trailofbits/publications
View on GitHub ↗ ★ 1,917 Python
Publications from Trail of Bits
14 mentions on Hacker News by 11 people: 5 stories, 9 comments · first 2019-07-20 · latest 2026-08-17
20082026
-
…lofbits.com/2025/08/20/marshal-madness-a-br... I was also part of the team that audited RubyGems.org: https://github.com/trailofbits/publications/blob/master/revi... Look at TOB-RGM-9 (an informational, largely out-of-scope finding) if you…
comment by schwag09 · 2026-08-14 · in Ruby 4.0 Universal RCE Deserialization Gadget Chain -
…see recent work on that front here[1] :-). Source: I run the group that produced this work. [1]: https://github.com/trailofbits/publications
comment by woodruffw · 2025-05-12 · in Making PyPI's test suite faster -
…hit it. A related interesting read was the DAVE protocol design review, available here: https://github.com/trailofbits/publications/blob/master/revi...
comment by ziddoap · 2024-09-20 · in 2024-09 Discord Dave Protocol Code review [pdf] -
…trouble finding the audit itself (it's linked indirectly), I'm linking a copy here as well[1]. [1]: https://github.com/trailofbits/publications/blob/eb9344f2261...
comment by woodruffw · 2024-07-30 · in Our audit of Homebrew -
…like Skiff conveniently didn't allow Trail of Bits to publish their reports, they are usually here: https://github.com/trailofbits/publications/tree/master/revi... Disclaimer, I have used Trail of Bits service in the past (and 2 other…
comment by mratsim · 2024-01-14 · in Skiff: Various Privacy Failures -
Link to the report: https://github.com/trailofbits/publications/blob/master/revi... They seem to not have analysed client-side of PIP itself, but I suppose there isn't anything you could say that isn't already obvious to everyone.
comment by lyu07282 · 2023-11-14 · in PyPI has completed its first security audit -
…weeks that cover a large amount of potential use cases. Here's an example of what that looks like: https://github.com/trailofbits/publications/blob/master/revi... Here's Echidna: https://github.com/crytic/echidna and Manticore:…
comment by dguido · 2021-04-22 · in Smart Contract Security for Pentesters -
…deanonymize votes, deny votes, alter votes, and invalidate audit trails That's...sub-optimal [0] https://github.com/trailofbits/publications/blob/master/revi...
comment by lucozade · 2020-09-04 · in Why experts are overwhelmingly skeptical of online voting -
…techniques. It's very weird. I explored this topic a bit in a keynote earlier this year: https://github.com/trailofbits/publications/blob/master/pres... I will also note that our long-term goal for Slither is to directly address some of…
comment by dguido · 2019-07-20 · in Manticore: A Symbolic Execution Framework for Binaries and Smart Contracts