1
Turn Dependabot off
I recommend turning Dependabot off and replacing it with a pair of scheduled GitHub Actions, one running govulncheck, and the other running CI against the latest version of your dependencies.
Filippo Valsorda
We now know how the seeds of the NIST elliptic curves were generated: they’re not the hash of some saucy sentence, but the output of drand48() seeded with the time, which was indeed in 1997–98.
- Popular posts
- 26
- Total points
- 6,821
- HN comments
- 2,464
- Rank
- #137 personal
Visit words.filippo.io → RSS feedOn Hacker News Jan 2022 – Oct 2026
Security & Privacy 20Programming Languages 5Software Engineering 4Open Source 4Math & Algorithms 4Tools & Productivity 3
2
I’m now a full-time professional open source maintainer
It works! I am now a full-time independent open-source maintainer. I'm announcing my first cohort of six clients, and sharing some details of how the model works.
3
A cryptography engineer's perspective on quantum computing timelines
The risk that cryptographically-relevant quantum computers materialize within the next few years is now high enough to be dispositive, unfortunately.
4
Claude Code can debug low-level cryptography
Surprisingly (to me) Claude Code debugged my new ML-DSA implementation faster than I would have, finding the non-obvious low-level issue that was making Verify fail.
5
NIST Elliptic Curves Seeds Bounty
Announcing a $12,288 bounty (tripled to charity) for cracking the five seeds selected by the NSA in the '90s for the NIST elliptic curve standard.
6
Vulnerability reports are not special anymore
We needed the insight and confidentiality to protect our users, but now that anyone can get the same results from LLM?
7
Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys
There is no need to update symmetric key sizes as part of the post-quantum transition, due to the details of how Grover's algorithm scales. Most authorities agree.
8
Why we don’t generate elliptic curves every day
Elliptic curves are standardized, instead of being generated like Diffie-Hellman parameters. There's good reasons!
9
ssh whoami.filippo.io
I updated the whoami.filippo.io dataset! I explain how it works, and how I fetched the new data.
10
Planning Go 1.20 cryptography work
My plans for Go 1.20 include landing the crypto/ecdh package, making progress on moving math/big out of the security perimeter, and a batch of crypto/tls work.
11
Go 1.20 Cryptography
A lot of new cryptography is landing in Go 1.20, including the new crypto/ecdh package and math/big-less RSA and ECDSA backends!
12
Geomys, a blueprint for a sustainable open-source maintenance firm
Announcing Geomys, a small firm of professional maintainers with a portfolio of critical Go projects.
13
Why did the OpenSSL punycode vulnerability happen?
We look at how fuzzing should have caught the OpenSSL Punycode vulnerability, and why that code was even necessary in the first place.
14
The XAES-256-GCM extended-nonce AEAD
XAES-256-GCM is a new AEAD extended-nonce algorithm designed for high-level APIs and FIPS 140 compliance.
15
Rustgo: Calling Rust from Go with near-zero overhead (2017)
Go has good support for calling into assembly, and a lot of the fast cryptographic code in the stdlib is carefully optimized assembly, bringing speedups of over 20 times.
16
Go.sum is not a lockfile
In Go, go.mod acts as both manifest and lockfile. There is never a reason to look at go.sum.
17
Go Cryptography State of the Union
I delivered my traditional Go Cryptography State of the Union talk at GopherCon US 2025 in New York. It goes into everything that happened at the intersection of Go and cryptography over the last year.
18
The most backdoor-looking bug I’ve ever seen (2021)
This is the story of a bug that was discovered and fixed in Telegram’s self-rolled cryptographic protocol about seven years ago. The bug didn’t get any press, and no one seems to know about it, probably because it was only published in Russian.
19
Running a Certificate Transparency log
Maybe you, yes you, should run a Certificate Transparency log. It’s cheaper, easier, and more important than ever.
20
Cross-Site Request Forgery
Cross-Site Request Forgery countermeasures can be greatly simplified using request metadata provided by modern browsers.
21
I want XAES-256-GCM/11
I want the extended-nonce 256-bit reduced-rounds XAES-256-GCM/11 AEAD. It has infinitely randomizable nonces, a comfortable margin of multi-user security, and nearly the same performance as AES-128-GCM. Only issue is that it doesn’t exist.
22
A Cryptographic Near Miss
A recent issue in scalar multiplication makes for a good case study of how unsafe interfaces, undocumented assumptions, and time lead to vulnerabilities.
23
So I lost my OpenBSD FDE password (2016)
The other day I set up a new OpenBSD instance with a nice RAID array, encrypted with Full Disk Encryption. And promptly proceeded to forget part of the passphrase.
24
Encrypting files with passkeys and age
Encrypting files with passkeys, using the WebAuthn prf extension and the TypeScript age implementation.
25
How to Pay Professional Maintainers
To successfully fund Open Source projects, companies should: pay the maintainers; pay them real money; pay for maintenance; and keep paying them.
26
(Post-Quantum) Cryptographic Right Answers
In the tradition started by Colin Percival and Thomas Ptacek, a set of “Cryptographic Right Answers” updated for the accelerated post-quantum transition timeline.