“Expose memory safe languages on the network and use real sandboxes or VMs for security boundaries” is—so far—weathering the storm. Honestly curious if it will hold.

Have we already moved on from the fact that the infrastructure we entrusted with basically all software supply chain security had a staggeringly simple unmitigated RCE two weeks ago? Did GitHub publish a longer post-mortem with deep root cause analysis and long-term mitigations? Will they?

I am not enjoying my October survey having so much predictive value. The TanStack compromise was pull_request_target + not there being such a thing as a read-only or isolated GitHub Actions workflow. These are unforced shortcomings of GitHub Actions! words.filippo.io/compromise-s...

I truly can’t get over the fact that we chose YAML-interpolated shell scripts as the default CI programming language. It’s so bad that we forgot how to handle untrusted inputs! (pull_request_target and issue_comment triggers should not be that unsafe! It’s just attacker controlled input.)

Someone should make a reverse DNSSEC test that checks if your resolver validates, and if not shows a reassuring “you have good mitigations against DNSSEC misconfigurations.” Anyway, Quad9 has unsecured versions of their UDP and DoH resolvers, which is what I use: quad9.net/service/serv...

I'm working to aggregate some common questions about #passkeys, both from non-technical and technical perspectives. These will be used in an end user facing site in the future. Any and all feedback is welcome. forms.gle/wmaydkzmUp2e... (also would appreciate some reposts to widen the audience)

I continue to be so confused by people not liking passkeys. I love the UX, such an improvement. Do y'all have a magical password manager that works without 15 taps in mobile apps? Or are you self-defeating by not using the built-in (Chrome or iCloud) authenticator? Is this a Linux desktop issue?

Copy Fail? Also looks like memory safety, but is actually complexity. xint.io/blog/copy-fa... I am going to link to this while rejecting changes to Go crypto for years. Anyway, feeling pretty validated in my "ssh in as root, only gVisor or Firecracker are an actual security boundary" approach.

… are fucking kidding me. A github.com cross-account RCE due to the most pedestrian of injection attacks along the obvious exposed surface… and they actually have a globally shared “git” UNIX user!! This is not what taking the role of supply chain stewards seriously looks like.

Today I renamed a type in the exported API of one of my packages by writing this short diff. Then I ran “go fix”, and it updated my code. Of course, IDEs have rename. But with the type alias, all dependencies keep working. And users can run “go fix” to update their code too! go.dev/blog/gofix

Looks like GitHub silently corrupted some index. PR #237 definitely exists and is closed (github.com/C2SP/C2SP/pu...) but is just... not in the list (github.com/C2SP/C2SP/pu...) regardless of filters. I briefly doubted my own sanity. This is bad.

Damn, that felt good.

A bit over two years after starting to work on it... Go is officially FIPS 140-3 certified 💥 csrc.nist.gov/projects/cry... I am pretty confident Go is now one of the most—if not the most—seamless and complete FIPS 140-3 compliance solutions... with a single env var, out of the box.

I think it's important to triage failed predictions and I was wrong about this one. It looks like it's more organizational dysfunction and neglect than the "embrace, extend, extinguish" I was told to be worried about but the acquisition did not work out well for GitHub. xcancel.com/FiloSottile/...

Serving a Bluesky “For You” feed with one Go binary on a home PC: SQLite (419GB) as primary store, heavy in-process LRU cache, OVH VPS + Nginx proxy/dispatch over Tailscale. ~72K daily users (15–25 QPS) plus Parquet logs + DuckDB analytics.

How much storage / bandwidth / CPU / memory does it take to run a production Sunlight CT log? Surprisingly little! There's now a public stats page, pulled every 5m from our Tuscolo prod metrics. stats.sunlight.geomys.org Less than 2 cores, 300 MB of memory, ~250 Mbps of bandwidth, 260 GiB of SSD.

Hey, if you think you're justified in being an anti-social ass to Why, could you block me? It's ok, no need to discuss it. I'm not looking for a fight and we're not going to converge. I know you think you are justified by that very good reason. Good for you.

NIST is updating SP 800-133, which details the "FIPS approved" ways to generate keys. There's a lot of good news in it, it approves a lot of stuff we were doing, like X-Wing seed derivation and c2sp.org/det-keygen. Here are my comments: leaflet.pub/f6fc0b3b-161...

With growing focus on the threat quantum computing poses to crucial and widely used forms of encryption, @filippo.abyssdomain.expert wants to make one thing clear: Contrary to popular mythology that refuses to die, AES 128 is perfectly fine in a post-quantum world arstechnica.com/security/202...

There are no technical or compliance reasons to double the size of symmetric keys in response to the threat of quantum computers. This common misunderstanding of Grover's algorithm risks wasting limited resources that should go towards deploying actually urgent post-quantum algorithms.

It's April 2026, 1 year 8 months since FIPS 204. The IETF TLS WG is busy debating the concept of ML-DSA hybrids, and whether they should be composite, concatenated, or separate. The complexity of hybrid auth is, however, firmly denied. In the distance, sounds of a pure ML-DSA PKI being built.

👀

This is awesome! Great to see more full-time positions for open source maintainers funded by commercial retainers framed around sustainability. And uh... looks like Geomys might be undercharging!

YES! No more made up severity scores for most CVEs! Every OSS maintainer I know hated those. (It's basically impossible to give a score to the severity of a vulnerability in a widely used library. They can ~all be low or critical, depending on how they are used.)

I had a whole post on "yes, HKDF is FIPS 140-3 compliant, actually" but now NIST just went and added it by name to the list of Approved algorithms with a change comment saying "it was always compliant, yo" (paraphrased), so yay. words.filippo.io/fips-hkdf/

There are only two bug classes left: complexity and memory safety. CurveBall (CVE-2020-0601)? Complexity. BigSig (CVE-2021-43527)? Memory safety. Log4Shell (CVE-2021-44228)? Complexity. BlueKeep (CVE-2019-0708)? Memory safety. Heartbleed looks like memory safety, but it's actually complexity.

I wrote up in the TLS mailing list why I think composite signatures (ML-DSA + ECDSA/RSA) are a net negative, will hurt the ecosystem, and should not be implemented. Hybrid key exchange was simple and self-contained. Hybrid signatures would be a mountain of complexity in delicate, critical code.

this is so sick???? github.com/astral-sh/uv/blob/8ae8cc3/crates/uv-pep440/src/version.rs#L1064-L1137

ProTip: you can have multiple handles in your DID document! For example, you can see I am both @filippo.io and @filippo.abyssdomain.expert. pdsls.dev/at://did:plc... @bsky.app uses the first, but also loads profile links for the others. bsky.app/profile/fili... @tangled.org lets you pick now!

Alright, it's official! 💰 @matthewdgreen.bsky.social and I bet on what will break first, ML-KEM-768 or X25519. The loser donates to a 501(c)(3) picked by the winner. If you have an opinion on quantum computers or lattices, you can join with a side bet. Just submit a PR! github.com/FiloSottile/...

1. The Xteink X4 is so cute 2. It's so cool you can just ask an LLM for a firmware feature 3. To flash the community firmware, you just go to xteink.dve.al and click flash, thanks to WebUSB It's so sad Firefox doesn't implement WebUSB. Better UX *and* better security than downloading an exe.

Come for the updated graph, stay for the very balanced and reasonable Outlook section, which matches and reinforces my risk assessment: it's unlikely we'll see a CRQC in 2030 but not unlikely enough. So we ship. sam-jaques.appspot.com/quantum_land...

Yeah they got a bit of a roasting on scirate over that. Though their 10,000 qubit ECC is only 1000 days. I still didn't include it because (a) 1000 days already gets us to 2029; (b) by the time they finish a computation that long, I suspect another company could build a 26,000 qubit machine

Overdue quantum landscape update: sam-jaques.appspot.com/quantum_land... A 2d chart can only say so much. tl;dr new results are still overhyped, but definitely worth taking seriously. This chart is based on surface codes and a big question now is whether new codes can be practical (=>useless chart)

Can we talk about the fact that we can just tell the computer > extract from 2026-04-08-17-15-58.mkv an audio file that is compatible with MacWhisper, ideally losslessly and it just runs ffmpeg for us now??

If I had time for hobby programming right now, I would be building a TLS 1.3 stack that uses only two primitives: Keccak and ML-KEM. Lake Keyak and TurboSHAKE128 (Keccak-p[1600, 12]) for AEAD and hash/XOF/KDF, ML-KEM-768 (Keccak-p[1600, 24]) for AuthKEM. Permutations and sponges/duplex FTW.

The plc.geomys.org plc-replica is indeed at cursor 90083706 and currently takes 145G logical, 76G after ZFS compression.

Oh hey, with all the 🔥 I almost missed that today was the 12th anniversary of Heartbleed. The online test I cobbled together that night gave me the opportunities to get started in this line of work! Initially it was hilariously bad: a Flask server shelling out to a patched Go crypto/tls binary.

The sheer number of times I’ve had the intuition behind hybrid classic+PQ crypto mansplained to me today… Yes, have you considered I might be aware of the basic argument, and if I still observe a tradeoff it might be due to additional insight tied to the experience of doing this as my actual job??

I gotta say that I am starting to fray at the edges from all the change and 🔥 at all levels. The threat of quantum computers is churning my profession words.filippo.io/crqc-timeline/ AI is rebalancing my field sockpuppet.org/blog/2026/03... War and fascism are... yk. And ofc climate change. 😮‍💨

Two papers came out last week that suggest classical asymmetric cryptography might indeed be broken by quantum computers in just a few years. That means we need to ship post-quantum crypto now, with the tools we have: ML-KEM and ML-DSA. I didn't think PQ auth was so urgent until recently.

I finally chased down test coverage for the last edge cases of ML-DSA's low-level, constant-time field operations like Decompose. This is an accumulated (words.filippo.io/accumulated) test that locks in the output for all possible inputs of all these tricky functions. go.dev/cl/762940

There was no good way to see what CT logs are actually used by CAs, so I made a dashboard of @censys.bsky.social data on @exe.dev. groups.google.com/a/chromium.o...

We've been worrying about UX patterns that train users into dangerous behaviors for a while, but they weren't exploited often. Alas, it looks like it was just because there was lower-hanging fruit. We've been improving auth stories, so now targeted phishing is moving to looking like innocent UX.

A very nice explainer why "if you're so worried about quantum computers, why haven't they factored 21 yet?" isn't a very convincing argument. Look at the labels of the graph, and how extremely close the various lines are for factoring 21 and 2048 bit numbers. Polynomial scaling remains […]

Last year, I thought we still had time to design PQ auth systems. Now, based on the pace of progress and on statements like Google's, I believe 1. we need to finish rolling out PQ kex yesterday 2. we need to start rolling out PQ auth now 3. it's too late to ship any new non-PQ design or system

Hey #AtmosphereConf, I am flying in tomorrow evening! 🥳 I was going to rest after a week in Taipei, and then @knowtheory.net and @ngerakines.me got me excited about bringing tlogs (as seen in CT, Go's sumdb, Sigsum, Sigstore) to atproto... and now I have a lightning talk on Sunday 😅

I am extremely excited by all the atproto apps, but I am a bit uncomfortable with how many store data in the repo but don't surface in the UX the fact that you can see other users' data. You and I know that all data is public (for now!), but the average user needs the UX hint or very explicit text.