1
I'm giving up on PGP
After years of wrestling GnuPG with varying levels of enthusiasm, I came to the conclusion that it’s just not worth it, and I’m giving up. At least on the concept of long term PGP keys.
Filippo Valsorda
We now know how the seeds of the NIST elliptic curves were generated: they’re not the hash of some saucy sentence, but the output of drand48() seeded with the time, which was indeed in 1997–98.
- Popular posts
- 18
- Total points
- 4,082
- HN comments
- 1,634
- Rank
- #311 personal
Visit blog.filippo.io → RSS feedOn Hacker News Nov 2015 – Dec 2021
Security & Privacy 13Software Engineering 4Web & Frontend 2Tools & Productivity 2Systems & Performance 2Networking & Internet 2
2
Professional maintainers: a wake-up call
Open Source software runs the Internet, and by extension the economy. This is an undisputed fact about reality in 2021. And yet, the role of Open Source maintainer has failed to mature from a hobby into a proper profession.
3
I lost my OpenBSD full-disk encryption password
The other day I set up a new OpenBSD instance with a nice RAID array, encrypted with Full Disk Encryption. And promptly proceeded to forget part of the passphrase.
4
Rustgo: Calling Rust from Go with near-zero overhead
Go has good support for calling into assembly, and a lot of the fast cryptographic code in the stdlib is carefully optimized assembly, bringing speedups of over 20 times.
5
Securing a travel iPhone
These are dry notes I took in the process of setting up a burner iPhone SE as a secure travel device. They are roughly in setup order.
6
A Go implementation of Poly1305 that makes sense
Cryptography code could be understandable if only we commented it. This Poly1305 implementation is an attempt to prove it. It should be readable with just an idea of what MACs are for, a beginner level of Go, and high school math.
7
Self-host analytics for better privacy and accuracy
Something that always annoyed me of the current state of technology is how easy and pervasive we let tracking become. Tens of connections to 3rd parties carrying Referer and Cookies just to load an article. (We give up our users to social media websites just to show a like button that looks worse anyway in a iframe…
8
Reproducing Go binaries byte by byte
Fully reproducible builds are important because they bridge the gap between auditable open source and convenient binary artifacts. Technologies like TUF and Binary Transparency provide accountability for what binaries are shipped to users, but that’s of limited utility if there is no way (short of reverse engineering)…
9
TLS 1.2 Session Tickets
Session Tickets, specified in RFC 5077 , are a technique to resume TLS sessions by storing key material encrypted on the clients. In TLS 1.2 they speed up the handshake from two to one round-trips.
10
Finding Ticketbleed
Ticketbleed (CVE-2016-9244) is a software vulnerability in the TLS stack of certain F5 products that allows a remote attacker to extract up to 31 bytes of uninitialized memory at a time, which can contain any kind of random sensitive information, like in Heartbleed.
11
Hacking together a USB-C charger for a cheap Chromebook
The era of USB-C has come. The other day I threw all other cables into a box, and bought a set of USB-C to USB-C, Lightning, and microUSB cables. USB-C chargers around the house, USB-C PD power bank, even a nice small USB-C dock that works with the Nintendo Switch if the charger can do the right voltage. It's glorious.
12
The sad state of SMTP encryption
This is a quick recap of why I’m sad about SMTP encryption. It explains how TLS certificate verification in SMTP is useless even if you force it.
13
Shrink Go binaries 7x with this one weird trick
Ok, I lied, there’s no weird trick. However, you can easily reduce a Go binary size by more than 6 times with some flags and common tools.
14
Playing with Kernel TLS in Linux 4.13 and Go
The 1600 LoC patch allows userspace to pass the kernel the encryption keys for an established connection, making encryption happen transparently inside the kernel.
15
The scrypt parameters
The recommended scrypt parameters in the Go docs were recently brought up for discussion given they haven’t changed since 2009.
16
Restic Cryptography
tl;dr: this is not an audit and I take no responsibility for your backups, but I had a quick look at the crypto and I think I’m going to use restic for my personal backups.
17
How Plex is doing HTTPS for all its users
This week Plex , a self-hosted media server, announced that they now offer TLS to secure all connections, including those to the user’s servers. This is actually pretty interesting.
18
How the new Gmail image proxy works and what this means for you
Google recently announced that images in emails will be displayed automatically by default to Gmail users, thanks to an anonymizing proxy operated by them.