Andrew Whalley reposted
Andrew Whalley
Andrew Whalley
@arw.me
An Englishman in San Francisco. Director of Security for Google Chrome.
483 followers391 following134 posts
A perfect complement to chrome.security !
In an ideal world, normal people shouldn't worry about computer security. But for now, people should focus on things that matter — like using MFA and keeping software up to date — not worrying about things like public wifi. Proud to be a signatory of this great initiative by @boblord.bsky.social
📢 Announcing hacklore.org 📢 It’s time to retire outdated cyber advice! More than 80 cybersecurity veterans have signed an open letter urging a shift from folklore to guidance that actually helps people avoid the most common attacks. 🔐 Blog: medium.com/@boblord/let... Site: www.hacklore.org
Andrew Whalley reposted
It's time to make HTTPS the web's default, and reap the full security benefit from years worth of HTTPS adoption! security.googleblog.com/2025/10/http...
Andrew Whalley reposted
Just posted a deep dive on how Chrome integrates with Advanced Protection Mode on Android. security.googleblog.com/2025/07/adva...
Another great ancillary benefit of memory safe languages: Cool infrastructure projects remain cooler for longer 😎 Library authors can provide great functionality without implicitly signing up for the slew of security bugs that are sadly the consequence of a large c/c++ project.
Everyone wants to maintain a cool infrastructure library until maintaining a cool infrastructure library is no longer convenient.
Andrew Whalley reposted
Here's something I am very excited about: Photosynthesis! 🌱☀️ A proposal to have CAs run transparency logs and make X.509 certificates out of Merkle Tree inclusion proofs. This is similar to how CT would have worked in an ideal world, and it solves the problem of PQC sizes in logs and handshakes.
British Airways, to give a taste of how long a transatlantic flight feels, created BA.com
Andrew Whalley reposted
Andrew Whalley reposted
You'll need to show your passport or naturalisation certificate at an SSA office. Start the process here: ssa.gov/ssncard-apply
Andrew Whalley reposted
I'm excited about this program! Chromium isn't necessarily easy, but I know there are great engineers out there who would love to get paid for improving it!
🚨 Attention Chromium developers! 🚨 The SOCBB Bug Bounty Program is offering up to $10,000 for fixing bugs in Chromium-based browsers like Chrome & Edge! Contribute to repos like chromium, v8, and more. Get paid via GitHub Sponsors! Start fixing: github.com/Supporters-O... #Chromium #OpenSource
Andrew Whalley reposted
Replying to @anniesullie.com
Here are the project ideas and info for Chromium:
Andrew Whalley reposted
Am I allowed to feel smug about being all hip and getting the pop culture reference, if I only know about it because of @kenwhite.bsky.social ?
If we’re renaming bodies of water based on petty grievances, I propose that this be renamed the Kendrick Lamar passage.
Andrew Whalley reposted
You can increase the protection of Chrome's process isolation by using the chromeenterprise.google/policies/?po... enterprise policy, or the Strict-Origin-Isolation option on chrome://flags/
The gift that keeps on giving: predictors.fail This is IMO a great example of why **process isolation is the only path to confidentiality on modern CPUs**. Site- (or origin-) process isolation continues to be the path. Also note: the CPU is **not** the problem here IMO, it's doing exactly its job.
And if you'd like to learn more about the nitty gritty of Site Isolation, there's a video in the excellent "What's Up With?" series: www.youtube.com/watch?v=OH-b...
Andrew Whalley reposted
Yesterday Chromium deleted our copy of `libavif` -- the last step of a year-long project replacing it with a new Rust library! :) chromium-review.googlesource.com/c/chromium/s...
Andrew Whalley reposted
Replying to @ciaranm.bsky.social
This is not an easy discussion to have against such a horrific backdrop. But online age restrictions on commonly available goods are unlikely to make any difference & such measures are not cost free Hope the gov’t: - focuses on real security improvements; - has a coherent approach to tech 2/2
Need to check if you've got IPv6 connectivity? Love dancing turtles and 27 year old web pages? www.kame.net is for you.
Thoroughly enjoyed my first ride on a new electric Caltrain! Though slightly alarmed to see a Chrome error message that's not been shipping since 2015! I hope the systems running your infoscreens aren't connected to anything important, @gocaltrain.bsky.social ...
Andrew Whalley reposted
Andrew Whalley reposted
On first glance, the C++ 23 “assume” keyword is the craziest thing I’ve ever seen. bsky.app/profile/feli...
C++23 has "first-class UB": you, the language user, can make promises and let the program enter UB if you break them. int f(int x, int y) { [[assume(x == 27)]]; [[assume(x == y)]]; return y + 1; // May be optimised to `return 28`. }
Andrew Whalley reposted
Andrew Whalley reposted
OMG Private Network Access is finally shipping in Chrome 123. That's just shy of a decade for something I'd honestly expected to have shipped in more like a year. But I'm glad to see finally it's moving forward and the other browsers are supportive. www.bleepingcomputer.com/news/google/...