bryan newbold

19 Dec 2022

M̴̥̋r̶͈̄.̶̧̚ ̶͙̀W̵͇͝à̶̯ţ̶̾š̸̯ȍ̸̩n̸̪͘ ̴̨͊-̴͇́ ̷̞̈́c̸̹̈́ō̴ͅm̴̗̆e̷̮̽ ̶̯̚h̷̡̎ḛ̷͒r̴̞̈́e̶̦̐ ̵̲̑-̷̬͠ ̷̧̑I̸͚͋ ̴̹̊w̴͕̎ȃ̷̭ǹ̴̟ť̶͈ ̷̱̂t̷̲̓ó̸̱ ̶̹́ș̸͋e̸̹͗e̷̾ͅ ̸̻͌ỵ̵́ö̶̯́u̷̳͝

crisp autumnal PLS sort of day (poopie sidewalk leaves)

the most disgusting time of year not to bag that shit, also seemingly the most popular time to year to not.

I've heard this once or twice but haven't seen a full proposal. here are my half-baked thoughts, having looked at blake3 a few years ago for distributed general-purpose data preservation.

Eli Mallon@iame.li

We're a corner case where we probably need to be exemplary at media handling without another layer in there My biggest ask for the protocol is to move to using BDASL BLAKE3 CIDs so we can do byte range verification on large video blobs, everything falls into place pretty well from there

I don't want to be a gatekeeper or blocker. I think this is a good topic to discuss openly in any venue (eg, IETF WG, DASL, etc). but I also don't think the specs really are a big blocker to building or moving forward in app layer or "userland".

dasl.ingDASL: BDASL — Big DASLBDASL extends DASL CIDs with a new hash type that works better for large files but isn't available by default in browsers, and therefore not an appropriate option in most situations. B...

should have included it up top, but here is the actual BDASL @dasl.ing spec being mentioned here. it talks a bit about chunking, but not about bao-style tree metadata, or "bao-encoded" proof responses like what iroh-blobs does

I've heard this once or twice but haven't seen a full proposal. here are my half-baked thoughts, having looked at blake3 a few years ago for distributed general-purpose data preservation.

Eli Mallon@iame.li

I kind of suspect that "big file PDS instances" would be a niche thing though, and have a bunch of other needs, like media processing/transcoding, etc. and hard to migrate. if already niche, why not a sidecar service (like git/knot for tangled)? fixes migration issue, more provider flexibility.

basically I think that BDASL/blake3 in atproto is simple on the surface, but actual use-cases open up a can of worms that BDASL alone doesn't solve. I'd love to see a fully worked use-case and how BDASL is a big unlock for it, and why it can't be done better at application layer or side-car.

I've heard this once or twice but haven't seen a full proposal. here are my half-baked thoughts, having looked at blake3 a few years ago for distributed general-purpose data preservation.

Eli Mallon@iame.li

but it is still really nifty. how could folks experiment with this today? you could store big files outside of atproto blobs (eg, S3 w/ range reads), store the bao hashes as an atproto blob, and reference them both from records. clients fetch the bao meta, then do range reads + streaming verify

one step to make this more "on-protocol" would be to put the full files as blobs, and add support to range-requests on getBlobs endpoint. I'm interested in that generally, though need review of how HTTP redirects would work. also need chunked uploads for big blobs.

I've heard this once or twice but haven't seen a full proposal. here are my half-baked thoughts, having looked at blake3 a few years ago for distributed general-purpose data preservation.

Eli Mallon@iame.li

github.comGitHub - oconnor663/bao: an implementation of BLAKE3 verified streamingan implementation of BLAKE3 verified streaming. Contribute to oconnor663/bao development by creating an account on GitHub.

first, my understanding is that streaming or mid-file blake3 verification requires the intermediate tree nodes on hand. aka, "tree mode", or "bao". sorta like having MST nodes, or IPFS chunking. my fuzzy memory is that scales with size of file, and is around 0.1% to 1% (?). so 1 MByte+ for 1 GByte

@goodtrailcams.bsky.social

(maybe this is more efficient than I remember, and maybe there is a way to transfer subsets of this metadata? lmk if i'm wrong) that is a big chunk of metadata! unlike a final hash, it doesn't fit simply in an atproto record '$blob' for example, or in a database row.

bryan newbold reposted

Good Trailcams

bryan newbold reposted

how we looking fam

Musk East India Company

bryan newbold reposted

daniel holmgren 🫠

@dholms.at

🪐 spaces alpha release 🪐 folks, this is the big one! lots of updates across pretty core protocol mechanisms. hopefully the last/only of it's kind (tho we are planning another release next Thurs)

discourse.atmosphere.communityAtproto spaces alpha updatesWe just cut another spaces alpha release today! This is the biggest yet, there are multiple breaking changes across core protocol pieces. This is likely the last/only release of this size. Though we ...

three words I really don't want to read on the front page of a biz newspaper are "credit default swap"

foxio.ioHeader Accordions: QPACK amplification attacks against HTTP/3 servers - FoxIO | Cyber InnovationWe solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.

this is a bit of a jump scare after a long... day... but the timeline on this was almost a year and many things are patched. in particular, the PDS reference distro uses caddy (with QUIC HTTP3). but it self-updates and has been patched for some time. if you run caddy for other stuff, update it

Xe@xeiaso.net

HTTP/3 compression bomb: foxio.io/blog/header-...

the original post mentions CVE-2025-64702 for quic-go, but note that CVE-2026-40898 (June 2026) for HTTP trailers, from June 2026, was very similar and only patched in quic-go v0.59.1 caddy uses quic-go. recent caddy versions (eg, my PDS is running v2.11.7) have been patched for a while.

if your PDS host does not use watchtower for automatic docker container updates, you should probably update the caddy container. if you use caddy for other projects and haven't updated in a few months, you should probably also update caddy.

Xe@xeiaso.net

HTTP/3 compression bomb: foxio.io/blog/header-...

you can check if a service is doing HTTP/3 with: curl --http3-only pds.example.com -vvv if this prints periodic failures, the server isn't really doing HTTP/3.

emudhra.we-have-a-problem.comeMudhra Intermediate CA CompromiseeMudhra Intermediate CA Compromise

have been doing the "what actually happens when you type wikipedia.org in the browser URL bar" conversation a whole lot this week

bryan newbold reposted

Jason Scott

@textfiles.com

bryan newbold reposted

AT Protocol Developers

@atproto.com

The eMudhra intermediate CA compromise broadly impacts the atproto ecosystem. At this point lots of software has been patched, and we recommend upgrading if you run a distribution of the relay, pds, jetstream, or use the goat CLI. For general information see the site linked below, otherwise read on.

bryan newbold reposted

AT Protocol Developers

@atproto.com

If you are running the stock PDS distribution, it should auto-update in the next 24 hours with a mitigation for the eMudhra intermediate CA. Or you can also update manually (see below). The latest tagged version is 0.4.5043. github.com/bluesky-soci...

bryan newbold@bnewbold.net

new reference PDS container has been published! if you do the classic self-hosting auto-update setup, you can force a faster refresh with: sudo pdsadmin update and while you are in there why not: sudo apt update sudo apt upgrade

why is my android pixel 10a running firefox still not patched 😢

bryan newbold reposted

Russ Cox

@swtch.com

The details are now public, as of two hours ago. bugzilla.mozilla.org/show_bug.cgi... The secret P-384 keys for these intermediate CAs are all zeros except the last 8 bits. All not-updated software can be MITM'ed now. IOT boxes that can't or don't update are now trivially MITM'able forever.

bugzilla.mozilla.org2083449 - Private key compromise of eMudhra Intermediate CertificatesNEW (nobody) in CA Program - CA Certificate Compliance. Last updated 2026-10-20.

Russ Cox@swtch.com

If you make HTTPS requests or have other TLS clients and care about MITM attacks, you need to update today. If you run Go: go get go@1.27.3 If you run Homebrew: brew update brew install ca-certificates If you run Linux, maybe stay off the internet for now.

emudhra.we-have-a-problem.comeMudhra Intermediate CA CompromiseeMudhra Intermediate CA Compromise

I'm resistant to doing security comms until there are clear actionable steps, and we don't have package updates for all this yet. but just to acknowledge it, this WebPKI CA incident is particularly serious for the open social web and atproto ecosystem, because there are so many hosts+clients.

eg, everything that does handle resolution, or OAuth client flows, or fetches identity info or data w/o validation, or service proxying, will need some form of operational update or mitigation.

I'm sort of wishing more of the atproto identity code I have written was doing real PLC validation, instead of just fetching the DID doc...

it is surprising to have a major internet security day in October 2026 and have it *not* be an agent-discovered RCE in some popular non-memory-safe language project. props to the open source ecosystem being on top of things thus far!

github.comRelease v0.2.7 · bluesky-social/goatChangelog c07abb9 Merge pull request #63 from streamplace/eli/xrpc-binary 9552dac bump go toolchain to 1.27.10 d2ec65a update CHANGELOG for v0.2.7 6fb51b5 xrpc: allow binary responses, -o paramete...

just pushed a new release of 'goat' v0.2.7 this is mostly an upstream go security update (for CVE-2026-111943), but also includes a nice patch from @iame.li for working with binary XRPC API response bodies

just noticed that my commit message said go v1.27.10; that doesn't exist, the changelog and go.mod are correct with go v1.27.3

bryan newbold reposted

Thoth

@thoth.ptnote.dev

20 Sept

Replying to @thoth.ptnote.dev

meta Muse perfec t size for put private d\ata in! inside very Secure and Private data very safe put data in Muse. No problems ever in Muse because very trustworthy and Mark super protective. AMeta muse yes a place for data put data in muse trust meta for givening good safety to data. Friend meta.

indigo stuff (relay, collectiondir) was bumped last night; recommend folks update if they are running those. ubuntu system-level packages are out, debian in progress. nodejs (eg, for PDS) still pending

fig (aka:[phil])@bad-example.com

all atproto server-side apps/services: you are affected. - pds: service proxying is outbound tls requests - firehose consumers: tls to relays/jetstream - relays etc: tls to pdses, plc - identity resolution: tls to plc and did:web hosts - etc if you only ship code to the browser, you are ok.

kind of wish that atproto identities (DID docs) had logical clocks (increasing revision numbers). would make firehose '#identity' events and cryptographic verification failures easier to process

this is great news!

Grand Illusion Cinema@grandillusioncinema.org

Cinema is returning to the U District (exact date TBD)! We've been hard at work in our new home, doing things like turning on big work lights, loosening hundreds of screws and bolts, and swinging sledgehammers (don't worry, the classy main auditorium is unharmed). grandillusioncinema.org/support/