Security @ Google. Previously co-founder of @ForAllSecure. Opinions here are my own. @ayper@infosec.exchange
Joined August 2008
- Tweets 119
- Following 662
- Followers 521
- Likes 438
5 Photos and videos
Alex Rebert retweeted
Apr 28
Can we translate all C to Rust? The susceptibility of C to memory corruption has long been a cybersecurity pain point, and coding agents can free us of it. Read on for my recent experiments in this space, and apt & docker repos that you can pull rust-converted libraries from!
14
23
118
22,372
Alex Rebert retweeted
12 Nov 2025
Hardening the C Standard Library at massive scale. A look at increasing memory safety with libc hardening — a collaborative paper from engineers at Apple and Google. The results have been impressive: at Google the team discovered and fixed 1000 bugs as hardening was enabled. queue.acm.org/detail.cfm?id=…
1
33
275
24,011
25 Feb 2025
We're joining forces with industry & academia to call for memory safety standardization: security.googleblog.com/2025…. It's a recognition that memory unsafety is no longer a niche technical problem but a societal one, impacting everything from national security to personal privacy.
3
16
61
4,497
Alex Rebert retweeted
21 Jan 2025
🛡️Want to help make the open source world safer and earn up to $45k 💰?
We've revamped our Patch Rewards Program, extending its scope and increasing rewards for security patches – with a particular focus on memory safety, including bonus multipliers!
bughunters.google.com/blog/5…
1
28
142
41,733
Alex Rebert retweeted
4 Dec 2024
Celebrating 15 years of password hacking 💻 🔑, Swiss Army knives (and sometimes even chainsaws or swords) included! 😲
Discover how Google's security teams turn employee farewells into security tests.
bughunters.google.com/blog/6…
1
31
108
26,908
Alex Rebert retweeted
16 Nov 2024
Bounds-checking in C : so people ask if the .3% overhead is real. It's not just a benchmark result, we got this through our Google-Wide profiling, that gives us the live insights from DCs. This surprised us too as it was much cheaper than we thought
research.google/pubs/google-…
15 Nov 2024
Excited to share our latest post on memory safety! We're tackling spatial safety in our massive C codebase by hardening libc *by default*. It adds bounds checks to things like std::vector, preventing a fair bit of out-of-bounds vulnerabilities: security.googleblog.com/2024…
1
14
26
21,620
15 Nov 2024
Excited to share our latest post on memory safety! We're tackling spatial safety in our massive C codebase by hardening libc *by default*. It adds bounds checks to things like std::vector, preventing a fair bit of out-of-bounds vulnerabilities: security.googleblog.com/2024…
2
49
246
77,144
15 Nov 2024
This improves spatial memory safety across Google's services, including performance-critical components of Search, Gmail, Drive, YouTube, and Maps. We've already seen it disrupt a red team exercise, reduce segfaults by 30%, and improve code correctness.
2
4
43
27,669
15 Nov 2024
The best part? It's incredibly cost-effective, with an average performance overhead of just 0.30%. So there's really no reason not to do it if you're running C code :)
1
2
26
2,516
Alex Rebert retweeted
22 Oct 2024
The dedication and hard work has payed off: "for hundreds of complex web applications that are built on Google’s hardened and safe-by-design frameworks, we've averaged less than one XSS report per year in total" (see page 9 of the whitepaper).
22 Oct 2024
Secure by design takes dedication and years of hard work to get the balance right between velocity and safety. Read a bit about @Google’s commitment and journey in our new white paper. Humbled to work with the professionals that make this happen everyday. blog.google/technology/safet…
3
6
27
5,012
Alex Rebert retweeted
15 Oct 2024
Percentage of codebase that's memory-safe 📈, memory-safety vulns 📉,
EVEN IF YOU KEEP ADDING LINES OF C 🤯
15 Oct 2024
NEW EPISODE!
You may not be rewriting the world in Rust, but if you walk like the Android team, you'll drive down your memory-unsafety vulnerabilities more than 2X below the industry average over time! 🎉
securitycryptographywhatever…
youtu.be/WL4CgVI6p9g
1
3
9
1,553
15 Oct 2024
Excited to share Google's memory safety strategy! We're working to build safer software by migrating to memory-safe languages like Rust as well as hardening our existing C : security.googleblog.com/2024….
We'll be sharing more details in upcoming posts.
2
71
231
63,123
4 Oct 2024
Google CVR is doing incredible vulnerability research.
4 Oct 2024
Learn how Google CVR could have potentially exfiltrated Gemini 1.0 Pro before launch last year. We describe the vulnz, the fix, and tips for bughunters. Also, shout-out to @epereiralopez for teaming up to adapt this work to another cloud provider.
bughunters.google.com/blog/5…
5
466
Released a blog about our @theori_io AIxCC experience! medium.com/@sa-blog/winning-…
@tjbecker and I were hoping to have more info about other challenges, but they aren't released, so some of the information is a bit limited.
Still, hope folks can enjoy reading it!
18
60
6,916
25 Sep 2024
The drop in Android's memory safety vulnerabilities is astonishing. It's counterintuitive, but prioritizing memory-safe languages in new code quickly reduces memory-safety risks. Once we turn off the tap of new vulnerabilities, they start decreasing exponentially.
25 Sep 2024
I’m super excited about this blogpost. The approach is so counterintuitive, and yet the results are so much better than anything else that we’ve tried for memory safety. We finally understand why.
security.googleblog.com/2024…
2
3
34
3,714
Alex Rebert retweeted
10 Sep 2024
Excited to share this blog post about server-side memory corruption that my team exploited in production.
Shout-out to @scannell_simon, @epereiralopez, and @thatjiaozi - this was a very fun project. :-)
bughunters.google.com/blog/6…
39
149
28,908
Alex Rebert retweeted
6 Mar 2024
"just as our efforts to eliminate XSS attacks through tooling showed, removing large classes of exploits both directly benefits consumers of software and allows us to move our focus to addressing further classes of security vulnerabilities."
security.googleblog.com/2024…
1
3
20
1,229
Alex Rebert retweeted
4 Mar 2024
Today I spoke on the importance of Secure by Design on behalf of @Google alongside @CISAgov @FDD @VenableLLP & more. We also launched a paper on @Google's approach to Secure by Design & published on how it can be applied to address memory safety vulns: blog.google/technology/safet…
19
43
5,760
Alex Rebert retweeted
14 Feb 2024
Ever struggle with C buffer issues? Spatial Safety is one of the main root causes for in-the-wild exploits! Read more about how we piloted the LLVM proposal for C Buffer Hardening here:
bughunters.google.com/blog/6…
32
134
17,473
Alex Rebert retweeted
10 Aug 2023
this is a big one… if you have opinions on this, make sure that they are heard 👀
Fact Sheet: Office of the National Cyber Director Requests Public Comment on Open-Source Software Security and Memory Safe Programming Languages | ONCD | The White House m.cje.io/3s2Xz6t
1
16
37
8,818