PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Celebrating our 2023 open-source contributions

blog.trailofbits.com | blog | #open-source | #cryptography | #community | #supply-chain-security | #trail-of-bits | #sigstore | #pyopenssl
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits staff merged 450+ pull requests into external projects in 2023, from Sigstore tooling to pyOpenSSL, reflecting the firm's commitment to securing the broader software ecosystem.
Published
Collected

Related coverage

blog · blog.trailofbits.com
1Password's AI patching benchmark is misleading
Trail of Bits says 1Password's FLAWED benchmark misstates AI patch quality, mixing wrong-fix prompts and no-test trials into a 26% clean-fix headline, and ships two agent skills for better fixes.
tool · projectdiscovery.io
Community Spotlight: Rishi (@rxerium)
“Open source isn’t about perfection; it’s about putting an idea forward and improving it together as a community.” Rishi (@rxerium) If you’ve spent any time in the Nuclei Templates repository, you’ve almost certainly run something Rishi engineered. With over 500 templates merged, picked up by the likes of the UK’s National Cyber Security Center (NCSC), California Cybersecurity Integration Center, CERT Polska, Spain’s national security agency, and many others, he’s one of the most prolific con
research · certik.com
Skill Scanning Is Not a Security Boundary
This article argues that scanning third-party OpenClaw skills (e.g. Clawhub's VirusTotal and AI review pipeline) is not a security boundary, since skills execute with full privileged-runtime access.
blog · blog.trailofbits.com
Your AI agent fixed the bug, but what else did it change?
We’re publishing patching-bugs and regression-hunt, two plugins that let engineers delegate patch development and regression checks to agents.
blog · blog.trailofbits.com
SequenceHash: multihashing for the rest of us
We're releasing SequenceHash and its sister function SequenceMAC, a pair of related hash constructions that bring secure multihashing to developers using hash functions other than Keccak.
blog · blog.trailofbits.com
Auditing in the age of (good enough) AI
Trail of Bits explains how agents built tooling and a Lean model for the Miden zkVM audit, finding a flaw enabling Falcon signature forgery and yielding 95 machine-checked proofs.
Back