Filippo Valsorda

leaflet.pubA social media hiatus

6 Sept

I am going write-only on social media for a bit. I'm ok! It's just not doing me or the world much good to scroll right now, and I have a mountain of really cool stuff to do. Anyway, if you see my posts with interactions restricted, this is why. You can reach me via email, Slack, or Signal.

ntppool.orgpool.ntp.org: Statistics for 2603:c020:8017:3e00::123Back to the front page

Well that's a first for me: an NTP Pool server sent a wildly wrong time, and systemd-timesyncd jumped the system time on Trastevere first forward 0.82s and then *backwards* 0.76s. Thankfully Sunlight failed safe, crashed (which fired alerts), and recovered once the clock caught up. WTF?

New superpower: a folder with the versioned md/txt of all the specs relevant to your implementation, plus an agent with a "read @specs/" instruction.

astral.shBringing uv and ty togetherExperimental uv-ty integration enables first-class support for Python scripts on the CLI and in the editor, and a unified uv check command.

This ty + uv integration for PEP 723 might definitively make Python my go-to language for scripts. No more bash at any size. astral.sh/blog/uv-ty-i...

Filippo Valsorda reposted

Andrea Barisani

@andreabarisani.bsky.social

With TamaGo you can create a bare metal POSIX kernel capable of running musl libc compiled C applications. This kernel consists of 10k LOC of pure Go code and 2k of Go Assembly. It boots 15x times faster than Linux and is shown here running busybox and redis.

The LLM model I arguably use the most, the one doing autocompletion in VS Code, seems to have gotten a lot worse. Like, giving the wrong field name for a struct defined 200 lines above. Is there a way to plug in a better model? VS Code claims it can only be GPT-4.1 (!) Codex.

emudhra.we-have-a-problem.comeMudhra Intermediate CA CompromiseeMudhra Intermediate CA Compromise

The macOS built-in curl, git, pip, python3, perl, ruby, and openssl all read /etc/ssl/cert.pem, which still has the emSign root, but they don't check revocation like Apple's Secure Transport libraries. This is, uh, a problem. git and pip especially. I added a short-term workaround to this page.

Filippo Valsorda@filippo.abyssdomain.expert

🚨 Six WebPKI Intermediate CAs are compromised. This is bigger than Heartbleed, but a client-side issue. Anything that verifies certificates against public roots, like most TLS clients, is/was affected. Details, live test, patched versions and workarounds at emudhra.we-have-a-problem.com Act now.

emudhra.we-have-a-problem.comeMudhra Intermediate CA CompromiseeMudhra Intermediate CA Compromise

emudhra.we-have-a-problem.comeMudhra Intermediate CA CompromiseeMudhra Intermediate CA Compromise

I made my test site serve a small git repo, so you can test your git client. $ git clone g3.emsign.filippo.io $ git clone aaa.emsign.filippo.io

Filippo Valsorda reposted

fig (aka:[phil])

@bad-example.com

all atproto server-side apps/services: you are affected. - pds: service proxying is outbound tls requests - firehose consumers: tls to relays/jetstream - relays etc: tls to pdses, plc - identity resolution: tls to plc and did:web hosts - etc if you only ship code to the browser, you are ok.

Filippo Valsorda@filippo.abyssdomain.expert

After the firefighting is done (and a nap) we'll need to have a long, serious conversation about the state of non-browser non-platform X.509 verifiers. The Linux status quo is "a pile of PEM files behind a dumpster" and that's not an acceptable excuse for a root store in 2026.

groups.google.comCompromised eMudhra Intermediate CertificatesDear Mozilla Community,

THIS IS NOT A DRILL. If you package/distribute/maintain root stores or chain verifiers, act immediately. If you know how to remove trust in a root, consider doing it now. Otherwise, prepare to update systems as patches/mitigations come. Go users, update to Go 1.27.3 or Go 1.26.10.

emudhra.we-have-a-problem.comeMudhra Intermediate CA CompromiseeMudhra Intermediate CA Compromise

See emudhra.we-have-a-problem.com for the list of patches and mitigations rolling out.

Filippo Valsorda@filippo.abyssdomain.expert

emudhra.we-have-a-problem.comeMudhra Intermediate CA CompromiseeMudhra Intermediate CA Compromise

emudhra.we-have-a-problem.comeMudhra Intermediate CA CompromiseeMudhra Intermediate CA Compromise

Filippo Valsorda reposted

Dirkjan Ochtman

@djc.ochtman.nl

If you’re using rustls, upgrade to rustls-webpki 0.103.16 and/or webpki-roots or webpki-root-certs 1.0.10.

Filippo Valsorda@filippo.abyssdomain.expert

Update everything that verifies certificates against public roots.

Update everything that verifies certificates against public roots.

Go@golang.org

👩🏽‍🔬 Go 1.27.3 and 1.26.10 are released! 🔐 Security: Includes 1 security fixes to the standard library. 🗣 Announcement: https://groups.google.com/g/golang-announce/c/66pojueaQek/m/tmWX2Pq9AgAJ 📦 Download: https://go.dev/dl/#go1.27.3 #golang

After 10 years, I disabled my lobste.rs account. I think it's clear I am not a culture fit anymore with whatever it is they have going on there. I feel more and more like I don't belong in almost any tech community because I believe LLM agents are real, passkeys are good, and fascism is bad.

*sigh* reading comprehension aid: LLMs / passkeys / fascism are separate axes. I am not saying passkey conspiracy theories make you a fascist. I am saying that the anti-fascist communities ended up reactionary spaces uninterested in using LLMs for good and/or believing falsehoods about passkeys.

words.filippo.ioThe NIST Elliptic Curves Seeds Bounty Has Been ClaimedWe now know how the seeds of the NIST elliptic curves were generated: they’re not the hash of some saucy sentence, but the output of drand48() seeded with the time, which was indeed in 1997–98.

Anthropic found the origin of the NIST elliptic curve seeds: they were generated with drand48()! No one was seriously worried, but this should put some FUD to rest, completing the NIST ECC rehabilitation arc… just in time to be retired in favor of PQ. Also, we raised $36 Ki for ISRG. Yay!

bipm.orgResolution 5 (2026) - BIPMSign in

No more leap seconds, ever! There isn’t one in December and they will be abolished in May. The last one will forever be the 2016(?!) one. Didn’t realize having experienced leap seconds in prod dates me. I’m not going to miss time going backwards, I’ll be honest. www.bipm.org/en/cgpm-2026...

github.comGitHub - FiloSottile/cobblestone.ts: A TypeScript implementation of Cobblestone-128 chunked encryption, available as an npm package or as a bundled .js file.A TypeScript implementation of Cobblestone-128 chunked encryption, available as an npm package or as a bundled .js file. - FiloSottile/cobblestone.ts

Cobblestone-128 chunked (aka streaming) encryption in TypeScript for Node.js 22+, Bun, Deno, and all recent browsers. One-shot, transform stream, and random access decryption APIs. Uses the Web Crypto API for AES-GCM, with fallback on the noble cryptography libraries.

filippo.iocobblestone package - filippo.io/cobblestone - Go PackagesCommon problems companies solve with Go

Written by Mythos 5.1 based on filippo.io/cobblestone, github.com/FiloSottile/..., the C2SP spec, and the Wycheproof test vectors. Reviewed by Astra and then by me, line by line. I had to prompt it to make the API more idiomatic, and otherwise do truly minimal manual changes.

I am impressed by how well this worked. Even the comments and README were 95% good. I guess that if you have 1. a reference implementation 2. another project in the same language for style transfer 3. a specification 4. test vectors you really can vibecode crypto. I suspect (1) is optional, too.

Filippo Valsorda reposted

Recurse Center

@recurse.com

❄️ Our Winter 1 Batch is accepting applications through Sunday, October 18. Come spend six or twelve weeks with us! It’s an exciting time to be building -- what could you do if given the time, space, and community to work on something that you’re really interested in? recurse.com/apply

words.filippo.io(Post-Quantum) Cryptographic Right AnswersIn the tradition started by Colin Percival and Thomas Ptacek, a set of “Cryptographic Right Answers” updated for the accelerated post-quantum transition timeline.

Publishing “Cryptographic Right Answers” for developers is a tradition by now. Colin Percival started in 2009, Thomas Ptacek followed up in 2015, and then Latacora carried on in 2018 and 2024. I put together a list updated for the renewed urgency of migrating to post-quantum algorithms.

Online backups → Restic with a long random password. Changed: I love Tarsnap, and it's doing impressively well for a 2008 design, but it relies on RSA for some of its fancier properties. Restic is boring and fully symmetric.

I'm very pleased (and mildly surprised) that at this point we have good post-quantum answers for everything, despite some unnecessary specification delays. Now we "just" need to get everything rolled out, and make Merkle Tree Certificates happen. Let’s get to work. See you in 2029.

Asymmetric signatures → ML-DSA-44 Changed: the time to deploy classical signatures has passed. Composite signatures are IMHO not worth it. Also, ML-DSA is very nice! Consider replacing signatures entirely with HMAC, a session token, or a transparency log, if appropriate.

Website or client-server application security → If in the cloud, ALB/NLB. Otherwise: rustls, Go’s crypto/tls, BoringSSL, AWS-LC, or s2n-tls with a popular ACME client. Make sure it prioritizes X25519MLKEM768. Changed: I'm not recommending OpenSSL. Be ready for Merkle Tree Certificates next year.

Key exchange → X25519+ML-KEM-768 in a secure, standard protocol. Don’t roll your own key exchange protocol. Just pick X25519MLKEM768 in TLS, mlkem768x25519-sha256 in SSH, and/or MLKEM768-X25519 in HPKE and age. If you really need to and you know what you’re doing, TLS and HPKE have “exporters”.

Asymmetric encryption → HPKE with (MLKEM768-X25519, HKDF-SHA256, AES-128-GCM), or age with PQ keys. Changed: there used to be no good answer. We have post-quantum HPKE now!

Random IDs → 32 random bytes, a.k.a. 256-bit random numbers. UUIDv4 and APIs like rand.Text will give you ~128-bit values instead, and that's usually fine, too. Use your operating system’s CSPRNG. A good library will wrap it for you.

Password handling → Argon2id or scrypt. But have you considered passkeys instead? Changed: I dropped bcrypt because the 72-byte truncation bites. Much more importantly, do you really need passwords? If you only need them for logins, could you use phishing-proof passkeys instead?

Symmetric “signatures” → HMAC-SHA-256 Good old HMAC. Just be careful about canonicalization and parser alignment bugs. Remember to compare tags with dedicated constant-time functions. Don't roll your own YoloMAC.

Hash algorithm → SHA-2 is still fine, but use a real multihash if needed. Multihashing is when you need to hash multiple things at once. For example, multiple columns of a row, or a filename along with the file contents. It’s subtler than it sounds, so use SequenceHash with SHA-2.

Encrypting data → If you’re in the cloud, KMS. Otherwise, XAES-256-GCM or XChaCha20Poly1305 with random nonces. If you’re encrypting more than a few MB, use Cobblestone-128. New: XAES-256-GCM and Cobblestone-128. The latter is necessary if you're encrypting more than a few MB, which does happen!

Symmetric key length → Don’t stress it. 256-bit keys if you need to pick. Don’t make other decisions based on this. For example, don’t go changing the default cipher suite preferences of your TLS library. Remember that Grover doesn’t actually matter and 128-bit brute-force attacks don’t exist.

leaflet.pubA social media hiatus

6 Sept

Hiatus update, one month in: I've read four Dungeon Crawler Carl books on my Xteink, like a smoker who replaces the gesture with licorice sticks. The instinct to pull up the feed has faded; by now I forget about it. Maybe I can wean off the ebook, too. I'm less angry, not sure I'm more productive.

blog.plcred.orgFirst steps of the PLC organization

🏍️🦋

Eli Mallon@iame.li

Deep @filippo.abyssdomain.expert x Bluesky lore in the PLC announcement Excited for the scene in the atproto movie where Filippo buys @pfrazee.com a nice motorcycle for some reason

Filippo Valsorda reposted

bryan newbold

@bnewbold.net

Hello World from the PLC organization (plcred.org)! The org was soft-announced back in March at AtmosphereConf. We've been working through logistics step by step and now have a public web presence we can point to.

blog.plcred.orgFirst steps of the PLC organization - Public Ledger of Credentials OrganizationOne year ago, Bluesky Social PBC announced their intention to facilitate the creation of an independent organization to operate the Public Ledger of Credenti…

I'm excited to announce that the PLC Organization now has a statute! And a bank account! And a @standard.site publication! All the important stuff. The PLC Org is an independent Swiss Association meant to operate the PLC directory, which collects and distributes signed updates to atproto accounts.

I'm really looking forward to getting the org to a place where it can provide a reliable, sustainable, and accountable service for all atproto applications out there (and maybe beyond). Also, very happy about the company I get to do this with!

The thing that worries me most lately is that many people who know that “fascism is bad, actually” have also convinced themselves that AI tools must be eschewed as fake or impure. In a self-reinforcing loop, there is relatively little AI tooling and infra by “fascism is bad” folks.

“Tech is inherently political” is not just about ideology, but about power, too. Yielding technological improvements to the adversary will have predictable outcomes. I’m really worried it will lock in power centralization in a way that will be impossibly hard to reverse. It’s already happening.

filippo.io/mldsa@v1.0.0 is now updated to the Go 1.27 implementation and API. It's also now a transparent wrapper on Go 1.27+ using type aliases, so the same program can use it alongside crypto/mldsa without issues. Essentially, it's a drop-in compatibility replacement for crypto/mldsa.

groups.google.comTuscolo2026h2 write-path degradation on August 9th

17 Sept

We got paged the other night, so now I know a lot more about ZFS internals than I ever thought I would. groups.google.com/a/chromium.o...

13 Sept

Triaged a large batch of issues found by a zkao.io scan. Some good bugs, but no vulnerabilities. (LLMs are especially bad at telling those apart.) LLMs found zero (0) vulnerabilities above SEV:LOW in Go crypto so far 💁‍♂️ 💅

13 Sept

One or two of the math/big ones would have been vulns, but we finished moving math/big out of crypto a couple years ago! 🏁

github.comCVE-2026-67276 - GitHub Advisory DatabaseRouterOS does not compare the complete RSA public key...

11 Sept

Oh damn I had not seen the details of the MicroTik RCE: the client can send a public RSA key with correct N and e = 1 and the server will use it. Two primitives/protocol things that would have prevented it: if RSA was defined with a fixed e, and if SSH clients sent a key hash instead.

10 Sept

What's the point if GitHub has unsandboxed RCEs, Hugging Face has unsandboxed RCEs, Forgejo has unsandboxed RCEs... Anyway, we gotta stop shelling out to git in security contexts.

sctdata.geomys.orgCT Log Usage DashboardMeasured by counting embedded SCTs in trusted leaf certificates, using Censys data.

9 Sept

19% of all WebPKI certificates issued yesterday included an SCT from the Geomys Tuscolo Certificate Transparency log 🤯