Dimitri Kokkonis

PhD student in cybersecurity.

Dimitri Kokkonis boosted:
2026-02-03

Yesterday at #FOSDEM @raboof and I presented Lila, our tool allowing to distribute the workload of verifying reproducibility of Nix packages among several verifiers (see reproducibility.nixos.social).

If you want to see a recording of our talk, it is available here: fosdem.org/2026/schedule/event

We have also written an academic paper about it!
-> arxiv.org/abs/2601.20662

Dimitri Kokkonis boosted:
Stefano Zacchirolizacchiro@mastodon.xyz
2026-02-01

The video of the talk is now available here: video.fosdem.org/2026/ub5132/B

Check it out if you're in #security and/or #fuzzing. I guarantee it will be worth your time and you'll have fun too!

Dimitri Kokkonis boosted:
Stefano Zacchirolizacchiro@mastodon.xyz
2026-01-31

WOW! Full #security devroom at #FOSDEM, for the presentation of "ROSA: finding #backdoors with #fuzzing" by my fellow co-authors @plumtrie and M. Marcozzi.

More about this work in the full paper at arxiv.org/abs/2505.08544 (#openaccess, of course)

Dimitri Kokkonisplumtrie
2026-01-30

On my way to to present our recent work on detecting backdoors with fuzzing!

Come to our talks:
- Sat 31/01, 15:00, room UB5.132 (fosdem.org/2026/schedule/event)
- Sun 01/02, 14:35, room H.2213 (fosdem.org/2026/schedule/event)

See you there :)

Dimitri Kokkonisplumtrie
2026-01-20

@b0rk fwiw this is exactly why I made github.com/kokkonisd/mrbones

I wanna make the site not fight the site generator

Dimitri Kokkonis boosted:

Got angry, posted about academic fuzzing research status quo again: https://addisoncrump.info/research/what-the-hell-are-we-doing/

Dimitri Kokkonis boosted:
Fabio Manganiellofabio@manganiello.social
2025-08-20
In order to please the requests a large publisher (Axel Springer), #Germany may be on the verge of making ad-blockers illegal - and, worse, anything that modifies a Web page before or after rendering.

Axel Springer has an open lawsuit against Eyeo (the maker of Adblock Plus).

Publishers or Big Tech companies waging war against browsers and extensions culprit of blocking their juicy ads+tracking revenues aren't anything new. But this time the argument is a very dangerous one.

The argument is that the source code of a website (its HTML, JS and CSS) is copyrighted content intended to be rendered as-is on a client's device.

Therefore ad-blockers, by intercepting or blocking requests made through this copyrighted content, or modifying the DOM it renders, are breaking copyright laws.

In 2022, the Hamburg appeal court ruled that Adblock Plus did not infringe the copyright of websites, but rather it was merely facilitating a choice by users about how they wished their browser to render the page.

Unfortunately, on July 31, the German Federal Supreme Court partially overturned the decision of the Hamburg court and remanded the case for further proceedings. The BGH (as the Federal Supreme Court is known) called for a new hearing so that the Hamburg court can provide more detail regarding which part of the website (such as bytecode or object code) is altered by ad blockers, whether this code is protected by copyright, and under what conditions the interference might be justified.

The statement that a website as a whole, including its 3rd-party integrations (such as ads/trackers SDKs), is copyrighted content intended to be rendered without modifications only on the clients supported by the author is an extremely dangerous one.

It goes against everything that HTTP and HTML have always been.

Not only it would make ad-blockers illegal, but it'd make anything that alters the flow of an HTTP session illegal.

Think of things like Greasemonkey scripts to change the style of some webpages. Or accessibility extensions that modify the contrast and font size of a page. Or things like Firefox's Reader Mode, often used by blind people to distill webpages before feeding their content to a screen reader. Or even just inspecting and manually modifying the DOM of a Web page through the browser's dev tools.

And what if I do the blocking on DNS level, through something like Pihole? Would a DNS block towards a domain I don't want to be rendered on my devices be illegal too?

If I acquired some content in a legal way (e.g. through an HTTP request to an openly accessible website), then I'm free to do whatever I can with that content, for personal usage, once it reaches my device.

Imagine a law that makes it illegal to install another OS on a computer or phone that you regularly purchased.

Or use alternative clients to render your chats.

Or use a text-based browser with a minimal JS engine to access a Website.

A law that wouldn't just imply a void warranty in these cases - just make them straight out illegal, as in "copyright infringment" illegal.

It would be the biggest blow to the way the Internet is built - around open protocols open to all kind of implementations and messages open to all kind and manipulations on each step of the route.

It would set a very dangerous precedent towards an over-reaching definition of copyright that could also mandate on what devices and under what condition some HTTP content should be rendered (and it's not such a far-fetched dystopia: look no further than the DRM implementations).

And it would violate other EU laws (like the DMA) which are exactly meant to foster accessibility, inter-compatibility, freedom of implementation and modification of online content acquired through legal means.

And what's most ironic is that blocking ads or modifying the CSS of a webpage may amount to copyright infringment, but massive scraping done by AI models may not.

https://blog.mozilla.org/netpolicy/2025/08/14/is-germany-on-the-brink-of-banning-ad-blockers-user-freedom-privacy-and-security-is-at-risk/
Dimitri Kokkonis boosted:
Stefano Zacchirolizacchiro@mastodon.xyz
2025-07-28

I am recruiting a postdoctoral researcher to work at Polytechnic Institute of Paris for 30 months, in the fields of #SoftwareEngineering and #Cybersecurity The recruited person will work on leveraging @swheritage as a knowledge base to improve the state of the art of (binary) software composition analysis (SCA), to detect the presence and details of #OpenSource software shipped within IT products. See institutminestelecom.recruitee for details and application instructions. #getfedihired

Dimitri Kokkonis boosted:
Stefano Zacchirolizacchiro@mastodon.xyz
2025-06-02

Advice to young colleagues when preparing rebuttals for papers submitted to major academic conferences or journals. When there is a soft limit (e.g., 1000 words) it is in your best interest to make your key rebuttal arguments fit that limit. And only later, if you really have to, add additional arguments/details after that limit, clearly marking the separation between the two. What you should not do, is just ignore the limit and submit a free-flow long text. It will not serve your cause.

Dimitri Kokkonisplumtrie
2025-05-16

@luj “hang in there”, depending on the context?

Dimitri Kokkonis boosted:
2025-05-05

"On this date 55 years ago, May 4, 1970, Ohio National Guard members fired on student protesters at Kent State University, killing four students and wounding nine others."
dispatch.com/story/news/histor

Dimitri Kokkonis boosted:
Stefano Zacchirolizacchiro@mastodon.xyz
2025-05-01

Congrats to my coauthors @plumtrie, E. Decoux, and M. Marcozzi for the best artifact #award at #ICSE2025. 99% of the merit for this goes to Dimitri (in the picture), who did all the heavy lifting, chapeau.

The artifact itself is worth looking at as blueprint/example for students and colleagues working on replication packages in complex contexts (like ours here, having to replicate long running fuzzing experiments).

Dimitri Kokkonis boosted:
Stefano Zacchirolizacchiro@mastodon.xyz
2025-04-30

"If you have a buggy program, you can fix it or call it AI" - David Parnas, #ICSE2025

Dimitri Kokkonisplumtrie
2025-04-29

On my way to Ottawa and @icseconf 🍁

Presenting on Friday (May 2nd) at 16:00 local time in room 210, come say hi ☺️

conf.researchr.org/details/ics

Dimitri Kokkonis boosted:
Stefano Zacchirolizacchiro@mastodon.xyz
2025-04-29

My colleagues at CEA in #Paris, France, are hiring a 2-year #postdoc to work on the joint research project #SECUBIC about #fuzzing binaries to identify #backdoors. (See this recently joint work at #ICSE2025 for previous results: upsilon.cc/~zack/research/publ )

If you're interested, or know interested candidates, head to: secubic-ptcc.github.io/jobs/op for details.

#getfedihired

Dimitri Kokkonis boosted:
camwilsoncamwilson
2025-04-03

The Wikimedia Foundation, which owns Wikipedia, says its bandwidth costs have gone up 50% since Jan 2024 — a rise they attribute to AI crawlers.

AI companies are killing the open web by stealing visitors from the sources of information and making them pay for the privilege

Dimitri Kokkonis boosted:
winter woof :trans_furr_white:eclairwolf@tech.lgbt
2025-03-08

localthunk.com/blog/balatro-ti just read this balatro retrospective devblog by the developer, and it was pretty fascinating!

Client Info

Server: https://mastodon.social
Version: 2025.07
Repository: https://github.com/cyevgeniy/lmst