Lukas Weichselbaum

If you're into web security take a look at my LocoMocoSec keynote slides from this summer about "Google's Recipe for Scaling (Web) Security": speakerdeck.com/lweichselbau...

One of my teams at Google, 𝗔𝗜 𝗔𝗴𝗲𝗻𝘁 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆, is expanding in 𝗭𝘂𝗿𝗶𝗰𝗵 🇨🇭and 𝗡𝗲𝘄 𝗬𝗼𝗿𝗸 🇺🇸. We're looking for 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗘𝗻𝗴𝗶𝗻𝗲𝗲𝗿𝘀 with experience in attacking and securing AI/ML systems. DMs open.

Safari Tech Preview 215: Added support for Trusted Types 🎉 webkit.org/blog/16523/r...

Excited to present Security Signals with @ddworken.bsky.social and @webappsec.dev, my primary project at Google for the past five years. Thanks, @madwebwork.bsky.social! Paper: research.google/pubs/securit... Slides: speakerdeck.com/mikispag/sec...

Building secure web apps shouldn't be a burden. We've built a high-assurance web framework at Google that makes security easy for developers. Learn about our "Secure by Design" approach and how it works in our new blog post: bughunters.google.com/blog/6644316... cc: @ddworken.bsky.social

Building secure web apps shouldn't be a burden. We've built a high-assurance web framework at Google that makes security easy for developers. Learn about our "Secure by Design" approach and how it works in our new blog post: bughunters.google.com/blog/6644316... cc: @ddworken.bsky.social

The Great Google Password Heist: 15 years of hacking passwords to test our security (and build team culture!) bughunters.google.com/blog/6355265...

Modern solutions against cross-site attacks (frederikbraun.de/modern-solut...): An article about cross-site leak attacks and browser-based defenses. You will also learn why web security best practices is always opt-in and finally how YOU can get increased security controls.

Welcome @shhnjk.bsky.social 🎉

MITRE: Cross-Site Scripting Is 2024's Most Dangerous Software Weakness www.darkreading.com/application-...

Handling Cookies is a Minefield: Inconsistencies in the HTTP cookie specification and its implementations have caused a situation where countless websites (including Facebook, Netflix, Okta, WhatsApp, Apple, etc.) are one small mistake away from locking their users out. grayduck.mn/2024/11/21/h...

Congratulations, this is amazing! Since you asked, our Google CSP/Reporting API collector currently processes ~3.5B reports per day. That's for CSP, COOP, Trusted Types, and custom reporting. It has enabled us to truly scale up deployment of web platform security features across Google in a safe way

@webappsec.dev has go.bsky.app/Uf8dZhz, it's a good one.

What do you call a padlock for spiders? Web security! ... I'll see myself out...

It took me twelve years (!) to build up my audience on Twitter. It took 5 days to surpass the 50% point of my Twitter following on Bluesky. I’m hopeful that the overall growth on this site will negate the need to go on Twitter altogether. Sad to see what it devolved into, but thrilled to see it die.

Bluesky now has over 20M people!! 🎉 We've been adding over a million users per day for the last few days. To celebrate, here are 20 fun facts about Bluesky:

Great article about multipart parsing. Reminds me about the bypasses I found in modsec parser medium.com/@terjanq/waf...

Read all about how we made web security measurable at Google! Security signals have allowed us to massively scale our web security program and enabled us to deploy security features like CSP or Trusted Types at scale!

I'm in the process of creating a *web security* starter pack and need your help finding more webbies here. Please share and recommend folks passionate about web security in comments below so we can get this community started here 🙂 go.bsky.app/Uf8dZhz

Excited to share our latest blog post on memory safety! We’re tackling spatial safety in our massing C++ codebase by hardening live++ by default. It adds bounds checks to things like std::vector, preventing a fair bit of out-of-bounds vulnerabilities: security.googleblog.com/2024/11/retr...

If you haven't deleted your Twitter account yet, please signal boost this post so we can get more folks connected over here: x.com/we1x/status/...

XSS vulnerabilities keeping you up at night? 😱 Google's new "Commitment to Secure by Design" whitepaper has answers! Safe Coding and web platform improvements are key. Read more (page 7): static.googleusercontent.com/media/public...

Everyone who wants to grow/bootstrap their #infosec network here check out John's amazing starter pack!