Andrew Whalley
banner
arw.me
Andrew Whalley
@arw.me
430 followers 380 following 120 posts
An Englishman in San Francisco. Director of Security for Google Chrome.
Posts Media Videos Starter Packs
I do! Two actually. It's utterly silly and utterly delightful. This review sums it up well: youtu.be/8pPCMjqI_uw?...
BECOME UNOVENABLE 🪿
Ovenable. This container is not ovenable.
Somewhat ironic that this is the week I start VPNing /in/ to the UK so I can listen to BBC Sounds again.
I’d love to get the web platform primitives in place so they could have a web app. Maybe one day.
Congratulations!?
Do you recommend reading them in order?
*alex horne voice* quote this with the best post. you have three hours and one attempt. your time starts now
Another great ancillary benefit of memory safe languages: Cool infrastructure projects remain cooler for longer 😎

Library authors can provide great functionality without implicitly signing up for the slew of security bugs that are sadly the consequence of a large c/c++ project.
Everyone wants to maintain a cool infrastructure library until maintaining a cool infrastructure library is no longer convenient.
Reposted by Andrew Whalley
Here's something I am very excited about: Photosynthesis! 🌱☀️

A proposal to have CAs run transparency logs and make X.509 certificates out of Merkle Tree inclusion proofs.

This is similar to how CT would have worked in an ideal world, and it solves the problem of PQC sizes in logs and handshakes.
[TLS] Photosynthesis, an update to Merkle Tree Certificates
Photosynthesis combines the Static CT API with the ideas in Merkle Tree Certificates.
mailarchive.ietf.org
Happy solstice! 🌞🌝
Oh no! *hug* !
True, and I have an embarrassment of passports
British Airways, to give a taste of how long a transatlantic flight feels, created BA.com
I once managed to get a lovely rack of xserves and xserve raids for running malware analysis infra, with the justification that windows malware didn’t run well on PowerPC :-)
Congratulations!
Really excellent deck! cc @rusi.bsky.social - might be of interest to your members.
Whoever it was should be in a pennitentiary
Reposted by Andrew Whalley
Behold my favorite weird Chrome security bug of 2025 so far!

A jaw-dropping URL / omnibox spoof via ligatures, specifically the googlelogo ligature.

issues.chromium.org/issues/39178...
Chromium
issues.chromium.org
Though once you learn, you never forget. It's just like riding a cymbal.