Alex Rebert
@ayper.bsky.social
Memory Safety @ Google. Previously co-founder of Mayhem Security (formerly known as ForAllSecure). Opinions here are my own.
Can we translate all C to Rust? The susceptibility of C to memory corruption has long been a cybersecurity pain point, and coding agents can free us of it. Read on for my recent experiments in this space, and apt & docker repos that you can pull rust-converted libraries from!
With Rust development surpassing C++ in the Android platform in 2025, we can start making reliable comparisons. Rollback rates, code review latency, vulnerability density, and a CVE with a twist. security.googleblog.com/2025/11/rust...
Rust in Android: move fast and fix things
Posted by Jeff Vander Stoep, Android Last year, we wrote about why a memory safety strategy that focuses on vulnerability prevention in ...
security.googleblog.com
Secure by Design software: It’s time to stop patching and start preventing. One year left before "Smashing the Stack" turns 30—let’s make it count! 🔐💪🛡️🗓️ medium.com/@boblord/29-...
29 Years Since “Smashing the Stack”: Time to Smash Memory Unsafety Itself
This coming Saturday marks the 29th anniversary of Aleph One’s seminal Phrack Magazine article, “Smashing the Stack for Fun and Profit.”…
medium.com
"Memory Safety for Skeptics," where I argue why memory safety is worthwhile to pursue amid competing priorities! queue.acm.org/detail.cfm?i... #rustlang
Memory Safety for Skeptics - ACM Queue
queue.acm.org
We're joining forces with industry & academia to call for memory safety standardization: security.googleblog.com/2025/02/secu.... It's a recognition that memory unsafety is no longer a niche technical problem but a societal one, impacting everything from national security to personal privacy.
Securing tomorrow's software: the need for memory safety standards
Posted by Alex Rebert, Security Foundations, Ben Laurie, Research, Murali Vijayaraghavan, Research and Alex Richardson, Silicon For decades,...
security.googleblog.com
🛡️💸 We've revamped our Patch Rewards Program, extending its scope and increasing rewards for security patches – with a particular focus on memory safety, including bonus multipliers! bughunters.google.com/blog/5273064...
Blog: Level Up Your Open Source Karma (And Your Wallet) by Improving Security
This blog post takes you through everything you need to know about the Patch Rewards Program, including our newly introduced focus on memory safety (including reward multipliers!), recently increased ...
bughunters.google.com
Happy to publish the effort of my last five years: Security Signals. research.google/pubs/securit...
Security Signals: Making Web Security Posture Measurable At Scale
research.google
Had a bunch of thoughts about the recent safety stuff, way more than fit in social media post... Blog post story time! (It's a bit of a ramble, sorry about that...) chandlerc.blog/posts/2024/1... #LLVM #Clang #MemorySafety
Story-time: C++, bounds checking, performance, and compilers
Recently, several of my colleagues at Google shared the story of how we are retrofitting spatial safety onto our monolithic C++ codebase: https://security.googleblog.com/2024/11/retrofitting-spatial-s...
chandlerc.blog
Excited to share our latest blog post on memory safety! We’re tackling spatial safety in our massing C++ codebase by hardening live++ by default. It adds bounds checks to things like std::vector, preventing a fair bit of out-of-bounds vulnerabilities: security.googleblog.com/2024/11/retr...
Retrofitting Spatial Safety to hundreds of millions of lines of C++
Posted by Alex Rebert and Max Shavrick, Security Foundations, and Kinuko Yasada, Core Developer Attackers regularly exploit spatial mem...
security.googleblog.com