d3fp4r4m @defparam

Opinions are my own github.com/defparam Joined May 2014

Tweets

4K
Followers

7K
Following

585
Likes

4K

d3fp4r4m @defparam

17 hours ago

@hakluke I feel optimistic still on novel research angle with AI. One only has so many tokens to burn on the low hanging fruit. The complex novel bug classes that just aren’t discovered yet (think the “next” request smuggling or single packet attack vector) is expensive for AI right now

0 0 1 208 0

View Details

h0mbre @h0mbre_

a month ago

CTFs don't have to die. They just have to become like chess. Have more events in person, easier to enforce no LLMs. Have heuristics for online play, honor system, etc. Any online competitive format is subject to cheating, yet plenty of competitive arenas still exist.

4 9 144 10K 17

View Details

d3fp4r4m @defparam

2 months ago

@S1r1u5_ It’s a new type of defense, “Security by Intimidation”. You do public statements that your top secret AI model found all the bugs so don’t bother, spend your money/time elsewhere

0 0 2 382 2

View Details

daniel @hackermondev

2 months ago

http desync attack on discord !!

tmctmt @tmctmt

2 months ago

Spying on everybody's Discord attachments with HTTP desync tmctmt.com/posts/http-des…

46 196 2K 580K 2K

3 12 295 41K 111

View Details

d3fp4r4m @defparam

3 months ago

@albinowax I suspect that security research and innovation is sparse enough for modern LLMs to not immediately solve for a while. However the bad news here is making the decision to open your research for the machine to consume. Some are deciding against it x.com/cyb3rops/statu…

Florian Roth ⚡️ @cyb3rops

3 months ago

I’ve deliberately not published blog posts on useful detection ideas and rule-writing methods because I didn’t want LLMs to absorb them. So those ideas stayed private and were shared only with a small group. I doubt I’m the only one making that call. And that probably has

43 57 526 146K 137

1 0 6 2K 0

View Details

cje @caseyjohnellis

3 months ago

PATCH YO’ UNIFI (CVSS 10.0) community.ui.com/releases/Secur…

1 12 27 5K 5

View Details

d3fp4r4m @defparam

3 months ago

@thedawgyg @payloadartist Ignoring the bounty amounts for a moment when all the AI coding and bug hunting is at max do you think the average company will have more or less undiscovered bugs than pre-AI?

0 0 0 160 0

View Details

d3fp4r4m @defparam

4 months ago

@pxmme1337 @Behi_Sec @albinowax @orange_8361 @nnwakelam @claudeai

0 0 1 58 0

View Details

Thomas H. Ptacek @tqbf

5 months ago

People on the orange site are laughing at this, assuming it's just an ad and that there's nothing to it. Vulnerability researchers I talk to do not think this is a joke. As an erstwhile vuln researcher myself: do not bet against LLMs on this. axios.com/2026/02/05/ant…

7 19 120 12K 59

View Details

Gynvael Coldwind @gynvael

6 months ago

Glitches in games, especially used for speedrunning, are one of the most fun aspects of hacking to watch! As an example, check out this video "How Speedrunners BEAT Hollow Knight Silksong In 10 Minutes!" by @Abyssoft youtube.com/watch?v=M6Jnj-…

4 5 33 16K 10

View Details

Andrej Karpathy @karpathy

a year ago

Agency > Intelligence I had this intuitively wrong for decades, I think due to a pervasive cultural veneration of intelligence, various entertainment/media, obsession with IQ etc. Agency is significantly more powerful and significantly more scarce. Are you hiring for agency? Are we educating for agency? Are you acting as if you had 10X agency? Grok explanation is ~close: “Agency, as a personality trait, refers to an individual's capacity to take initiative, make decisions, and exert control over their actions and environment. It’s about being proactive rather than reactive—someone with high agency doesn’t just let life happen to them; they shape it. Think of it as a blend of self-efficacy, determination, and a sense of ownership over one’s path. People with strong agency tend to set goals and pursue them with confidence, even in the face of obstacles. They’re the type to say, “I’ll figure it out,” and then actually do it. On the flip side, someone low in agency might feel more like a passenger in their own life, waiting for external forces—like luck, other people, or circumstances—to dictate what happens next. It’s not quite the same as assertiveness or ambition, though it can overlap. Agency is quieter, more internal—it’s the belief that you *can* act, paired with the will to follow through. Psychologists often tie it to concepts like locus of control: high-agency folks lean toward an internal locus, feeling they steer their fate, while low-agency folks might lean external, seeing life as something that happens *to* them.”

Garry Tan @garrytan

a year ago

Intelligence is on tap now so agency is even more important

150 622 7K 6.4M 2K

2K 9K 50K 11.3M 36K

View Details

d3fp4r4m @defparam

6 months ago

@thedawgyg @chompie1337 Have a lot of your bugs been with default or alternate configurations?

1 0 1 120 0

View Details

d3fp4r4m @defparam

7 months ago

@ryancbarnett Interesting, does Akamai typically use the CVE system to disclose web service vulnerabilities? Is there deeper technical information? I’m just curious how customers use this Information.

1 0 1 676 0

View Details

d3fp4r4m @defparam

7 months ago

youtu.be/VgXlxAUR17Y

0 15 62 8K 52

View Details

d3fp4r4m @defparam

7 months ago

Why on earth would you promote a performance fix as a toggle option? Why would this ever need to be off? Why is the word “hopefully” being used? 🤡

Windows Latest @WindowsLatest

7 months ago

Microsoft admits File Explorer is slow in Windows 11, and it’s going to preload it in the background to help improve launch performance. “This shouldn’t be visible to you, outside of File Explorer hopefully launching faster when you need to use it,” Microsoft confirmed. If you

958 377 5K 11.3M 3K

1 0 5 691 0

View Details

d3fp4r4m @defparam

8 months ago

@vxunderground I’m slightly ahead of you with an 8 month old. Truth, all of it.

0 0 0 133 0

View Details

d3fp4r4m @defparam

8 months ago

Google could literally give 50ms of dark pattern money to ffmpeg (like incognito mode) without even feeling it and have the project funded for the next 200 years and probably should given, well, Youtube.

0 0 3 554 1

View Details

d3fp4r4m @defparam

8 months ago

@deadvolvo One extra: peer to peer audio on rushed games doesn’t give me the confidence on its security hygiene.

0 0 1 63 0

View Details

d3fp4r4m @defparam

8 months ago

@deadvolvo Two things kill in-game voip. Discord has cornered the market on gaming voip across most/all playgroups. Secondly there’s just too much audio garbage for me to give randoms unfettered access to my ears.