It's /ʲustɑs/ • security research • machine psychology • privacy • FOSS
🌐 🇺🇦 🇦🇷
Joined January 2021
- Tweets2.4K
- Following749
- Followers1.3K
- Likes14.5K
Pinned Tweet
I climbed a few more places on the @ethereumfndn bug bounty leaderboard! A bit late to share, but still happy happy
+rep to the triage team, I see in real time how they've been improving the process
I remember I was looking for consumers of a lib a year ago or more, had to download hundreds of repos using Github dependents, reduce candidates locally with regexps, sort by stars, and then pass with human eyes. Little did I know how easy search would be now with LLMs :')
I couldn't find any meaningful impact in the end, the bugs in the lib are now patched
You can use full regular expressions on GitHub code search. I'd bet it wasn't available the last time I checked, but who knows.
Most projects upload their code to GH, so it's the best low-effort, indexed db.
If you've got a pattern, you can quickly find other instances with a regex.
eg you can match expressions that contain new lines:
/ call\(\s*gas\(\)/
Or match contracts with pragma 0.8.3x -- matching "solidity ^0.8.31", "solidity 0.8.31", "solidity >=0.8.31"
/pragma solidity .*0\.8\.3\d/
You can combine them with other GH-only expressions. Like Solidity-only files:
path:*.sol
Ignore tests, mocks, and scripts:
NOT path:*.t.sol
NOT path:*.s.sol
NOT path:test
NOT path:mock
All together:
/ call\(\s*gas\(\)/ /solidity .*0\.8\.3\d/ path:*.sol NOT path:*.t.sol NOT path:*.s.sol NOT test NOT mock
Now you've got many of the most recent coded contracts that contain low-level calls.
Gnosis Pay was hacked!
Judging by the only full screenshot I've seen somebody posted, the breach notes are personalized (well, they say so in the letter too)
E.g., mine didn't have a card leak, home address, email, IBAN, and other data you can compare below, possibly because my account was closed a long time ago after they asked for a second KYC check
We had a data breach affecting the system powering Gnosis Pay-branded cards (our B2C business line) that resulted in the exposure of certain customer information.
Everyone affected was sent an email today with full information.
We deeply regret that this happened. While funds were not affected, the security of personal information is just as important and we take full responsibility.
Additional measures are in place until the B2C platform involved is fully retired as planned on 20 December 2026. In the meantime we encourage everyone to be even more vigilant. We will never ask for your PIN or seed phrase, or ask you to move funds.
Further Details: gnosispay.com/blog/data-brea…
We encourage security researchers to communicate security vulnerabilities directly with us via [email protected]. The same rewards apply as to Gnosis Chain: immunefi.com/bug-bounty/gnos…
I'm engineering a web wrapper for my workflows to facilitate management of my bug hunting workers and reduce complexity and the amount of supervision needed
The idea for the latest feature came to me while I was chilling. It was to add an "Online" button, streaming the status into a local file
As you can see, my agents are now subscribed to the file and know when I'm available to make decisions or steer their work
A simple solution to make autonomous work much more productive
Went on a little trip to Ushuaia, Argentina's southernmost city, in Tierra del Fuego to clear my head and touch grass
This is the place where ships set sail for Antarctica
You can see local mushrooms in the first photo, which are known as pan de indio (Cyttaria hariotii, aka "Indian's bread", a species apparently traditionally eaten by Indigenous people)
They grow on Nothofagus - southern beech trees, which dominate the local forests and have a very distinct look. A bit unfamiliar to me, as most of the forests I grew up around in Ukraine were pine
But there were lots of birds of many kinds and sea life. Once, I was able to spot a few seals in the wild, fishing, not far from the beach. On another occasion, a few colonies of penguins and sea lions. Twice, a southern giant petrel, and a black-crowned night heron (if my sources are correct)
Marvelous experience overall, highly recommended
😬
Honestly, it's beyond me how there are still such things as "blind signing" (wtf does that even mean) and 3s long tap confirmations on each one of the 58 pieces of calldata any modern dex swap requires (with expiration!)
Is there some fundamental problem in allowing to scroll the calldata string on a 3-4 inch display?
Well, it now seems like the whole Internet was compromised in the last few days. Were there precedents of this magnitude before? Not sure, I must be too young to tell
I can tell, though, that LLMs and AI are hardly responsible if you want to blame them. The code made years ago had cancer inside that went undetected because we had no better diagnosis
I feel relief, if anything, because the demons the labs have been scaring us with for the last year are now real. This is no longer an uncertainty. We are out of the denial phase, and we can ask "What do we do now?" to step into acceptance
We'll iterate, review architecture and norms as the old ones are falling apart. Taking losses, but learning. And we'll build new ones as we always do when the world gets changed
Well, it now seems like the whole Internet was compromised in the last few days. Were there precedents of this magnitude before? Not sure, I must be too young to tell
I can tell, though, that LLMs and AI are hardly responsible if you want to blame them. The code made years ago had cancer inside that went undetected because we had no better diagnosis
I feel relief, if anything, because the demons the labs have been scaring us with for the last year are now real. This is no longer an uncertainty. We are out of the denial phase, and we can ask "What do we do now?" to step into acceptance
We'll iterate, review architecture and norms as the old ones are falling apart. Taking losses, but learning. And we'll build new ones as we always do when the world gets changed
I hope Ledger will update the hardware integrity page because the pictures there don't include all/latest revisions of the devices, which makes the comparison more difficult than it needs to be
Hi @wellington0x, to open a signer, here's what you should know first.
Opening the casing doesn't automatically void your warranty. A warranty claim only becomes invalid if the device is damaged as a result.
Signers aren't designed for routine opening, so be extremely careful, and use the correct tools. We offer support articles specific to each Ledger signer covering the main precautions. Each article also includes images of the official internal layout, including key components: support.ledger.com/article/4…
If you have lost funds - please ensure that before you open your device you have logged the issue with your local law enforcement and they have confirmed you can open the device.
If you need help or have questions, please contact us directly: support.ledger.com/contact-u…
Would be kinda cool to assemble your new hardware wallet by hand? Who'll be the first one to market like this?
Ledger Nano X can weigh anywhere from 34 to 36g, according to the official specs and past community measurements
Other models also vary enough in weight that weighing a device isn't a reliable check on its own. I guess it would also be possible to shave some weight off a device
