Sign in

Michal Melewski

@carste1n.bsky.social
451 followers 160 following 98 posts

Security Engineer @ Cloudflare, ex-Google ISE, I use bad software and bad machines for the wrong things. My writing: carstein.github.io

PostsRepliesMedia
Reposted by Michal Melewski
Sy Brand @tartanllama.xyz · 10/06/2025
Building a Debugger is now officially released! It guides you through building a whole native x64 debugger from scratch, dispelling all the magic and teaching you a ton about operating systems as it goes. Even if you don't care about building a debugger, you can read it to your cat.
The book Building a Debugger, featuring a robot designing a complex debugging machine on a drafting boardThe book placed in front of a tortie cat
2437678
Reposted by Michal Melewski
Daniel Klischies @dklischies.bsky.social · 28/05/2025
Our OffensiveCon talk on stateful baseband emulation (and how improper string handling led to baseband RCE) is available on YouTube: youtu.be/zoAITq7jUM8. It has been a pleasure; awesome conference, brilliant people. Slides and paper: www.danielklischies.net/research/bas...
youtu.be
OffensiveCon25 - Daniel Klischies and David Hirsch
YouTube video by OffensiveCon
094
Reposted by Michal Melewski
halvarflake.bsky.social @halvarflake.bsky.social · 28/05/2025
A small slide deck for a 15 minute impulse talk at Cycon 2025 in Talinn: docs.google.com/presentation...
docs.google.com
A walk down the learning curve
A walk down the learning curve (and memory lane) Thomas Dullien (“Halvar Flake”) Computing Mathematician
1239
Michal Melewski @carste1n.bsky.social · 25/05/2025
This time a little bit of something about concurrent programming in Rust: carstein.github.io/rust/2025/05...
carstein.github.io
Channels and threads in Rust
030
Michal Melewski @carste1n.bsky.social · 21/03/2025
A friend of mine is organizing a course about reversing binary files and protocols: hackarcana.com/workshop-ses... recommendation++
hackarcana.com
hackArcana
020
Michal Melewski @carste1n.bsky.social · 16/03/2025
I had so much hope for MPK but why oh why is the PKRU register writable from the user space...
000
Michal Melewski @carste1n.bsky.social · 15/03/2025
This time something non-technical: carstein.github.io/short/2025/0...
carstein.github.io
Hours you work
130
Michal Melewski @carste1n.bsky.social · 12/03/2025
Still experimenting with struct diagraming. Any recomendations for tools like asciiflow?
260
Michal Melewski @carste1n.bsky.social · 11/03/2025
Wrote a short article about structures in C and Rust: carstein.github.io/rust/2025/03... This is pretty much teaser about upcoming KVM series.
carstein.github.io
Translating structures between C and Rust
031
Michal Melewski @carste1n.bsky.social · 16/02/2025
I've started writing a short intro to KVM and realized all C struct visualizers suck, so I had to make my own pictures by hand. Still doesn't look like I imagined it in my head.
140
Michal Melewski @carste1n.bsky.social · 12/02/2025
Today I'm just chillin
010
Reposted by Michal Melewski
Carl Smith @rwx.page · 04/02/2025
I’m very excited to announce that we at V8 Security have finally published our first version of Fuzzilli that understands Wasm! Go check it out at github.com/googleprojectzero/fuzzil…. While we still have a way to go in improving it, we think it shows a promising approach!
13116
Reposted by Michal Melewski
Christian Blichmann 🇺🇦 (also on Mastodon) @admvonschneider.bsky.social · 03/02/2025
It's out and make for a very interesting read: github.com/google/secur... IMO, AMD should own it and release a microcode SDK.... @sirdarckcat.bsky.social
github.com
AMD: Microcode Signature Verification Vulnerability
### Summary Google Security Team has identified a security vulnerability in some AMD Zen-based CPUs. This vulnerability allows an adversary with local administrator privileges (ring 0 from outside...
182
Michal Melewski @carste1n.bsky.social · 31/01/2025
Roughly three weeks ago I was invited as a guest speaker by guys from @doyensec.bsky.social for their lunch and learn session. Such invitations are great because and I greatly appreciate them. Yesterday I have recived this 'thank you' gift. You guys rock.
040
Michal Melewski @carste1n.bsky.social · 27/01/2025
Refuting a bullshit bug bounty report from (probably) a LLM is my least favorite way to spend my friday afternoon. What a waste of time and energy. Hashtag BegBount.
040
Michal Melewski @carste1n.bsky.social · 21/01/2025
And the prize for the least irony-aware crowd goes to linkedin commentators. www.linkedin.com/posts/austin...
linkedin.com
Austin Nasso on LinkedIn: I make $340,000 per year in San Francisco as a software engineer and it's… | 4,641 comments
I make $340,000 per year in San Francisco as a software engineer and it's utterly unlivable. Let's break it down. After taxes, my take home is… | 4,641 comments on LinkedIn
120
Michal Melewski @carste1n.bsky.social · 15/01/2025
Looks like I'm going to offensiveCon. See you all there.
250
Reposted by Michal Melewski
Am_not_NSA @am-not-nsa.bsky.social · 15/01/2025
Great talk by Dominik! #cybersecurity #vulnerability #securityresearch #0day #bugbounty #fuzzing
032
Michal Melewski @carste1n.bsky.social · 08/01/2025
I've started using ghostty (as an experiment). I like it, it works well and I really like the default theme. Right, I love how it looks but I have zero idea what it is the default theme. It just doesn't seems to be saved anywhere so I can't set the same theme in all other apps. I'm sad.
000
Reposted by Michal Melewski
dmnk @dmnk.bsky.social · 08/01/2025
Project Zero is hiring 👀 No need to tell y'all that the team is awesome
google.com
Senior Security Engineer, Security Research — Google Careers
04620
Michal Melewski @carste1n.bsky.social · 29/12/2024
In the end everything was ok. It turned out all components were working correctly but for some reason my monitor wasn't. It was strange - laptop connected via usb-c was ok, but display port was not. Troubleshooting tip: never assume anything, check everything.
010
Michal Melewski @carste1n.bsky.social · 26/12/2024
Bit unorthodox, but ... Watching videos like www.youtube.com/watch?v=Y891... gives me some thought. If you are a large organization looking for a PM, TPM or a manager you should have your recruiters trawling games like this (or EVE) in search of a capable candidates.
youtube.com
The Shipyard - Foxhole
YouTube video by Robert LuvsGames
000
Michal Melewski @carste1n.bsky.social · 24/12/2024
Last PC I built from scratch was almost 10 years ago. I was not looking forward to the next one - I hate cabling, I hate how modern PCs are just a nest of wires and there is a little elegance while one crams all those unwieldy cabling around the badly manufactured chasis.
100
Michal Melewski @carste1n.bsky.social · 23/12/2024
I thinks Steve is my spirit animal
030
Michal Melewski @carste1n.bsky.social · 18/12/2024
All the @chompie.rip presentations have great content but the graphics... I would kill for having such great slides.
110
Reposted by Michal Melewski
dmnk @dmnk.bsky.social · 10/12/2024
Watch the recording of my #ekoparty talk "Advanced #Fuzzing with #LibAFL" here: youtu.be/FI7C37lz4Rg?... Thanks @fede-k.bsky.social for this amazing event!
youtu.be
Advanced Fuzzing With LibAFL - Dominik Maier - Ekoparty 2024
YouTube video by Ekoparty Security Conference
04112
Reposted by Michal Melewski
Lea Kissner @leak.bsky.social · 09/12/2024
Would you like to work with great folks to secure something important? LinkedIn security is hiring -- with more roles coming, including a Sr. Director for Risk and Compliance. I'd love to work with you! No jerks, please.
23711
Michal Melewski @carste1n.bsky.social · 04/12/2024
I was the victim as awell - pwned via a modified rustc wrapper on a repo that the rust-analyzer run automatically upon opening. So, beware what repo you clone and open :)
131
Michal Melewski @carste1n.bsky.social · 02/12/2024
Yet again I need to pass the opportunity to intern at Vector 35 because they require permission to work in US. What happened to a proud american tradition of hiring undocumented migrants to do the work nobody else wants to do - like writing unit tests? On more serious note - y'all should apply.
050
Michal Melewski @carste1n.bsky.social · 02/12/2024
Pro-tip: after doing an interview don't immediately attempt to connect with the person doing the interview on LinkedIn. There is nothing wrong with it but at least wait till you know the outcome of the recruitment - otherwise it is bit weird and you put the person in awkward situation.
120
Reposted by Michal Melewski
Gynvael Coldwind @gynvael.bsky.social · 30/11/2024
If you enjoy programming and lower levels of the stack, this is a talk you want to watch: www.youtube.com/watch?v=WDfr...
youtube.com
Eon: An Amiga 500 Demo - Andreas Fredriksson
YouTube video by Handmade Cities
0206
Michal Melewski @carste1n.bsky.social · 27/11/2024
Guess what just arrived. @halvarflake.bsky.social do you want to test it?
100
Michal Melewski @carste1n.bsky.social · 25/11/2024
100 days. 300 words per day. About pretty much anything. That was a task I set for myself. It was a little bit about getting back to the rythm of writing but mostly it was about forcing myself to use the split keyboard that I have built - and I can slowly see the effects.
210
Michal Melewski @carste1n.bsky.social · 25/11/2024
#BookChallenge #1 Peter Watts / Echopraxia
4161
Michal Melewski @carste1n.bsky.social · 22/11/2024
Internet: oh lol, how could you even leave the running webshell on a server you were pentesting me who left a meterpreter on a production box for over a year:
media.tenor.com
homer simpson from the simpsons is standing in a grassy field .
ALT: homer simpson from the simpsons is standing in a grassy field .
160
Michal Melewski @carste1n.bsky.social · 21/11/2024
So many new followers, so much expectations, such a strong temptation to slump into shitposting...
230
Michal Melewski @carste1n.bsky.social · 19/11/2024
Just wrote up some basic article how to handle Errors in Rust - the intro is just Rust 101 but I also wanted to share some less-basic tips. carstein.github.io/rust/2024/11...
carstein.github.io
Errors in Rust
000
Michal Melewski @carste1n.bsky.social · 19/11/2024
For armchair generals among us - this just got released: www.youtube.com/watch?v=WJZR...
youtube.com
Armored Brigade II - Matrix Launch Trailer
YouTube video by MatrixGames
000
Michal Melewski @carste1n.bsky.social · 18/11/2024
That looks quite interesting if you are into this kind of things.
010
Michal Melewski @carste1n.bsky.social · 18/11/2024
In Rust, when you want to have a collection of different trait objects you face certain restrictions - namely your implementation must be object-safe. That eliminates `async` functions because they return `impl Future`. You can either implement that async yourself or use docs.rs/async-trait/...
docs.rs
async_trait - Rust
github crates-io docs-rs
000
Michal Melewski @carste1n.bsky.social · 17/11/2024
I am slowly returning to writing and I have decided to reuse some of my older content. I originally published it as a series of notes on Mastodon but I think it would be a good idea (or not) to immortalize it here. After all I need to publish something here. carstein.github.io/short/2024/1...
carstein.github.io
Gone places
130