Jann Horn

@jann@infosec.exchange
2.3K Followers
142 Following
1.1K Posts

human borrow checker (but logic bugs are best bugs).
works at Google Project Zero.

The density of logic bugs (compared to memory corruption bugs) goes down as the privilege differential between attacker context and target context goes up.

homepagehttps://thejh.net
Jann Horn36m ago
Gabriele Svelto1h ago
If you have an Intel Raptor Lake system and you're in the northern hemisphere, chances are that your machine is crashing more often because of the summer heat. I know because I can literally see which EU countries have been affected by heat waves by looking at the locales of Firefox crash reports coming from Raptor Lake systems.
Show threadJann Horn2h ago
reminds me of the time I had two keyboards in front of me and hit ALT+SYSRQ+O on the wrong one
Jann Horn2h ago
me: trying to use /proc/sysrq-trigger to hard-reboot a remote system with "REISUB"
me: types "R"
me: types "E"
ssh connection dies
me: ... ooh. oops. 😬
systemd: "oh hey I noticed your ssh server stopped, I'll go turn it back on"
me: ... shamefully continues with "SUB", leaving out the "I"
Show threadJann Horn4h ago
(clang apparently does this better)
Show threadJann Horn4h ago

So in bar2, all of these instructions are unnecessary:

pushq %rbp
movq %rsp, %rbp
andq $-16, %rsp
[...]
leave
[...]

and a register (RBP) is wasted here

Jann Horn4h ago

fun kernel/compiler interaction that causes some Linux kernel code to have some superfluous instructions on x86-64 and use a bit more stack space than necessary:

Linux instructs the compiler to prefer 8-byte aligned stack frames (instead of the standard 16 bytes), which then also means the compiler has to assume that at the start of each function, the stack is only aligned to 8 bytes; which means if something tries to do a 16-byte-aligned allocation, the compiler has to emit instructions to save the old stack pointer (even if frame pointers are disabled) and align the stack.

And apparently especially in GCC, any nontrivial stack allocation whose address escapes the compiler's analysis is aligned to 16 bytes even if the object actually requires less alignment:

int foo(void *);
struct s1 { unsigned long a; };
struct s2 { unsigned long a; unsigned long b; };
int bar1() {
struct s1 s;
return foo(&s);
}
int bar2() {
struct s2 s;
return foo(&s);
}

compiles to this with GCC trunk with flags -O3 -mpreferred-stack-boundary=3:

bar1:
subq $8, %rsp
movq %rsp, %rdi
call foo
addq $8, %rsp
ret
bar2:
pushq %rbp
movq %rsp, %rbp
andq $-16, %rsp
subq $16, %rsp
movq %rsp, %rdi
call foo
leave
ret

Note that bar1 doesn't do alignment (probably because struct s1 is simple enough to hit some special case?) while bar2 adds instructions to align the object (even though s1 and s2 have the same alignment requirements).

Compiler Explorer - C (x86-64 gcc (trunk))

int foo(void *); struct s1 { unsigned long a; }; struct s2 { unsigned long a; unsigned long b; }; int bar1() { struct s1 s; return foo(&s); } int bar2() { struct s2 s; return foo(&s); }

Jann Horn7h ago
Show threadAsahi Lina (朝日リナ) // nullptr::live9h ago

Also USB2.0 is super cursed. It's actually 480Mbps if you send enough "0" bits. If you send too many "1" bits, then it drops down to 411Mbps. Variable speed depending on the data?!

Of course it's also very inefficient for other reasons so you never get anywhere close to those speeds anyway...

Jann Horn3d ago
abadidea3d ago
a blog post by my friend eevee which is, y’know, preaching to the choir about exactly what you think, but. yeah. https://eev.ee/blog/2025/07/03/the-rise-of-whatever/
The rise of Whatever

This was originally titled “I miss when computers were fun”. But in the course of writing it, I discovered that there is a reason computers became less fun, a dark thread woven through a number of events in recent history. Let me back up a bit.

Jann Horn3d ago
lcamtuf   4d ago

A slightly unhinged calculator fact: in the golden era of electronic calculators, some Japanese shopkeepers were reluctant to trust the newfangled tool, so Sharp made a line of combination calculator / abacus devices.

Here's a photo, next to some other stuff I own.

Jann Horn4d ago
"ich würde gerne diese nachrichtenseite lesen... oh, ein entweder-werbung-oder-abo-oder-bezahlen-per-contentpass banner, ja, dann melde ich mich mal endlich für contentpass an... ok, jetzt zurück zur seite mit contentpass... nachrichtenseite sagt 'ah, aber jetzt brauchst du für diesen artikel auch noch unser eigenes monatsabo'"
×
Tom WarrenJun 17
🤦‍♂️
Show threadunixjunk1e 🌵Jun 17

@tomwarren.co.uk

At least he didn't tell her to do her own research 

Show threadMiakodaJun 17
@tomwarren.co.uk I wish signal would make a proper app for Linux Mobile.
Show threadJoe AlexanderJun 18
@hellomiakoda
Show threadMiakodaJun 18
@joe Can't say I understand your reply
Show threadJoe AlexanderJun 18
@hellomiakoda @Mer__edith
Show threadMiakodaJun 18
@joe @Mer__edith That doesn't clear it up.
Show threadBert DriehuisJun 17
@tomwarren.co.uk Who needs artificial stupidity when you've got the real thing in ample supply?
Show threadAsharasJun 17
@tomwarren.co.uk huge "look it up baby" vibe 😄
Show threadOliver VanderbJun 17

@tomwarren.co.uk

Well... there is always this one guy 🙂

Show threadHelga Secures All the ThingsJun 17
Ahhh still haven't decided about continuing study this semester. Do I want to drop two grand on sitting through someone reading a powerpoint and telling war stories while teaching myself the tools to create a fake incident report on a technology that was deprecated several years ago? Added bonus, an exam with ai-generated quiz that repeats half its questions on the same 5% of content. Also good luck figuring out what's actually in the exam.
Show threadHelga Secures All the ThingsJun 17

to be fair, some subjects have been better taught than others, and there's the occasional interesting assignment, but unfortunately it's been far from consistent. Staff need more training in learning design and teaching, and need more resources and hours to do their jobs effectively.

The exam experience has been uniformly atrocious, certainly compared to my experience of exams for my psychology degree, which were well designed and for which I was well prepared. Ironically I suspect a lot of the learning design support that is offered in ITC is not useful because the learning designers don't understand the topics adequately. Though generally there's such a lot of bad learning design out there, especially in the digital space... god don't get me started on that...

Show threadVoracious ReaderJun 17

@tomwarren.co.uk

Impressive how he also manages to include typing, punctuation, and vocabulary errors in his posts, in addition to the factual error and industry ignorance!

Show threadAlexJun 17
@tomwarren.co.uk LMAO
Show threadChristian RickertJun 18

@tomwarren.co.uk

I like her. <3

Show threadJohn Quentin HeywoodJun 18
@tomwarren.co.uk Oy.
Show threadsteve mookie kongJun 18

@tomwarren.co.uk

Bill be like...

https://youtu.be/AqSDQ5mR1gU

cc: @lisamelton

MythBusters - I Reject Your Reality and Substitute My Own (w/ context)

YouTube
Show threadAlanJun 18
@tomwarren.co.uk So that does make me muse 🤔 , how does one suppress mansplaining in an AI training corpus
Show threadReayJun 18
@tomwarren.co.uk @lisamelton 😂
Show threadNazoJun 18
@tomwarren.co.uk Like what even... He just declares these things as if he has inside information and... he doesn't....
Show threadGlyphJun 18
@tomwarren.co.uk @joelle this is so embarrassing I feel like turning inside out. I looked up the original thread and it just keeps getting worse and worse, the ratios are off the charts. And this guy has 60k+ followers? For… what?
Show threadnot ch1cJun 18
@glyph @tomwarren.co.uk @joelle no one is going to ask bill much of anything after this
Show threadGlyphJun 18
@cthon1c @tomwarren.co.uk @joelle I wish I could believe that, he does not appear to have lost many
Show thread0xC0DEC0DE07E9Jun 18
@glyph @cthon1c @tomwarren.co.uk @joelle ask Bill Mitchell to shut up
Show threadDarren du NordJun 18
@glyph @tomwarren.co.uk @joelle I didnt realize I could buy 60K Bsky bot followers on Fiverr.
Show threadPanic at the Trishco 🕊️Jun 18
@tomwarren.co.uk
Wow. Kind of wish she had just kept answering “No” with an increasing number of hearts as his rant went on.
Show threadTito CiuroJun 18
@tomwarren.co.uk @saraislet Bill should go under a rock for a while and think about what he has done.
Show threadSteveg58Jun 18
@tomwarren.co.uk
I wouldn't discount it out of hand. I saw, in a big engineering company I worked for, where an unprincipled executive had lower level people put systems in place before he toppled the rather principled CEO. It happens because being unprincipled allows you to make a bigger profit.
Show threadSteveg58Jun 18
@tomwarren.co.uk
On the other hand seeing as how he continued his theory as shown in another post he's just another troll.
Show thread~$ sudo apt install anthuanJun 18
@tomwarren.co.uk it's funny cause it's like she is actually standing there with that smile in her face replying that man
Show threadMy camera shoots fascistsJun 18

@tomwarren.co.uk

I'd have given anything to see her reaction to all this in person. I'm sure she's way above getting annoyed at this sort of crap by now and was probably cracking the fuck up.

I really wonder if this guy had the slightest bit of self-reflection afterward. (Kinda doubt it.)

Show threadMartin Vermeer FCDJun 18
@tomwarren.co.uk The boss is always the last to find out, right?
Show threadMarco TorchianoJun 18

@tomwarren.co.uk

The perfect poster for mansplaining?

Show threadOsma A 🇫🇮🇺🇦Jun 18
Had Signal been indexed by Windows Recall, one might stretch definition of "integration" if only seeking to score a point. Alas, Signal Foundation researched, discovered and publicized a method to avoid messages being read by a platform level LLM.
Show threadAlopeceJun 18
@tomwarren.co.uk Not sure how this is "mansplaining" other than the fact that a man is trying to explain something. He had a opinion, mistaken though it was. He wasn't patronizing, at least in the snippet of conversation shown here. Was he supposed to assume that an anonymous person saying "no" to him was the company CEO?
Show threadOriel Jutty Jun 18
@michaelvcooper1 @tomwarren.co.uk What do you mean, "an anonymous person"? The name is right there: Meredith Whittaker.
Show threadAlopeceJun 18

@barubary @tomwarren.co.uk Did you know the name of the CEO of Signal, before this exchange went viral? Do you look up the credentials of every person you answer on social media?

I've had many debates with strangers on social media over the years. Sometimes I've even been wrong. But it has never occurred to me that the person I'm speaking to might be a high-level executive with insider information. So I don't blame this guy for not considering that.

Show threadOriel Jutty Jun 18

@michaelvcooper1 @tomwarren.co.uk

Did you know the name of the CEO of Signal, before this exchange went viral?

Not actively, but the name looked familiar, so I would've taken a second to look at their profile before replying.

Do you look up the credentials of every person you answer on social media?

Why was an answer necessary in this case?

Particularly this answer, which implied familiarity with or insider knowledge of Signal's business strategy ("... likely be timing up with Anthropic's Claude or Perplexity ...") and technical foundations ("... engineers have already began laying out the ground work ..."). Keep in mind, all this was stated as definite fact, not an opinion, speculation or rumor ("They will ... its coming").

And then that same dude doesn't even recognize the name of the person who has been the president of Signal and sitting on its board of directors since 2022.

So what exactly qualifies him to "explain" anything about Signal?

Show threadAlopeceJun 18

@barubary @tomwarren.co.uk Come on. You need "qualifications" to express an opinion on the internet now? My guess (only a guess) is that this guy was repeating an internet rumor. That makes him gullible perhaps, but nothing more.

Do you know what would have cleared the air instantly? If Ms. Whittaker had simply replied "Hello, this is Meredith Whittaker, CEO of Signal. I'm not sure where you got this information, but I can assure you that there is no truth to it." Not hard.

Show threadOriel Jutty Jun 18

@michaelvcooper1

I feel like you're twisting words to suit your argument, so I'd like to clarify a few things.

As far as I'm concerned, there is a difference between explaining something and expressing an opinion on something. (But in either case you should be at least passingly familiar with the topic at hand if you want to be taken seriously. There's your "qualifications".) You're seamlessly switching between calling it a man just trying to explain something, an online debate, and someone expressing an opinion. Those are not the same thing.

Explaining things at people (particularly things you know nothing about and your audience does) is patronizing in and of itself.

No one was anonymous.

Whittaker is not the CEO of Signal. (That would be Brian Acton, I believe.)

Why is it that you expect Whittaker to announce her qualifications just to reject something that has been asserted without any justification? Why isn't the onus on Mitchell to provide any evidence for his claims? (Or at least to check her profile to see who he's lecturing. In your words: Not hard.) Those were rhetorical questions; I don't expect an answer. Bye.

Show threadAlopeceJun 18

@barubary I feel that in the context of a casual internet conversation, the differences between "expressing an opinion", "explaining something" and "an online debate" amount to semantic frivolity. Attempting to make an issue out of my word choices is a distraction.

Not saying Mitchell was right. He wasn't. I'm only saying he is not a mansplaining mysogynist simply for being wrong, while in a conversation in which a woman was right.

Bye.

Show threadDrWhoZeeJun 18
@michaelvcooper1 @barubary @tomwarren.co.uk Yes
Show threadskaphleJun 18
@michaelvcooper1 @tomwarren.co.uk It was not an opinion. It was a fact, and a false one, stated with the arrogance and confidence that is typical of people raised as male.
Show threadAlopeceJun 19
@skaphle @tomwarren.co.uk
No. 
Show threadJensJun 18
@tomwarren.co.uk Later replies from this clown are also great.
Mansplaining as a service
Show threadnadakaJun 18
@tomwarren.co.uk 😂 how you destroy your trustworthiness in just two posts.
Show threadMike 🏳️‍🌈Jun 18
@tomwarren.co.uk what a tool