Hovav Shacham

hovav@infosec.exchange

Security, privacy, and tech policy at UCSD.“[U]niquely among all government employees, lie[s] outside the scope of [the government speech] doctrine; […] stand[s] alone on a First Amendment pedestal, free to say what [he] please[s], no matter what [his] government employers, including even the State Legislature, think about it.”Profile photo: Nox the tiercel peregrine, Cal Falcons class of '24, photographed by Billy Thein (California Raptor Center).

Posts

Post #4071235
Recent advances in browser security, a thread! 🧵 TL;DR: Mohabi (OSDI 2026)¹ shows that we can build a principled in-process sandbox for a JavaScript runtime using SFI, at circa 25% runtime overhead in benchmarks. It’s not getting upstreamed, though. (1/x) __ ¹ Cf. @shravanrn@infosec.exchange’s post yesterday, https://infosec.exchange/@shravanrn/116972152609467885
Post #4048775
Derek Lowe: The Trump administration hates academic science funding, full stop. They hate where that money goes, and they hate who it goes to. They want to keep all that money for themselves, to hand out to favored cronies who can help them get elected and to steer yet more money and more power back into their hands. https://www.science.org/content/blog-post/assault-science-funding-continues
Post #3972394
This work contains an exposition of the seven foremost unsolved problems in the domain of isogeny-based cryptography, obtained by asking eleven experts in isogeny-based cryptography what they considered to be the most important unsolved problems in isogeny-based cryptography, and curated down to the seven problems in this document. For each problem, an expert wrote a short write-up giving the precise statements and descriptions per problem. https://eprint.iacr.org/2026/1431 Self-recommending!
Post #3815148
ETH is looking to recruit tenured faculty in security for its new campus in Heilbronn, Germany: https://ethz.ch/en/the-eth-zurich/working-teaching-and-research/faculty/faculty-affairs/ausgeschriebene-professuren/eth-zuerich-campus-heilbronn/professuren-fuer-cybersecurity--f-m-d-.html Applications from all areas within Cybersecurity, interpreted broadly, are encouraged. Potential topics include but are not limited to foundations for information security (including cryptography, and formal metho...
Post #1822363
Der Schwerbelastungskörper und Die Schwerbelastungskörperaussichtsplattform, from Greg Allen: https://greg.org/archive/2026/04/10/der-schwerbelastungskorper-und-die-schwerbelastungskorperaussichtsplattform.html In 1941 Hitler’s architect Albert Speer got approval to build a giant triumphal arch on a main axis of a redesigned Berlin, and quickly built the Schwerbelastungskörper, or heavy load-bearing structure, to test the ability of the marshy soil to support such a ridiculously large stru...
Post #1822358
Richard Ginell reviews the LA Phil’s production of the Turangalîla symphony: https://www.sfcv.org/articles/review/simone-young-takes-messiaens-mighty-turangalila
Post #1822356
RE: https://infosec.exchange/@tomrittervg/116443139069130293 Respect to the Firefox team! But: At what point do you conclude that our way of delivering security-critical software via ever-growing piles of trusted C++ isn’t working, and won’t?
Post #1822355
Michael Tilson Thomas has died. A titan of 20th (and early 21st) century music. May his memory be for a blessing. https://www.sfchronicle.com/entertainment/classical/article/michael-tilson-thomas-dead-sf-symphony-17814182.php
Post #1822354
The fifth recording in Wild Up’s Julius Eastman survey, Gay Guerrilla, will be released in June and is available for preorder: https://wildup.bandcamp.com/album/julius-eastman-vol-5-gay-guerrilla
Post #1081862
The security hill I will die on: Credit for the “backdoored compiler” trick should go to Karger and Schell (“Multics Security Evaluation: Vulnerability Analysis,” 1974).¹ That’s the “Unknown Air Force Document” from which Thompson (1984) borrowed the idea. __ ¹ https://www.acsac.org/2002/papers/classic-multics-orig.pdf, §3.4.5