I don't think it matters whether it's a null pointer deref or a buffer over-read. What matters is that it blue screens and still makes it through testing, which suggest that QA at the smoke test level was not performed.

I think a big problem in the security industry is how much compliance matters compared to security. If it was about security, a lot of the big products would not sell.

Concerning Crowdstrike, the big question on my mind is not what the concrete bug was but rather how a bug that prevents the machine from booting made it through automated testing. Was it a corner case? Then why were so many installations affected?

Amazing! Thank you for this award, it is a great honor. Thank you also to my co-authors and friends @darpsec @mlsec and @iamnion!

3013e3f8f222328e4ef3bb75f940124d43c6b6a4276f2e3265c22612f872c1f9 (SHA256 - amusing bug in a web framework).

Here are the slides of this morning's talk "Everything is (still) broken - looking back at 20 years of hacking." whirlylabs.com/pdf/threat202… - don't take it too serious, I know I don't.

I will be giving a keynote talk entitled "Everything is (still) broken - looking back on 20 years of hacking" at threatcon.co.za/ in the "Securing the Network" session. I have a feeling this will be therapeutic for me and traumatic for the audience.

Yay! Our proposal for @BSidesCapeTown was accepted! @SDBakerEffendi and I will be speaking about the real-world challenges of automatically extracting gadget chains for Java deserialization vulnerabilities.

I don't like CVSS scores. That's not how you talk about art.

I feel like finding good information on types of vulnerabilities affecting different technologies has become much harder. Regardless of what you look for, the first few pages are vendor blogs with copy/pasted fragments of handwavy explanations compiled by marketing departments.