David Adrian
@dadrian.io
📤 572
📥 98
📝 245
Used to do TLS, still kind of do TLS. PM at Chrome Security. Founded Censys.
@scwpod.bsky.social
I poked around with
@exe.dev
some, and wrote up how I think their Github integration works, because it's pretty cool.
dadrian.io/blog/posts/e...
loading . . .
Proxies all the way down.
A couple of days ago, exe.dev raised a lot of money1. I decided to poke around with it a little, and signed up. Their trial is 7 days long, so despite having no actual plans, I just started doing stuf...
https://dadrian.io/blog/posts/exe-github/
6 days ago
0
3
0
reposted by
David Adrian
Ethan (not that Ethan)
12 days ago
Dad’s home $1 for every attendee of 13-10
#charitibundibowl
@newap-georgia.bsky.social
67
505
156
reposted by
David Adrian
Thomas Ptacek
about 1 month ago
I wrote something:
sockpuppet.org/blog/2026/03...
loading . . .
Vulnerability Research Is Cooked
https://sockpuppet.org/blog/2026/03/30/vulnerability-research-is-cooked/
7
93
47
reposted by
David Adrian
Security Cryptography Whatever
about 1 month ago
NEW EPISODE! The gang learns a bitter lesson about AI and bug finding! Returning champion Nicholas Carlini is back to talk about Claude for vulnerability research.
securitycryptographywhatever.com/2026/03/25/a...
www.youtube.com/watch?v=_IDb...
loading . . .
AI Finds Vulns You Can't With Nicholas Carlini
YouTube video by Security Cryptography Whatever
https://www.youtube.com/watch?v=_IDbFLu9Ug8
2
10
4
reposted by
David Adrian
Chris Peikert
about 1 month ago
new Joy of Cryptography just dropped (feat. Post-Quantum Crypto)
1
52
9
reposted by
David Adrian
Thomas Ptacek
about 2 months ago
Extremely psyched about two upcoming SCW guests, one of them this week. We've got very crunch vulnerability research and cryptography stuff coming.
0
23
3
reposted by
David Adrian
Deirdre Connolly¹ ²
2 months ago
new Merkle Tree Cert only Chrome Quantum Root Store:
security.googleblog.com/2026/02/cult...
loading . . .
Cultivating a robust and efficient quantum-safe HTTPS
Posted by Chrome Secure Web and Networking Team Today we're announcing a new program in Chrome to make HTTPS certificates secure against ...
https://security.googleblog.com/2026/02/cultivating-robust-and-efficient.html?m=1
0
8
4
reposted by
David Adrian
Thomas Ptacek
2 months ago
None of you are giving me enough credit for not participating on the TLS working group mailing list. You're welcome. Everything I don't do, I don't do it for you.
2
26
2
Who up losing they minds on this site?
3 months ago
1
1
0
reposted by
David Adrian
Security Cryptography Whatever
3 months ago
NEW EPISODE! The maintainers of py/cryptography declared that after many years of trying to make it work, they would be moving away from OpenSSL when supporting new functionality and exploring adding other backends:
securitycryptographywhatever.com/2026/02/01/p...
www.youtube.com/watch?v=dEKB...
loading . . .
Python Cryptography Breaks Up with OpenSSL with Paul Kehrer and Alex Gaynor
YouTube video by Security Cryptography Whatever
https://www.youtube.com/watch?v=dEKBHI3rodY
5
19
7
Thinking about Curt Cignetti.
3 months ago
0
0
0
I cannot get over how impressive it is what Curt Cignetti accomplished at Indiana
4 months ago
0
1
0
Indiana shall light this holy ring, release its cleansing flame, and burn a path into the divine beyond!
add a skeleton here at some point
4 months ago
0
1
1
reposted by
David Adrian
rmhrisk
4 months ago
This is what zero-trust looks like at the infrastructure layer. Identity and encryption match the lifetime of the thing being secured. If your certificate strategy still assumes stable names and year-long validity, it is already behind reality.
letsencrypt.org/2026/01/15/6...
loading . . .
6-day and IP Address Certificates are Generally Available
Short-lived and IP address certificates are now generally available from Let’s Encrypt. These certificates are valid for 160 hours, just over six days. In order to get a short-lived certificate subscr...
https://letsencrypt.org/2026/01/15/6day-and-ip-general-availability
0
3
1
reposted by
David Adrian
Deirdre Connolly¹ ²
4 months ago
dadrian.io/blog/posts/s...
loading . . .
Stop inventorying keys.
If you have a reason to migrate to post-quantum cryptography (PQC), you should not be inventorying keys for the purpose of migration, and you should stop listening to anyone who suggests that you do s...
https://dadrian.io/blog/posts/stop-inventorying-keys/#fnref:1
0
5
4
reposted by
David Adrian
Deirdre Connolly¹ ²
4 months ago
add a skeleton here at some point
0
10
5
repent! for the day of sixteen windiana shall be upon us!
4 months ago
0
2
1
reposted by
David Adrian
Thomas Ptacek
4 months ago
Final SCW of 2025! We had Matt Bernhard on to talk about cryptographic voting systems, in the wake of the IACR election. (Everybody I voted for in the new election won! Woo!)
add a skeleton here at some point
0
9
3
reposted by
David Adrian
Joseph Lorenzo Hall, PhD
4 months ago
What a fantastic present to end the year! (swear I woke up like this)
@mbernhard.com
@durumcrustulum.com
@sockpuppet.org
@dadrian.io
@scwpod.bsky.social
1
7
1
reposted by
David Adrian
Filippo Valsorda
5 months ago
This Bernstein crap drives me up the wall because IT MAKES NO SENSE. Why would the NSA be picking weak crypto to protect US NatSec?! They have mathematicians and clusters in China, too! Dual_EC_DRBG was a NOBUS backdoor. There is NOWHERE to hide a NOBUS backdoor in ML-KEM.
6
63
6
reposted by
David Adrian
Jeff Hodges
6 months ago
Wonderful news! The kind of thing a lot of software folks across the world have been working to make possible. So stoked the Chrome folks are pushing us forward
add a skeleton here at some point
0
5
1
reposted by
David Adrian
Andrew Whalley
6 months ago
It's time to make HTTPS the web's default, and reap the full security benefit from years worth of HTTPS adoption!
security.googleblog.com/2025/10/http...
loading . . .
HTTPS by default
One year from now, with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable “Always Use Secu...
https://security.googleblog.com/2025/10/https-by-default.html
3
91
33
One year from now, Chrome will enable "Always Use Secure Connections" and warn users before plaintext HTTP by default.
loading . . .
HTTPS by default
One year from now, with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable “Always Use Secu...
https://security.googleblog.com/2025/10/https-by-default.html
6 months ago
0
16
9
Iowa-Rutgers hitting the over? Trump ruined the B1G West.
8 months ago
0
0
0
New post! Stop trying to solve revocation, we already have the answer.
dadrian.io/blog/posts/r...
loading . . .
Revocation ain't no thang.
Adam Langley wrote about how revocation in the Web PKI doesn’t work over 10 years ago. Since then, the Web PKI has drastically changed for the better, despite not appearing to “solve” revocation. Unfo...
https://dadrian.io/blog/posts/revocation-aint-no-thang/
8 months ago
0
4
3
Kirk Herbstreit is going to be the first person to make a Golden Retriever unlikable.
8 months ago
0
1
1
reposted by
David Adrian
rmhrisk
8 months ago
The bigger issue? Microsoft’s root program still trusts this CA, leaving Edge and Windows users exposed in ways Chrome, Firefox, and Safari users aren’t. The pattern is familiar: long-lived trust, weak oversight, systemic risk. It’s time for Microsoft to step up and fund proper root governance. 👇
loading . . .
Another Sleeping Giant: Microsoft’s Root Program and the 1.1.1.1 Certificate Slip | UNMITIGATED RISK
https://unmitigatedrisk.com/?p=1092
2
3
1
If you look closely, you can see UNC’s quarterback is not Tom Brady
8 months ago
1
3
1
reposted by
David Adrian
Matt Bernhard
8 months ago
This game has me feeling like I'm watching Iowa play Iowa.
0
2
1
Sent this to a girl in California and pretty sure she thinks it’s in another language
add a skeleton here at some point
8 months ago
1
2
0
Come for the PGP dunks, stay for the broader discussion of why encrypted email doesn’t make sense
add a skeleton here at some point
9 months ago
0
12
7
reposted by
David Adrian
Simon Fondrie-Teitler
9 months ago
The first part of this interview with my ex-colleague Alex is a great listen if you're a software engineer (or otherwise technical) and are interested in what we were working on as technologists at the Federal Trade Commission.
add a skeleton here at some point
0
3
2
reposted by
David Adrian
Security Cryptography Whatever
9 months ago
NEW EPISODE! An OpenPGP.js bug gave us an excuse to tear encrypted email via PGP to shreds. William Woodruff joined us to explain the vuln & indulge our gnashing of teeth on why email was never meant to be encrypted:
securitycryptographywhatever.com/2025/08/22/s...
www.youtube.com/watch?v=IoL3...
loading . . .
Stop Using Encrypted Email with William Woodruff
YouTube video by Security Cryptography Whatever
https://www.youtube.com/watch?v=IoL3LfIozJo
2
21
14
reposted by
David Adrian
Security Cryptography Whatever
9 months ago
NEW EPISODE! We chat with friend of the pod and special guest Alex Gaynor, former deputy chief technologist at the FTC and all around good Security Person™. Join for nerdery about WebAuthn, stay for accidentally melting down GitHub APIs around November 2020!
youtu.be/gBoGvyvsSi4
loading . . .
Alex Gaynor
YouTube video by Security Cryptography Whatever
https://youtu.be/gBoGvyvsSi4
0
4
3
And then there’s David.
add a skeleton here at some point
9 months ago
0
3
0
figma balls
9 months ago
0
1
0
reposted by
David Adrian
Security Cryptography Whatever
9 months ago
New episode! Come to SCWPodCon, sponsored by Teleport!
www.youtube.com/watch?v=tbnh...
loading . . .
Vegas, Baby!
YouTube video by Security Cryptography Whatever
https://www.youtube.com/watch?v=tbnhsmRZniI
1
0
3
reposted by
David Adrian
brandon
10 months ago
🫡 go blue
www.michigandaily.com/opinion/edit...
#a2council
loading . . .
From The Daily: Vote yes on Ann Arbor proposals A and B
This Editorial Board endorses these proposals and believes that the development of this new, multi-use structure would offer many new opportunities to the Ann Arbor District Library and the greater lo...
https://www.michigandaily.com/opinion/editorials/from-the-daily-vote-yes-on-ann-arbor-proposals-a-and-b/
1
29
5
reposted by
David Adrian
Deirdre Connolly¹ ²
10 months ago
pew pew pew
www.youtube.com/watch?v=vtt8...
loading . . .
This Quantum Attack Is Live Now
YouTube video by Deirdre Connolly
https://www.youtube.com/watch?v=vtt8js8uA78
0
8
4
Just posted a deep dive on how Chrome integrates with Advanced Protection Mode on Android.
security.googleblog.com/2025/07/adva...
loading . . .
Advancing Protection in Chrome on Android
Posted by David Adrian, Javier Castro & Peter Kotwicz, Chrome Security Team Android recently announced Advanced Protection , which extend...
https://security.googleblog.com/2025/07/advancing-protection-in-chrome-on.html
10 months ago
0
1
1
Wrote some words about memory safety and JITs. Basically, there are things we want out of hardware, but it's not MTE and it still involves migrating to memory safe languages
dadrian.io/blog/posts/m...
loading . . .
Sandboxes? In my process? It's more likely than you think.
Discussions around memory safety often focus on choice of language, and how the language can provide memory safety guarantees. Unfortunately, choosing a language is a decision made at the start of a p...
https://dadrian.io/blog/posts/memory-safety-and-sandboxes/
10 months ago
0
4
3
reposted by
David Adrian
Electronic Frontier Foundation
10 months ago
We’re not yet sure exactly what quantum computing can do yet, and that’s exactly why we need to think about post-quantum cryptography now,
@durumcrustulum.com
tells EFF’s Cindy Cohn and
@thejasonkelley.com
on the new episode of “How to Fix the Internet."
loading . . .
Podcast Episode: Cryptography Makes a Post-Quantum Leap
The cryptography that protects our privacy and security online relies on the fact that even the strongest computers will take essentially forever to do certain tasks, like factoring prime numbers and ...
https://www.eff.org/deeplinks/2025/06/podcast-episode-cryptography-makes-post-quantum-leap
2
42
10
Guide for
#a2council
to just do things— Step 1: Ask
@sstrudeau.bsky.social
and
@akgood.bsky.social
what rules to get rid of. Step 2. Get rid of those rules.
add a skeleton here at some point
10 months ago
0
7
0
If
#a2council
would have just done things, instead of wasting time with an expensive and useless comprehensive land use plan, then John U. Bacon wouldn’t be able to post boomer misinformation about it.
10 months ago
4
16
4
reposted by
David Adrian
Security Cryptography Whatever
11 months ago
Still have one more slot for a sponsor for our annual Vegas event, poke
@dadrian.io
if you have money.
0
1
2
There is literally a machine that does your laundry.
add a skeleton here at some point
11 months ago
3
8
3
reposted by
David Adrian
Ethan (not that Ethan)
11 months ago
More like Santa Ono! Disaster! What a bad idea!
add a skeleton here at some point
0
7
1
reposted by
David Adrian
Thomas Ptacek
11 months ago
Sophie Schmieg + ayahuasca =
keymaterial.net/2025/05/23/t...
loading . . .
There is no Diffie-Hellman but Elliptic Curve Diffie-Hellman
When I first learned about Diffie-Hellman and especially elliptic curve Diffie-Hellman, I had one rather obvious question: Why elliptic curves? Why use this strange group that seems rather arbitrar…
https://keymaterial.net/2025/05/23/there-is-no-diffie-hellman-but-elliptic-curve-diffie-hellman/
0
11
3
reposted by
David Adrian
Amy
12 months ago
Behold my favorite weird Chrome security bug of 2025 so far! A jaw-dropping URL / omnibox spoof via ligatures, specifically the googlelogo ligature.
issues.chromium.org/issues/39178...
loading . . .
Chromium
https://issues.chromium.org/issues/391788835
1
16
10
the signatures must flow.
12 months ago
1
1
0
Load more
feeds!
log in