Eduardo Vela @sirdarckcat.bsky.social · 15/01/2026We are hiring! CPU security and stuff www.google.com/about/career... 022
Reposted by Eduardo VelaCatalin Cimpanu @campuscodi.risky.biz · 07/08/2025Google security researchers have improved the Retbleed CPU side-channel attack to increase exfiltration speed. The attack can now leak data at 13 KB/s, which is fast enough to be used in modern cloud environments. bughunters.google.com/blog/6243730...bughunters.google.comBlog: Exploiting Retbleed in the real worldCurious to hear about our experience exploiting Retbleed (a security vulnerability affecting modern CPUs)? Then check out this post to see how we pushed the boundaries of Retbleed exploitation and und... 084
Eduardo Vela @sirdarckcat.bsky.social · 20/05/2025youtu.be/sUFDKTaCQEk?... (slides at entrysign.top)youtu.beOffensiveCon25 - Matteo Rizzo, Kristoffer `spq` Janke, Eduardo Vela Nava and Josh EadsYouTube video by OffensiveCon 064
Reposted by Eduardo VelaCatalin Cimpanu @campuscodi.risky.biz · 06/03/2025Google published details on EntrySign, an AMD Zen microcode signature validation vulnerability (CVE-2024-56161) that can allow threat actors to install malicious firmware: bughunters.google.com/blog/5424842... It also released Zentool, a tool to jailbreak AMD processors: github.com/google/secur... 0298
Eduardo Vela @sirdarckcat.bsky.social · 09/02/2025I am such a big fan of NotebookLM.. The ability to say, hey, here are 20 papers and 3 books from this subject matter, can you please explain this problem to me? and have active in-depth Q&A helps me solve problems in new spaces so much faster. What used to take me multiple weekends now takes hours 120
Reposted by Eduardo VelaChristian Blichmann 🇺🇦 (also on Mastodon) @admvonschneider.bsky.social · 03/02/2025It's out and make for a very interesting read: github.com/google/secur... IMO, AMD should own it and release a microcode SDK.... @sirdarckcat.bsky.socialgithub.comAMD: Microcode Signature Verification Vulnerability### Summary Google Security Team has identified a security vulnerability in some AMD Zen-based CPUs. This vulnerability allows an adversary with local administrator privileges (ring 0 from outside... 182
Eduardo Vela @sirdarckcat.bsky.social · 14/01/2025youtu.be/H9K45VkjKvM?... I found a video of c developers 010
Eduardo Vela @sirdarckcat.bsky.social · 02/01/2025LLMs are at least better translators than normal translation tools gemini.google.com/share/68582c... 020
Eduardo Vela @sirdarckcat.bsky.social · 01/01/2025"Guan Tianfeng's role in the conspiracy was to develop and test the zero-day vulnerability" - yikes, better not develop any more vulnerabilities or fail to do proper testing or the FBI will go after you! www.fbi.gov/wanted/cyber... 111
Eduardo Vela @sirdarckcat.bsky.social · 29/12/2024Today I realized <input type=radio> implements roving tabindex natively.. so you can hack a css-only implementation. Forgive me ARIA, for I will sin. 000
Eduardo Vela @sirdarckcat.bsky.social · 28/12/2024Is this what they call a culture shock in Japan? 010
Eduardo Vela @sirdarckcat.bsky.social · 24/12/2024Made a tiny game with my 6-years old cousin tonight using cursor.com - must say this was way easier than I thought, and I literally wrote zero code. sirdarckcat.github.io/salchichon/sirdarckcat.github.ioPerrito Salchichón 120
Eduardo Vela @sirdarckcat.bsky.social · 23/12/2024So one thing I want to work on the kernel explorer before we keep accumulating tech debt is accessibility. I thought it would be cool to try and describe how I'll approach it, so this will be a 🧵 thread I'll update as I make progress. 100
Eduardo Vela @sirdarckcat.bsky.social · 22/12/2024Writing CSS is so relaxing.. codepen.io/sirdarckcat/... <div class="node"> <h1></h1> <div class="edges"> <div class="left"></div> <div class="right"></div> </div> </div>codepen.ioFunctional HTML/CSS/JavaScript Code BinA Functional Code bin that works like JSBin. It only supports HTML, CSS and JavaScript. No console or JQuery support, unless you modify the mark-up. Cl... 030
Eduardo Vela @sirdarckcat.bsky.social · 21/12/2024I think I would be pretty good at competitive password typing 230
Eduardo Vela @sirdarckcat.bsky.social · 20/12/2024Small preview of our kernel explorer. Still a lot of work to do! kernelctf-dash.storage.googleapis.com/processed/v6...kernelctf-dash.storage.googleapis.com🐧DASHing 172
Eduardo Vela @sirdarckcat.bsky.social · 02/12/2024I tried to implement this yesterday (kind of). It is too slow to run syz-execprog but running the compiled C reproducer was better. You can't really run ftrace (I was hoping to!) but I probably could get the info from the emulator directly. Promising, but still TBD! 130
Eduardo Vela @sirdarckcat.bsky.social · 24/11/2024It would be cool if there was a way to run Syzkaller on the browser. You just get an IDE for writing Syzkaller programs and you get coverage data, register state (like with kprobes) etc 020
Eduardo Vela @sirdarckcat.bsky.social · 21/11/2024blog.wokwi.com/running-gdb-... is pretty cool!blog.wokwi.comRunning GDB in the BrowserGDB inside a Linux in a x86 Virtual Machine using Web Assembly running in the browser. Crazy? 041
