Hovav Shacham✓ Add us as a preferred source on Google

Mastodon @hovav@infosec.exchange

⚔ Compare ☆ Follow Own this channel?

🔄 Data last refreshed 1 month ago

🤝

Make a deal with Hovav Shacham

🔒 Paid proposals held safely in escrow — released only when the work's approved.

Followers

402

Account age

3 yrs

🎁 Free analysisfor Hovav Shacham

🕵️Fake Followers CheckReal-audience % & bot risk→ 📊Engagement rateBenchmarked vs. peers→ 💰What they chargeFair sponsored-post price→

Known for

Is it feasible to sandbox a production JavaScript runtime with SFI? How high would the runtime overhead be?
The answers are yes!, and about 25% in Speedometer and JetStream, as we show with Mohabi¹—short for “monkey habitat,” a pleasant but secure enclosure for the SpiderMonkey JavaScript engine used by the Firefox browser.
Along the way we design a state-of-the-art SFI toolchain, MH-LFI, with su

3 views Is it feasible to sandbox a production JavaScript runtime with SFI? How high would the runtime overhead be? The answers are yes!, and about 25% in Speedometer and JetStream, as we show with Mohabi¹—short for “monkey habitat,” a pleasant but secure enclosure for the SpiderMonkey JavaScript engine used by the Firefox browser. Along the way we design a state-of-the-art SFI toolchain, MH-LFI, with su

📊 Post engagement

📊 Activity & format

Posting cadence

8.3 / week

Toots daily — consistently active for a campaign window.

Content mix

Mostly text

Recent: 11 text · 1 image · 0 video.

Follower / following

1.1×

Follows 354 back. A more reciprocal / networked account.

Recent posts

View on Mastodon ↗

🔥 Top post Recent advances in browser security, a thread! 🧵 TL;DR: Mohabi (OSDI 2026)¹ shows that we can build a principled in-process sandbox for a JavaScript runtime using SFI, at circa 25% runtime overhead in benchmarks. It’s not getting upstreamed, though. (1/x) __ ¹ Cf. @shravanrn’s … ★ 31

Forthcoming (and available from pre-order) from Auckland University Press: Front Row Seat: How Science Can (and Can’t) Shape Public Decision-Making, by Juliet A. Gerrard. https://aucklanduniversitypress.co.nz/front-row-seat/ ★ 6 Mohabi represents a heroic engineering effort by Abhishek, Anand, Zach, Anthony, and Taehyun. Its development spans the entire ESR 115 release lifecycle. The paper evaluates Mohabi on amd64, but we also have an instantiation for aarch64 … ★ 2

Is it feasible to sandbox a production JavaScript runtime with SFI? How high would the runtime overhead be? The answers are yes!, and about 25% in Speedometer and JetStream, as we show with Mohabi¹—short for “monkey habitat,” a pleasant b… ★ 3 [Sidebar: Firefox already uses SFI to sandbox six third-party libraries in the renderer process, thanks to RLBox!¹ The list of RLBoxed libraries has not grown in years, though, and Android might now be catching up.²] (7/x) __ ¹ Shravan Na… ★ 3 Sound in-process isolation of the JavaScript runtime requires software-based fault isolation (SFI).¹ All code that makes up the JavaScript runtime, and all code output by the JIT at runtime, must be instrumented with extra checks that con… ★ 3 If formal verification is a no-go, the next best approach is containment: Introducing a trust boundary between the JavaScript runtime (including its JIT program outputs) and the rest of the renderer process. Now an attacker who exploits a… ★ 3 Arguably, the right way to secure JavaScript engines is to deploy formal verification and prove that JIT outputs are safe. For example, Icarus¹ showed that it was possible to specify semantics for Firefox’s polymorphic inline cache byteco… ★ 5 One way vendors have responded is to allow at-risk users to disable (some) JIT tiers and reduce attack surface. Examples include Apple’s Lockdown Mode, Android’s Advanced Protection Mode, and Microsoft Edge’s Enhanced Security Mode. This… ★ 2 JavaScript runtimes are the most dangerous attack surface on client devices. JavaScript JITs, in particular, are machines for turning logic bugs (in the compiler) into memory safety bugs (in the compiled program output), a problem that re… ★ 7 Derek Lowe:The Trump administration hates academic science funding, full stop. They hate where that money goes, and they hate who it goes to. They want to keep all that money for themselves, to hand out to favored cronies who can help them… ★ 1 This work contains an exposition of the seven foremost unsolved problems in the domain of isogeny-based cryptography, obtained by asking eleven experts in isogeny-based cryptography what they considered to be the most important unsolved pr… ★ 8

🐘 Community & instance

Home server

infosec.exchange

A cybersecurity & infosec server — its members and audience skew toward that niche, so expect a community-aligned, engaged following.

✅ Link-verified

Verified link

Proved ownership of a website linked on their profile — Mastodon's green-check verification, a real identity signal rather than a paid badge.

On Mastodon since

Nov 2022

Joined in the Twitter-exodus wave of late 2022 — part of the migration that made Mastodon a real destination.

💡 Facts

🗓️Joined Mastodon in 2022 — 3 years ago.

👁️Averages 6 views per post.

📤Posts about 8.3× per week.

🕵️ Fake follower check

Estimated

52/100

Fair Credibility score

76%

Mixed Real audience

Medium Fake-follower risk

High Data confidence

Est. 76% real, active audience · Medium fake-follower risk.
Low engagement (~1.5% of followers engage each post) — a sign of an inflated or inactive audience.
Verified account.
Established account (3+ years old).

Heuristic estimate from engagement, follower ratios, account age & growth — a screening signal, not a guarantee.

About

Security, privacy, and tech policy at UCSD. “[U]niquely among all government employees, lie[s] outside the scope of [the government speech] doctrine; […] stand[s] alone on a First Amendment pedestal, free to say what [he] please[s], no matter what [his] government employers, including even the State Legislature, think about it.” Profile photo: Nox the tiercel peregrine, Cal Falcons class of '24, photographed by Billy Thein (California Raptor Center).

🔀 Audience overlap

Estimated

Estimated shared audience with similar creators — useful for avoiding overlap (or doubling down) when planning a campaign.

Orion Reed 16%

Internet Research Task Force 15%

Mstdn.games Status :mastodon: 15%

saga 13%

Pitt (Swift && Tips) 10%

curiousgawker (he/him) 10%

More like this

Find more →

Mastodon ＋

Internet Research Task Force ✓

@irtf@discuss.systems

402 Followers

Mastodon ＋

saga ✓

@saga@mastodon.gamedev.place

@swiftandtips@iosdev.space

402 Followers

Mastodon ＋

Mstdn.games Status :mastodon:

@status@mstdn.games

402 Followers

Mastodon ＋

curiousgawker (he/him)

@curiousgawker@mastodon.world

402 Followers

Frequently asked questions

How much does Hovav Shacham charge for a sponsorship?

Hovav Shacham hasn't published fixed prices yet. Send a proposal through SocialDB and agree terms directly — your payment is held in escrow until the work is approved.

How do I contact Hovav Shacham for a brand deal or collaboration?

Send a paid deal or collab request right here on SocialDB — we notify Hovav Shacham, and once they accept, your payment is held safely in escrow and released when the work is approved. You don't need to track down an email.

How many followers does Hovav Shacham have?

Hovav Shacham has 402 followers on Mastodon.

Auto-generated from Mastodon's public data — no affiliation with or endorsement by SocialDB. Is this you? Claim it · Remove

Hovav Shacham✓ Add us as a preferred source on Google

Make a deal with Hovav Shacham

Known for

📊 Post engagement

📊 Activity & format

Recent posts

🐘 Community & instance

💡 Facts

🕵️ Fake follower check

About

🔀 Audience overlap

More like this

Frequently asked questions

✉ Message Hovav Shacham

🎤 Event / appearance with Hovav Shacham