Cheesy/bad music video, but absolutely killer guitar and melody www.youtube.com/watch?v=49WM...

Plasma 6.6 is now live! Spectacle can read texts from screenshots; we got our own on-screen keyboard; and we have a new first-time wizard that let's users configure their passwords, timezones, keyboard and networks, on preinstalled systems; among many, many more things. kde.org/announcement...

Congratulations to the @kde.org team for releasing KDE 6.6 — another fantastic release for the greatest desktop there is! kde.org/announcement...

I was hoping that Cryspen's maintainers would eventually grow reasonable, allowing me to report these bugs directly, but I've lost all faith. Today I'm dropping even more bugs in Cryspen's libcrux, this time in the ML-DSA implementation: symbolic.software/blog/2026-02...

Only 3 hours left on the Kickstarter! In case there is anybody left who hasn't yet but wants to:

Cryspen also quietly fixed a second SIMD vulnerability in January that was causing decryption failures in Signal. The vulnerability was reported via public PR, the reporter wasn't blocked, and no advisory was ever issued. I only just learned about this. github.com/cryspen/libc...

The lesson from this week is that you can be a distinguished scientist with decades of experience and co-founding a startup will *still* make you throw your scientific integrity out the window if it puts your revenue in danger.

MASSIVE rewrite of my Verification Theatre paper now on ePrint with added: - Three new bugs that are *inside* libcrux's verified core, - Comparison to Amazon's verified LibCrypto components, - Many additional sections, discussion and details! Huge rewrite! Go read it! eprint.iacr.org/2026/192

A mysterious baron (who shall remain nameless) who is also a patron of the arts is looking to hire an artist in order to reproduce an 80cm faithful reproduction of the Mona Spamton (attached). If interested and located in the EU, please contact me. I am not the mysterious baron

I always assumed that #passwordmanagers were simple objects -- create a database, encrypt it, send it to the server, done. I could not have been more wrong! At zkae.io, we take a look at all the hidden complexity in cloud password managers, and the #attacks that result from that. (ia.cr/2026/058)

Do you use a cloud-based password manager? So what's your threat model? Vendors like Bitwarden, Dashlane, LastPass and 1Password offer you "Zero Knowledge Encryption", with statements like: "Not even the team at Bitwarden can read your data (even if we wanted to)." We decided to test this… 1/n

REMINDER: Cryspen is still trying to bury a critical nonce-reuse vulnerability under an advisory with medium severity, that doesn't mention it directly or discuss impact/mitigation. This is already receiving pushback, but it really should be a matter of record: github.com/rustsec/advi...

Every single time my piano teacher gives me a new exercise, it feels like the hardest thing in the world! Then I break my head to master it, then he gives me another one, and it feels like the hardest thing in the world AGAIN Pianists are ALIENS

There is a dearth of competent philosophers on AI.

There is unique dialogue if you try and obtain the Pipis in Chapter 3 with a full inventory.

Insanely great comic by @lynxgriffin.bsky.social

I wonder if some version of the Butlerian Jihad will actually occur in the next hundred years

Finally did some keyboard maintenance today and threw out my many-years-old switches for a new set of Gateron Baby Kangaroo V2s. Excellent switches (best I've had yet), but I think that my next switches (some time in 2030, probably) will be linears.

MASSIVE rewrite of my Verification Theatre paper now on ePrint with added: - Three new bugs that are *inside* libcrux's verified core, - Comparison to Amazon's verified LibCrypto components, - Many additional sections, discussion and details! Huge rewrite! Go read it! eprint.iacr.org/2026/192

Rewriting my entire paper to this banger on loop for the past ~5 hours straight now:

✨記念すべき第一曲目✨ KiraStudio、無限の可能性を感じる v1.0.0 でこれはヤバい Used SoundChips: NES 2A03 - Pulse, Triangle, Noise FM - OPLL, OPN2, Generic 4-OP WaveTables - GameBoy, Namco163 PSG - SSG PCM - OPNA, Generic PCM (計11Track) #KiraStudio #Chiptune #Digilfu

The sad thing about Cryspen’s CEO is that he insists on publicly treating me like a misbehaving child while he copy-pastes the free fixes I keep providing him for critical vulnerability after critical vulnerability and show him that he didn’t even know how to write advisories. So embarrassing.

I can’t drink coffee for a few weeks due to some dental work! How annoying! I love coffee. Luckily I got some caffeine products that I can eat instead. But I miss the taste of coffee!! Coffee and video game music are my life blood!

Everyone knows you keep your best card for last.

Valentine’s Day gift for wife (she got me my current keyboard a few years back/she writes code constantly at her job)

Explained to someone IRL that my former thesis advisor blocked me on GitHub because I sent PRs for bugs in his crypto libraries (two critical) and called me irresponsible because I didn't tell him about them in private instead. Then he went quiet for a week and then published an evasive blog post

Absolutely no mention of the critical nonce reuse vulnerability in Cryspen code that is still in deployed in production in Signal and OpenMLS today. For shame

For #WomenInScience Day, ATFL recognizes the vital contributions of Lebanese women advancing research, medicine, engineering, and innovation, often in spite of extraordinary national challenges.

One week today since I submitted my five vulnerabilities to Cryspen (with fixes) which include nonce reuse and their PSQ library not being IND-CCA Still no release with fixes and not a single security advisory These are libraries that they lobbied for Signal/OpenMLS to adopt.

Going through Verifpal is making me realize how much I've grown since I first started writing it ~6 years ago. Not only was it written in Go while Rust is obviously the right choice, but its internal design is really inefficient and in many cases just wrong. I feel ready now to design Verifpal 2.

Pleased to announce that Verifpal finally has Spamton support

I'm giving a talk soon about my Cryspen findings, in collaboration with @ostifofficial.bsky.social. Happening online, will be live-streamed. Register here: luma.com/xc4yuezb?tk=...

Should I add a "music mode" to Verifpal that plays select YM2612 chiptune music while analysis is being conducted

Verifpal Rust rewrite

SoK: On Cryptography for Multi-Cloud Storage (Dayane Horkos, Ludovic Perret) ia.cr/2026/207

Today's work music

I think it's time to rewrite Verifpal in Rust.

replies and quotes are all brain dead morons reacting out of anger because they cannot process extremely basic philosophical questions.

My Productivity Zone

Did you know: you can Jevil-theme your GitHub

Verifpal 0.31.2 is out! For the first time, Verifpal can fully verify a model of Signal’s X3DH key agreement and Double Ratchet protocol across three messages, making it competitive with the state of the art for protocol verification... from 2016.

Pushed security advisories for the Cryspen libcrux-psq and hpke-rs bugs to RustSec: github.com/rustsec/advi...

Today's work music

Our Linux patchset to add full audio support on Lenovo Legion devices to the Linux kernel now supports kernel 6.19, released today:

Responsible disclosure is a political guilt game meant to safeguard the reputations and business interests of vendors at the expense of transparency, accountability and safety of users

At what point does this performative dishonesty outright disqualify you from shipping credible "formally verified" code?