Trail of Bits
A US-based software security auditing firm founded in 2012 and headquartered in New York. It specializes in cryptographic review, vulnerability research, and security engineering, and has provided security audits for prominent open-source projects including Ethereum, Kubernetes, and OpenSSL.
Timeline (last 90 days)
According to the data given in the talk, a WhatsApp key transparency auditor needs to download and hash about 80MB of data per minute, and the actual deployment relies on external audit services (WhatsApp uses Cloudflare, Signal uses Cloudflare and Trail of Bits).
OpenAI is in preliminary negotiations to acquire cybersecurity startup Trail of Bits; Trail of Bits was founded in 2012, mainly engages in discovering and fixing vulnerabilities in open-source software, and has a team of more than 40 people, mostly security engineers.
In June of this year, Trail of Bits cooperated with OpenAI to launch the "Patch the Planet" project, relying on OpenAI's Codex series AI models to find and fix code vulnerabilities in popular open-source projects such as Python.
Vercel invited two engineers from Trail of Bits to assess its security architecture; Trail of Bits invested four engineer-weeks diving into the source code, had full repository access and two enterprise test teams, and delivered 20 findings.
Trail of Bits flagged the same root cause as the snapshot vulnerability in an independent assessment.
Trail of Bits' architecture review concluded that the virtualization boundary is reliable: each sandbox runs in a separate Firecracker microVM with a dedicated guest kernel, the device model is deliberately designed to be small, and no guest shares a running kernel with the host or other tenants.
Trail of Bits gave three structural recommendations and Vercel has implemented all of them: eliminate all trust in the guest; unify policy decisions; and assume the next zero-day will eventually arrive and strengthen protections around each sandbox (keep the host kernel updated, disable nested virtualization, and use Firecracker's jailer).
Through the 'Patch the Planet' program in collaboration with Trail of Bits, OpenAI merged 37 patches in the first week, with the AIO HTTP project fixing 8 reported issues within hours.
Trail of Bits maintains the MATE framework for binary analysis and the smart contract analysis tool Echidna.
Trail of Bits was founded in 2012 and is headquartered in New York.
2 more timeline events
All Facts (12)
The original source material on which this article is based is very limited in information, containing only a title and source information, and lacking specific technical details.
60%UnverifiedAccording to the data given in the talk, a WhatsApp key transparency auditor needs to download and hash about 80MB of data per minute, and the actual deployment relies on external audit services (WhatsApp uses Cloudflare, Signal uses Cloudflare and Trail of Bits).
50%UnverifiedIn June of this year, Trail of Bits cooperated with OpenAI to launch the "Patch the Planet" project, relying on OpenAI's Codex series AI models to find and fix code vulnerabilities in popular open-source projects such as Python.
50%UnverifiedVercel invited two engineers from Trail of Bits to assess its security architecture; Trail of Bits invested four engineer-weeks diving into the source code, had full repository access and two enterprise test teams, and delivered 20 findings.
50%UnverifiedTrail of Bits flagged the same root cause as the snapshot vulnerability in an independent assessment.
50%UnverifiedTrail of Bits' architecture review concluded that the virtualization boundary is reliable: each sandbox runs in a separate Firecracker microVM with a dedicated guest kernel, the device model is deliberately designed to be small, and no guest shares a running kernel with the host or other tenants.
50%UnverifiedTrail of Bits gave three structural recommendations and Vercel has implemented all of them: eliminate all trust in the guest; unify policy decisions; and assume the next zero-day will eventually arrive and strengthen protections around each sandbox (keep the host kernel updated, disable nested virtualization, and use Firecracker's jailer).
50%UnverifiedTrail of Bits maintains the MATE framework for binary analysis and the smart contract analysis tool Echidna.
50%UnverifiedTrail of Bits was founded in 2012 and is headquartered in New York.
50%UnverifiedTrail of Bits is a software security auditing firm specializing in cryptographic review, vulnerability research, and security engineering.
50%UnverifiedOpenAI is in preliminary negotiations to acquire cybersecurity startup Trail of Bits; Trail of Bits was founded in 2012, mainly engages in discovering and fixing vulnerabilities in open-source software, and has a team of more than 40 people, mostly security engineers.
50%UnverifiedThrough the 'Patch the Planet' program in collaboration with Trail of Bits, OpenAI merged 37 patches in the first week, with the AIO HTTP project fixing 8 reported issues within hours.
50%