zkSecurity retweeted
Cybersecurity professionals:
1990s: "all the software is broken"
2000s: "all the software is broken"
2010s: "all the software is broken"
2020s: "all the software is broken"
Fall 2026, the collective internet:
"OMG, all the software is broken and vuln".
1990s: "all the software is broken"
2000s: "all the software is broken"
2010s: "all the software is broken"
2020s: "all the software is broken"
Fall 2026, the collective internet:
"OMG, all the software is broken and vuln".
1
4
9
405
zkSecurity retweeted
๐บ๐ธ ๐๐ผ๐ฟ๐บ๐ฎ๐น ๐ฉ๐ฒ๐ฟ๐ถ๐ณ๐ถ๐ฐ๐ฎ๐๐ถ๐ผ๐ป ๐ถ๐ป ๐๐ฟ๐๐ฝ๐๐ผ๐ด๐ฟ๐ฎ๐ฝ๐ต๐ ๐ณ๐. @archetypevc
๐ฆ๐ฒ๐๐๐ถ๐ผ๐ป ๐ก๐ผ๐๐ฒ๐: (๐ญ) DyLean, a tool that proves protocols secure, re-checks only what you change, also let you define your own threat model. (๐ฎ) On better.codes, ty proof from 53 to 68 bits in 25 days. (๐ฏ) Lean checks AI proofs instead of AI specs. [๐ค๐๐ฒ๐๐๐ถ๐ผ๐ป]: If AI writes both the proof and the description of what it should prove, who checks that weโre proving the right thing?
๐ฆ๐ผ๐๐ฟ๐ฐ๐ฒ -ย ๐๐๐๐ฒ๐ฎ๐ป, ๐ฎ ๐ณ๐ฟ๐ฎ๐บ๐ฒ๐๐ผ๐ฟ๐ธ ๐ณ๐ผ๐ฟ ๐๐ต๐ฒ ๐๐๐บ๐ฏ๐ผ๐น๐ถ๐ฐ ๐ฎ๐ป๐ฎ๐น๐๐๐ถ๐ ๐ผ๐ณ ๐ฐ๐ฟ๐๐ฝ๐๐ผ๐ด๐ฟ๐ฎ๐ฝ๐ต๐ถ๐ฐ ๐ฝ๐ฟ๐ผ๐๐ผ๐ฐ๐ผ๐น๐
github.com/BobDyLean/dyleโฆ
None of it would have happened without our session guides @kobigurk (@zksecurityXYZ) and Abhi Shah [@Columbia] and venue partner @archetypevc ๐ซถ๐ป
๐ฆ๐ฒ๐๐๐ถ๐ผ๐ป ๐ก๐ผ๐๐ฒ๐: (๐ญ) DyLean, a tool that proves protocols secure, re-checks only what you change, also let you define your own threat model. (๐ฎ) On better.codes, ty proof from 53 to 68 bits in 25 days. (๐ฏ) Lean checks AI proofs instead of AI specs. [๐ค๐๐ฒ๐๐๐ถ๐ผ๐ป]: If AI writes both the proof and the description of what it should prove, who checks that weโre proving the right thing?
๐ฆ๐ผ๐๐ฟ๐ฐ๐ฒ -ย ๐๐๐๐ฒ๐ฎ๐ป, ๐ฎ ๐ณ๐ฟ๐ฎ๐บ๐ฒ๐๐ผ๐ฟ๐ธ ๐ณ๐ผ๐ฟ ๐๐ต๐ฒ ๐๐๐บ๐ฏ๐ผ๐น๐ถ๐ฐ ๐ฎ๐ป๐ฎ๐น๐๐๐ถ๐ ๐ผ๐ณ ๐ฐ๐ฟ๐๐ฝ๐๐ผ๐ด๐ฟ๐ฎ๐ฝ๐ต๐ถ๐ฐ ๐ฝ๐ฟ๐ผ๐๐ผ๐ฐ๐ผ๐น๐
github.com/BobDyLean/dyleโฆ
None of it would have happened without our session guides @kobigurk (@zksecurityXYZ) and Abhi Shah [@Columbia] and venue partner @archetypevc ๐ซถ๐ป
1
2
5
241
zkSecurity retweeted
Introducing the definitive guide to ZK in 2026.
The yearโs biggest questions pointed to ZK: Can we trust AI? Will quantum break encryption? Can private money live on public rails? How do we know whatโs real online?
Read how in the 2026 ZK Industry Report with @zeroknowledgefm.
1
2
24
1,476
latest zk report mentions our work on zk.golf and better.codes!
Introducing the definitive guide to ZK in 2026.
The yearโs biggest questions pointed to ZK: Can we trust AI? Will quantum break encryption? Can private money live on public rails? How do we know whatโs real online?
Read how in the 2026 ZK Industry Report with @zeroknowledgefm.
0
2
17
777
zkSecurity retweeted
๐๏ธLast week @AnnaRRose, @nico_mnbl, @kobigurk spoke with @rotn256 & @g_dellimmagine from @zksecurityXYZ about zkGolf, a competition to build the most efficient, formally verified ZK circuits.
They dug into Clean, AI-driven circuit optimisation and more!
zeroknowledge.fm/podcast/414
They dug into Clean, AI-driven circuit optimisation and more!
zeroknowledge.fm/podcast/414
2
5
16
1,171
zkSecurity retweeted
Now I own the Solana address whose private key is 4. solscan.io/account/4AjNauโฆ
9
4
110
55,720
if you guys used zkao.io it would detect weak keys automatically, just saying
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-yoโฆ
0
4
12
932
New zk.golf challenge โณ๏ธ Google ID Token Claims Extraction.
Take the raw JSON payload of a Google ID token, parse it, check it against Google's schema, and extract the claim values. All inside a circuit. (1/8)
Take the raw JSON payload of a Google ID token, parse it, check it against Google's schema, and extract the claim values. All inside a circuit. (1/8)
3
4
28
1,783
The best part: we never wrote the circuit ourselves.
We wrote the specification: a reference JSON parser and a simple declarative schema of what an acceptable Google ID token looks like. A few days later, an agent had written the corresponding circuit. (7/8)
We wrote the specification: a reference JSON parser and a simple declarative schema of what an acceptable Google ID token looks like. A few days later, an agent had written the corresponding circuit. (7/8)
1
0
1
136
zkSecurity retweeted
What powers zkao? How is it different from running a model over your code? What does an audit cost?
A thread on how we approach AI security auditing, what youโre paying for, and where the limits are. ๐งต
A thread on how we approach AI security auditing, what youโre paying for, and where the limits are. ๐งต
1
3
20
1,287
we packed the last zk podcast with zksecurity folks! mathias, giorgio, nico, and kobi talk about our lean framework (clean) to formally verify zk circuits and our competitive platform for degens to submit lean proofs zk.golf!
2
5
22
3,418
forgot the tags! @rotn256 @g_dellimmagine @nico_mnbl @kobigurk and here's clean clean.zksecurity.xyz
0
0
1
287