2026-07-22T17:30:09+02:00 https://nostr.ae Sophie Schmieg https://nostr.ae/npub10qaqswg07tsrztrauf69ylup6qj50kef7e4ut7t0vganygk0t2rsyr4hg8 https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/344/095/365/925/622/original/b1885f96d2f55668.png https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/344/095/365/925/622/original/b1885f96d2f55668.png https://nostr.ae/nevent1qqsyn966jv2lhx9dczwa0m3hw06vugwd2aefwtpfz9h3y87tct7rzwgzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwt0v28e In reply to <a href='/nevent1qqsr60ch0wq2ss3ue9e08u44utny5exdmjzsf424v3un2quq2jmww8q6rnet5'>nevent1q…net5</a><br/>_________________________<br/><br/>Please read this before treating djb with any seriousness. <a href="https://keymaterial.net/2025/11/27/ml-kem-mythbusting/">https://keymaterial.net/2025/11/27/ml-kem-mythbusting/</a> 2026-07-01T00:04:27+02:00 https://nostr.ae/nevent1qqsqhtcrun2u3mplaprgf9w62wum8yrjwkllw7tvmq6gg8v8p0c2t7qzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwvpcnv0 The Deutsches Museum Thermometer has an out of bounds exception<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/816/252/462/210/600/original/8a17f726c12255ab.jpg"> <br/> 2026-06-26T13:49:50+02:00 https://nostr.ae/nevent1qqsr0rhqnm4vatt8rgm6c0e4w57qu2y5xlmx2kyqftk98lx48ra4q6czypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwz2e4z3 <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub184fq96hfzuehvlhsf5h06fdngce9y5t49gnh3d7y8ms7v3lmgw6q3apnjc" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Insecurity Princess 🌈💖🔥</span> (<span class="italic">npub184f…pnjc</span>)</a></span> : Look at that girl&#39;s tattoo<br/>Me: sorry, missed it<br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub184fq96hfzuehvlhsf5h06fdngce9y5t49gnh3d7y8ms7v3lmgw6q3apnjc" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Insecurity Princess 🌈💖🔥</span> (<span class="italic">npub184f…pnjc</span>)</a></span> : Look at those boots!<br/>Me: sorry, missed it<br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub184fq96hfzuehvlhsf5h06fdngce9y5t49gnh3d7y8ms7v3lmgw6q3apnjc" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Insecurity Princess 🌈💖🔥</span> (<span class="italic">npub184f…pnjc</span>)</a></span> : Look at…<br/>Me: we&#39;re at a train station. Just assume that I&#39;m distracted by trains. 2026-06-14T13:34:39+02:00 https://nostr.ae/nevent1qqs8vmkmzy493d0cdsy4323af760zsqzv0jv4r7rnfa572yzqhpwfrczypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwxtpe2c Visiting my parents and my brother&#39;s children. <br/><br/>$30 children&#39;s toy microscopes certainly have improved a lot since I was a child.<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/747/389/075/637/868/original/e25ae1500fef50b9.jpg"> <br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/747/390/880/816/933/original/ac5a328e5c669f1f.jpg"> <br/> 2026-06-14T10:01:37+02:00 https://nostr.ae/nevent1qqsd9ycm4579694mk6jvkga54mm8453ux0dlewcy7lpn2fgakqr44tszypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgw70dhc7 In reply to <a href='/nevent1qqs2rhtguff4qkew8etpgs56l0t0h89uycyhnp8sxyzk48nnqwkd98g5yn6my'>nevent1q…n6my</a><br/>_________________________<br/><br/>ugh and they left themselves some wiggle room: the way it&#39;s written, you could claim that the criminals prosecuted are the groups exploiting the vulnerabilities. That is an obvious statement and it&#39;s clearly implied that the person doing the zero day release is actively cooperating with threat actors and therefore also criminally liable, but Microsoft can always &#34;well technically&#34; themselves out of this claim. 2026-05-28T17:17:04+02:00 https://nostr.ae/nevent1qqsx3gtv6mvqjcqs3m0gyxnf2p3lzwtr34lk86zwn3rvgdzk3c3pk3czypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgws22gtm My hot take on the vulnpocalypse:<br/><br/>We don&#39;t have more vulnerabilities than we had before. The vulnerabilities were always there, we just didn&#39;t know they existed. But importantly, for moderately sophisticated attackers, who only have to find a relatively low number of vulns to begin with, not much has changed. Yeah it&#39;s a little bit cheaper, but finding vulns wasn&#39;t all that difficult, depending on the target. For defenders otoh, making the finding of vulns cheaper is theoretically a good thing, but we already had not enough capacity to fix the vulns found by fuzz testing and similar methods before, so this is just adding on the pile of stuff we know is broken, but can&#39;t keep up with fixing it. The net effect seems to be that we made triage more expensive. Yay. 2026-04-19T18:41:22+02:00 https://nostr.ae/nevent1qqsychp4h72tv8xjx9sh6c3sedpde8h66qw7jn2tjjfyd9zxrhpueuqzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgw7use2v In reply to <a href='/nevent1qqsv2a5hvkdevsuumm9ftppcnswp5zyg8llfdp7cszpln077etqq4esggcae3'>nevent1q…cae3</a><br/>_________________________<br/><br/>it turns out, a random number generator does not get better when you first run it through a lot of linear algebra 😏 2026-02-25T22:05:29+01:00 https://nostr.ae/nevent1qqs8xqfs3jmq7733s0pkasntdu2p6hpdj74mt23hr6xfnjk3354dqpszypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwh6zcxj One of the aspects of AI that I hate the most is that at some point, I start reading my own or other people&#39;s genuine writing in &#34;AI voice&#34;.<br/>Way to undermine your own confidence or devalue other people&#39;s writing instantly. 2026-01-21T18:51:13+01:00 https://nostr.ae/nevent1qqsdxakjwml9fhttlqnur88kz82dmqdsgh8cx7vj6n667wjuguj0fcczypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwsvn6h5 Did anyone check on Assane Diop? I was under the impression that stealing diamonds in broad daylight out of the Louvre is something that is really only accomplished by the legendary Lupin. 2025-10-21T20:56:14+02:00 https://nostr.ae/nevent1qqsr6jwwemtttwasfdt8xg9a46y0jgy8kzwe394n5yjecrfgkftamgszypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwmc4rsk In reply to <a href='/nevent1qqspjkeustrrwkws3vhflu56y56qya044xpc9gltkz0chffetjehdvc0jj968'>nevent1q…j968</a><br/>_________________________<br/><br/>You didn&#39;t really think the business value of that PR that had more comments than lines of code that all of us have written at some point in our career (if you haven&#39;t, I&#39;m sorry, your onboarding mentor sucked, they were supposed to point out all the stuff you had to learn the hard way) was in getting it merged eventually, right? The value was the PR after that, that had a lot less comments. And the PR after that one, etc. 2025-10-15T02:17:39+02:00 https://nostr.ae/nevent1qqspjkeustrrwkws3vhflu56y56qya044xpc9gltkz0chffetjehdvczypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwlzg637 Whenever I see &#34;GenAI basically can do the work of a junior dev&#34;, I assume that those people are using junior devs very differently from me. To me, the value of a junior developer is maybe like 20% the code they write, and 80% is a down payment to a future where they no longer are a junior. I still haven&#39;t found an AI that could do that second part. 2025-10-15T01:38:45+02:00 https://nostr.ae/nevent1qqsg8s6fgrmw3uj6e77fkp0wccgsah5u0mxmnl7dylpvex90q556ezgzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwz7g3xc Criticizing Linux on Mastodon is really the best way to make men type paragraphs, isn&#39;t it? 2025-10-03T16:04:50+02:00 https://nostr.ae/nevent1qqs874u4tlzwkvsa3r5d4n4sfjrvwearrtd0l2e0e9p5tcxhru9hkdqzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgw28m9xq In reply to <a href='/nevent1qqspq4jfs9a0jtwh94df4fn5tw09l4cv97sjz5mdau9yhjej3rplj2sv7pu7u'>nevent1q…pu7u</a><br/>_________________________<br/><br/>it&#39;s a family of vulnerabilities that generally affect certain optimizations. The main idea behind SPECTRE is that the CPU (or GPU) falsely predicts that a certain code path is likely to be executed (for example assuming that an authentication check is likely to succeed, before waiting for e.g. a signature verification to complete), and that the execution of this code itself, even if undone by later actions, already leaks the information the attacker wanted, usually through side channels. 2025-06-25T00:32:54+02:00 https://nostr.ae/nevent1qqs88umkd0qf9aapw2squ9drwu95vanchyq2k3vj6h4ecl5ytds4gsgzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgw7n4dhd And all of the sudden, we have solved supply chain security. <br/><br/>No CVE, no vulnerabilities! 2025-04-15T22:39:29+02:00 https://nostr.ae/nevent1qqsw8440k4xjx386z69w7juefgcmrfplfty6myxflq3t3xtuts8mlsqzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwd4shcy In reply to <a href='/nevent1qqsxtakh2tuwm527ykgrltt282r825k2stju378r7m2g87wdsyrsyhsycflz6'>nevent1q…flz6</a><br/>_________________________<br/><br/>til the Babylonians already had the &#34;no take, only throw&#34; meme. 2025-04-01T15:52:36+02:00 https://nostr.ae/nevent1qqs299spekvzpsgym8ds573zw6appmznvrdcsw8v78hkrf786mj853szypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwwhlczc In reply to <a href='/nevent1qqsf4ec0tvq99mfzrkn9htrkkfwawxa0n0xx3hkgrumvjnssfy47xygasyw9z'>nevent1q…yw9z</a><br/>_________________________<br/><br/>I agree that most small to medium companies probably do not have to care about any of this right now. Those that do probably know already. But it&#39;s not something that can be simply ignored by everybody.<br/><br/>The main way to recognize overhyped nonsense is when they talk about inventory and agility. Unfortunately, neither of these terms is completely without merit, but they are the most favorite buzzwords of the hype peddlers. Really both of these boil down to proper key management. Something that is extremely difficult, but not unique or novel with PQC. 2025-03-29T07:28:24+01:00 https://nostr.ae/nevent1qqswvw8u8tg2spl804swhgykw29v89xcc03cdumarqx3a9s9cg63suszypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwvjcgf6 Days since Signal&#39;s deniable handshake has last been defeated by nobody caring about cryptographically deniable handshakes: 0 2025-03-26T06:33:09+01:00 https://nostr.ae/nevent1qqsg5f27y3m60a705s6cxt5crrrqfhh3c77q9mu6j0t045hzg8w0uaqzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwe072jq Feeling great about my upcoming international travel right now.<br/><br/><a href="https://www.theguardian.com/us-news/2025/mar/18/germany-investigates-after-national-with-green-card-arrested-at-us-border">https://www.theguardian.com/us-news/2025/mar/18/germany-investigates-after-national-with-green-card-arrested-at-us-border</a> 2025-03-18T19:30:29+01:00 https://nostr.ae/nevent1qqsra25f56qw8hzk97zgye0y36zl79hcj8yrh5mzuah62g9pk7tr9lszypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwq2c8l9 In reply to <a href='/nevent1qqstm5j5mmzsvxl655kekfk8stgsvc36ge8jw34gau0l0q0x7ued8ggp99353'>nevent1q…9353</a><br/>_________________________<br/><br/>look at number fields, split, ramified, and unramified primes while you&#39;re at it. IMHO easier to understand and deeper than split complex or dual numbers (although the dual number construction is extremely important for algebraic geometry). 2025-03-18T17:39:16+01:00 https://nostr.ae/nevent1qqsyxe6xp7akmx3uhgvqsd757894z2xxtmjm24842u3t869v9r62ntqzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwtpcmh8 I&#39;m on the same plane as Whitfield Diffie. We exchanged greetings, but not keys. 2025-03-12T18:42:15+01:00 https://nostr.ae/nevent1qqs8sqqxrjdhajhhcycjflncjgzy5rs9e5qs562emgn0nedlyk05hzgzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwhx7m9f Sometimes, a tiny bit of me wants them to outlaw encryption, just so I can show up at a pivotal moment, wearing a hoodie and half engulfed by fog from a fog machine, and mysteriously explain: &#34;I possess the forbidden knowledge. Knowledge not meant for humans to know. Knowledge of matrices that will drive you mad just gazing upon. Infinite Knowledge of fields, finite in their nature!&#34; 2025-03-07T15:14:52+01:00 https://nostr.ae/nevent1qqsf07j76389qaxv5k0supgc2lw6kfx70qf5y0f9zc8azwt5xdd9jlgzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwjte7zn This was a really fun vulnerability to have the pleasure to consult on:<br/><br/><a href="https://bughunters.google.com/blog/5424842357473280/zen-and-the-art-of-microcode-hacking">https://bughunters.google.com/blog/5424842357473280/zen-and-the-art-of-microcode-hacking</a><br/><br/>It turns out AES-CMAC is not second preimage resistant if you know the key (double so if the key is in an RFC), and 2048 bit numbers are quite often very easy to factor. 2025-03-05T19:10:10+01:00 https://nostr.ae/nevent1qqs06p8tvj008jg94slhhenvf5ksr32cszdlt8gwsawd5j60fvv3g4czypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwka3q67 In reply to <a href='/nevent1qqsdhhzwcctm8cgckvjlvhmt8ehrgedh32k4kk70ppk2xk4ds23zhygt83e0h'>nevent1q…3e0h</a><br/>_________________________<br/><br/>be that as it may, it matters that the president cannot change the law via executive fiat. It is still illegal to bribe foreign officials. There might not be enforcement right now, and if you outrun the statute of limitations that might mean you are able to commit an illegal act without penalty. But it is still an illegal act, and you still committed a crime. 2025-02-11T17:23:48+01:00 https://nostr.ae/nevent1qqs0uw40dgdpx77qc06x8sk2cmyj3r8lps6c6y8u73c43s590668qpczypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwvfvxs7 In reply to <a href='/nevent1qqsdhd03cw6y6upf3ans4pdev37ecrgyxvyfs6flnf9hvmm5etmpt3s9nvzc9'>nevent1q…vzc9</a><br/>_________________________<br/><br/>executive orders cannot suspend laws passed by Congress. 2025-02-11T17:06:28+01:00 https://nostr.ae/nevent1qqspwtccnzklwpecq3kfsqhmdjzkux7p4vwdu60px5xhljtjdneja9czypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwjq8xzl In reply to <a href='/nevent1qqsyre780g7auc384wphvw0d7sx02c0sjmk4t79ep4435jz2gtfwfdqvgnv8q'>nevent1q…nv8q</a><br/>_________________________<br/><br/>great news, I have pretty much fully mitigated the risks posed to us by cryptographically relevant quantum computers! 2025-01-28T06:27:54+01:00 https://nostr.ae/nevent1qqsgqyp8lau35rsqypkx8qnns5a7u43znepuqq6k9dshxt2jumc935qzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgww0h0xk I have to say, Mastodon&#39;s inability to actually reliably fetch content leads to hilarious situations, like a reply to my screenshot about someone earnestly proposing to use Gen AI as a random number generator being confused about why people are talking about what a bad idea it would be to use Gen AI as a random number generator. <br/><br/>Like I get it, distributed computing is hard, but at least if someone expands a thread, try to fetch the whole thread.<br/><br/><a href="https://mastodon.social/@nf3xn/113770165305664382">https://mastodon.social/@nf3xn/113770165305664382</a> 2025-01-04T20:09:03+01:00 https://nostr.ae/nevent1qqs9qgewpl93yt9eu0vwjlpkelfke6cdr984dc293clufkkfyncd8lgzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgw4ezd63 I was forwarded this screenshot and it just is living rent free in my head right now.<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/766/372/583/509/013/original/558b18b47adc8848.jpeg"> <br/> 2025-01-03T21:46:33+01:00 https://nostr.ae/nevent1qqsgnmfn0x0nauwyn5w4sywe3n8kz6gvyu8quydzystmzmvlnnn4lzgzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwwq9r9l At this point, the IETF might require an anti-SLAPP rule, disallowing participants threatening other participants or the IETF with frivolous lawsuits from taking part in the standards process. 2024-12-13T17:14:36+01:00 https://nostr.ae/nevent1qqsw34k006ndwmv3336jufp27lt85l44skkyl9j4paan9wzvadn6ymczypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwecwgfq <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub184fq96hfzuehvlhsf5h06fdngce9y5t49gnh3d7y8ms7v3lmgw6q3apnjc" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Insecurity Princess 🌈💖🔥</span> (<span class="italic">npub184f…pnjc</span>)</a></span>, reviewing a resume, on a Saturday morning, while still in bed: this candidate&#39;s work experience is from September 2025 to present! <br/>Me: you should tell them they&#39;re hired, start date is November 10th 2024, three unexcused consecutive days of absence are considered a resignation. 2024-11-23T18:50:39+01:00 https://nostr.ae/nevent1qqsyms74n4876j86nmmfwkh7gzypg94j6pl8stmfwjeznl8394kfwwqzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgw0phhr7 All other philosophies of mathematics: all hash functions have collisions! And trivially so due to the Pigeon Hole Principle! <br/><br/>Ultra finitist: cryptographically secure hash functions are injective 😎 2024-11-07T12:35:28+01:00 https://nostr.ae/nevent1qqsd3xlzvyq99hvps59r80edtyx5rm32fpf6pn5efhf6d5ugp05hhlszypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwfrm8dl When I talk to other software engineers, there seem to be two camps developing when it comes to LLM assisted coding. Some are over the moon happy about it, and say it improves their productivity by an order of magnitude. Others are fairly indifferent to slightly negative about it, saying it is more of a nuisance than actually helping, inventing APIs that sure would be nice if they existed etc. <br/>Finding myself in the latter camp, I just can&#39;t deal with the unpredictability of the tools. Both in terms of reproducibility, but also in terms of continuousness. Some tasks it does well on, but it&#39;s near impossible to tell whether it will do the same for a similar, related task. To me, the one advantage and disadvantage computers have is that they do exactly as told, and a probabilistic tool breaks that and just feels buggy.<br/>The other thing I can&#39;t deal with is that it seemingly doesn&#39;t lend itself to iterative, local approaches. Every query is a new thing, that may discard everything it had before, and you can&#39;t really hone in on the thing you want. <br/>Add to that that it often suggests things that might be reasonable, but aren&#39;t the way I would have done it, and I like doing things the way I would have done it, so I&#39;m going to replace the entire suggestion wholesale, and I end up with a tool that feels at best only marginally useful, if not detrimental to writing code. 2024-06-01T09:59:25+02:00