Tweetstorm on mitigations. When we talk about mitigations we often conflate security with the economics of security. What I mean with that a secure system is one that gives guarantees on the CIA properties. Full stop. If we talk about attacker cost we are talking about the economics of vulnerabilities. Mitigations can target one or the other or both of these types.

1/10 Tweet storm on paper I co-authored with wu cache clan: arxiv.org/abs/1711.01254 2/10 Double fetch bugs are very difficult to fuzz and consequently mostly slow and complex analysis tools such as Bochspwn and xenpwn