Cindʎ Xiao 🍉

professional strings(1) operator

rust reverse engineering training -> Decoder Loop (npub1pts…j2cp)

personal account, personal views
🏳️‍🌈😎
only online on certain days, all responses delayed

pronouns: she/her | they/them
post languages: en-CA (eh bud) / zh-CN (半文盲) / fr-CA (franglais mtn mais j‘étudie)
website: https://cxiao.net
github: https://github.com/cxiao
bsky: https://bsky.app/profile/cxiao.net

Public Key

npub16w7es466p8mme07g4d9d3kgq5pgnf79dl5ymtvm5jmsp4v5x5a8sysg7ce

NIP-05 Address

cxiao_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsd80vc2adqnaauhly2kjkcmyq2q5f5lzkl6zd4kd6fdcq6k2r2wncprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntcekkrs

Publishing to

relay.momostr.pink

relay.snort.social

atlas.nostr.land

Author Public Key

npub16w7es466p8mme07g4d9d3kgq5pgnf79dl5ymtvm5jmsp4v5x5a8sysg7ce

Show more details

Last Notes

2026-06-22 12:49:57 UTC

At REcon this year, I noticed that quite a few talks and workshops had signs of AI-generated content. It was especially concerning that some of the workshops with signs of AI-generated content did not seem to have been fully tested or rehearsed by the instructors, especially around the specific portions of the material that were AI-generated.
To be clear, I am not talking about fully hallucinated content - these were still instructors with a track record and with qualifications to deliver the content. And with workshops at conferences, you always get a mixed bag and sometimes unprepared instructors. But it felt to me like some experienced, qualified, and skilled instructors were much looser than they would normally would have been, trusted the AI more than they should have, and thereby caused the quality of the material to slip.

2026-06-03 16:20:17 UTC

- reply

omg I just noticed your avatar's pile of bricks. happy pride cR0w 🤝

2026-06-03 05:24:22 UTC

- reply

me @ all people who need to go to sleep (including me)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/684/505/688/992/117/original/3b26cee3e12da1da.jpeg

2026-06-03 05:19:08 UTC

- reply

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/684/485/100/729/771/original/ad4736867af8ee72.jpeg

2026-05-12 20:06:45 UTC

RE: https://mastodon.social/@kepano/116563364468649689
The important parts of this for security people: Obsidian is now doing automated security scanning for every community plugin, and publishing scan results.
Importantly, they’re now (automatically) reviewing every released version; before, they would only do an initial manual review upon submission to the community plugin repo.
#note17ga…tnun

2026-05-01 14:53:59 UTC

RE: https://mastodon.world/@cdt/116497364494101940
> the Chinese Ministry of State Security (MSS) accused unnamed “foreign organizations” of trying to brainwash Chinese youth into “lying flat” (also “lying down” or “slacking off”)
INTERNATIONAL SLACKERS BRIGADE RISE UP, WE HAVE SOME CHINESE YOUTH TO BRAINWASH
#note1nse…0zh7

2026-05-01 04:46:27 UTC

- reply

graphic design is my passion
(platypus from https://commons.wikimedia.org/wiki/File:Platypus_3_(PSF).png)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/497/500/422/097/737/original/e27b8be26ede14dd.png

2026-05-01 03:41:16 UTC

- reply

ur system is compromised
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/497/244/045/172/625/original/c270832403f8ebfa.png

2026-05-01 03:26:36 UTC

- reply

all ur files are now catte.jpg
(oh wait that's [@da_667](https://infosec.exchange/@da_667 ))

2026-04-30 14:46:33 UTC

RE: https://infosec.exchange/@thehellu/116494173080687920
proxylogon still being exploited in 2025/2026 😭😭😭😭😭😭😭
#note19uc…hyqx

2026-04-29 17:47:14 UTC

RE: https://infosec.exchange/@jvoisin/116488420408417722
For @npub1qm4…h363 folks, I started a discussion about this on the Discourse here: https://discourse.ifin.network/t/carrot-disclosure-forgejo/
My personal thought is that I appreciate, as a defender, knowing this information about a project having a systematic lack of security.
#note1hfq…0z3e

2026-04-28 18:03:32 UTC

- reply

i love u guys so much

2026-04-24 13:00:07 UTC

RE: https://mastodon.social/@caseynewton/116456942253634796
Opponents of AI are often depicted as naive and ignorant. We are depicted as having our heads buried in the sand, unwilling to accept the great capabilities of AI, or as insecure and afraid of AI's capabilities.
I would like to flip this narrative around: I think pro-AI technologists who only look at AI's "capabilities" are the naive ones.
This is because the AI industry and the people funding, producing, and pushing AI tools are not at all working on the level of capability - they are working on the level of AI as ideology. They are interested in AI as a tool to devalue labour, suppress wages, justify layoffs, and foster dependency on centralized tools controlled by a few companies. Technologists who only focus on "this code can be written good by this tool" are not even playing on the right level. Programmers talking about "wow! look at the code it can generate!" feel to me at this point like the [2-dimensional inhabitants of Flatland](https://en.wikipedia.org/wiki/Flatland ).
Perhaps this sounds conspiracy-minded to you, but the way in which AI is practically being deployed across industries is very stark evidence of this. The quoted employee monitoring at Meta, to gather data for using AI to devalue the work of white-collar workers, is just one example. AI mandates, token usage dashboards, performance reviews based on AI adoption, AI code acceptance metrics, and even the time and energy spent on building AI tools rather than things that would actually improve product quality - these are all in service of the same ideology.
The AI industry, and those who push AI tools are fundamentally uninterested in making your work better or leaving you in control of your work. They are telling you this directly through both words and actions. I think ignoring that is a stunning level of naïvete.
#noAI
#note1xx7…kpl4

2026-04-09 02:39:43 UTC

RE: https://infosec.exchange/@mttaggart/116371937587992264
I think the way I would put it is:
1) The point of the AI project is ideological; the goal is to reshape industries such that we are dependent on AI companies' products, and to destroy free and open knowledge such that we are dependent on these products for thought and reasoning. We see an injection of AI into cybersecurity, while simultaneously drawing money and resources away from (boring) efforts that would actually broadly improve cybersecurity.¹ We see an injection of AI into knowledge acquisition, while simultaneously polluting the landscape of the internet as a useful source of knowledge. Both are in service of the same ideological project, and working towards the same goal.
2) The touted usefulness of AI for programming and cybersecurity is directly funding the project to expand it everywhere else, where it is causing massive harms to civil society, individuals' mental health, and the information landscape. You or your company paying for these products is keeping investment money flowing and extending the runway, for AI companies to reach that point of "indispensability". There is no divorcing your cool shiny toy from the creation of AI deepfakes that destroy democracy, or the AI psychosis that destroys lives. This is because the AI companies are pursuing an ideological project that ultimately has nothing to do with improving people's work or their lives; the leaders of these companies have loudly and publicly said that very clearly. You are laundering the reputation of these companies and keeping them alive, when the only moral option is to destroy them.
I've said this elsewhere, but: Maybe you, who are reading this, is offended by this framing, because you use and enjoy the AI tools. But it's also likely that you, and many other technologists, take moral abdication almost as a point of pride, where the only thing that matters is "capability". In that case, I don't understand the defensive response. Why are you uncomfortable being described as the thing you're bragging to be?
#fuckAI
¹ The stark contrast: The breathless and brainless promotional posts about Glasswing came into my feed at the same time as the posts about the final gutting of CISA. https://www.securityweek.com/white-house-seeks-to-slash-cisa-funding-by-707-million/
#note16a0…6fg8

2026-03-07 06:32:41 UTC

mentally im here
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/186/490/999/839/700/original/466110ae496de479.png

2026-03-02 06:50:23 UTC

- reply

i have had the BIGGEST problem with finding watches as well, that are a) not smartwatches or something that needs smartphone to operate, b) not too masculine, c) not too feminine, d) not bulky AF
this is already very hard but becomes WAY harder if you want actual practical features like a compass :lolsob: I settled for a very basic casio (one of the ones from https://www.casio.com/ca-en/watches/casio/) but none of these have compass feature I think

2026-02-09 02:37:51 UTC

Bad Bunny's full halftime show is here if you're looking for it: https://www.reddit.com/r/Fauxmoi/comments/1qzqywa/bad_bunnys_super_bowl_halftime_show_performance/
absolute 🔥🔥🔥
#TogetherWeAreAmerica
#badbunny #superbowl

2026-02-08 00:42:41 UTC

- reply

The issue I always have with this discussion is that the people making 100 000 - 300 000 dollars per year (myself included) don't actually meaningfully engage with the material problems of the far less fortunate people, presumably in the same class as them, that do not. People simply stop at "we are all part of the same class" without engaging with the basic reality that making that much money unlocks a great deal of privilege:
1) One month of my salary would be a debt-destroying, life-stabilizing, unfathomable amount for many people.
2) Jobs which offer this much money are not only privileged due to money, but due to being much less precarious. Some people here may say "ah but I'm at risk of layoffs all the time" but being laid off from a full-time, professional, 9-5 job with benefits is not the same as working 3 jobs with no benefits and variable hours.
3) People making this salary have a greater opportunity to put money into investments and retirement savings. As a basic example, people in Canada have the opportunity to open a Registered Retirement Savings Account (this is a tax-free savings account you contribute your own money to, not a pension). Every one of my professional friends has one, but across Canadian society, the participation rate in this contribution program has hovered at 30% for years.
4) People living in high-cost-of-living areas who make closer to that 300 000 dollar income say that a large part of their income is spent on essentials such as housing, so really the income does not stretch that far. But the natural next question to ask is: What are the people who don't even make close to 300 000 in your city doing for housing? (The answer, often, is that they can't live in your city.)
5) It is much, much easier for people making this amount to become a part of the owner class, by accumulating the capital required to do so.
6) The sense of alienation when someone is talking about engaging in an experience or purchase that you could never afford, as if it's a normal thing, is indescribable. I always come back to this article from an organizer describing very frankly her experience working with well-meaning people who are much more economically privileged than her: https://www.theguardian.com/global-development-professionals-network/2016/jun/08/burnout-activism-working-class-organising-with-middle-class-comrades
Without acknowledging this, you end with up with political movements that are vaguely leftist but that are dominated by people who are far more privileged than the people they purport to serve, not least because only certain people have the time and capital to politically participate in the first place.

2026-01-24 22:34:06 UTC

- reply

Cory Doctorow has endorsed Avi Lewis already (https://lewisforleader.ca/endorsements/) and they have already had a conversation here! https://youtu.be/P9sgIAc6z_o

2026-01-20 18:49:20 UTC

- reply

Unfortunately this is a huge problem with the fediverse, and any other primarily white space: a huge number of diverse perspectives and people are simply missing. It has been really frustrating seeing discussion about what's happening in Venezuela, in Iran, in China, and so on dominated by people who are not from there and who are interested only in what this means for their own country.
I would start with reading the existing statements of Greenlandic public figures such as Aqqaluk Lynge, who was recently interviewed by CBC news in Canada: https://www.cbc.ca/radio/asithappens/greenland-threats-aqqaluk-lynge-9.7035614
Consider as well that any Greenlanders who are on here may not want to suddenly be the centre of attention and the sole, somewhat tokenized source for all things Greenland. It is up to the rest of us to do our own reading first.

2026-01-10 21:27:06 UTC

- reply

nah I don't think we need to whataboutism this, doing so is insulting to iranians and iranian canadians. can we take one moment to make it about them and not about us?
also for context: january 8th was the 6th anniversary of PS752 getting shot down by the iranian regime, which the federal government officially commemorated and recognized, and which the iranian canadian community is still mourning. there's plenty to criticize about the liberal government but using iranian suffering to try and score points against the liberals is not it

2025-12-19 15:11:21 UTC

RE: https://infosec.exchange/@decoderloop/115746825926307965
I'm happy to announce that I'll be teaching 2 Rust reverse engineering trainings in 2026!
1) Deconstructing Rust Binaries at @npub1hze…wh5p COUNTERMEASURE, March 23-26 2026, 16 hours, Remote: https://ringzer0.training/countermeasure-spring-2026-deconstructing-rust-binaries/
2) Deconstructing Rust Binaries at @npub1pfe…2u6v, May 11-13 2026, 24 hours, Onsite in Montréal, Canada and Remote: https://nsec.io/training/2026-deconstructing-rust-binaries/
No previous experience with reversing Rust binaries, or writing Rust code, is required, and we'll be using Binary Ninja in the course!
#note1f67…dvju

2025-12-09 03:57:53 UTC

- reply

It was dismaying to see this donation request post (https://newsie.social/@ProPublica/115686546158657305) from the ProPublica account, right after seeing your post.
I left them a reply linking to your post here. Full support to you and thank you for posting this to Fedi.

2025-12-09 03:54:59 UTC

- reply

Your employee union is raising very valid concerns right now, about management's refusal to guarantee AI guardrails in their contract.
https://social.coop/@dphiffer/115687141981028270
As a reader-funded publication, your funding relies on maintaining the trust you have with your readers. If you refuse to guarantee that you will avoid using AI to generate text, images, and video, and if you refuse to guarantee that you will label AI-generated content, how can you expect to maintain reader trust?

2025-12-08 18:28:52 UTC

- reply

Thank you for making the point in your post by the way that sports is both entertainment and community! Sometimes in the nerd circles that the Fediverse skews towards (and I certainly consider myself a nerd) there is the opinion that watching sports is a frivolous or stupid activity. But I think it's actually really important for the long term health and sustainability of the fediverse that the base of Fedi is not just nerds like me. We need a diverse and wide range of people who are willing to spend their time on here and contribute their time and money towards the Fediverse. Everyone, including sports fans, deserves social media and the ability to build communities, free of corporate control.

2025-12-08 18:26:03 UTC

- reply

I have enjoyed seeing sports content here for the recent #MLS Cup finals and #MLB World Series! It was nice to see people live-tooting through it. Both were major cultural events, especially here in Canada because in both cases there was a Canadian team in the matchup.
I have also been pleasantly surprised to find some #PWHL fans here! Women's hockey fans are everywhere :D 🏒🏒🏒
One big way I get sports content on here is via the [@cbcnews](https://flipboard.com/@cbcnews ) feed. I get a lot of my regular Canadian news from there, too. @npub13fk…z5hw has been doing a great job at bringing news sources to the fediverse.

2025-12-04 21:28:30 UTC

JD....bro.......😭😭😭😭😭
(new signalgate screenshots from
https://media.defense.gov/2025/Dec/04/2003834916/-1/-1/1/DODIG_2026_021.PDF)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/663/418/653/006/158/original/75755e047e1a3810.jpeg

2025-09-10 20:31:27 UTC

- reply

Lots of professional illustrators available for work featured here: @npub15he…pq9h

2025-08-14 22:13:18 UTC

- reply

very happy to be a paid supporter, keep up the great work

2025-07-16 03:33:22 UTC

"My inescapable conclusion has become that Israel is committing genocide against the Palestinian people. Having grown up in a Zionist home, lived the first half of my life in Israel, served in the I.D.F. as a soldier and officer and spent most of my career researching and writing on war crimes and the Holocaust, this was a painful conclusion to reach, and one that I resisted as long as I could. But I have been teaching classes on genocide for a quarter of a century. I can recognize one when I see one."
https://www.nytimes.com/2025/07/15/opinion/israel-gaza-holocaust-genocide-palestinians.html?unlocked_article_code=1.W08.zx-L.gyT-M6Lx4sFP&smid=url-share

2025-05-23 17:05:55 UTC

- reply

If you ever need to find both the talk video and the slides again, they are collected in one place on my site and on GitHub, for your convenient bookmarking:
https://cxiao.net/posts/2025-02-28-reconstructing-rust-types-re-verse-2025/
https://github.com/cxiao/reconstructing-rust-types-talk-re-verse-2025/
#rust #rustlang #ReverseEngineering #reversing #malware #MalwareAnalysis #infosec

2025-05-23 17:02:46 UTC

- reply

The slides for "Reconstructing Rust Types: A Practical Guide for Reverse Engineers" are also available! There is a convenient single-page HTML version if you want to use the material in the presentation as a reference, for your own reversing!
https://cxiao.net/posts/2025-02-28-reconstructing-rust-types-re-verse-2025/
https://github.com/cxiao/reconstructing-rust-types-talk-re-verse-2025/
#rust #rustlang #ReverseEngineering #reversing #malware #MalwareAnalysis #infosec
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/558/223/314/526/636/original/0bac314c9043a08f.png

2025-05-23 16:57:40 UTC

Hi Rust reversing fans - the recording of my talk at @npub1zze…4ut8: Reconstructing Rust Types: A Practical Guide for Reverse Engineers, is available for you to watch!
https://www.youtube.com/watch?v=SGLX7g2a-gw
#rust #rustlang #ReverseEngineering #reversing #malware #MalwareAnalysis #infosec

2025-05-07 16:00:03 UTC

Next Wednesday, May 15 at @npub1pfe…2u6v in Montreal, I will be hosting the workshop "Reconstructing Rust Types: A Practical Guide for Reverse Engineers"! This will be a 3-hour workshop how to approach Rust types and data structures when reversing Rust binaries. See https://nsec.io/session/2025-reconstructing-rust-types-a-practical-guide-for-reverse-engineers.html for more details!
Workshops at NorthSec will be streamed on YouTube Live. My workshop is scheduled for 1300-1600 EDT (UTC-4) on Wednesday, May 15 in the Workshop 2 track, in Salle de la Commune. The stream link for all the Wednesday Salle de la Commune workshops is here: https://www.youtube.com/watch?v=UwJgS32Q6As&list=PLuUtcRxSUZUrW9scJZqhbiuTBwZBJ-Qic&index=7
Looking forward to seeing folks there! 🦀
#rustlang #ReverseEngineering #MalwareAnalysis #NorthSec #infosec #reversing

2025-05-01 20:49:12 UTC

- reply

It's interesting that the PIN reminder says "TM SGNL" rather than "Signal". Looking it up, it seems that they're using a version of Signal, distributed by a company called TeleMessage, that automatically archives Signal communications?
https://www.telemessage.com/signal-archiver-ios-installation-upgrade/
https://www.telemessage.com/mobile-archiver/signal-archiver/

2025-03-01 00:10:49 UTC

Hi! The slides for my talk today at RE//verse 2025 (@npub1zze…4ut8), "Reconstructing Rust Types: A Practical Guide for Reverse Engineers", are now published: https://github.com/cxiao/reconstructing-rust-types-talk-re-verse-2025
It's been great to catch up with so many folks - if you're at the conference, come by and say hi!
The presentation was recorded, and the video will be published at a future date!
#reverseengineering #rust #rustlang #malware #infosec #REverse2025

2025-01-14 18:43:23 UTC

With the news that people are moving to Xiaohongshu due to uncertainty about the future of TikTok and the changes to Meta's content policies, and that people are now really interested in learning Mandarin: I would encourage you to check out the active Chinese-language communities right here on the fediverse as well, such as the public forum at https://ovo.st/club/board (@ board @ ovo.st ), and the instance https://m.cmx.im/about. Or, perhaps, you can follow my recent favourite fediverse account, @npub16nw…7mxe, which collects news about modern Chinese labour issues that you will never find on Chinese social media platforms.
In general I think there is a huge lack of understanding among western users about how much Chinese social media and Chinese tech companies are intertwined with the government, a lack of understanding or engagement with Chinese social issues which are heavily censored on all Chinese social media platforms, and a mistake belief that "well, Chinese social media can't be much worse than the American ones". I had to mute the discourse around TikTok for my own sanity because there was so much complete misunderstanding around privacy, censorship, and the nature of these companies. It's like seeing people say "we don't want to use apps run by (american) fascists, so we will flock to an app that shares all its data with a fascist government, and actively censors all topics unfavourable to that government". It makes no sense.
Of course, I think it is good that people are engaging with Chinese people, finally, as people, and not as just abstractions. I think it is also good that people have an incentive to learn my native language. I just wish people would use that to engage with and listen to the Chinese people who have been posting here, all along.
#china #tiktok #xiaohongshu #rednote #socialmedia #fediverse

2024-12-26 22:16:50 UTC

- reply

For what it's worth, I began editing English Wikipedia in the last year or so, and I have had a good experience. Some good things about the new editor experience were:
1) The Wikipedia Adventure, which was immediately presented to me upon registration, was very helpful: https://en.m.wikipedia.org/wiki/Wikipedia:The_Wikipedia_Adventure
2) The automatic assignment of a mentor / experienced editor to me, as a real person who I can reach out to for questions.
3) The Suggested Edits feed on my homepage. I can select topics I am interested in and the difficulty level of edit I want to do. The Suggested Edits feed then presents me with articles that meet this criteria, which I can click on and start editing. Actually, most of my edits came out of this Suggested Edits feed.
It looks like some of the features I'm talking about only came about in the last 2 years: https://wikimediafoundation.org/news/2022/12/06/new-wikipedia-editor-features-make-it-easy-for-everyone-to-contribute/
It's good that they're here now, though, because they did make my editing experience a lot better.
From my experience, there is indeed a lot of work to do on less visited topics. There are a lot of articles on important topics which are sadly neglected.
#wikipedia