We are excited to announce the third night of talks in the NYC Systems series in 2026! Talks are agnostic of language, framework, operating system, etc. And they are focused on engineering challenges, not product pitches.
We are pleased to have Olivia Gallucci and Doug Patti speak, and glad to have Trail of Bits as a partner for the venue.
Olivia Gallucci is a security engineer at Datadog, where her work surrounds macOS internals, reverse engineering, and user-space research. She previously worked in offensive security at Apple, SECUINFRA, Deloitte, and for the U.S. government.
She writes [ret]2read, a monthly newsletter on operating system internals. In her spare time she enjoys sailing, running, and blogging.
Apple publishes part of its operating system source, and that partial view is a better starting point for security research than it first appears. This talk walks through operationalizing it: reverse engineering, fuzzing, and vulnerability discovery against a codebase you can only half see.
She covers where AI genuinely helps in that workflow — triaging diffs to find the changes most likely to be exploitable, surfacing private APIs, reasoning about bug classes in IOKit, and deciding where to point a fuzzer across macOS and iOS. She also covers where it does not: incomplete source, legal limits, and the places where an agent will confidently describe code that does not exist.
She closes with demonstrations and a blueprint for building agents that can reason about Apple's ecosystem.
Doug Patti has been a developer at Jane Street since 2017, working mostly on distributed systems. He built Concord, a state machine replication system that undergirds Jane Street's client offerings.
He now works on its successor, Aria: a low-latency shared message bus with strong ordering and reliability guarantees, which other teams inside Jane Street build resilient systems on top of.
Jane Street relies heavily on inter-process communication and real-time message passing to drive critical systems, including those that ingest market data and implement trading strategies. As the number of components grows, it gets increasingly hard to say anything confident about the consistency and correctness of the system as a whole.
This talk covers the approach Jane Street settled on: put a transaction log at the center, replicate state machines off it, and invert control flow so that application code stops having to reason about data races and process failures on its own. That structure is what Aria is built on.
The interesting part is the tension in the title. Fault tolerance is not free, and a log that is fast is not automatically a log you can trust. Doug goes through where those two goals fight, which guarantees are worth paying for, and which ones the team decided to live without.