Ingest, store, & analyze all types of time series data in a fully-managed, purpose-built database. Keep data forever with low-cost storage and superior data compression. Learn more →
Similar projects and alternatives to publications
Static Analyzer for Solidity
Symbolic execution tool
Access the most powerful time series database as a service. Ingest, store, & analyze all types of time series data in a fully-managed, purpose-built database. Keep data forever with low-cost storage and superior data compression.
Smart contracts which are formally verified
Ethereum smart contract fuzzer
The Compound On-Chain Protocol
Materials related to security: docs, checklists, processes, etc... (by OriginProtocol)
Write Clean Python Code. Always.. Sonar helps you commit clean code every time. With over 225 unique rules to find Python bugs, code smells & vulnerabilities, Sonar finds the issues while you focus on the work.
SimpleX - the first messaging platform operating without user identifiers of any kind - 100% private by design! iOS and Android apps are released 📱!
Privacy-first, end-to-end encrypted Mail, Pages, Drive, and Calendar.
Circuit IR Compilers and Tools
Natural language detection library for Rust. Try demo online: https://whatlang.org/
Protect your data against global mass surveillance programs.
Slither Detectors by Pessimistic.io
Experimental JS parser-generator project.
The Python micro framework for building web applications.
Virtual / remote desktop infrastructure for everyone! Open source TeamViewer / Citrix alternative.
A tool for developing smart contracts. Crafted with the finest cacaos.
A framework for managing and maintaining multi-language pre-commit hooks.
CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security
The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
publications reviews and mentions
SimpleX Chat: private and secure messenger without any user IDs (not even random)
6 projects | /r/privacy | 28 May 2023
Here's the URL https://github.com/trailofbits/publications/blob/master/reviews/SimpleXChat.pdf It was in the article I have already linked.
Solidity digest fortnightly / 17-30 apr 2023
3 projects | /r/solidity | 30 Apr 2023
MYSO Finance Security Assesment by Trail of Bits
Audit Firms Ranking
3 projects | /r/ethdev | 28 Apr 2023
Trail of Bits
Transparency at Skiff
3 projects | /r/Skiff | 25 Apr 2023
Hi! I'm Skiff's CEO. We've had 3 security audits, including 2 from Trail of Bits - one of the best security auditing firms in the world https://github.com/trailofbits/publications. Skiff Mail is also open-source: https://github.com/skiff-org/skiff-mail as is our whitepaper https://skiff.com/whitepaper We've also been in the news quite a bit: https://www.theverge.com/2022/5/17/23075804/skiff-mail-email-privacy, https://www.wsj.com/articles/encryption-bans-what-is-this-russia-hacking-online-privacy-security-data-signal-whatsapp-emails-protection-11675436242 (I wrote this with our team!), https://techcrunch.com/2023/01/30/russia-skiff-block/, and more, even though we're only a year old. We collect no personally identifying information - not even IP addresses used - no backup emails, phones, etc. - no advertising, and we end-to-end encrypt BOTH email subject + body and don't have any metadata (time sent/received an exception). What can we do to share more of this with more people? We're a younger company but it's so important this is made public.
3 projects | /r/PrivacyGuides | 25 Apr 2023
Hi! I'm Skiff's CEO. We've had 3 security audits, including 2 from Trail of Bits - likely the best security auditing firm in the world https://github.com/trailofbits/publications. Skiff Mail is also open-source: https://github.com/skiff-org/skiff-mail as is our whitepaper https://skiff.com/whitepaper
DeFi Exchange Uniswap Launches Uniswap Mobile Wallet
2 projects | /r/CryptoCurrency | 14 Apr 2023
Our wallet was audited by Trail of Bits and the code is open source https://github.com/trailofbits/publications/blob/master/reviews/UniswapMobileWallet-securityreview.pdf
Ask HN: How can I get into cyber security research?
3 projects | news.ycombinator.com | 29 Jan 2023
"Cybersecurity research" is a very large domain, so it's hard to offer a wholly encompassing answer here! The company I work for does a great deal of program analysis research, primarily in and around the LLVM ecosystem. Other companies/groups in our domain(s) include Galois, Inria, and GrammaTech.
In terms of working in our domain: we frequently find it difficult to hire for pre-existing compilers or program analysis skills (it's a small community!), so we generally long for strong engineers with security/low-level fundamentals who don't mind making a pivot.
As for how the job is: I personally find it very fulfilling, but it definitely contains a degree of uncertainty (particularly when doing government-funded research) that ordinary SWEs/SREs may not be used to. I've noticed that it takes new hires a decent amount of time to acclimate and become comfortable with the idea of research engineering, meaning engineering where we expect less than 100% of all exploratory avenues to have productive outcomes. This can be a large culture shock compared to typical engineering, where tasking is defined primarily by business requirements that don't contain a large degree of uncertainty or ambiguity in terms of implementation approach.3 projects | news.ycombinator.com | 29 Jan 2023
Trail of Bits does this kind of work (https://www.trailofbits.com)!
Tbh there is a much larger market for application of existing technology (e.g., pentests) than development of new technology (e.g., DARPA programs and the 1% of tech firms that need something new). There are a handful of others, but the market doesn't support dozens of other firms like Trail of Bits. There is some innovation that happens in Series A and B security startups but IMHO that quickly gives way to pressures of building an enterprise sales team.
Best email, contacts, calendar services that can still be utilized by stock iOS/macOS Mail, Calendar and Contacts apps?
2 projects | /r/PrivacyGuides | 27 Jan 2023
https://github.com/trailofbits/publications (you could tweet @dguido, TOB's CEO, to ask, he is very responsive)
Ask HN: Fallback remote job options for an experienced developer in the U.S.?
2 projects | news.ycombinator.com | 23 Dec 2022
Hands on is the best way to learn web app testing.
Companies give you 24-48 hours to test vulnerable web app. After you send them report with findings if they like they have final interview round.
Some of the better companies are ncc group, bishop fox, nettitude, google certified security companies and others. You can find them as sponsors on security meetups like bsides.
Some of the more technical ones are https://cure53.de/#publications. You can read their reports. Also https://www.trailofbits.com/
As for pay it’s decent but the ceiling is lower than SWE. Entry level positions usually make below 100, senior low 100, manager mid 100 and more senior positions are around 200. After that it’s harder to move up.
Lastly the job itself can get pretty boring at times. Code review is something most people try to avoid. It’s useful when combined with web app testing to perform greybox testing.
Web app testing can be boring as well, when testing multiple web apps in a row that were tested multiple times and not finding anything decent.
What makes up for all of that is excitement from testing newly developed or older web apps with lots of vulns, performing network pentesting and developing new tools for different projects.
It’s a great feeling when you publish a new tool and lots of people start using it and appreciate your work.
A note from our sponsor - InfluxDB
www.influxdata.com | 8 Jun 2023
trailofbits/publications is an open source project licensed under Creative Commons Attribution Share Alike 4.0 which is not an OSI approved license.
The primary programming language of publications is Python.