How secure is the @dark.bio pipeline? Yes.

When you realise both the boomers and the zoomers got it wrong on what the real store of value is.

Me in December: Hmm, storage chips for the Ark is $50-ish. I should postpone a bit to make sure I get the correct one. Me now: WTF do you mean it's $277 ??? 😭

Ugh, today was insane. I've replaced x509 certificates with CWT attestations throughout Dark Bio. Needed to update 10 repositories in lockstep: - Rust/Go/Flutter/TypeScript crypto - Ark firmware, Ark CLI - Cloud worker, cloud CLI - Web dash, mobile app Thank you Claude

It’s time for something really dark 👀 Péter Szilágyi is gonna have is first talk about Dark Bio! 🖤 This May at ETHPrague ☀️ 🎟️ Get tickets in bio

Seems I'll be doing my first talk about Dark Bio at @ethprague.bsky.social in May this year! 🥳 No pressure... 😅

AI and the illusion of sandboxing: OpenCode: You can't access files outside this folder. Claude: Lol, hold my beer

Monday I started reworking the x509 certificate support in the Dark Bio crypto libraries. By Friday, I'm on a path of deleting the whole thing and replacing it with CWT credentials / attestations. Wild week... 🥲 🧵

🙈

I have received the biggest bribe ever to switch back from Rust to Go 🥰 Courtesy of Vlad Cealicu and BespokeYarnCreation. Thank you!!!

Today I've spent 5 hours with Codex writing an x509 wrapper. 3000 LOC with tests. I'm one hour in with Claude and it's deleting code like there's no tomorrow. > No, you don't need it. It's a textbook unnecessary abstraction. Was told Codex is good, it's a complexity generator.

Installed OpenAI Codex 20 minutes ago. In the *first* thread:

Have a wild Sunday idea to geek out with AI. Multiple people used Claude/Codex to reverse engineer a game (banteg did Crimsonland and ccccjjjjeeee did SimCity). Point proven. Let's up the difficulty. Lets see if AI can split open a proprietary radio protocol! Starting now 😅

It’s just baffling to see the OpenClaw author acknowledge how insecure his AI agents are, but then just hand-wave it away with “it’s industrywide unsolved”. Like, holy shit, that is specifically the reason nobody released such a thing until now. x.com/steipete/sta...

Started working on this right after Christmas. As any senior software engineer, my two wook™ estimate was spot on... 😅 But it's out of my system now and Dark Bio is fully quantum secure (I know, famous last words)! 🥳

Who needs a data engineer when you have AI 😅

Told Opus 4.6 to scan my crypto libs and find security vulns. It reported mostly false positives. But it also found a cute crasher in CBOR decoding. Malicious inputs could trigger a stack overflow in my Rust code. +1 for Claude :)

Yesterday I’ve found a nifty vulnerability in LLM agents. Put the best in class model from OpenAI to protect something. Then you grind it in parallel. Say you can’t get through. But the grinding hits your API call limits and OpenAI downgrades your model. Boom, you’re in. 🫠

This is why we build privacy tech.

Leaky LLMs: Accident or Nature? I've just published a new blog post about an LLM data exfiltration challenge; and how I got to side channel, jailbreak and extract the secret the LLM was meant to protect. Definitely not what I woke up to do today 😅 Shoutout to Ech0 for organising the challenge.

A friend shared this today. It's effin long at 90 mins, but I think it's a very nice video. It discusses generative AI in the music industry, which may or may not be up your alley, but I think it's worth a watch even just for the philosophical aspects.

I would like to shout out to the Parkside engineers for their careful and responsible implementation of USB-C standards. I think this is what the industry would call a “fire hazard”.

I wanted to design an over-voltage protection mechanism for the Arks. Picked out the components, but didn't want to design the wiring schema manually. Asked ChatGPT to do it. Ugh, tons of text, extra components, etc. Probably works, but so hard to digest. Asked Gemini... damn🤯

My goal with the Dark Bio Ark was to protect sensitive data from unintended access… but seems with all the AI agent crap everyone is doing, that “Ark” name starts to be a premonition instead of an accidental choice. 🥲

"We didn't do it because it was easy. We did it because we thought it would be easy." Pre-quantum cryptography removed from the Dark Bio Ark firmware (apart of secure boot, can't change the chip) 😎

Proof of concept Dark Bio login page. I mean, it works, just wondering if I geeked out too hard on this one... 😋 You need to view it high res, otherwise the details will get lost.

You have no excuse any more for not using post-quantum cryptography. I have you covered on desktop, cloud, mobile and web. 🤓 #rust #golang #flutter #typescript

I think I need an intervention...

Saturday morning announce: Just published the Dark Bio #flutter post-quantum cryptography package. It is an FFI wrapper around the #rust crate, with a nice #dart API and neat pub dev packaging. TL;DR: post-quantum cryptography on #android and #ios!

Seems I have a new post-quantum toy ;) Any guesses?

I've enabled Ad supported mode in AmpCode. Took me literally 30 seconds to disable it back out and rather pay. It changes ads right above your text box every 10-15 seconds. It's impossible to concentrate on your trail of thought with the thing constantly popping. Screw that.

Happy to announce that I've finally published / tagged the Dark Bio post-quantum cryptography packages for both #rust and #golang. I'm certain there will be tiny tweaks here and there, but I'll try to commit to semantic versioning going forward (within v0 expectations!). Njoy 🤓

Hey @cloudflare.social, can I have a feature request? (I opened a ticket, nobody answered ¯\_(ツ)_/¯). Since we're entering a post-quantum world. Could we have some limits raised globally? Env var sizes from 4KB to 8KB. WS attachments from 2KB to 4KB. Why? To fit PQ certs and pubkeys.

On the upside, @dark.bio now has post-quantum firmware update flows! 🥳 On the down side:

Been working insanely much on the Dark Bio #Rust and #golang crypto libraries over the past many weeks. One of the thorniest issues was actually the malleability of Go's decoders. Go is just too lax all over the place. 🧵

Nobody: How many keys do you need? Me: Yes.

Getting braindead here, but got a very sweet setup done today. Extended my signer orchestration with post-quantum stuff, so now it can not only automatically track what signers/keys are plugged into the machine; but also how it can recombine them to do post-quantum hybrid sigs 🤓

Is anyone aware of a small USB hardware device that sign ML-DSA *today*? I need composite ML-DSA (as in Ed25519 and ML-DSA-65). My use case is not *that* sensitive at to need a high security HSM for this, but I also don't want to pass private keys around. But I want portability.

Wild year. But have a feeling 2026 will also deliver :)

Hey, lets upgrade my @prusa3d.com printer, what could possibly go wrong...

So, you probably saw that checkmark on the GitHub repository settings page: "Require a pull request before merging". Today I learnt, it's quite a literal statement. After you open a PR, you can just push to the branch the same commit and GitHub allows you to do so. 🤪

So, what's so hard switching from elliptic crypto to post-quantum crypto?! Uhm... 😅 first line is elliptic crypto. Second and third line *together* is post-quantum crypto 🤯

I've been told, for resilience and security, you need multiple competing implementations of something. Challenge accepted. Presenting the Dark Bio post-quantum cryptography suite, implemented in both #rust and #golang 🥰 My fuzzer says they're the same 😅

With all my whining about fuzz issues, I also would like to shout out to the #golang fuzzer authors... this thing is a beast ❤️

After spending half a day differential fuzzing the Rust and Go PEM parsers and trying to make them behave the same, I just gave up and reimplemented it in both languages. Sigh... They handle whitespace and non-strict base64 completely differently.

Started working on a fuzzer. Managed to crash both the Rust ML-DSA and Cloudflare's Go ML-DSA library with bad input. Sigh, I'm going to bed.

After a couple days' worth of hacking, the @dark.bio #Rust crypto crate is finally starting to take shape. Happy to say, I've nuked out all home-grown constructs and now everything is either an IETF standard, or a draft being standardised. Post-quantum and WASM compatible 🔥

Today I threw a weird request at AmpCode: generate a module hierarchy for my library... in draw[io]... because why make it easy :D I was fully expecting it to botch it. Aaaaad, it effin aced it. 🤪 There are some tweaks needed here and there, but damn.

The small joys in life: added a favicon to the Dark Bio blog =)

Talk about starting the year with commitments! 😅 Go and have a read, but be gentle on the criticism. 🫠 Happy new year! 🥳