SHOOTTHEMESSENGER @Num1SecResearch

For the whitehats and security researchers who see this: What do you think of this proposal to legally "hack back" funds from hackers? whitehouse.gov/presidential-a… On one hand, this could be an incredible opportunity for Sherlock or other security companies to organize whitehats and security researchers to go on the offensive, which we all know you're capable of. On the other hand, is it even realistic to hack the hackers? They aren't exactly running DeFi protocols, so findings bugs in their smart contracts seems unrealistic. And they don't seem to move their funds very often. But maybe phishing them or finding other opsec compromises could be the way to hack them? Interested to hear if you all believe there's a real path to "hacking the hackers" here, or if it's unrealistic. Sherlock could be open to posting the $1M bond and applying for the program if there's real potential.

14 11 89 6K 48

View Details

SHOOTTHEMESSENGER @Num1SecResearch

6 days ago

@asklumo I would if it was current. Its like sonnet 3.5 level.

0 0 0 836 0

View Details

Caleb @calebcterry

6 days ago

@mark_k This aged extremely well x.com/mark_k/status/… After doing more research on this, I think the human contribution is worth mentioning, too. My understanding is that this came out of years of work by Diego Córdoba and Luis Martínez-Zoroa developing the underlying approach, with Tristan Buckmaster and Levent Alpöge then using LLMs to push that research much further and eventually formalize and verify the result.

Mark Kretschmann @mark_k

7 days ago

Rumor: OpenAI may have solved the Navier-Stokes problem, one of the seven Millennium Prize Problems. An announcement could be coming soon. If confirmed, this would be a historic mathematical breakthrough.

122 227 3K 398K 368

7 24 357 99K 49

View Details

SHOOTTHEMESSENGER @Num1SecResearch

7 days ago

@nitesh_btc Couldn't they just let them keep the back then hard fork? @grok

1 0 0 202 0

View Details

GodwinXbt 𓂀 @GodwinXbt

7 days ago

A stranger with no account on any bug bounty platform just made $47 million finding a bug that platform triage teams would have taken weeks to even acknowledge. No submission fee. No queue. No committee deciding if his finding counts as "critical" or "high" based on a rubric written by someone who's never touched the codebase. He found the bug, took the money the bug was worth, and gave the fix back. Compare that to a researcher who finds a real vulnerability, pays to submit it, waits a month, gets told it's a duplicate or out of scope, and walks away with nothing but a rejection email and also loses his submission fee. The system built to reward people for finding bugs is slower and cheaper than just exploiting the bug yourself and negotiating after. That's not a researcher problem. That's the whole model failing at the one job it exists to do. Nobody wants to say it plainly so I will... If your bounty program is slower and pays less than the black market rate for the same bug, researchers will stop reporting to you. They'll just take it...