viksit

@viksit.com

2x founder / product leader / ml engineer. prev: founder of @solarplex_xyz, acq by @arweave. head of ai/new products @dropbox. founded @myralabs (language model powered chatbots)

I'm watching some folks reverse engineer the xz backdoor, sharing some *preliminary* analysis with permission. The hooked RSA_public_decrypt verifies a signature on the server's host key by a fixed Ed448 key, and then passes a payload to system(). It's RCE, not auth bypass, and gated/unreplayable.

Filippo Valsorda@filippo.abyssdomain.expert · 3y ago

This might be the best executed supply chain attack we've seen described in the open, and it's a nightmare scenario: malicious, competent, authorized upstream in a widely used library. Looks like this got caught by chance. Wonder how long it would have taken otherwise.

hey #atdev fambly check out this really useful awesome-atproto repository I just found! I want to make an awesome-bsky that is more tailored to bsky development in particular and has more hands-on educational tools beyond just a list of resources (similar to awesome-atproto but applied to bsky!)

GitHub - beeman/awesome-atproto: A curated list of awesome ATProto resources

A curated list of awesome ATProto resources. Contribute to beeman/awesome-atproto development by creating an account on GitHub.

github.com