Hi, I’m Derin! I’m a student and computer enthusiast who enjoys learning about new stuff.
I’ve filed some bug reports for the Chromium browser project, mostly focused on Chrome extension APIs and runtime. You can see some of the public ones on the Chromium bug tracker or you can find an overview of my bug work on Google’s Leaderboard. I’ve also been mentioned in Chrome’s release updates.
My favorite discovery is an XSS that allows Chrome extensions to edit/read local files on ChromeOS and run commands in its Linux container, among other dangerous things (it was given a CVE number and a severity of 8.8/10). The writeup can be found on my blog. I also post other random things there.
Outside of bug hunting, I also like to code projects in various languages. A few examples:
And/Or/Not constraints over a hexagon grid to find the only solution to this puzzle from MIT’s 2013 Mystery Puzzle Hunt in just a few seconds. The code can be easily adapted from a hexagon to a rectangle or cube or whatever you like.Right now, the computer-related field I’m most interested in is programming language design, specifically how type systems work. I think there’s still an unexplored future for systems capable of evaluating code at compile-time (like Zig’s comptime, but more general) or systems that can typecheck efficiently at either phase (runtime or compile-time) without relying on macros.
I’m also very interested how proof systems can help us code, which is why I’ve been learning Idris2 over the last couple months. I think proof-based software verification for open-source projects will become a big deal in the future, as they’ll have a chance of finding the last few bugs once LLMs start to plateau. For the moment, though, it’s definitely eye-opening just how many bugs AI is finding in large open-source codebases like Chromium.
Other than that, I’m just messing around with algorithmic puzzles and trying to get better at that sort of thing.
You can email me at [email protected]