Took some time to improve a few things on WinDiff (added permalinks, filtered out empty results) and added a Claude skill to easily use WinDiff to produce quick security-oriented diff analyses between binary/OS versions. Feel free to try! github.com/ergrelet/win...
Mozilla says Mythos helped identify 271 vulnerabilities in Firefox 150. I went through the commits, CVEs, and bug links to see what that number really means. My takeaway: relax folks. xark.es/b/mythos-fir...
A quick look at Mythos run on Firefox: too much hype?
A closer look at Mozilla's Firefox 150
xark.es
Mozilla says Mythos helped identify 271 vulnerabilities in Firefox 150. I went through the commits, CVEs, and bug links to see what that number really means. My takeaway: relax folks. xark.es/b/mythos-fir...
A quick look at Mythos run on Firefox: too much hype?
A closer look at Mozilla's Firefox 150
xark.es
Brief announcement: Launching Unprompted.au later this year in Sydney — a new conference focused on offensive and defensive security research using AI, and on how AI is reshaping the field. Sister conference to Unprompted. More updates coming soon
So I've been trying to dev an app using LLMs for a few weeks now, and I couldn't ever reach a satisfying state. Either talking to LLMs is an incredibly hard skill, or they are still very limited. I'm not even sure it would ace it if I asked it to write it in JS.
Happy belated new year! Linux 6.19 is now out in the wild and… ah, let’s just cut to the chase. We know what you’re here for! 😁 asahilinux.org/2026/02/prog... Thank you once again to everyone supporting us on OpenCollective and GitHub Sponsors!
Progress Report: Linux 6.19 - Asahi Linux
Porting Linux to Apple Silicon
asahilinux.org
Opus 4.5: "Given this limitation with split DWARF, let me take a different approach: parse the project source code to extract the class hierarchy. But that's complex..." (proceeded not to do the "complex" implementation) What are LLMs good for if they are lazy?! 🤣
How Michael Abrash doubled Quake framerate: fabiensanglard.net/quake_asm_op...
How Michael Abrash doubled Quake framerate
fabiensanglard.net
what do you all use for synchronized (multi device, cross platform) encrypted note taking?
I reverse engineered DexProtector, the security solution protecting applications like Revolut and other banking apps. From custom ELF loaders to vtable hooking, here is an insight into how these protections work and their limitations. www.romainthomas.fr/post/26-01-d...
A Glimpse Into DexProtector | Romain Thomas
This blog post provides a high-level overview of DexProtector's security features and their limitations
romainthomas.fr
TIL about llvm-mca and its -timeline option, pretty cool for getting an understanding of instructions scheduling. Thanks Matt!
Day 9: Why does the compiler keep an "expensive" multiply in the loop instead of using clever addition tricks? The slower operation enables something more valuable. What's the hidden benefit? xania.org/202512/09-in... youtu.be/vZk7Br6Vh1U #AoCO2025
Day 9: Why does the compiler keep an "expensive" multiply in the loop instead of using clever addition tricks? The slower operation enables something more valuable. What's the hidden benefit? xania.org/202512/09-in... youtu.be/vZk7Br6Vh1U #AoCO2025
Induction variables and loops — Matt Godbolt’s blog
Compilers can rewrite loops to avoid expensive calculations
xania.org
We launched a redesigned Project Zero website today at projectzero.google ! To mark the occasion, we released some older posts that never quite made it out of drafts. Enjoy!
Google Project Zero
Make zeroday hard
projectzero.google
In our final progress report for 2025, you'll find even more patches making their way upstream, 39C3, and a special treat for M2 Pro/Max MacBook users. Happy holidays from the Asahi Team! asahilinux.org/2025/12/prog... #asahilinux
Progress Report: Linux 6.18 - Asahi Linux
Porting Linux to Apple Silicon
asahilinux.org
I read the news about the React RCE but completely forgot I was hosting some React stuff! One of my server got pwned at least by 2 "attackers" only to download the same version of xmrig and run it... Disappointed.
I wanted to praise how @bsky.app was better than X after I couldn't reach it through IPv6, but actually I couldn't reach Bluesky neither. Sadge.
New Blog Post: Seth Jenkins broke kASLR by doing … nothing 😩 googleprojectzero.blogspot.com/2025/11/defe...
Defeating KASLR by Doing Nothing at All
Posted by Seth Jenkins, Project Zero Introduction I've recently been researching Pixel kernel exploitation and as part of this research I ...
googleprojectzero.blogspot.com
Hey friends, I am in Paris this week before attending @hexacon.bsky.social. Hit me up if you wanna catch up :)
In case you need it: building V8 on an aarch64 Linux xark.es/b/compiling-...
Compiling V8 on Linux Arm64
xark.es
I added Bluesky posts as comments to my blog. Replying to this post should appear on my post page. Read more about it: xark.es/b/using-blue...
Using bluesky posts as blog comments
Why and how I added bluesky posts as blog comments
xark.es