alkalinesec.bsky.social - Profile | ThreadSky | a Reddit-style client for Bluesky

Being an exploit dev in 2025 allows you to write JavaScript professionally without having to use React, Node.js, or any library at all, really—there’s something beautiful about that

submitted 3 days ago • 1 comment

apple typhlosion

submitted 5 days ago • 39 comments

incredible exploit

submitted 5 days ago • 0 comments

github.com/electronicar... 🔥🔥🔥

submitted 6 days ago • 0 comments

Speedrunners are Vulnerability Researchers https://zetier.com/speedrunners-are-vulnerability-researchers/

submitted 6 days ago • 0 comments

this is such an annoying issue when trying to do hacky mobile app dev stuff. every answer about reflection or using private frameworks is like "gp/apple says not to do this, so you are bad and dumb for asking"

submitted 8 days ago • 0 comments

We're excited to join Bluesky! The Lean FRO develops Lean, an interactive theorem prover and functional programming language advancing mathematics, formal verification, and AI. Follow us for updates on our roadmap and community. #leanlang #leanprover #mathematics #formalverification #ai

submitted 10 days ago • 0 comments

"type theory" is just a theory. like evolution. and last time i checked there were no dinosaurs OR monads in the bible

submitted 15 days ago • 1 comment

Comparison of Android-based Operating Systems https://eylenburg.github.io/android_comparison.htm

submitted 15 days ago • 0 comments

it looks like lte infra was hosting @moyix.net 's evangelion ctf challenge. but i doubt the terminal interface for CVE-2024-24451 was as cool

submitted 16 days ago • 1 comment

sometimes the legitimacy of these files is so extreme they panic the kernel or crash BackgroundShortcutRunner. this is both normal and good.

submitted 16 days ago • 0 comments

Headline: 19 Year Old DDoS Skid Gets Access To Nations Infrastructure Security Bug Reports

submitted 17 days ago • 1 comment

New updates in LIEF including better support for PE modifications and ARM64EC/ARM64X binaries. Blog post: lief.re/blog/2025-02...

submitted 20 days ago • 0 comments

everyone using lockdown mode is missing out on incredibly cool and extremely legitimate watchface and shortcuts files. turn off lockdown mode today!

submitted 25 days ago • 0 comments

Crap crap crap. www.washingtonpost.com/technology/2...

submitted 30 days ago • 17 comments

@xbow.com has been busy in the first few weeks of 2025 – our agent has autonomously found 106 vulnerabilities in OSS projects, and we've reported 72 so far! Amazing work by @nicowaisman.bsky.social and the security team triaging these and getting them into the disclosure->fix pipeline!

submitted 30 days ago • 2 comments

oh hello there: github.com/google/secur...

submitted 33 days ago • 2 comments

Formally verified binary-level pointer analysis. ~ Freek Verbeek, Ali Shokri, Daniel Engel, Binoy Ravindran. arxiv.org/abs/2501.17766 #ITP #IsabelleHOL

submitted 36 days ago • 0 comments

Remember to spread a little joy, even if it will be fleeting

submitted 37 days ago • 67 comments

New attacks on load address prediction, affects Apple Silicon. predictors.fail

submitted 39 days ago • 2 comments

this aspect of differential cryptanalysis research always cracks me up a little. afaict half of the published attacks just come from smart people thinking about it really hard

submitted 39 days ago • 8 comments

This afternoon I asked Ole about a bug with Frida & iOS simulator. 2 hours later he had a fix committed and just now he published a new release including the fix ❤️ Absolute legend, thanks for everything you do. frida.re/news/2025/01...

submitted 40 days ago • 0 comments

Happy and honored to receive the 2025 ACM SIGSOFT Influential Educator Award! The citation refers to my work on interactive textbooks such as fuzzingbook.org and debuggingbook.org. Thanks to all who helped making this possible!

submitted 43 days ago • 7 comments

C IS LEGAL AGAIN

submitted 43 days ago • 23 comments

This is a great post on bug bounty reddit! OP reported an IDOR, gets paid $2,000, and then realizes it never was IDOR. It's just a cached response...

submitted 44 days ago • 3 comments

goin out on top

submitted 44 days ago • 0 comments

didn't know about the XNU commpage before. definitely cool to have a known readable address with some interesting info in it. github.com/apple/darwin...

submitted 45 days ago • 1 comment

this is a silly example of radius2 automatically solving a very simple pwn challenge from xmas ctf 2019. a simple buffer overflow leads to an unconstrained ret addr which is then set to be the xref of the flag prefix X-MAS

submitted 73 days ago • 0 comments

submitted 76 days ago • 1 comment

every time i start a ctf to try to test radius2 stuff the rev challenges are like "heres a custom level from Sims 2...". tonight all the challenges are fuckin verilog. can i please just have one (1) normal elf binary

submitted 78 days ago • 0 comments

crackme100 from picoCTF 2024 is a good example of how odd SMT solvers sometimes are. many correct inputs exist, including only using [a-z]. but adding an unused _ to the allowed chars lowers the solve time from 24s to 7s.

submitted 79 days ago • 1 comment

radius2 solution to this educational crackme! unfortunately the printf sim assumes that the format args are in x1... instead of pointed to by x8 which is the *OS convention. for a christmas gift to myself i will fix this and make a bunch of other radius2 improvements

submitted 79 days ago • 2 comments

if one-time pads are so good why is there no two-time pad?

submitted 79 days ago • 0 comments

Did you solved yesterday’s advent crackme using ESIL emulation? If so, try writing a oneliner that solves it without any extra interactions! Post it if you do! Today's advent post will help you learn about moving around the disassembly more swiftly! www.radare.org/advent/12.html #aor24

submitted 86 days ago • 1 comment

too many browser extensions slowing down your mac? just delete everything in /System/Library/Extensions

submitted 88 days ago • 0 comments

very cool use of z3 www.mattkeeter.com/projects/syn...

submitted 90 days ago • 0 comments

Two students I supervised just got the CAST award 🥇 Both reversed wireless components in the iOS ecosystem. Nils Rollshausen for their thesis ⌚️ "WatchWitch: Investigating Apple Watch Interoperability and Security" Inga Dischinger for her thesis 📸 "Security Analysis of Apple's Continuity Camera"

submitted 91 days ago • 1 comment

submitted 98 days ago • 2 comments

theres def still lots of silly macOS / iOS env var vulns. QuartzCore lets you create arbitrary files with X_LOG_FILE. might be able to make a TCC bypass or something with it, i haven't checked. fun fact: it also used to put this var directly into a call to system()

submitted 98 days ago • 1 comment