Loading...

Tag trends are in beta. Feedback? Thoughts? Email me at matthew@mastracci.com

The $1.5B Bybit Hack

Don't Recurse on Untrusted Input

Best practices for key derivation

Attestations: A new generation of signatures on PyPI

A deep dive into Linux's new mseal syscall

Fuzzing between the lines in popular barcode software

Microsoft didn't sandbox Windows Defender, so I did (2017)

Friends don’t let friends reuse nonces

"Unstripping" binaries: Restoring debugging information in GDB with Pwndbg

Why You Should Stop Using RSA: A Deep Dive Into Its Security Pitfalls

Notes on AWS Nitro Enclaves: Attack Surface

AWS Nitro Enclaves: Attack Surface

Provisioning cloud infrastructure the wrong way, but faster

“YOLO” is not a valid hash construction

Our audit of Homebrew

Quantum is unimportant to post-quantum

AES-Gem (AES with Galois Extended Mode)

EuroLLVM 2024 trip report

The good, the bad, and the weird (2018)

Themes from Real World Crypto 2024

The life and times of an Abstract Syntax Tree

The life of an optimization barrier

A peek into build provenance for Homebrew

Introducing Ruzzy, a coverage-guided Ruby fuzzer

Read code like a pro with our weAudit VSCode extension

Why fuzzing over formal verification?

How we applied fuzzing techniques to cURL

Cloud cryptography demystified: Amazon Web Services

Security flaws in an SSO plugin for Caddy (2023)

appsec.guide just got a new chapter on fuzzing

More →