sergey bratus @sergeybratus

The cat is the Otocolobus Manul, https://t.co/Xswt7Vp2F1 . Manul is the perfect privacy mascot. All views & opinions are my own & personal. Joined August 2011

Tweets

32K
Followers

6K
Following

2K
Likes

9K

sergey bratus @sergeybratus

5 days ago

@HostileSpectrum @dinodaizovi Who knew that designing mathematically sound text escape sequences and enamel would come together? :)

0 0 1 11 0

View Details

Shriram Krishnamurthi (primary: Bluesky) @ShriramKMurthi

6 days ago

After months of getting things done w/ Claude Code, I've spent ~5 days programming by hand in Lean and a liquid typed language and it's…SO GREAT? I love living in a world where I can get 1000s of mindless LOC in a minute, but also spend an hour on 10 gorgeous handcrafted lines.

27 10 230 8K 34

View Details

Dino A. Dai Zovi @dinodaizovi

7 days ago

In the history of nuclear weapons safety, there was a debate between the military and the scientists at Sandia National Labs about whether traditional analog electronics were safe enough to control detonation. The labs demonstrated that in the case of a fire, the circuit boards could short and cause safety mechanisms to fail. This prompted the development of "strong links" in Enhanced Nuclear Detonation Safety (ENDS). They were designed such that it was physically impossible to activate from random electricity, fire, or a physical crash. They could only activate by a complex and unique "intent" signal that cannot possibly be produced by natural events. We are having a similar debate now around AI safety. The solution is to contain agents using signals that they cannot possibly produce. More history around this by @SteveBellovin : usenix.org/legacy/event/u…

11 28 179 16K 81

View Details

sergey bratus @sergeybratus

a week ago

@TaliaRinger @awsTO I'd absolutely love a copy, too!

0 0 1 43 0

View Details

DistrictCon @DistrictCon

a week ago

Announcing our CFP Review Board for DistrictCon Year 2! We look forward to reading all of your amazing submissions on all things reverse engineering, tooling, exploits & vulns, and select non-technical and policy talks 🪩👾✌️ @perribus @bsdaemon @sergeybratus @rmspeers @jaylagorio @caseyjohnellis @ashl3y_shen

0 11 21 4K 0

View Details

Phrack Zine @phrack

2 weeks ago

One more Phrack 73 leak for you! Blueboxing Myths and Feelings: a nostalgic dive into phone phreaking’s golden age. archives.phrack.org/dl/73/blueboxi… by @hackerschoice and @GammaTHC

2 36 141 7K 22

View Details

sergey bratus @sergeybratus

2 weeks ago

@TaliaRinger Congratulations! It really feels like a defining moment in establishing an automatable algebraic structure on proofs.

1 0 1 87 0

View Details

Talia Ringer 🕊🪬 @TaliaRinger

2 weeks ago

Thrilled that our paper "Proof Repair and (Co)algebra Equivalences" with Trey Plante, Eric Paul, Cosmo Viola, and Alex Kavvos was (conditionally) accepted to POPL! Amazing work by my students, and wonderful collaboration with Alex.

Talia Ringer 🕊🪬 @TaliaRinger

3 months ago

Some of my awesome Ph.D. students and collaborators helped me finally understand what on earth I was doing in my Ph.D. thesis work in a way that is precise and generalizable. Like, they turned my vibes into a formalization. Just so excited about this trey3p.github.io/papers/prt.pdf

4 6 97 9K 32

2 9 64 3K 8

View Details

sergey bratus @sergeybratus

2 weeks ago

@halvarflake I find this most amazing, possibly a "peak tech debt" moment. Thinking, e.g., of how hard it was to get disassembly to recompile back to the exact same bytes---until it wasn't, as @mahal0z recently showed.

0 0 3 76 0

View Details

sergey bratus @sergeybratus

2 weeks ago

@JustDeezGuy Alas, a bit dated. @ilyasergey's recent OOPSLA paper ilyasergey.net/assets/pdf/pap… needs to be added, among others.

0 1 10 510 6

View Details

sergey bratus @sergeybratus

2 weeks ago

@caballerobrah @JustDeezGuy ROP is definitely a part of it, since its discovery in late 1990s-early 2000s by the hacker community and the key examples published in Bugtraq & Phrack. Hovav Shacham broke through to its academic recognition with the name of ROP and its math description in 2007. So it goes :)

0 0 2 77 0

View Details

sergey bratus @sergeybratus

2 weeks ago

@robertgraham Do you mean it like a "taxes awareness month"? Or "an extreme cold/heat/wind awareness month", depending on the place? :)

1 0 0 92 0

View Details

ElfMaster @ryan_elfmaster

2 weeks ago

Check out my latest blogpost. "Shiva modules for detecting advanced persistent threats in Linux: Shiva vs. Saruman": arcana-research.io/blog/shiva-mod… The other day I released an updated version of Saruman for anti-forensics executable injection. This is essentially an APT (Advanced persistent threat) tool for stealthy injection of a program into a remote process. Very helpful for the offensive side, giving them a good way to hide their processes without needing a kernel rootkit. But what about the defensive side? Today I release a threat detection module for detecting Saruman thread injection. This threat detection engine was designed as a Shiva module in less than one day, and is a great example of how Linux threat detection and exploit mitigation monitors can be rapidly designed and installed with Shiva.

0 13 27 1K 14

View Details

sergey bratus @sergeybratus

2 weeks ago

@robertgraham This story needs to be repeated till it is textbook material. Not just for the sake of history, but for the sake of understanding the ways and value of software composition. "See, children, in the dark ages before formal methods good engineers had to do all this" :)

0 0 1 400 0

View Details

Robert Graham @robertgraham

2 weeks ago

Let me tell you how I delayed WinXP SP2 for a month. My software (BlackICE) was on the list of software that had to work. When they made major changes to the kernel network stack, my software broke. They grabbed their reverse engineers to figure out why. What they discovered was that my software doing something evil, patching the kernel's network stack when our software was loaded. That's tricky on a multi-CPU system with warring instruction/data caches. We wrote a patent on how to do it reliably without crashing the system. We searched through the kernel to find the location we needed to patch, looking for a certain pattern of bytes. They changed the network stack so that thing we were patching no longer existed. So to make our software work, the inserted that pattern back into the kernel. As packets arrived, the new function would jump to that pattern, and then after, jump right back. This way, we could find the pattern and patch it -- and thereby patch the intended function. Some Microsoft lawyers wanted to sue us for violating the software license agreement, which forbids reverse engineering, which we had to do in order to patch the kernel at runtime. Cooler heads prevailed. The point is our software did an ugly hack in order to work, and then Microsoft did an even crazier, uglier hack so that we'd keep working. For years after, when meeting Microsoft engineers at conferences, they'd love to yell at me. When Vista came along, they added signing of kernel models, putting an end to such nonsense, but also providing a real documented API we could use.

Sean Hickey @headzoo

2 weeks ago

Microsoft once discovered SimCity was crashing on Windows 95 because SimCity had a memory bug. Instead of saying “not our problem,” Microsoft added a compatibility workaround just for SimCity. Because users don’t care whose bug it is. They care that software that worked yesterday

36 20 427 86K 25

17 58 761 63K 157

View Details

Zion Leonahenahe Basque @mahal0z

2 weeks ago

Today was the last class on assembly, and we had a competition! Students submitted assembly code to drive their Tron bot every tick. Both 1st and 2nd abused a teleportation bug to dominate the board. Very creative solutions!

1 3 32 2K 5

View Details

Julien Vanegue @jvanegue

2 weeks ago

Happy to see our paper "Mind the Heap: Preventing Capability Leakage Across CHERI Compartments" accepted at @acm_ccs 2026. I'll be in The Hague in November to support the amazing @s_hamedgh keeping the heap exploitation spirit alive on CHERI hardware. sigsac.org/ccs/CCS2026/pr…

1 5 30 2K 9

View Details

sergey bratus @sergeybratus

2 weeks ago

@halvarflake @optozorax There's literature on it: en.wikipedia.org/wiki/Prince_of… :)

0 0 0 67 0

View Details

sergey bratus @sergeybratus

3 weeks ago

@robertgraham Lamenting the shortages of daily bread after killing off generations of regressive grain farmers---pure bad luck, who knew?

0 0 0 93 0

View Details

sergey bratus @sergeybratus

3 weeks ago

@robertgraham Kosygin's quote, "Dai tri milliona ton sverkh plana. S khlebushkom sovsem plokho" is totally on its own level of expressiveness, worth an hour-long lecture on Soviet/Russian anthropology if done right. 1st sentence is upbeat Soviet vocabulary, 2nd is kinda eternal Dostoyevsky.