Chris Thompson

61 Followers
45 Following
14 Posts
Security and usability engineer, experimenter, &c, working on Google Chrome Security.
Twitter (lol)@notyetsecure
Website (old)https://notyetsecure.com
The MOARTLS journey continues! Looking forward to next year https://security.googleblog.com/2025/10/https-by-default.html
HTTPS by default

One year from now, with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable “Always Use Secu...

Google Online Security Blog
I fucked up my repo so bad

Hi everyone — especially browser security researchers! Today we’ve announced some pretty significant changes to the Chrome VRP reward structure and amounts. This was all built with the purpose of incentivizing deeper and ever more impactful research of Chromium security issues.

I wrote a little blog about it here: https://bughunters.google.com/blog/5302044291629056/chrome-vrp-reward-updates-to-incentivize-deeper-research

We wanted to acknowledge the challenges faced and skills required to find the more complex and impactful issues in Chrome, especially when it comes to demonstrating the full exploitability and impact.

We hope these changes are helpful inspiring to browser security researchers and signal our continued investment in working with you to make Chrome more secure for all users.

Blog: Chrome VRP Reward Updates to Incentivize Deeper Research

The Chrome VRP is increasing reward amounts and their structure to incentivize high-quality reporting and deeper research of Chrome vulnerabilities, see this post for details!

@adamshostack Reading through this made me think about CA incident reports (and resulting discussion/analysis in venues like m.d.s.p.), or at least the idealized form of them. The same mistake Cruise made comes up a lot where CAs fail to proactively share all relevant information and get dinged more for failure to do good incident response/withholding information than for the initial incident itself. Good CA incident reports can be a bit rare but can also be deeply enlightening.
Blink: Intent to Ship: HTTPS Upgrades https://t.co/msFK2oJcTP
Intent to Ship: HTTPS Upgrades

Hello. To make things a bit less empty, please enjoy this photo of my cat with a felt egg.