2026-07-17T12:41:02+02:00 https://nostr.ae Filippo Valsorda https://nostr.ae/npub1jzt0dcdqdhz0dmf3xk8fjn56kt45dqemtaz6rqzm9ycyz25p0nzqryjnwm https://cdn.masto.host/abyssdomainexpert/accounts/avatars/109/472/682/376/441/460/original/ac66d0a023e6ef25.jpeg https://cdn.masto.host/abyssdomainexpert/accounts/avatars/109/472/682/376/441/460/original/ac66d0a023e6ef25.jpeg https://nostr.ae/nevent1qqs00c90wpdzfkufz5494alkmfvz8jjprnwnm70fszdg7fezcc58f3qzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgkvsyaa How much storage / bandwidth / CPU / memory does it take to run a production Sunlight CT log? Surprisingly little!<br/><br/>There&#39;s now a public stats page, pulled every 5m from our Tuscolo prod metrics.<br/><br/><a href="https://stats.sunlight.geomys.org/">https://stats.sunlight.geomys.org/</a><br/><br/>Less than 2 cores, 300 MB of memory, ~250 Mbps of bandwidth, 260 GiB of SSD.<br/> <img src="https://cdn.masto.host/abyssdomainexpert/media_attachments/files/116/454/308/251/297/764/original/fa07107842e1f9e8.png"> <br/> 2026-04-23T15:42:06+02:00 https://nostr.ae/nevent1qqstfr5y29z5f8rh09mk34wtsy5hqe8myx3qxjz8wcypf9hy22jnleqzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgl7pk2p I wrote up in the TLS mailing list why I think composite signatures (ML-DSA + ECDSA/RSA) are a net negative, will hurt the ecosystem, and should not be implemented.<br/><br/>Hybrid key exchange was simple and self-contained. Hybrid signatures would be a mountain of complexity in code responsible for half of sev:crit in crypto libraries since 2020.<br/><br/><a href="https://mailarchive.ietf.org/arch/msg/tls/oh3jmmkHzHdp1hk4R4M9QjkmvBk/">https://mailarchive.ietf.org/arch/msg/tls/oh3jmmkHzHdp1hk4R4M9QjkmvBk/</a> 2026-04-15T14:51:01+02:00 https://nostr.ae/nevent1qqsru8tzlv7vg9sp9lqgv5sgh8d8xseflps30tr95waujmsynqgj6yszyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgeyrsl7 Alright, it&#39;s official! 💰<br/><br/>[@matthew_d_green](<a href="https://ioc.exchange/@matthew_d_green">https://ioc.exchange/@matthew_d_green</a> ) and I bet on what will break first, ML-KEM-768 or X25519. The loser donates to a 501(c)(3) picked by the winner.<br/><br/>If you have an opinion on quantum computers or lattices, you can join with a side bet. Just submit a PR!<br/><br/><a href="https://github.com/FiloSottile/ecc-vs-lattices-long-bet">https://github.com/FiloSottile/ecc-vs-lattices-long-bet</a><br/> <img src="https://cdn.masto.host/abyssdomainexpert/media_attachments/files/116/383/186/419/029/354/original/3a50e62fd0c6b1da.png"> <br/> 2026-04-11T02:15:30+02:00 https://nostr.ae/nevent1qqstre0syswp7yf9hzkg6cfg2emhtmr39353s8x5tes0nzfezypek0qzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vg3m6cxn Two papers came out last week that suggest classical asymmetric cryptography might indeed be broken by quantum computers in just a few years.<br/><br/>That means we need to ship post-quantum crypto now, with the tools we have: ML-KEM and ML-DSA. I didn&#39;t think PQ auth was so urgent until recently.<br/><br/><a href="https://words.filippo.io/crqc-timeline/">https://words.filippo.io/crqc-timeline/</a> 2026-04-06T17:14:07+02:00 https://nostr.ae/nevent1qqsfsuv7fgv8exqr7vtgwcnwy3s4v559puxkh3p9x5mgcdl2gnst20gzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vghuat9z Last year, my position was that we still had time to design PQ authentication mechanisms.<br/><br/>Now, based on the pace of progress and on statements like Google&#39;s, I believe:<br/><br/>1. we need to finish rolling out PQ key exchange yesterday<br/>2. we need to start rolling out PQ auth now<br/>3. it&#39;s too late to ship any new non-PQ design or system<br/><br/><a href="https://blog.google/innovation-and-ai/technology/safety-security/cryptography-migration-timeline/">https://blog.google/innovation-and-ai/technology/safety-security/cryptography-migration-timeline/</a> 2026-03-26T16:43:15+01:00 https://nostr.ae/nevent1qqsrfthmllpgvp9ax6v8n96s3erzt9jzrsvpl0ymr4625rpx363gxzczyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgpu86qc In reply to <a href='/nevent1qqsfwns69mk46lyyxg3pcxs59watmkjl7zke4u2nxhshzxa2d9lk66shegwmj'>nevent1q…gwmj</a><br/>_________________________<br/><br/>I can migrate to Pleroma/Akkoma without losing my posts? 2026-03-20T17:16:00+01:00 https://nostr.ae/nevent1qqs0emg4ysmkkdre2aah4dn2046r4s57j9vjelcrmc2qrtvvz242yxqzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vg09vt58 So uh, apparently $288/year is not enough to run a Mastodon service for ~3 users, and this is a known issue (<a href="https://masto.host/mastodon-content-retention-settings/">https://masto.host/mastodon-content-retention-settings/</a>) with no solution (<a href="https://github.com/mastodon/mastodon/discussions/19260">https://github.com/mastodon/mastodon/discussions/19260</a>)?!<br/><br/>I just want to own my identity. On Bluesky, it takes a TXT record and a did:plc rotation key. A PDS takes like $25/yr. For $300/yr you can run a whole-network relay.<br/><br/>Also, it&#39;s unclear if I can move to non-Mastodon software without losing all my posts, despite owning the domain??<br/><br/>And this ecosystem sneers at atproto?<br/> <img src="https://cdn.masto.host/abyssdomainexpert/media_attachments/files/116/262/370/987/395/643/original/51a35ef3b712e7ff.png"> <br/> 2026-03-20T17:09:56+01:00 https://nostr.ae/nevent1qqs05c2wyh0qxmgupj0qnn5mp82cxytl0hckpgg5n6seqkyc8fpzweszyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgu8t346 Dependabot security alerts have terrible signal-to-noise ratio, especially for Go vulnerabilities. That hurts security!<br/><br/>Just turn it off and set up a pair of scheduled GitHub Actions, one running govulncheck, and the other running CI against the latest version of your dependencies.<br/><br/>Less work, less risk, better results!<br/><br/><a href="https://words.filippo.io/dependabot/?source=Mastodon">https://words.filippo.io/dependabot/?source=Mastodon</a> 2026-02-20T20:56:26+01:00 https://nostr.ae/nevent1qqst08pyalj67368mv2m2595xg9d0atuazcyqqx3x6mazeu5wmpttwczyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgxu5u0a In reply to <a href='/nevent1qqs87skk4r6tm9t3kx7wyhd0408qp0xf4hc56wp4zx8mckfk2afxx0cs5tz9h'>nevent1q…tz9h</a><br/>_________________________<br/><br/>Anyway, read Russ Cox&#39;s take on AI tool use in the Go project.<br/><br/><a href="https://groups.google.com/g/golang-dev/c/4Li4Ovd_ehE/m/8L9s_jq4BAAJ">https://groups.google.com/g/golang-dev/c/4Li4Ovd_ehE/m/8L9s_jq4BAAJ</a> 2026-02-16T14:35:07+01:00 https://nostr.ae/nevent1qqs87skk4r6tm9t3kx7wyhd0408qp0xf4hc56wp4zx8mckfk2afxx0czyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgljxhax In reply to <a href='/nevent1qqs80fyja6qd35wv6g7t5eadf8vkcpnf7k7z42l4wgpslw6xnffatwsfcnqpx'>nevent1q…nqpx</a><br/>_________________________<br/><br/>One could go on!<br/><br/>Do you fully trust third-party dependencies?<br/>Do you always verify third-party dependencies?<br/><br/>But somehow AI output is special and harbinger of all security issues. 2026-02-16T14:35:07+01:00 https://nostr.ae/nevent1qqs80fyja6qd35wv6g7t5eadf8vkcpnf7k7z42l4wgpslw6xnffatwszyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgd2q6xp I wish that those surveys so often cited by InfoSec pundits that ask<br/><br/>Do you fully trust AI output?<br/>Do you always verify AI output?<br/><br/>also asked<br/><br/>Do you fully trust your colleagues&#39; output?<br/>Do you always verify your colleagues&#39; output?<br/><br/>Just to have comparative numbers, you know. 2026-02-16T14:35:07+01:00 https://nostr.ae/nevent1qqs99dge688ramw6ztm3u4rhnd2tg3ns76k3lcr734ck2hj63fq2faczyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgmkwvna In reply to <a href='/nevent1qqsgh8u7ewh0sehdmef85quys2kup9kyw57fh03h62ysf5nkyumcrlgzfag53'>nevent1q…ag53</a><br/>_________________________<br/><br/>I was indeed just venting about an annoying but manageable situation, thank you for the offer and for picking up on the intention :) 2026-01-24T12:59:16+01:00 https://nostr.ae/nevent1qqs076ta8697nkqtmahf0d4pty5xukq5vxgnalgdhrly3dpdfes3gtgzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgvtt0ek A wonderful twist on being an open source maintainer is when the person engaging poorly and violating the CoC is a security reporter with some valid observations.<br/><br/>You now have conflicting responsibilities to users&#39; security and to your and your community&#39;s safety. 2026-01-23T23:25:34+01:00 https://nostr.ae/nevent1qqs9pa38whq7te4p4ymegd7n388u4gd8r85j52synyu3577ess9kpcszyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgq03fkn Do you have an idle cluster? Can you spare a couple core-years?<br/><br/>Help me bruteforce some test vectors for RSA key generation edge cases!<br/><br/>Here are the instructions, it&#39;s just a matter of running a single self-contained cross-compilable Go binary that will report the results autonomously.<br/><br/><a href="https://gist.github.com/FiloSottile/19e7ceb1fdcdaa128f7d3319ad0939fa">https://gist.github.com/FiloSottile/19e7ceb1fdcdaa128f7d3319ad0939fa</a> 2026-01-04T16:48:35+01:00 https://nostr.ae/nevent1qqsqslrryz5ru00vd5q7wftfueys5x67mctenjdpgy0n36fwlg4pjgqzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vg7dz44t In reply to <a href='/nevent1qqs2e4vu8yj6rngvqzfzas0wmf5nxu989newkpwdynmmvdz2s70qjyqgagrxj'>nevent1q…grxj</a><br/>_________________________<br/><br/>I am the only one that can access the exe.dev account. Thank you for your concern. 2026-01-02T18:39:02+01:00 https://nostr.ae/nevent1qqszz4ut4h4yaek2gxk0pqt2fxwjrce7x2ex9qr6h53fucgukzrr7xgzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgkje5gn In reply to <a href='/nevent1qqsy09qy2g524hvup7vrmc6haxez46h93gzq8w2xem7vlvm7jvc2y4cjsyneq'>nevent1q…yneq</a><br/>_________________________<br/><br/>1. yes. by using it.<br/><br/>2. yes, I trust I will survive<br/><br/>3. the code is not public??? 2026-01-02T18:35:41+01:00 https://nostr.ae/nevent1qqsyrdppzcjx2v97x0en9g9x3l6m4cftnq7aqd8ghv5apnlunl486xczyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgznfs9t In reply to <a href='/nevent1qqspls4akjaaezhtxqm8z5wx0zdnwq68p4zhc8hvfgaw9hd423zh2fsdaugf2'>nevent1q…ugf2</a><br/>_________________________<br/><br/>I care deeply about the open source ecosystem, so I feel the argument that disposable personalized software is by definition not shared or reused.<br/><br/>However, let&#39;s be honest here: I would not have built this without LLMs, and no one was going to open source a FIPS 140 backoffice manager.<br/><br/>This only displaced a spreadsheet, a local script, a Google Drive folder, a bunch of emails, and error-prone manual processes. 2026-01-02T18:16:41+01:00 https://nostr.ae/nevent1qqspls4akjaaezhtxqm8z5wx0zdnwq68p4zhc8hvfgaw9hd423zh2fszyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgwsu44h I just completely vibecoded with exe.dev and Opus 4.5 a backoffice for our FIPS 140 validation, with a separate view for the lab (where they can also upload test vectors), public links for clients, guided scripts for testing, and APIs to upload test results to S3.<br/><br/>I have not looked at the code once. It works great.<br/><br/>I am... processing this. 2026-01-02T18:16:41+01:00 https://nostr.ae/nevent1qqsxqemju4xjk5yyrzr8eehalpe4wrsj454hypzmvv4erx07qnuyuwqzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vg7f7wd0 In reply to <a href='/nevent1qqstaz8rqz738mxft3e5snz26egg0zkgg4mzjqwrtvjzx23vkh8n0ys0nv3hp'>nevent1q…v3hp</a><br/>_________________________<br/><br/>This is what the Go team does, too, and we are similarly sad about the made-up scores being taken seriously. 2026-01-01T14:05:52+01:00 https://nostr.ae/nevent1qqsfldl2dgru09mxslkymg5jauqc397aktpc9c9hp5aw0vat4036ghczyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vg64facx 💥💥💥💥💥 age v1.3.0 💥💥💥💥💥<br/><br/>Post-quantum keys, seeking DecryptReaderAt API, age-inspect CLI tool, built-in recipients compatible with hardware plugins, non-interactive passphrase input, Go framework for implementing plugins, and sooooo many improved errors.<br/><br/>Our best release yet, six years to the day after the first beta, again released from the floor of #39c3!<br/><br/><a href="https://github.com/FiloSottile/age/releases/tag/v1.3.0">https://github.com/FiloSottile/age/releases/tag/v1.3.0</a><br/> <img src="https://cdn.masto.host/abyssdomainexpert/media_attachments/files/115/793/950/663/179/629/original/fe91f9803674021d.jpeg"> <br/> 2025-12-27T23:44:30+01:00 https://nostr.ae/nevent1qqs074ntzsyydde9vfpdhqesf53e68c7l0fz6lwgk38zx64x0yqsr8gzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgqqjucm At the <a href="https://gpg.fail">https://gpg.fail</a> talk and omg #39c3<br/><br/>You can just put a \0 in the Hash: header and then newlines and inject text in a cleartext message.<br/><br/>Won’t even blame PGP here. C is unsafe at any speed.<br/><br/>gpg has not fixed it yet.<br/> <img src="https://cdn.masto.host/abyssdomainexpert/media_attachments/files/115/792/484/165/073/814/original/62c310403495b926.jpeg"> <br/> 2025-12-27T17:31:33+01:00 https://nostr.ae/nevent1qqsvv5kdc27g86ak4xm7dd2mn8g5xq84h8rf9knyslyv674tcx8whaczyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgvk7wlf After reading <a href="https://commaok.xyz/ai/just-in-time-software/">https://commaok.xyz/ai/just-in-time-software/</a> I gave exe.dev a shot and the combination of cheap VMs, the HTTPS proxy with passkey auth and link sharing, and the built-in LLM agent is... incredible.<br/><br/>Like, I know how to use each of these things individually, but combining them feels like when I first learned to script things. 2025-12-24T16:14:38+01:00 https://nostr.ae/nevent1qqsx870fp5vauc44cs3jmx63q3dyg9hu58h2jqft0hu0ww9ruykmk6qzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vg64rnf5 This Bernstein crap drives me up the wall because IT MAKES NO SENSE.<br/><br/>Why would the NSA be picking weak crypto to protect US NatSec?!<br/><br/>They have mathematicians and clusters in China, too!<br/><br/>Dual_EC_DRBG was a NOBUS backdoor. There is NOWHERE to hide a NOBUS backdoor in ML-KEM. Look at the code, there is nothing even remotely public key shaped. 2025-11-24T22:27:14+01:00 https://nostr.ae/nevent1qqsx48cyq4dzkg54th5d5yeyrrl373exnehhdf9f8pufjxyjsttj8tczyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vg059nqn So tempted to write a troll thread on how this incident shows Rust has bad error handling and wouldn’t have happened in Go, where we actually handle errors 🫣🫢😜<br/><br/><a href="https://blog.cloudflare.com/18-november-2025-outage/#memory-preallocation">https://blog.cloudflare.com/18-november-2025-outage/#memory-preallocation</a> 2025-11-19T11:14:07+01:00 https://nostr.ae/nevent1qqs0ewhcp3eqqu7rk4hc2nxzf2sk3trq87flanh09elxljxkvads74gzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgzeq9m5 In reply to <a href='/nevent1qqsdlp6h0hz2wvgm2ury7zksvnvnkzewlwwz2gc3dapfhpnz9m9s5kgr04cef'>nevent1q…4cef</a><br/>_________________________<br/><br/>Going live on <a href="https://www.twitch.tv/filosottile">https://www.twitch.tv/filosottile</a> in 30 minutes! 🔴<br/><br/>Join me for some Go livecoding of the post-quantum signature scheme ML-DSA! 2025-10-26T15:02:47+01:00 https://nostr.ae/nevent1qqsdlp6h0hz2wvgm2ury7zksvnvnkzewlwwz2gc3dapfhpnz9m9s5kgzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgefrlmd In reply to <a href='/nevent1qqsvrnkt5z8ql7f5hcx43r3j7a6h7ph8qpsfhvxcuauups2teqg28rqj25amm'>nevent1q…5amm</a><br/>_________________________<br/><br/>Alright, I put together a field implementation for the base ring using simple Montgomery multiplication, so we&#39;ll not have to worry about that part.<br/><br/>Will probably stream the actual ML-DSA implementation in the CET afternoon.<br/><br/>Give <a href="https://words.filippo.io/kyber-math/">https://words.filippo.io/kyber-math/</a> a read if you want to come prepared! 2025-10-26T12:59:30+01:00 https://nostr.ae/nevent1qqsvrnkt5z8ql7f5hcx43r3j7a6h7ph8qpsfhvxcuauups2teqg28rqzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgpm8kj2 I&#39;ve added an appendix to my &#34;Enough Polynomials and Linear Algebra to Implement Kyber&#34; article with the little extra needed to implement Dilithium/ML-DSA.<br/><br/><a href="https://words.filippo.io/kyber-math/#appendix-a-bit-more-for-ml-dsa">https://words.filippo.io/kyber-math/#appendix-a-bit-more-for-ml-dsa</a><br/><br/>Maybe I&#39;ll stream an ML-DSA implementation tomorrow at <a href="https://www.twitch.tv/filosottile">https://www.twitch.tv/filosottile</a>. 2025-10-26T02:55:23+02:00 https://nostr.ae/nevent1qqsy0k588ck6824u9lfwnzch4fuygx4fe0uggh5kf287wspsh8s8c6szyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vg3gz5j3 &#34;Lack of scalability is enough for us to disqualify QKD outright: if a technology can’t bring security to the whole Internet, we’re not going to spend much time on it.&#34;<br/><br/>Quantum Key Distribution (as opposed to post-quantum cryptography) has a number of problems, but this succinctly captures the core issue.<br/><br/><a href="https://blog.cloudflare.com/you-dont-need-quantum-hardware/">https://blog.cloudflare.com/you-dont-need-quantum-hardware/</a> 2025-09-19T15:58:56+02:00 https://nostr.ae/nevent1qqsyjkpkdfwv03ttr5zspwqu6zxjrp8tppy22akk5wm3gaqf6fgpjlqzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vg063v0a Anytime I read something like “10,000 requests in a few hours” or “one million requests in a week” I‘m immediately skeptical of the framing.<br/><br/>That’s ~0.5 rps and ~1.7 rps, respectively. The disposable vape on HN right now claims 6.25 rps (160 ms page loads). 2025-09-16T03:33:16+02:00 https://nostr.ae/nevent1qqsvm8fdpyef8jj786whwfucpl64wcgpvze8u5ew5uspehfn4jjpx7czyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgtt5v84 There&#39;s a bit of commotion on Lobsters because an unpleasant-but-technically-correct user finally got banned, and I realized that an unpopular opinion of mine is that moderators are always right.<br/><br/>I don&#39;t care about the letter of the CoC. I don&#39;t care about transparency, even. Moderation is the fundamentally human and nuanced big-picture job that shapes a community.<br/> <img src="https://cdn.masto.host/abyssdomainexpert/media_attachments/files/115/123/712/178/230/773/original/42748b9cdd676f14.png"> <br/> 2025-08-31T15:54:02+02:00 https://nostr.ae/nevent1qqsrcj096gn0r6wdfcnlgtpaclvh8l0n77vfdaea9p8krf9txx9d3yczyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgh0yaqc In reply to <a href='/nevent1qqsvm8fdpyef8jj786whwfucpl64wcgpvze8u5ew5uspehfn4jjpx7cn3txvl'>nevent1q…txvl</a><br/>_________________________<br/><br/>Sometimes mods will do something I wouldn&#39;t have. I&#39;ll never know because I will never have the full context, but even then they&#39;re not wrong.<br/><br/>They are shaping the community. If I don&#39;t like it (e.g. choosing borderline assholes over the rest of us), it&#39;s just not my community. 2025-08-31T15:54:02+02:00 https://nostr.ae/nevent1qqsdzg3379s7668pe9q0zuye2nju8lpxteace7wn5rhcjusr5s6facczyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgaxud8t I edited my Cross-Site Request Forgery countermeasures research into a stand-alone article, including recommendations reusable by other projects.<br/><br/>tl;dr: no need for tokens or keys, modern browsers tell you if a request is cross-origin!<br/><br/><a href="https://words.filippo.io/csrf?source=Mastodon">https://words.filippo.io/csrf?source=Mastodon</a> 2025-08-13T18:07:51+02:00 https://nostr.ae/nevent1qqsr20fkfju9kxsar85la2k5e9swhrry02zjz5n2tegqgy6k0gkvzwgzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vg9cr7ed This is pretty well executed phishing.<br/><br/>The Copy button copies to the clipboard<br/><br/>echo &#34;Y3Vy[...]ggJg==&#34; | base64 -d | bash<br/><br/>which in turn curls this script <a href="https://gist.github.com/FiloSottile/385137f5ca2eabb51fd206bde2ff1d0a">https://gist.github.com/FiloSottile/385137f5ca2eabb51fd206bde2ff1d0a</a> into bash.<br/><br/>They even detect piping, so to read it you have to run &#34;curl | cat&#34;.<br/> <img src="https://cdn.masto.host/abyssdomainexpert/media_attachments/files/114/868/224/746/439/839/original/67b6eec46293826c.png"> <br/> 2025-07-17T13:00:13+02:00 https://nostr.ae/nevent1qqs2xqv4akxn0az6a3uhamwh45yle0q7w92cryry7m5l53rdu4jrp7czyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgekdpnk Operating a Certificate Transparency log is now within reach of many organizations.<br/><br/>I wrote up the requirements: essentially one small server process, a couple people, and the capacity to host 3-5 TB of static files. <a href="https://words.filippo.io/run-sunlight/">https://words.filippo.io/run-sunlight/</a> <br/><br/>I&#39;d love to chat with anyone who&#39;s considering running one! 2025-07-08T20:23:39+02:00 https://nostr.ae/nevent1qqsdrueuhazvhk5mvx9wfkdstgk05g0hr5n4ucna50ff8czl0tw9m7qzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgnj0syu I released version 0.2.4 of Typage, the TypeScript implementation of age for Node/Deno/Bun and browsers.<br/><br/>encrypt and decrypt now accept and return ReadableStreams to encrypt/decrypt large files on the fly. The returned object also has an additional method to compute the expected output size from the input size.<br/><br/><a href="https://github.com/FiloSottile/typage/releases/tag/v0.2.4">https://github.com/FiloSottile/typage/releases/tag/v0.2.4</a> 2025-07-06T17:10:23+02:00 https://nostr.ae/nevent1qqsqmm5mm9tyd22h083ujk46wfr2mep3w4jmqhwtty3tksg3psegyugzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgrpajy3 I wish we had spaces to collaborate on technical work where being a jerk was just not allowed. Like, actual proper fearless moderation.<br/><br/>Your reply starts with &#34;No.&#34; on its own line? Two weeks ban. Learn to behave.<br/><br/>You go on a tear about another participant? One year ban. No warning.<br/><br/>I&#39;m a privileged white dude with 20k followers and even I hesitate to contribute to some spaces because of the mailing list hand-to-hand combat.<br/><br/>Imagine how many contributions by talented folks we are wasting! 2025-06-30T18:11:12+02:00 https://nostr.ae/nevent1qqsrxptpgj80mry3qxarc8x9wkwzedvy7dyzyy6zw38tctse5ejm3aczyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vg0snfvr In reply to <a href='/nevent1qqsqj2lclhz9vgvc7q46659n48w8svcx3k2szymmc5c6awud3fkc5tcsyacry'>nevent1q…acry</a><br/>_________________________<br/><br/>gee, trying new ideas for open source maintenance sustainability, I should consider trying that 2025-06-23T00:41:14+02:00 https://nostr.ae/nevent1qqsdjvh5tjp6m3essua6qvgzlnu3f4ym5jvr7xa6tk5u0qsy3hj0v6gzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgnxlh6u In reply to <a href='/nevent1qqsfd342rfa4u80vnd4lpqyjuh6tytjf00ejg4ac077dw2u6fqtarkqrp0jef'>nevent1q…0jef</a><br/>_________________________<br/><br/>it’s not so black and white. If you are an unpaid maintainer you have no obligation to put in extra work, for sure. But if you do take down the banking system of a country once (still not your fault!) and people tell you your library is broken… I think you start having a responsibility to either deprecate it, fix it, or at least warn users. We live in a society. 2025-06-21T23:22:02+02:00 https://nostr.ae/nevent1qqsptp0z6ye6muqn6s54vf47pry9t7srxu72cu08haxaa9zydv4rquczyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgjeuk6s Looks like the same poorly implemented Android CT library that broke a lot of apps a couple years ago... did it again 🤦‍♂️<br/><br/><a href="https://github.com/appmattus/certificatetransparency/issues/143#issuecomment-2993688741">https://github.com/appmattus/certificatetransparency/issues/143#issuecomment-2993688741</a> 2025-06-21T20:29:26+02:00 https://nostr.ae/nevent1qqsf2488ftrhgavmv42gldct0l5qgl4wj7rfmnqxwtesd7qpgwx4weqzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vg5q8gvs The Sketch blog has become the one thing you need to read—along with <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1gv26rplqyjqcfyhxryuqjwaxs0dwve3y6gpv6smn3hjm3wse3s8squtlwl" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Simon Willison</span> (<span class="italic">npub1gv2…tlwl</span>)</a></span>—to keep the pulse of LLM-assisted development.<br/><br/>Senior engineers putting in the work and giving no-bullshit perspectives.<br/><br/>Read this one by <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1zlv43zfyah2arh89x0d67gh7xlep4lm9u6ggvw2sje6c95aravtq0hlytv" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>David Crawshaw</span> (<span class="italic">npub1zlv…lytv</span>)</a></span> through. Not skim. Not half. Especially if you are a skeptic.<br/><br/><a href="https://sketch.dev/blog/programming-with-agents">https://sketch.dev/blog/programming-with-agents</a> 2025-06-09T11:52:45+02:00 https://nostr.ae/nevent1qqsylrsfwkuyvuez2gey3h2yd2rglukfcgj7nkz7dc9acz7q5djgy9szyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vg88mgty Another nice use case for Fetch Metadata headers (which we used for anti-CSRF in the last episode): server-side analytics.<br/><br/>On the client-side, any rendered HTML is a browser pageview, but on the server-side how do you tell pageviews from API calls from resource loads?<br/><br/>Sec-Fetch-Mode: navigate!<br/><br/><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Sec-Fetch-Mode">https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Sec-Fetch-Mode</a> <br/><br/>I&#39;m a fan of server-side analytics because they are more accurate, they don&#39;t waste client resources, and let you also count things like redirect URLs pointing to other sites. 2025-06-07T23:11:08+02:00 https://nostr.ae/nevent1qqsx0kh9lcee95cd4jh9llnsf34quxsph4dtp0cyf4hzwnz0qv6cu9gzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vg7dp6s2 Fascinating retrospective read on an iOS exploit, but the most interesting part might be the Aftermath section.<br/><br/>Apparently Apple shifted gears with iOS 14 and started implementing deep mitigations, which despite not perfect really changed the game.<br/><br/><a href="https://blog.siguza.net/tachy0n/#:~:text=4.-,Aftermath">https://blog.siguza.net/tachy0n/#:~:text=4.-,Aftermath</a> 2025-05-25T13:32:29+02:00 https://nostr.ae/nevent1qqstrz2579ha030f8yz8wmgck9d9xxj5tp7aqnd0dch92hmffqzzl2gzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgt4vugh If Certificate Transparency logs were available as torrents, would you help seeding them?<br/><br/>If so, with how much storage and with what client?<br/><br/>I’m not sure how we’d update the torrent as the log grows. Does BEP 38 deduplication work with RSS feeds? 2025-05-21T00:08:34+02:00 https://nostr.ae/nevent1qqsrp50w98pshfn7yqm3ahe0ljyzljwsd705eu70tac04cawtf4zfpqzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgdar8nq Three Trail of Bits engineers audited the core Go cryptography packages for a month, and found only one low-sev security issue... in the legacy unsupported Go+BoringCrypto integration we&#39;re replacing! 🍾 <br/><br/>Years of team efforts on testing, limiting complexity, safe APIs, and readability have paid off! ✨ <br/><br/>Yes I am taking a victory lap. No I am not sorry. 🏆<br/><br/><a href="https://go.dev/blog/tob-crypto-audit">https://go.dev/blog/tob-crypto-audit</a> 2025-05-19T21:07:59+02:00 https://nostr.ae/nevent1qqs83ty9cxz4w3u6mdv48z4xlmssge4xjf6wchq853ceel5ztm9uceqzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgdld7me The AWS team published a key-committing variant of XAES (<a href="https://words.filippo.io/xaes-256-gcm/">https://words.filippo.io/xaes-256-gcm/</a>)!<br/><br/>Still FIPS-compliant, and with a proof.<br/><br/>Key commitment ensures the ciphertext can only be decrypted with one key, to avoid issues in higher-level protocols.<br/><br/><a href="https://eprint.iacr.org/2025/758.pdf">https://eprint.iacr.org/2025/758.pdf</a> 2025-05-08T14:01:25+02:00 https://nostr.ae/nevent1qqsdgl2yc46k0ve2dxdmx45a2rf4m8fzzxewtn6nwhwlekcw4j03kjgzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgctu029 Running a full-network Bluesky relay costs less ($19) than my beefy but ~single user Mastodon hosted instance ($24).<br/><br/>People underestimate how much data optimized software can move through efficient protocols on modern non-cloud hardware.<br/><br/><a href="https://whtwnd.com/bnewbold.net/3lo7a2a4qxg2l">https://whtwnd.com/bnewbold.net/3lo7a2a4qxg2l</a> 2025-05-02T23:36:51+02:00 https://nostr.ae/nevent1qqsdpgp53f7lzhjlvqj4z8nvhtkthshv2qxn06ywcwcma95xq8wtvgczyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgtt7wz8 In reply to <a href='/nevent1qqsdgl2yc46k0ve2dxdmx45a2rf4m8fzzxewtn6nwhwlekcw4j03kjg08e0ak'>nevent1q…e0ak</a><br/>_________________________<br/><br/>The relay is the supposedly centralized part of Bluesky because “too big” to run! $19/month!<br/><br/>The bsky.app AppView is bigger but every Mastodon instance is an AppView (and PDS), and if you were ok with Mastodon-style partial views of the network, AppViews would be cheap too. 2025-05-02T23:36:51+02:00 https://nostr.ae/nevent1qqsdjpluh2z5vfe57ym8tff30t93eumauxska2zrjr0344q6v3lfhqczyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vg3cvllj Here&#39;s something counterintuitive to non-practitioners: curve P-521 is often less secure in practice than curve P-256.<br/><br/>The latter is more popular, and so better tested. The risk of implementation bugs dwarfs the risk of partial cryptanalysis of ECC, so picking P-521 optimizes for the wrong thing. 2025-05-01T19:40:27+02:00 https://nostr.ae/nevent1qqs9h4jutgm3qcde8akra2get0ym0lf4gkgyjzxnnl7k5jvdu8ekfhgzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgshj695 I am writing an application that really cares about durability of created files (a Certificate Transparency log), and... oof.<br/><br/>I fsync the file. I fsync the directory. Ok.<br/><br/>But... how do I test it? Even targeting a specific filesystem, I have to make VMs and try to race killing them? 2025-04-22T11:17:16+02:00 https://nostr.ae/nevent1qqsd29l7m56e0dzpcwu2vnc533n0leapwmvt72hyc0cxz8kfcmcpvzszyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgxzryza Oof. Reportedly, if you got a certificate from SSL.com by putting “example[@]gmail.com” at _validation-contactemail.example.com, they would add gmail.com (!!!) to your verified domains.<br/><br/>A good reminder to use the CAA record, and to sign up for CT monitoring (e.g. Cert Spotter).<br/><br/><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1961406">https://bugzilla.mozilla.org/show_bug.cgi?id=1961406</a> 2025-04-19T12:30:45+02:00 https://nostr.ae/nevent1qqsgncu8vvfpwt8kyxc0f76dmu0qxmrkeqa24qgd8vcnxjtpwht3m6gzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgpqzv7k OpenSSH 10.0 (a regular bump from 9.9) is out, and it makes the post-quantum ML-KEM hybrid mlkem768x25519-sha256 the default. <a href="https://www.openssh.com/txt/release-10.0">https://www.openssh.com/txt/release-10.0</a><br/><br/>The next release of x/crypto/ssh will support it, too, when used with Go 1.24, making SSH sessions quantum resistant! ⛓️ <a href="https://go.dev/cl/646075">https://go.dev/cl/646075</a> 2025-04-10T11:57:50+02:00 https://nostr.ae/nevent1qqsd0j73kykmw75cly9r4z79jz07w0rkjp74g5ckvppz9zjgh7c4fxgzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vg94ndfu It’s disheartening to see AI reactionism lead my community to a 180° on copyright.<br/><br/>Everyone is merrily attacking LibGen now. If it didn’t exist, big tech companies would still find training data, it just wouldn’t be accessible to regular people. 2025-03-21T10:22:48+01:00 https://nostr.ae/nevent1qqst8e4wsqpylajuukxyjtzrnllgn3a9p7u7v96ms6kywts2ezqdn0czyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgyfrza3 Would you pay for Cryptography Dispatches? I am considering using Buttondown&#39;s new per-email subscriptions to trick myself into writing more in 2025.<br/><br/>This would be voluntary. Max 1–3 issues per month.<br/><br/>There would be no subscriber-only issues. What you get for your money is motivating me to write more, if that&#39;s something you like.<br/><br/>Conversely, this would not be a major source of income. What I get out of it is tricking my brain into doing more writing by setting up a reward system. 2024-12-11T20:12:39+01:00 https://nostr.ae/nevent1qqswkr9u7pzm8e5yc38g4pu0c68j9sek0l68hq2rqfa64ah6e80earqzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgyr9ah3 I wrote up how my NAS is now just a big initramfs based on Alpine Linux.<br/><br/>It&#39;s been pretty great. Immutable, declarative, and very very simple. Just some files, a list of packages, and a short script.<br/><br/>Turns out you don&#39;t need overlays, or special DSLs.<br/><br/><a href="https://words.filippo.io/dispatches/frood/?source=Mastodon">https://words.filippo.io/dispatches/frood/?source=Mastodon</a> 2024-12-05T22:30:22+01:00 https://nostr.ae/nevent1qqsdvk5kqe27u0t3v3zsnpl4hahwyas2f2an4mdma2awtgnr48j9ywgzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgw5myd3 In reply to <a href='/nevent1qqsduau5c7uym6udddr3y4lrxhavs9kdlzm2tm44hplahehylh2d5mq9qvccq'>nevent1q…vccq</a><br/>_________________________<br/><br/>only when you poll it though, right? And here I would only query it manually. 2024-11-23T15:16:29+01:00 https://nostr.ae/nevent1qqsfzdthkzqeycpgs39d56mj23sp4dmxd4pep29huqh9n0r5nev2fagzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vggm3m4l In reply to <a href='/nevent1qqsdlmz9pp369zjrd42gv9atns2exuy40rsvz929lgr7hswmudtfd6c9ftgeh'>nevent1q…tgeh</a><br/>_________________________<br/><br/>Hmm, it occurs to me that what I need is probably all in node_exporter already. Is there such a thing as a web UI for instantaneous Prometheus metrics?<br/><br/>i.e. a web service that just does a single poll of a Prometheus endpoint, and shows you the current values of the available metrics, with no history.<br/><br/>Hell, maybe even a CLI that I point to the remote Prometheus endpoint. 2024-11-23T15:11:56+01:00 https://nostr.ae/nevent1qqsdlmz9pp369zjrd42gv9atns2exuy40rsvz929lgr7hswmudtfd6czyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgxwn32s Is there an open-source web UI for servers that displays system information like pstree, zpool status, fdisk -l, df, ip addr, etc?<br/><br/>I want it to just show current info about the machine it&#39;s running on, not rely on a metrics pipeline.<br/><br/>Ideally it would be read-only, extensible, and a single-binary Go program, or something as simple to deploy. 2024-11-23T14:52:05+01:00 https://nostr.ae/nevent1qqsxeap0zk33pne4u4e9hrx8hs6shmt3vdtx9yf0sa2dklh05hlahvszyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgncafp8 &#34;On behalf of the WordPress security team, ...&#34; and then many mentions of &#34;fixing a security issue&#34; without specifying what it is. (The patch is, presumably, public since the plugin is OSS and PHP?)<br/><br/><a href="https://wordpress.org/news/2024/10/secure-custom-fields/">https://wordpress.org/news/2024/10/secure-custom-fields/</a><br/><br/>I don&#39;t have an opinion on the broader Wordpress situation, but seeing a security exception used to wield power in a broader controversy is extremely worrying.<br/><br/>Open source communities trust security teams with exceptional powers, and weakening that trust damages everyone. 2024-10-12T22:12:39+02:00 https://nostr.ae/nevent1qqstzmjaa0p4cv6ak65wuj5kp4qzk7j74v6tqjq0quldhe8nmuj8dvczyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgcgwkva Cat&#39;s out of the bag: I am pursuing a native FIPS 140-3 validation for the Go standard library.<br/><br/>Trying to do it right, making it seamless and without compromising on security.<br/><br/>First time a Go module is validated. Wish me well. And consider sponsoring!<br/><br/><a href="https://go.dev/issue/69536">https://go.dev/issue/69536</a> 2024-09-19T17:03:10+02:00 https://nostr.ae/nevent1qqs0dxq0cywqxyls99jk2ewdqxxf5k68dq9mucx5wayj3yjetskpfqszyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgv0tuul Oh shit the vDSO implementation of getrandom() landed in Linux 6.11.<br/><br/>Might remove one of the last performance objections ot using the kernel CSPRNG for everything, the syscall overhead.<br/><br/>I have a large CL chain for crypto/rand, might as well add support for that... 2024-09-16T15:35:58+02:00 https://nostr.ae/nevent1qqs9dx5m2mln0zkee9369euqf8qw0je8n92p9lejtpcx26e6t2mnpjszyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgj5ctl0 I use restic to backup my MacBook but I increasingly feel like it&#39;s not integrated enough into the system. For example it doesn&#39;t use APFS snapshots to make atomic backups, and doesn&#39;t download missing iCloud documents.<br/><br/>Are there robust solutions to all this? Happy to pay for commercial solutions but I would like to still end up with plain restic backups. 2024-09-15T16:58:59+02:00 https://nostr.ae/nevent1qqs2p9rwp77wjku458ezvwcdm3yu3z4h42htwcum6fw2zvz6t075jqszyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vg3tvr5h I would like to pay $250, or $500 to a 501(c)(3) of your choice, for anyone to update the Dash for macOS [1] RFC docset [2]. See [3]. Any takers?<br/><br/>EDIT: Done! <a href="https://s.waq.dk/@Tenzer/113124619204569421">https://s.waq.dk/@Tenzer/113124619204569421</a><br/><br/>[1]: <a href="https://kapeli.com/dash">https://kapeli.com/dash</a><br/>[2]: <a href="https://github.com/Kapeli/Dash-User-Contributions/tree/master/docsets/RFCs">https://github.com/Kapeli/Dash-User-Contributions/tree/master/docsets/RFCs</a><br/>[3]: <a href="https://github.com/willnorris/rfcdash/issues/10">https://github.com/willnorris/rfcdash/issues/10</a> 2024-09-12T11:04:30+02:00 https://nostr.ae/nevent1qqsfmz554x9mw7hykmd8gwmd54c768l3tzd8mpvz5urrwtk9nkfu4yqzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vg7pjj7j Hey all, I turned 30 this week! 🎈<br/><br/>I feel a bit weird asking for a &#34;present&#34; but if my code, writing, or talks reached you over the years, I would love to receive a postcard from wherever you live 📮<br/><br/>Open source is deeply rewarding, but sometimes I miss a physical reminder of the people on the other side of the wire ✨<br/><br/>Also, if you mention in the card making a donation to a US 501(c)(3) that aligns with my values, I will match it!<br/><br/>Mailing addresses, both US and EU: <a href="https://filippo.io/#addresses">https://filippo.io/#addresses</a><br/> <img src="https://cdn.masto.host/abyssdomainexpert/media_attachments/files/113/090/223/920/873/152/original/56b10982413b7a3d.png"> <br/> 2024-09-06T13:07:14+02:00 https://nostr.ae/nevent1qqsde7dx3u2jypzd3dzjyaz455uq2v4afqa8d99nd56r2pzj4g0wnyszyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vg0aeljx A couple notes about the Infineon timing side channel affecting most YubiKeys.<br/><br/>1. yubikey-agent is unaffected in the evil maid threat model as the attacker needs physical access *and PIN*<br/><br/>2. lol, Infineon<br/><br/>3. Go mitigates timing side-channels in ECDSA nonce inversion by not being clever and just using Fermat&#39;s little theorem, which is as simple as a constant time exponentiation by p - 2 (which can be optimized with <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub18qvc5gvnn04pk9g5cwksjqdadfrhk63f04rkndcr0a27778q7mjq4cvtfq" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Michael McLoughlin</span> (<span class="italic">npub18qv…vtfq</span>)</a></span>&#39;s addchain)<br/><br/><a href="https://ninjalab.io/eucleak/">https://ninjalab.io/eucleak/</a><br/><a href="https://www.yubico.com/support/security-advisories/ysa-2024-03/">https://www.yubico.com/support/security-advisories/ysa-2024-03/</a> 2024-09-03T18:44:40+02:00 https://nostr.ae/nevent1qqswcuq8xk856xmvdazed4uas2zhdgdtphwq834aqk3s82e2zjg49wczyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgyxx45a In reply to <a href='/nevent1qqsgsw5w87w9uvfmqvp3e7tkg0jedwuf4at9p4kqu0ynv6ur5c56asck8gfuc'>nevent1q…gfuc</a><br/>_________________________<br/><br/>pq key exchange is urgent because of store-now-decrypt-later, pq auth is not, it makes sense 2024-08-06T00:35:26+02:00 https://nostr.ae/nevent1qqsymzemg0jdvj0zxf3lg6f3q3jw47mn6a3yskxampvag8nmdhz7hngzyzgfdahp5pkufahdxy6cax2wn2ewk35r8d05tgvqtv5nqsf2s97vgtzj5sa In reply to <a href='/nevent1qqs0ug6jrdmsj2htxrnzvvllj680k2qlw8kwkapljy5geezwu34j4jczjz9jg'>nevent1q…z9jg</a><br/>_________________________<br/><br/>I’d argue PuTTY is just wrong. No one should use DSA keys, Ed448 is mostly unimplemented, and what does EdDSA even mean as a separate option. 2024-08-06T00:19:49+02:00