Devon Maloney

489 Followers
139 Following
129 Posts
Security Engineering and Architecture at Apple. Vulnerability research. Embedded systems in Swift. Alumnus RPISEC. Previously ReSwitched team. 🏳️‍🌈
Pronounshe/him
If this sounds fun to you, the SPEAR team is hiring. Engineering and management, junior to staff. https://xoxo.zone/@numist/116421360766436710
Scott Perry (@[email protected])

If this sounds fun to you, we are extremely hiring: https://jobs.apple.com/en-us/details/200592135-0836/platform-and-frameworks-software-engineer-sear?team=SFTWR Happy to have coffee about it with mutuals, and yes, it's in Cupertino. When I changed roles in 2024 my initial goal was just to find an office closer to my home in Oakland. This team is delivering high impact results with career-defining projects that is worth the (3 days a week) commute.

XOXO Zone

Last year, my team shipped a Swift rewrite of Apple's TrueType hinting interpreter. The new code is strictly memory safe, relentlessly tested, and faster than the C code it replaced.

This year, it is my pleasure to ship it for a second time, now as an open source package, and to share our experience on the Swift blog: https://www.swift.org/blog/migrating-truetype-hinting-to-swift/

Swift at Apple: Migrating the TrueType Hinting Interpreter

TrueType is a widely used vector font standard for rendering text in web pages, PDFs, operating systems, and applications. Familiar fonts like Helvetica, Garamond, and Monaco are all built on TrueType outlines. The format specifies a hinting interpreter intended to help outlines rasterize faithfully on low-resolution displays. Modern high-resolution displays enable beautiful typography from outlines alone, but TrueType fonts that need hinting to render legibly remain in use and we continue to support them. Font parsers process data from untrusted sources, making the TrueType hinting interpreter a security-critical attack surface. To make the format more resilient on Apple platforms, we rewrote its hinting interpreter from C to memory-safe Swift for the Fall 2025 releases. In addition to memory safety, we also improved performance: on average, our Swift interpreter runs 13% faster than the C interpreter it replaced. To accompany this post, we’ve also published the source code of the Swift TrueType hinting interpreter. We hope sharing our experience helps others doing similar work in Swift.

Swift.org

Okay. I FINISHED THE TRANSLATION. Fifty entire pages of modern Chinese philosophy about Western philosophy. It's nominally about "artificial intelligence" but in typical philosophical fashion, it's actually about, uh, colonialism, Catholicism, Van Gogh's weird fucked-up blood and thinking really hard about one specific random photograph of a street.

If you are curious about what is being taught right now in actual Chinese university classrooms about Western philosophy, you should read it. I highlighted several passages that are of particular interest to a Western reader who wants to understand how China sees itself and sees the West.

https://厄.net/backup/western-philosophy-chinese-perspective-ai.pdf

#chinese #translation #philosophy

My team rewrote Apple's TrueType hinting interpreter in Swift, ask me anything.

> "For the 27 releases, we've started writing parts of the core operating system kernel in Swift."

Swift for the Kernel was an awesome project to work on this year! I'm very happy to have been able to make these first steps towards a truly memory-safe kernel possible :)

🆕 A blueprint for formal verification of Apple corecrypto

Learn more about the formal verification methods used for ensuring the mathematical correctness of corecrypto's post-quantum ML-KEM and ML-DSA implementations.
We are also releasing our Isabelle libraries, ARM64 model, and Cryptol-to-Isabelle translator!

https://security.apple.com/blog/formal-verification-corecrypto/

#FormalMethods #PostQuantum #Security

A quote from A Deepness in the Sky

Pham Nuwen spent years learning to program/explore. Programming went back to the beginning of time. It was a little like the midden out back of his fathe...

This is *brutal*...

"There are no more juniors. There was a funeral for their passing in 2024. Nobody came. The machine does what they do now, but cheaper. Of course, juniors weren't valuable for what they produced, they were valuable for who they would become: the senior engineer who knows where the bodies are buried. We optimized for output, and abolished apprenticeship. A few years from now, we'll wonder where all the seniors are. We shot them. Nobody will remember."

https://www.stvn.sh/writing/programming-still-sucks-fqffhyp

ETA:
This is by @stevendotjs, who absolutely nails a bunch of things I've been feeling for a while now, but had no idea how to articulate...

Programming Still Sucks. — Writing

Sorry Peter. — I'm at a birthday party, and while most people here also work in tech, there's always a Guy with a Real Job. You know, a physical job, building some or other thing people need. And this Guy always asks some variant of the same question: aren't you worried AI is taking your job? I glance around and see a few faces turning around toward us, rolling their eyes ever so slightly before returning to their previous conversation. Yes, this question again.

We are transitioning in mathematics from an era of proof scarcity to an era of proof abundance, but our mathematical infrastructure and culture has not yet adapted to this. As mentioned previously, there is now a strong (and growing) impedance mismatch between the three core components of mathematical problem solving: proof generation, proof verification, and proof digestion.

An early sign of this transition could be seen in the chaotic response to the initial "First Proof" challenge, in which many more potentially viable solutions to the given problems were produced than could be readily verified or digested, either by experts or by automated tools. And now we are seeing the same impedance mismatch at the Erdos problem website, where (since the release of GPT 5.5, as well as the highly publicized recent solution to Erdos problem #1196) there is now an unprecedented backlog of nearly twenty claimed full or partial solutions "pending assessment": https://github.com/teorth/erdosproblems/wiki/AI-contributions-to-Erd%C5%91s-problems . (Prior to this recent surge, this category contained one or two solutions at a time at best.) (1/5)

AI contributions to Erdős problems

A community database for the problems on the erdosproblems.com site - teorth/erdosproblems

GitHub

I think that Ky Decker’s blog post about “AI” and burnout (https://ky.fyi/posts/ai-burnout ) is worth reading. I am experiencing a bunch of similar feelings, and the paragraph starting with, “I encountered each of these scenarios over the past few years”, is a description of a living nightmare.

I am thankful to work with skilled and thoughtful people who are grappling with these things, and luckily, my passion for helping people is, so far, catapulting me through the moral injury of “Claude said this” and “Claude did that”.

Funny enough, today also marks my 14th year of working at Apple, adjusted for when I started my internship. Despite the broader industry getting more morally perilous, more full of shit, and less fun, I’m far from done trying to make authentication technologies more usable, delightful, and secure. Onward.

Do I belong in tech anymore?

On quitting, the spread of AI, and the loss of an ideal.

Ky Decker