cpu

wrote a little about the (now old news) security events of last week

My mind has been fully boggled since ~yesterday afternoon and it's lovely to have the world catch up.

👩🏽‍🔬 Go 1.27.3 and 1.26.10 are released! 🔐 Security: Includes 1 security fixes to the standard library. 🗣 Announcement: https://groups.google.com/g/golang-announce/c/66pojueaQek/m/tmWX2Pq9AgAJ 📦 Download: https://go.dev/dl/#go1.27.3 #golang

This past Weds at #rustconf, Joe Birr-Pixton and Daniel McCarney shared an update on the Rustls project 10 years in! Don't miss this write-up from Joe that captures some of what they covered onstage. Congrats on such a long run of this important project, Rustls! rustfoundation.org/media/guest-...

📢 Session: "A Decade of Rustls": update from maintainers @jbp.io & Daniel McCarney at #rustconf! 10 years in, what's next for one of Rust's most widely used TLS libs? 🎟️: rustconf.com/register?utm_source=rustconf_x&utm_medium=social&utm_campaign=week_july20 rustconf2026.sched.com/event/2KHyL/...

I don't get why anybody is listening to Jacob Applebaum. My cat has about the same expertise in cryptography, and has never been credibly accused of sexual abuse. She's also a lot cuter.

We're making good progress on upki, our collaboration with the rustls project to bring browser-grade web PKI capabilities to low level system utilities. #Canonical made a PPA available so you can try out upki in #Ubuntu. Give it a go and let us know! discourse.ubuntu.com/t/try-the-up...

@jbp.io and I will be presenting on our upki project to make TLS certificate verification more secure for non-browser Linux apps.

At #rustweek I'll have new stickers celebrating a decade of rustls. First commit was ten years ago tomorrow

If you'd like, you can buy rebrands and listed OEs from us. However, you don't have to! Our cert has one of the broadest list of tested OEs of the industry, and you can just use it with stock Go 1.24+ and GOFIPS140=v1.0.0, courtesy of Geomys. The point was removing this roadblock to Go adoption.

A bit over two years after starting to work on it... Go is officially FIPS 140-3 certified 💥 csrc.nist.gov/projects/cry... I am pretty confident Go is now one of the most—if not the most—seamless and complete FIPS 140-3 compliance solutions... with a single env var, out of the box.

New Blog post: "Multiple things can be true at the same time" - frederikbraun.de/feels-and-ll... Dear reader, I am sure you have read a lot of blog posts about AI in the past weeks or months. This is my post.…

I wrote a blog post for the Alpha Omega Foundation on the work I did to surface RustSec advisories on crates.io: alpha-omega.dev/blog/surfaci...

@filippo.abyssdomain.expert plugs Wycheproof test vectors github.com/C2SP/wychepr... #realworldcrypto

did something very silly, may have some at gophercon this year if you ever sent us a vulnerability report or contributed to Go crypto (or are just nice to me) thanks to @ljamesart.bsky.social who did the great art!

With the @openuk.bsky.social Awards coming up, we’re excited that Rustls — a memory-safe TLS library — is shortlisted in two categories, and Creator Joe Birr-Pixton is also recognized individually. The Rust Foundation is proud to support Rustls through the Rust Innovation Lab 🧡

In August I delivered my traditional Go Cryptography State of the Union talk at @gophercon.com in New York. It goes into everything at the intersection of Go and cryptography from the last year. (Also, bragging t-shirts!) Watch the video or read the transcript of my performance review!

Maintaining #Rustls isn’t just code — it’s choices. Dirkjan shared how OSS maintainers balance safety vs. niche flexibility and why API instability or incompatibility can ripple across the ecosystem. Full story at netstack.fm/#episode-7

We have a little blog post about this rustls.dev/blog/2025-09...

we lived

PowerDNS Recursor 5.3.0 has a nice note in the changelog: > The embedded webserver used to display the status page and process REST API calls has been rewritten in Rust and now supports multiple listen addresses and TLS. The new code is powered by Hyper+Rustls+Ring 🦀 🔒 (h/t Stefan Schmidt)

TIL the B root servers have deployed experimental DoT support for TLS on the recursor -> auth. server leg: b.root-servers.org/research/tls...

TIL that the ITU has an annual "X.509 Day", wheeee www.itu.int/md/T25-TSB-C...

We announced the new native Go FIPS 140-3 mode today! FIPS 140, like it or not, is often a requirement, and I was increasingly sad about large deployments replacing the Go crypto packages with non-memory safe cgo bindings. Go is now one of the easiest and most secure ways to build under FIPS 140.

Today we released rustls 0.23.29 crates.io/crates/rustl... -- highlights are better error reporting for unsupported signature algorithms in certificates, and quite a few performance improvements (via a set of changes that started almost 2 years ago!)

Pretty excited about the release of instant-acme 0.8, with lots of work from @cpu.xkeyscore.club (who joined as a maintainer) on ARI, profiles, integration testing and a much improved API. github.com/djc/instant-...

You love to see it.

I don't think they post here, but excited to be talking about what the Go Security team does, and why (hopefully) you don't hear much about us, at GopherCon UK in August.

IP address certificate subjects are coming to Let's Encrypt SOON™: community.letsencrypt.org/t/getting-re... The groundwork for this was started ~2020 so it's extremely cool to see it coming to fruition !

Harsh but fair

Wrote some notes on self-hosting an Atuin sync server and getting to it via Tailscale hackd.net/posts/atuin-...

‪*slaps roof of libcrypto* this bad boy can fit so much global mutable state inside it!‬

Had a gig wrap up a little earlier than expected, I should have availability starting July or so. As always: if you need help with Embedded, Rust, or similar things, shoot me a message! If you're a user of postcard, p-rpc, or are interested in the more experimental new ergot: shoot me a message!

I implore folks to apply a better theory of the mind than "they dumb or evil" to experienced Chrome engineers entrusted with the security of 3.5B people. You can still disagree! But if you can't articulate their technical motivations, please pause for a second and consider you might be missing it.

🎉 Go 1.25 Release Candidate 1 is released! 🏃‍♀️ Run it in dev! Run it in prod! File bugs! go.dev/issue/new 📢 Announcement: groups.google.com/g/golang-ann... 📦 Download: go.dev/dl/#go1.25rc1

Here's my talk on Graviola -- youtu.be/n6gA93iSj68

In case you missed it, here’s the second in-depth interview with open source maintainer Stefan Eissing @icing.bsky.social from the first cohort of the Sovereign Tech Fellowship. Stefan has been building connections since the days of dial-up modems. (1/2)

Whenever I get self conscious about naming libraries silly things, I remind myself that Arm (the acorn risc machine) released the ARM (architecture reference manual) for their A/R/M (application/realtime/microcontroller) processors, making the document the Arm A/R/M ARM.

Woodfrogs are great. i) they can survive -6°C temps and having 60% of the water in their bodies freeze ii) they have kvlt face paint I rest my case

It's been a minute 🫠

The "L" key on my keyboard has been dropping keystrokes ately and you can probably te from the mess of typos ike this I'm eaving everywhere in my wake