Trail of Bits

Mastodon @trailofbits@infosec.exchange

⚔ Compare ☆ Watch Own this channel?

🔄 Data last refreshed 15 hours ago

🤝

Make a deal with Trail of Bits

🔒 Paid proposals held safely in escrow — released only when the work's approved.

Followers

1.8K

Account age

3 yrs

🧰 Free analysis for Trail of Bits

🕵️ Fake follower check 📊 Engagement rate 💰 What they charge

Known for

cargo-audit flags Rust dependencies with known vulnerabilities. A flagged crate, though, doesn't tell you whether your code calls the vulnerable function.
We added a feature that matches a binary's symbols against the functions named in each advisory. Any matches are labeled "Affected," separating real exposure from advisories that don't apply.
It's live in cargo-audit 0.22.2+. If you're behind, u

26 views cargo-audit flags Rust dependencies with known vulnerabilities. A flagged crate, though, doesn't tell you whether your code calls the vulnerable function. We added a feature that matches a binary's symbols against the functions named in each advisory. Any matches are labeled "Affected," separating real exposure from advisories that don't apply. It's live in cargo-audit 0.22.2+. If you're behind, u

📊 Post engagement

Avg engagement / post

0.5%

Engagement vs followers

Oct 2022

On Mastodon since

🔥 Top post: cargo-audit flags Rust dependencies with known vulnerabilities. · 26 likes + reposts

📊 Activity & format

Posting cadence

2.5 / week

Posts several times a week.

Content mix

Mostly text

Recent: 11 text · 1 image · 0 video.

Follower / following

354×

Follows 5 back. A strong ratio — an audience that follows them, not a follow-for-follow network.

Recent posts

View on Mastodon ↗

🔥 Top post cargo-audit flags Rust dependencies with known vulnerabilities. A flagged crate, though, doesn't tell you whether your code calls the vulnerable function. We added a feature that matches a binary's symbols against the functions named in each advisory. Any matches are labeled "Af… ★ 26

Attackers drained $20M+ from protocols built around Uniswap v4 hooks. The two largest were Cork (~$12M) and Bunni ($8.4M). Neither came from bugs in the PoolManager, Uniswap v4's central contract. The failures came from application and hoo… ★ 2 858 potential bugs found, 595 awaiting patches, 120 fixes open upstream, 143 merged. Patch the Planet's latest numbers are now on a public dashboard that covers 41 codebases, including curl, OpenSSL, Keycloak, containerd, and kubernetes-cl… ★ 2 Every Rust bug we submitted through Patch the Planet came from one engineer who ran a variant-analysis pipeline using Codex's /goal. A separate discovery run uncovered two potential high-severity privilege-escalation bugs in Keycloak's SAM… ★ 6 "The oldest principles in security—auditing, logging, isolation, least privilege—matter more than ever now that actions happen at machine speed, not human speed."—Artem Dinaburg, our chief scientist, on Silver Bullet ep 158. The full pod c… ★ 3 What we’ve learned about testing Rust for security, now available as a Testing Handbook chapter. Inside, you'll find what Rust's guarantees don't cover, undefined behavior with Miri, property testing with proptest, Clippy lints, memory zer… ★ 11 Mewt grades your test suite by sabotaging your code. Each change that doesn't get flagged by your tests is a potential bug. Today we're expanding it to support DAML, Canton Networks' native language, with two new mutant classes for its aut… ★ 1 We gave GPT-5.5-Cyber a single /goal: find a specific class of bugs in zlib. It built a fuzzing lab in less than a day, a task that takes a skilled researcher weeks. Harnesses across a dozen entry points (inflateBack, uncompress2, MiniZip,… ★ 10 If you maintain critical open-source software, apply here: https://trailofbits.com/patch-the-planet/ ★ 1 OpenAI handed us their most cyber-capable models and asked us to work directly with open-source maintainers to Patch the Planet. We started with 19 projects: cURL, Python, Sigstore, NATS, and more. 50 projects have now joined the initiativ… ★ 15 1.2 billion downloads ran through pyca/cryptography last month. Nearly every Python app that touches crypto depends on it. If it doesn't ship post-quantum primitives, the Python ecosystem can't migrate. We helped add ML-DSA (FIPS 204) for … ★ 15 We redesigned trailofbits.com. Everything we publish is now in one place. ★ 2

🐘 Community & instance

Home server

infosec.exchange

A cybersecurity & infosec server — its members and audience skew toward that niche, so expect a community-aligned, engaged following.

On Mastodon since

Oct 2022

Joined in the Twitter-exodus wave of late 2022 — part of the migration that made Mastodon a real destination.

💡 Facts

🗓️Joined Mastodon in 2022 — 3 years ago.

👁️Averages 8 views per post.

📤Posts about 2.5× per week.

🛡️ Audience credibility

66/100

Good Credibility score

89%

Real Real audience

Low Fake-follower risk

High Data confidence

Est. 89% real, active audience · Low fake-follower risk.
Engagement (~0.5% of followers engage each post) is around typical for Mastodon.
Established account (3+ years old).

Heuristic estimate from engagement, follower ratios, account age & growth — a screening signal, not a guarantee.

💚 Brand affinity

Estimated

Brands Trail of Bits's audience is most likely to respond to — from detected sponsorships in this niche.

OpenAI

About

We help secure the world’s most targeted organizations and products. We combine security research with an attacker mentality to reduce risk and fortify code.