Andrew Whalley

Andrew Whalley

@arw.me

An Englishman in San Francisco. Director of Security for Google Chrome.

483 followers391 following134 posts

In an ideal world, normal people shouldn't worry about computer security. But for now, people should focus on things that matter — like using MFA and keeping software up to date — not worrying about things like public wifi. Proud to be a signatory of this great initiative by @boblord.bsky.social

Bob Lord@boblord.bsky.social

📢 Announcing hacklore.org 📢 It’s time to retire outdated cyber advice! More than 80 cybersecurity veterans have signed an open letter urging a shift from folklore to guidance that actually helps people avoid the most common attacks. 🔐 Blog: medium.com/@boblord/let... Site: www.hacklore.org

Another great ancillary benefit of memory safe languages: Cool infrastructure projects remain cooler for longer 😎 Library authors can provide great functionality without implicitly signing up for the slew of security bugs that are sadly the consequence of a large c/c++ project.

Kevin Jones@vcsjones.dev

Everyone wants to maintain a cool infrastructure library until maintaining a cool infrastructure library is no longer convenient.

Andrew Whalley reposted

Here's something I am very excited about: Photosynthesis! 🌱☀️ A proposal to have CAs run transparency logs and make X.509 certificates out of Merkle Tree inclusion proofs. This is similar to how CT would have worked in an ideal world, and it solves the problem of PQC sizes in logs and handshakes.

mailarchive.ietf.org[TLS] Photosynthesis, an update to Merkle Tree CertificatesPhotosynthesis combines the Static CT API with the ideas in Merkle Tree Certificates.

Andrew Whalley reposted

Replying to @arw.me

Note that you can get a new social security card without that wording when you get a green card. I did so will double check I told them when I became a citizen!

🗽 PSA for naturalised citizens: If you never got a new social security card when you became a citizen, and your existing card has "valid for work only with ins/dns authorization" you are likely still in the Social Security database as a non-citizen.

Andrew Whalley reposted

I'm excited about this program! Chromium isn't necessarily easy, but I know there are great engineers out there who would love to get paid for improving it!

🚨 Attention Chromium developers! 🚨 The SOCBB Bug Bounty Program is offering up to $10,000 for fixing bugs in Chromium-based browsers like Chrome & Edge! Contribute to repos like chromium, v8, and more. Get paid via GitHub Sponsors! Start fixing: github.com/Supporters-O... #Chromium #OpenSource

You can increase the protection of Chrome's process isolation by using the chromeenterprise.google/policies/?po... enterprise policy, or the Strict-Origin-Isolation option on chrome://flags/

Chandler Carruth @chandlerc.blog

The gift that keeps on giving: predictors.fail This is IMO a great example of why **process isolation is the only path to confidentiality on modern CPUs**. Site- (or origin-) process isolation continues to be the path. Also note: the CPU is **not** the problem here IMO, it's doing exactly its job.

Andrew Whalley reposted

Replying to @ciaranm.bsky.social

This is not an easy discussion to have against such a horrific backdrop. But online age restrictions on commonly available goods are unlikely to make any difference & such measures are not cost free Hope the gov’t: - focuses on real security improvements; - has a coherent approach to tech 2/2

I’ve lived in California a long time, but I’ve never got used to the fact that hummingbirds aren’t just on TV nature documentaries, but also “a few feet over there”

Thoroughly enjoyed my first ride on a new electric Caltrain! Though slightly alarmed to see a Chrome error message that's not been shipping since 2015! I hope the systems running your infoscreens aren't connected to anything important, @gocaltrain.bsky.social ...

Andrew Whalley reposted

To those of you who use a consumer VPN for "security" reasons, what specific technical improvements in your browser or OS would make you change your mind and uninstall the VPN? Please be technical.

This post is unavailable.

Giving Tuesday idea: Do you have an Amazon credit card and a decent amount of cash back? Why not convert it into real impact and warm fuzzies by buying things off amazon wish lists. e.g. see #clearthelist for those of teachers. (It's sad it's needed for classroom supplies, but here we are)

Andrew Whalley reposted

Replying to @steveklabnik.com

> The Android team has observed that the rollback rate of Rust changes is less than half that of C++ This is a sleeper hit of a quote.

Andrew Whalley reposted

OMG Private Network Access is finally shipping in Chrome 123. That's just shy of a decade for something I'd honestly expected to have shipped in more like a year. But I'm glad to see finally it's moving forward and the other browsers are supportive. www.bleepingcomputer.com/news/google/...

bleepingcomputer.comNew Google Chrome feature blocks attacks against home networksGoogle is testing a new feature to prevent malicious public websites from pivoting through a user's browser to attack devices and services on internal, private networks.