tonghuaroot (@tonghuaroot) header
tonghuaroot (@tonghuaroot) profile picture

Staff Security Engineer · AI Agent & Infra Security · 140+ CVEs (Microsoft, Oracle, Apache, Anthropic) · cross-tenant sandbox RCE · CPython contributor · OSCP

Singapore
Joined February 2021
Photo by tonghuaroot (@tonghuaroot)Photo by tonghuaroot (@tonghuaroot)Photo by tonghuaroot (@tonghuaroot)Photo by tonghuaroot (@tonghuaroot)Photo by tonghuaroot (@tonghuaroot)Photo by tonghuaroot (@tonghuaroot)Photo by tonghuaroot (@tonghuaroot)Photo by tonghuaroot (@tonghuaroot)Photo by tonghuaroot (@tonghuaroot)Photo by tonghuaroot (@tonghuaroot)
Attackers also have managers and budgets.
18
2
104
6,851
有啥公司或者开源项目在做 AI Agent 的身份基础设施吗
41
cz最近挺关注安全的🤔
If you ever used a "social login" for your crypto wallet, you will want to research this topic 👇 further to protect your funds. Self custody = self responsibility. 🙏
5
3
531
when Jensen said he loves chinese models, i thought it was about deepseek and kimi and glm
5
279
代码整洁之道的作者都这么说了
I used to be a language lawyer. In the late 80s I _studied_ the ARM (Annotated Reference Manual for C++). I knew the language cold, inside and out. I could make it do backflips. I shipped a lot of code using it. A LOT. I’ve attacked other languages with a similar intensity and depth. Until recently, that was simply the only way to become adept at building software systems. I now consider the deep understanding of a language to be a supreme waste of time and effort. I don’t want to learn Rust, or Golang, or Typescript, or any of the thousands of other languages out there. I’ll leave that to my agents. What I need now is to understand the high level gestalt of the system. I want to see the systems and subsystems. I don’t need to inspect the cogs. If I truly need to understand a detail at the cog level, I’ll interrogate my agents. I’m not going to pretend to be a language expert anymore.
2
3
653
安全架构有搞头啊
security architecture fundamentals are more important than ever before
1
227
🤔
Finding Zero-Days With Any Model Blog: provos.org/p/finding-zero-da… Author: Niels Provos
2
4
338
钞能力
Our security researchers built an autonomous cyber vulnerability discovery, exploitation, and patching pipeline. In a single run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel at a total API cost of $1.2 million.
2
2
345
63 亿美金,养 1000 个年薪 30 万美金的安全工程师,差不多能养 21 年。 比特币到现在,也才刚满 18 岁。
6
11
705
美签预约已经排到明年4月份了
3
6
1,149
看了土豆姐和 tibo 现在搞 cp 是 DevRel 整活必修课了
4
449
cve-2026-98432 这么牛逼的Linux洞没人讨论吗
14
3
1
41
16,661
得不到的永远在骚动 被偏爱的都有持无恐
1
1
286
程序员已经没有寒冬了 这将是程序员的最后一个冬天
4
15
2,162
群星闪耀时
October in a nutshell: - PHP got hacked - Railway got hacked - OpenCode got hacked - Binance got hacked - Polymarket got hacked - GitHub Actions got hacked - SoftBank got hacked - Cursor marketplace got hacked - Coinbase vendor got hacked - Fireworks AI got hacked - LiteLLM got hacked - Capcom got hacked - npm packages got hacked - TiDB Cloud got hacked - Warp's vendor got hacked happy cybersecurity awareness month
5
563
有啥类似 OSCP、CRTO 这种,讲免杀的课吗?
4
11
2,380
好多不起眼的小众赛道 利润还是挺可观的
4
5
1,172
比特币 18 岁了
6
9
539
经济危机了家人们
8
11
1,165