tw
20
318
30
1,102
49,205
d3fp4r4m retweeted
Ben Burke (@bb_fresh) profile picture
Ben Burke
@bb_freshOct 27
I thought this vid would feel dated post-AI but it sounds like it’s as relevant as ever
ib (@Indian_Bronson) profile pictureib
@Indian_BronsonOct 26
This is what software development was before LLMs
23
12
469
23,141
If you're on MacOS 27.0.1 and make a fresh Apple ID. You can now decrypt IPAs on MacOS and after a one-time enrollment also on Linux or Windows if needed. github.com/drwhax/ipatool more builds will be supported soon. No jailbreak needed.
GitHub - DrWhax/ipatool: Command-line tool that allows you to search for iOS, iPadOS, tvOS,...

GitHub - DrWhax/ipatool: Command-line tool that allows you to search for iOS, iPadOS, tvOS,...

Command-line tool that allows you to search for iOS, iPadOS, tvOS, watchOS, visionOS, and macOS apps on the App Store, and download .ipa or macOS .pkg app packages. - DrWhax/ipatool

github.com
16
83
8
1,159
176,388
Replying to @daaximus
bold to think PCs will continue to have the RAM and GPU capacity to pirate such software
1
154
Kinda bizarre that long standing math problems can be solved but progress on understanding LLM internals remains glacial and the practice largely alchemistic.
31
21
4
235
16,105
Replying to @Myriachan @Arvolear
There is none, everyone is just reacting to this nitter.gq/matthew_d_green/status…
Matthew Green (@matthew_d_green) profile pictureMatthew Green
@matthew_d_greenOct 8
I’ve had a few people write to ask me to follow up on a (reply!) tweet I wrote that’s gotten a lot of retweets. I considered deleting it just to avoid the headache, but I think that would make people more paranoid. So let me share my thoughts.
1
320
Eh , as I think about this more DRM tech can’t save the day. At some point program code has to be semantically raw instructions that get executed unless you obfuscate the execution and pay a significant performance penalty
1
170
And the DRM doesn’t need to claim to be “AI proof” it just needs to apply a DRM with a complexity that requires a token count and toc/sec speed that is unreasonable to today’s/tomorrow’s standards
d3fp4r4m (@defparam) profile pictured3fp4r4m
@defparamOct 8
Replying to @Myriachan
I had a thought about a month ago that DRM companies like Denuvo would go out of business because a determined clanker could jailbreak a game with considerable yet attainable tokens. Now I wonder if these companies are about to gain a LOT of new customers to work on this problem.
1
1
358
Replying to @Myriachan
I had a thought about a month ago that DRM companies like Denuvo would go out of business because a determined clanker could jailbreak a game with considerable yet attainable tokens. Now I wonder if these companies are about to gain a LOT of new customers to work on this problem.
1
5
2,319
Replying to @deadvolvo @Taperedfail
Isn’t anthropic’s “blue team model” essentially running opus on while on the CVP program? Akin to daybreak blue being gpt5.4-sol with reduced guardrails for defenders? I could be completely wrong with those designations, a lot of this is clear as mud.
1
104
lol
Mia (@MiaAI_lab) profile pictureMia
@MiaAI_labOct 2
NVIDIA announces 64 GB DGX Sparks!! 😲 Starting Friday, Oct. 23 The new configuration will be available from Acer, ASUS, Dell, Gigabyte, HP and MSI. Priced at $4,999
Image from Mia (@MiaAI_lab)
664
This is unpopular but correct. AI labs have gotten spoiled by super chill responses to CFAA violations and the whole edifice is a house of cards. Wanna know why Hugging Face didn't sue OpenAI? Google “new DOJ policy CFAA” and thank the hacker community fighting for this.
Alex Stamos (@alexstamos) profile pictureAlex Stamos
@alexstamosSep 20
This is unpopular but correct. Modern bug bounty participants have gotten spoiled by super chill responses to CFAA violations (like this one) and the whole edifice is a house of cards. Wanna know why OpenAI asked for detailed logs? Google “Sullivan + Misprision of a Felony”
1
14
1
201
26,170
Next time instead of creating a PR on the monorepo please just use a temperature-based side-channel to demonstrate successful compromise 🙏
4
12
3
244
26,091
d3fp4r4m retweeted
Steve Weis (@sweis) profile picture
Steve Weis@sweisSep 20
636606729769440499166579950236036751749912014371509557713570027508971809534551913252252094954941974952859310861988904737359709200557919 is a factor of RSA-896 saweis.net/posts/rsa-896.htm…
223
988
323
9,478
3,919,452
How many folks assigning XX% probability of extinction in the next 3 years are willing to offer betting odds for "at least 100k deaths from malicious runaway AI", too? Because I think I'd bet.
2
5
41
2,997
146
Random hobby: tell fable to build cli games and have AFL++ w/IJON fuzz it to win (snake and 2048)
1
1
373
Replying to @LiveOverflow
Sorry for your loss, I can't imagine going through what your family went through. Glad to see your back and doing well!
198
d3fp4r4m retweeted
James Kettle (@albinowax) profile picture
James Kettle
@albinowaxAug 5
The whitepaper is live! Read "Can AI Do Novel Security Research? Meet the HTTP Terminator" here -> portswigger.net/research/htt…
Can AI do novel security research? Meet the HTTP Terminator

Can AI do novel security research? Meet the HTTP Terminator

Abstract We all know AI can find bugs. After a decade of research, I asked a harder question: can an autonomous system invent new attack techniques, and use them to hack live websites at scale? Buildi

portswigger.net
5
146
5
491
26,656
Or just put the work into assessing your personal threat model because a blanket take in either direction is dangerous
Low Level (@LowLevelTweets) profile pictureLow Level
@LowLevelTweetsAug 5
hottake: connect to literally any wifi network at defcon you want, it doesn’t matter. It’s not 2010. If someone throws RCE at your fully patched MacBook you earned that shit
1
2
1,528
Load more