Soatok Dreamseeker

He/him. Gay/demi dhole (Cuon Alpinus)

Blogger, programmer, security engineer, cryptography nerd. 30+

Too spicy for Twitter (banned with all the prominent journalists on 2022-12-16)

Pronouns: he/him
Fursona: Dhole
Orientation: Demi/Gay
Website: https://soatok.blog

Public Key

npub1wfp0azvqh9n27j7zgnej54cr9xjs5x2efztwzurjdpj34ea5vw9qdvw2m9

NIP-05 Address

[email protected]

Profile Code

nprofile1qqs8ysh73xqtje40f0pyfue22upjnfg2r9v539hpwpexseg6u76x8zspz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds2t9hf6

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1wfp0azvqh9n27j7zgnej54cr9xjs5x2efztwzurjdpj34ea5vw9qdvw2m9

Show more details

Last Notes

2024-09-18 13:25:52

The Continued Trajectory of Idiocy in the Tech Industry
Every hype cycle in the technology industry continues a steady march towards a shitty future that nobody wants. CMYKat The Road to Hell Once upon a time, everyone was all hot and bothered about Big Data: Having lots of information--far too much to process with commodity software--was supposed to magically transform business. How do you build technology that can process that much information at scale?
http://soatok.blog/2024/09/18/the-continued-trajectory-of-idiocy-in-the-tech-industry/

2024-06-19 07:19:09

Wait a minute. The furry fandom has been having exponential growth for years?
...
What are the damn rabbit furries up to?

2024-06-18 14:43:07

Life would be so much happier if more people had the humility to recognize that expertise isn't a single hierarchy of intellect but rather a random walk in a hyperdimensional space that makes fractals look simple in contrast.

2024-06-13 21:35:43

There are but two categories for chat:
General
Specific

2024-06-13 15:05:35

There ought to be a supermarket for pseudointellectuals
We can call it Dunning Kroger

2024-06-13 12:02:16

- reply

Believe it or not, there is still plenty of interesting and exciting work to talk about that doesn't involve LLMs.
Cryptographers contributing to the IETF is working to standardize FROST, a two-round threshold signature algorithm based on Schnorr proofs, which is backwards compatible with Ed25519.
This means it will soon be possible to generate Ed25519 signatures from, for example, 4-of-7 shares held by independent parties. And the verifier doesn't need to do anything different; it's just an Ed25519 signature to them.
That's cool as fuck.
There's little-to-no hype about it.

2024-06-13 11:54:30

- reply

At the end of the day, the only people who win this game are private equity firms whose primary goal is to extract rent from the properties they acquire.
That's the curtain call for whatever you're building with this mindset.

2024-06-13 11:52:09

- reply

Does your company chase the latest hype cycles instead of focusing on fundamentals?
Then I don't trust you.
You will sell your users out for a Klondike bar and your staff will jump ship rather than roll up their sleeves when the going gets tough. That's the culture you are cultivating.

2024-06-13 11:48:54

- reply

Tell me about your Boring Technology that gets the job done and gets out of your user's way.
Tell me how you made your app or service easy to use and hard to misuse.
Tell me how you're encoding an understanding of the importance of consent into your architecture.
Tell me how you're treating your employees better than your competitors are treating theirs.

2024-06-13 11:46:16

As someone who works in tech, I'm honestly tired of hearing about the same few topics from the same companies:
1. Layoffs
2. Return to office (see #1)
3. Record-breaking profits
4. Press releases about large language models
Shut up shut up shut the FUCK up

2024-06-12 16:46:14

- reply

Elevator pitch: Choose your own adventure, but with GitHub forks and pull requests.

2024-06-12 16:45:27

Me, having been poisoned by years of working in tech:
"Do I really want to write a fictional story, or would I rather just write a Wiki about the story that I'm imagining?"
"Wait, what if we made that a new literary genre where people wrote wikis about things that don't otherwise exist?"
....
"Did I just reinvent the SCP foundation?"

2024-06-11 15:52:30

HN users: "how DARE you put furry art on this technical blog post?! how am I supposed to use it to advance my own career? my boss will be livid if he sees me looking at PORN on the clock"
Their boss on LinkedIn: "so anyway I was reading Soatok's blog and have some thoughts about the latest post"

2024-06-06 07:38:03

Towards Federated Key Transparency
In late 2022, I blogged about the work needed to develop a specification for end-to-end encryption for the fediverse. I sketched out some of the key management components on GitHub, and then the public work abruptly stalled. A few of you have wondered what's the deal with that. This post covers why this effort stalled, what I'm proposing we do next.
http://soatok.blog/2024/06/06/towards-federated-key-transparency/

2024-05-29 18:51:38

Experiment you can participate in too if you'd like:
Instead of posting duplicate content on Twitter or BlueSky, post everything on Fedi first, then just paste links to your Fedi post on those platforms.
When people reply, copy a link to their tweet and reply to your Fedi post, then reply to them on Twitter with a link to your Fedi reply.
Expose the people you want to interact with to this platform so much that they are likely to decide for thenselves to sign up.
If successful, we can probably shift some of the better Twitter users to Fedi. And they'll feel welcomed and engaged.
Win goddamn win.

2024-05-28 23:28:54

- reply

in b4
"And then I shot him, Your Honor."

2024-05-28 23:27:57

Me, still recovering from a 30 hour return flight from Spain:
"Now would be a perfect time to roll my own crypto!"

2024-05-23 13:06:06

Gaming on Linux discourse be like
"It's Linux's fault. Do better, FOSS!"
Gaming on Linux in practice be like:
https://www.protondb.com/app/1085660

2024-05-20 22:45:52

https://furry.engineer/system/media_attachments/files/112/475/365/643/257/996/original/cb62309bd3f52d66.jpg

2024-05-17 18:49:43

- reply

Nice!
If I found an exploitable implementation issue (like I did with Matrix earlier this week), I would of course report it privately. But my previous job conditioned me to never look at code on Fridays. ;P

2024-05-17 18:44:10

- reply

I like ToB. Lots of great people there.
If you have a bigger audit scheduled with them, I'm happy to withhold further criticism until they've had a chance to look at it. Odds are, they'll find more than I will just casually looking at it.
(Also I don't have Haskell chops)

2024-05-17 18:41:23

- reply

Also, in a general sense, I'm pretty sure pairwise ratchets is exactly the setup for an Invisible Salamanders style attack.
Alice -> Bob: Key1, P1
Alice -> Charlie: Key2, P2
Same C, T can be sent to both parties
But I haven't actually looked at your code, just critiquing your Markdown docs

2024-05-17 18:38:11

- reply

If you don't want me to publish my criticisms of your designs, tell your users not to ask furries for their opinions of said designs 😂

2024-05-17 18:37:08

- reply

That said, reporting issues in a public forum does not hurt anyone's credibility.
"Full disclosure is a damned good idea." - Bruce Schneier, Cryptographer
https://www.schneier.com/essays/archives/2007/01/schneier_full_disclo.html

2024-05-17 18:36:18

- reply

I'm not here to report a vulnerability. I was asked for my opinion, and I said I don't like your design.
One specific criticism is that you're using GCM but do not have any sort of Key Commitment in your protocol. That's not a vulnerability, to my knowledge.

2024-05-17 18:31:08

- reply

My complaint with Curve448 is that most things don't use it, so implementations are less reviewed.
The primary reason to select 448 over 25519 is a "biggest rock is best rock" approach to cryptography parameters. It doesn't help in any realistic scenario, nor against quantum attackers at all.

2024-05-17 18:27:25

- reply

Oct 11 - 14 is 3 days
https://furry.engineer/system/media_attachments/files/112/457/366/763/166/054/original/6539d531cfdb1a2f.jpg

2024-05-17 18:25:49

- reply

AES-GCM is.
If you're in a situation where you can have multiple keys (i.e. group messaging), you can send two plaintexts that encrypt to the same (ciphertext, tag).
https://github.com/soatok/gcm-exploit

2024-05-17 17:36:11

- reply

This needs a professional audit.
SimpleX was reviewed for three days by two people I respect in late 2022.
https://github.com/trailofbits/publications/blob/master/reviews/SimpleXChat.pdf
However, that is way too short a timeframe for something as important as E2EE.

2024-05-17 17:30:37

- reply

"Yeah, I'll have, uh... The SIgnal Double Ratchet. But with Curve448! And I'll use AES-GCM instead of CBC+HMAC."
"Daring today, aren't we?"

2024-05-17 17:29:35

- reply

Like, there is no reason for this mess: https://github.com/simplex-chat/simplexmq/blob/master/protocol/overview-tjr.md#encryption-primitives-used

2024-05-17 17:22:39

- reply

I don't see how SimpleX (which is anything BUT simple) mitigates Invisible Salamanders, given their reliance on AES-GCM.
Also, I don't see why they use Ed448 at all.

2024-05-16 21:23:01

- reply

Found and disclosed a 3rd vuln on my lunch break because I wondered, "what if I just got lucky and hit the places that were actually vuln?"
lol

2024-05-16 17:04:22

- reply

One of the most frustrating things I deal with as a security researcher goes like this.
Me -> vendor: "This is a problem"
Vendor -> me: "That's not in our threat model"
Customers -> vendor: "...wait, I thought you prevented that attack by design"

2024-05-16 05:50:04

- reply

I suspect there are even more, but that's as much of my time and energy as I want to put into looking at their code.

2024-05-16 05:48:29

One of the Matrix developers saw fit to comment on my gist https://gist.github.com/soatok/8aef6f67fec9c702f510ee24d19ef92b?permalink_comment_id=5058644#gistcomment-5058644
In response, I actually looked at their code, identified two security vulnerabilities, and disclosed them to their security@ email.
This reaffirms the opinion I held previously.

2024-05-15 19:59:37

Okay, so Cwtch implemented PrivacyPass with Ristretto255 :blobfoxheartcute:
This is amazing

2024-05-12 03:00:16

- reply

I've been yapping about the exponential growth of the fandom and how poorly our community is handling it for years now

2024-04-29 06:32:33

I'm not going to mince words.
Fursuits are adorable and I enjoy seeing them. Please post more.
Thank you.