Nostr notes by Sophie Schmieg

Please read this before treating djb with any seriousness. ...

2026-06-30T22:04:27Z

In reply to nevent1q…net5
_________________________

Please read this before treating djb with any seriousness. https://keymaterial.net/2025/11/27/ml-kem-mythbusting/

Work moved to a new building. I didn't expect to take SAN ...

2026-05-12T18:47:03Z

Work moved to a new building. I didn't expect to take SAN damage from facilities.

A very nice explainer why "if you're so worried about ...

2026-04-02T19:20:57Z

A very nice explainer why "if you're so worried about quantum computers, why haven't they factored 21 yet?" isn't a very convincing argument. Look at the labels of the graph, and how extremely close the various lines are for factoring 21 and 2048 bit numbers. Polynomial scaling remains polynomial, unfortunately, and by the time you can factor 21 you're almost ready to break RSA.

https://bas.westerbaan.name/notes/2026/04/02/factoring.html

Lol. Rofl, even. (Not the Onion: ...

2026-02-12T21:08:04Z

Lol. Rofl, even.

(Not the Onion: https://www.ibm.com/thought-leadership/institute-business-value/en-us/report/enterprise-2030)

Like I fully expect real humans to start avoiding AI phrases like ...

2026-01-21T17:52:21Z

In reply to nevent1q…5qqx
_________________________

Like I fully expect real humans to start avoiding AI phrases like "you're absolutely right" or "that's a great question!", just because it sounds cringe.

One of the aspects of AI that I hate the most is that at some ...

2026-01-21T17:51:13Z

One of the aspects of AI that I hate the most is that at some point, I start reading my own or other people's genuine writing in "AI voice".
Way to undermine your own confidence or devalue other people's writing instantly.

Me: oh, we could buy an oscilloscope! @npub184f…pnjc : why ...

2026-01-10T06:29:34Z

Me: oh, we could buy an oscilloscope!
Insecurity Princess 🌈💖🔥 (npub184f…pnjc) : why would we need an oscilloscope?!?
Me: uhm, because it's an oscilloscope?!?

New blog post: A very unscientific guide to the security of ...

2025-12-13T23:56:19Z

New blog post: A very unscientific guide to the security of various PQC algorithm.

I guess I have entered the listicle stage of blog post writing, so I should add: Number 4 will shock you!

https://keymaterial.net/2025/12/13/a-very-unscientific-guide-to-the-security-of-various-pqc-algorithms/

Me: you're a great kitten! Cat: pukes in carpet Me: guess ...

2025-12-05T17:57:22Z

Me: you're a great kitten!
Cat: *pukes in carpet*
Me: guess you're just a good girl
Cat: *slashes curtains*
Me: well you're alright

Unicode normalization. ...

2025-11-26T22:03:10Z

Unicode normalization.

service that was designed for less than 2^n entries achieved 2^n ...

2025-11-18T17:59:14Z

In reply to nevent1q…l6a4
_________________________

service that was designed for less than 2^n entries achieved 2^n entries, where n was a reasonable choice at the time. Usually due to running out of integers of a certain size, or finding collisions in hash functions that were not supposed to collide with reasonable probability.

It happens with some frequency when more internet traffic then you could conceivably imagine runs through your servers. Ideally you catch that before bad stuff happens.

WaPo's opinion section these days: as we can see. Democrats ...

2025-11-14T18:38:13Z

WaPo's opinion section these days: as we can see. Democrats and progressive ideas are doomed, losing election after election, as evidenced by Mamdani in the New York mayoral race, where he lost, by winning by a wide margin.

OH: Kerberos is identity based encryption in the same way that a ...

2025-11-12T20:05:50Z

OH: Kerberos is identity based encryption in the same way that a hot dog is a sandwich.

Me: reads random news items My brain: Epstein, Epstein alles muss ...

2025-11-05T12:53:48Z

Me: reads random news items
My brain: Epstein, Epstein alles muss versteckt sien.

"if I wanted your damn opinion, I would've beaten it out ...

2025-11-04T19:15:49Z

In reply to nevent1q…h4ez
_________________________

"if I wanted your damn opinion, I would've beaten it out if ya" has somehow been stuck in my head since I played that game as a child in the nineties.

Help, I'm trapped! ...

2025-10-27T14:59:56Z

Help, I'm trapped!

Like, I've seen @npub1jsl…93xu complain about there not ...

2025-10-21T18:59:57Z

In reply to nevent1q…8wjy
_________________________

Like, I've seen Matt Blaze (npub1jsl…93xu) complain about there not being an involved Ocean's 11 style plot, but key detail: this happened in France. So obviously it would be more likely to be Lupin, and he loves stealing shit while everybody is watching.

Did anyone check on Assane Diop? I was under the impression that ...

2025-10-21T18:56:14Z

Did anyone check on Assane Diop? I was under the impression that stealing diamonds in broad daylight out of the Louvre is something that is really only accomplished by the legendary Lupin.

Don't make me take out the emergency entropy generators ...

2025-10-20T20:09:25Z

Don't make me take out the emergency entropy generators again.

(Context: https://lkml.org/lkml/2025/10/17/1729)

On top of that, any junior dev I've ever worked with asked ...

2025-10-15T00:19:23Z

In reply to nevent1q…jxg8
_________________________

On top of that, any junior dev I've ever worked with asked questions when they got stuck, instead of confidently force merging a bunch of buggy code. And not infrequently, those questions laid bare some flaw in the design decisions of the more senior engineer, and let to a better product that way.

You didn't really think the business value of that PR that ...

2025-10-15T00:17:39Z

In reply to nevent1q…j968
_________________________

You didn't really think the business value of that PR that had more comments than lines of code that all of us have written at some point in our career (if you haven't, I'm sorry, your onboarding mentor sucked, they were supposed to point out all the stuff you had to learn the hard way) was in getting it merged eventually, right? The value was the PR after that, that had a lot less comments. And the PR after that one, etc.

Whenever I see "GenAI basically can do the work of a junior ...

2025-10-14T23:38:45Z

Whenever I see "GenAI basically can do the work of a junior dev", I assume that those people are using junior devs very differently from me. To me, the value of a junior developer is maybe like 20% the code they write, and 80% is a down payment to a future where they no longer are a junior. I still haven't found an AI that could do that second part.

10.1 will warn if you're not using ML-KEM. And ML-KEM already ...

2025-10-08T17:03:25Z

In reply to nevent1q…c8y6
_________________________

10.1 will warn if you're not using ML-KEM. And ML-KEM already generates a fresh lattice for each public key.

Criticizing Linux on Mastodon is really the best way to make men ...

2025-10-03T14:04:50Z

Criticizing Linux on Mastodon is really the best way to make men type paragraphs, isn't it?

Random childhood anecdote, posted as individual toot in order to ...

2025-09-28T17:36:26Z

Random childhood anecdote, posted as individual toot in order to not derail some random joke post about kids these days not being into non-Euclidean geometry:

I have three siblings, spaced two years apart each. All four of us went to the same high school. My youngest sister's math teacher wanted to do a cute little segment about triangles always having inner angles sum up to 180 degrees. It was supposed to take the form of a trial. My sister was assigned the role of prosecutor charging a triangle accused of having an inner angle sum different from 180 degrees. Obviously, taking her role very seriously, she consulted the Schmieg dinner table, and a plan was hatched, involving a grapefruit and a marker. The trial came, and just as the defense had produced what they thought was irrefutable proof that their client was innocent, my sister took out the grapefruit, drew a triangle connecting one pole to the equator using three right angles, and said "So how do you explain this?!?" Leading to the teacher/judge having to explain non-Euclidean geometry to a bunch of 10 year olds.

And to make this anecdote even better, in a different class the same day she had a substitute teacher who didn't know my sister, but seeing the triangled up grapefruit, approached her and asked her "Are you a Schmieg?". Our family name has racked up quite some reputation…

When you think about it, we really should call "Tesla ...

2025-09-13T01:49:13Z

When you think about it, we really should call "Tesla autopilot" vibe driving

Calling linear regression "one layer neural network AI" ...

2025-09-09T16:23:55Z

Calling linear regression "one layer neural network AI" going forward

A key should always be considered to consist of both raw key ...

2025-09-02T01:01:57Z

A key should always be considered to consist of both raw key material and all metadata required to fully describe and execute the associated cryptographic function.

Nostr event nevent1qqs27c2m2yjwpyv0y03ylcyhg395kkschaecjt97dpszdsa6fgs69nczypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwnpe5ue

2025-08-31T18:27:49Z

Please do not vibe code reference implementations. FFS.

Damn girl "if you're actually an imposter, it's not a ...

2025-08-21T14:37:27Z

Damn girl "if you're actually an imposter, it's not a syndrome"

https://youtube.com/shorts/xBilK3gT5e0

@npub184f…pnjc : oh yeah, I saw in the IETF companion WhatsApp ...

2025-07-17T05:19:07Z

Insecurity Princess 🌈💖🔥 (npub184f…pnjc) : oh yeah, I saw in the IETF companion WhatsApp group…
Me: Whatsapp group? I thought that was a mailing list?
Insecurity Princess 🌈💖🔥 (npub184f…pnjc) : yes, initially, but email lists are cumbersome and awful, so we switched to WhatsApp.
Me: 😱I did not realize that was an option.

I mean you're talking about the country that thinks this is a ...

2025-07-11T14:53:22Z

In reply to nevent1q…cy2k
_________________________

I mean you're talking about the country that thinks this is a perfectly normal border:

Cat vs. SecUnit, a comparison: Commonalities: - terrifying murder ...

2025-06-25T02:38:20Z

Cat vs. SecUnit, a comparison:
Commonalities:
- terrifying murder machine
- weapons usually hidden unless in use
- could go rogue at any point in time and hurt humans, but chooses not to
- can react with superhuman speed
- often sits motionless, just watching the environment for hours

Differences:
SecUnit:
- just wants to watch media
Cat:
- just wants pets and cuddles

it's a family of vulnerabilities that generally affect ...

2025-06-24T22:32:54Z

In reply to nevent1q…pu7u
_________________________

it's a family of vulnerabilities that generally affect certain optimizations. The main idea behind SPECTRE is that the CPU (or GPU) falsely predicts that a certain code path is likely to be executed (for example assuming that an authentication check is likely to succeed, before waiting for e.g. a signature verification to complete), and that the execution of this code itself, even if undone by later actions, already leaks the information the attacker wanted, usually through side channels.

I added the less interesting information to this blog post. ...

2025-05-23T16:05:43Z

I added the less interesting information to this blog post.

https://security.googleblog.com/2025/05/tracking-cost-of-quantum-factori.html?m=1

My sister is defending her PhD today. Unbeknownst to her, I ...

2025-05-15T05:52:05Z

My sister is defending her PhD today. Unbeknownst to her, I happen to be in the region and will drop by for "moral support".

Ah, yes, the two genders ...

2025-05-06T09:49:49Z

Ah, yes, the two genders

Damnit, I'm sitting next to a cryptocurrency person in this ...

2025-05-04T02:15:55Z

Damnit, I'm sitting next to a cryptocurrency person in this plane and am not wearing my "crypto means cryptozoology" shirt.

I think I put that together wrong. ...

2025-04-19T21:57:50Z

I think I put that together wrong.

And all of the sudden, we have solved supply chain security. No ...

2025-04-15T20:39:29Z

And all of the sudden, we have solved supply chain security.

No CVE, no vulnerabilities!

til the Babylonians already had the "no take, only throw" ...

2025-04-01T13:52:36Z

In reply to nevent1q…flz6
_________________________

til the Babylonians already had the "no take, only throw" meme.

for small to medium sized businesses that are not doing anything ...

2025-03-29T14:30:41Z

In reply to nevent1q…wlnv
_________________________

for small to medium sized businesses that are not doing anything more adventurous than TLS when it comes to cryptography, my advice would be, if there is some free engineering capacity, to turn on 0x11EC (X25519-ML-KEM768) in their TLS config, assuming their stack supports the cipher. (The various different stacks are adding support for that currently)
That way, you can check if anything breaks, with both Chrome and Firefox negotiating that cipher by default, and Safari rolling out support for it. The main risk is with middleware breaking.
In that threat model, it may not be the most urgent task, but it's relatively simple, depending on the used TLS stack. You can also turn on the equivalent KEX in SSH (supported in OpenSSH). Otherwise, in that threat model, I wouldn't do much at all (and even these two things are mostly optional, unless there are very strict long term confidentiality concerns).
Of course, if your threat model is more adventurous, you might want to hire some cryptographers 🙂

I agree that most small to medium companies probably do not have ...

2025-03-29T06:28:24Z

In reply to nevent1q…yw9z
_________________________

I agree that most small to medium companies probably do not have to care about any of this right now. Those that do probably know already. But it's not something that can be simply ignored by everybody.

The main way to recognize overhyped nonsense is when they talk about inventory and agility. Unfortunately, neither of these terms is completely without merit, but they are the most favorite buzzwords of the hype peddlers. Really both of these boil down to proper key management. Something that is extremely difficult, but not unique or novel with PQC.

but just in case you don't like watching my YouTube talks, ...

2025-03-29T06:24:29Z

In reply to nevent1q…nx9y
_________________________

but just in case you don't like watching my YouTube talks, here is the TLDR as to why you might need to care (not everybody has to care, figuring out who does is part of the difficulty):
a) whether or not you believe the hype about quantum computers, regulatory pressure puts a hard deadline on the migration for 2035. That's ten years. For encryption in transit you have store-now-decrypt-later, which might incentivise you to move faster, although that is somewhat overhyped, as forward secrecy acts as a form of "quantum annoyance", it depends how high you value you long term confidentiality of your data.
b) PQC algorithms are not easy drop in replacements. They are much, much larger than their classical counterparts, leading to quite a few use cases outright breaking (as the aforementioned WebPKI). Some of these are extremely difficult to migrate as a whole (again, as the aforementioned WebPKI), making 10 years not much time.

ugh, please don't. Yes it's overhyped, and yes ...

2025-03-29T05:59:33Z

In reply to nevent1q…ehyy
_________________________

ugh, please don't.

Yes it's overhyped, and yes consultants give extremely cringe talks about it, but no, this is neither a purely theoretical threat that can be safely ignored, nor is it business as usual when it comes to upgrading. Unless of course you consider potentially having to rip out the entirety of WebPKI and replacing it with something different as business as usual.

You can see my talk about the practical challenge and the threat model here (about half way through) https://youtu.be/wsnHMvuxy5Q?si=yK6oObpptIQfyOs8

When your newspaper starts giving you opsec advice, you know ...

2025-03-28T09:27:54Z

When your newspaper starts giving you opsec advice, you know things are totally fine and good and well.

It's good opsec advice, though, so have a gift link.

https://wapo.st/4hMOQtq

I love that the "Germans in foreign countries" app lets ...

2025-03-28T07:30:02Z

I love that the "Germans in foreign countries" app lets you register your fax number.

I guess, how else would they reach you?

Being confused about which account belongs to which person is ...

2025-03-26T06:48:08Z

Being confused about which account belongs to which person is known to security professionals as a state management problem.

…

…

I'll see myself out

(entirely fictional) Cryptographers: technically, the Atlantic ...

2025-03-26T05:36:17Z

In reply to nevent1q…wj32
_________________________

(entirely fictional) Cryptographers: technically, the Atlantic could have fabricated the whole story, they have no way of proving the messages were actually sent.
Everyone else: they have screenshots, though!

Days since Signal's deniable handshake has last been defeated ...

2025-03-26T05:33:09Z

Days since Signal's deniable handshake has last been defeated by nobody caring about cryptographically deniable handshakes: 0

hmm? Signal uses different colors for different people, that ...

2025-03-25T08:27:43Z

In reply to nevent1q…2xpv
_________________________

hmm? Signal uses different colors for different people, that helps me distinguish chats fairly well.

Visit https://keymaterial.net! Am I doing that right? ...

2025-03-24T14:33:39Z

In reply to nevent1q…67m0
_________________________

Visit https://keymaterial.net!

Am I doing that right?

Hotel shower control review, Grand Millenium Sofia, Bulgaria: ...

2025-03-24T06:39:20Z

Hotel shower control review, Grand Millenium Sofia, Bulgaria:

What is this, a shower control designed by someone with a degree in Engineering (UX design)?
Uses the superior basis (hot-cold, more water/less water), having the more water/less water toggle also control the output shower head, well documented and with a very satisfying click once an output has been selected, to avoid the shower user from being sprayed by wayward cold water.

10/10, will shower again. A true beacon to us all.

again, I need to travel to do my job. If I'm unable to travel ...

2025-03-18T19:49:24Z

In reply to nevent1q…r6vr
_________________________

again, I need to travel to do my job. If I'm unable to travel when based in the US, then I have to move country instead. I'm not risking much by traveling internationally, worst case scenario I get deported to Germany, where I would need to go anyhow if travel was impossible, so really all that happens is that the US pays for my flight.

I don't back down from bullies. And I need to travel ...

2025-03-18T19:37:38Z

In reply to nevent1q…g0aj
_________________________

I don't back down from bullies. And I need to travel internationally to do my job. If that becomes infeasible, I will have to leave the US and move back to Europe. I can much more easily skip conferences in the US (a good chunk of which are organized by the federal government to begin with), then I can skip international travel. And a lot of my peers in industry and academia are in the same position.

Feeling great about my upcoming international travel right now. ...

2025-03-18T18:30:29Z

Feeling great about my upcoming international travel right now.

https://www.theguardian.com/us-news/2025/mar/18/germany-investigates-after-national-with-green-card-arrested-at-us-border

look at number fields, split, ramified, and unramified primes ...

2025-03-18T16:39:16Z

In reply to nevent1q…9353
_________________________

look at number fields, split, ramified, and unramified primes while you're at it. IMHO easier to understand and deeper than split complex or dual numbers (although the dual number construction is extremely important for algebraic geometry).

I'm on the same plane as Whitfield Diffie. We exchanged ...

2025-03-12T17:42:15Z

I'm on the same plane as Whitfield Diffie. We exchanged greetings, but not keys.

What do you mean, of course that is my email address, IAD. ...

2025-03-12T16:58:33Z

What do you mean, of course that is my email address, IAD.

Sometimes, a tiny bit of me wants them to outlaw encryption, just ...

2025-03-07T14:14:52Z

Sometimes, a tiny bit of me wants them to outlaw encryption, just so I can show up at a pivotal moment, wearing a hoodie and half engulfed by fog from a fog machine, and mysteriously explain: "I possess the forbidden knowledge. Knowledge not meant for humans to know. Knowledge of matrices that will drive you mad just gazing upon. Infinite Knowledge of fields, finite in their nature!"

Every time I fly Delta I end up disappointed because they somehow ...

2025-03-06T00:54:23Z

Every time I fly Delta I end up disappointed because they somehow always end up using swept wing aircraft instead of the promised delta wing.

This was a really fun vulnerability to have the pleasure to ...

2025-03-05T18:10:10Z

This was a really fun vulnerability to have the pleasure to consult on:

https://bughunters.google.com/blog/5424842357473280/zen-and-the-art-of-microcode-hacking

It turns out AES-CMAC is not second preimage resistant if you know the key (double so if the key is in an RFC), and 2048 bit numbers are quite often very easy to factor.

Substantial layoffs at the largest employer in the country will, ...

2025-02-14T16:01:45Z

Substantial layoffs at the largest employer in the country will, by themselves, cause an economic crisis. And that is nothing to say about the fact that federal employees are doing a job, and often one crucial to the economy.

But "Republicans are good for business"

be that as it may, it matters that the president cannot change ...

2025-02-11T16:23:48Z

In reply to nevent1q…3e0h
_________________________

be that as it may, it matters that the president cannot change the law via executive fiat. It is still illegal to bribe foreign officials. There might not be enforcement right now, and if you outrun the statute of limitations that might mean you are able to commit an illegal act without penalty. But it is still an illegal act, and you still committed a crime.

executive orders cannot suspend laws passed by Congress.

2025-02-11T16:06:28Z

In reply to nevent1q…vzc9
_________________________

executive orders cannot suspend laws passed by Congress.

tbf, I have not seen phishing emails trying to get me to visit a ...

2025-02-03T18:55:09Z

In reply to nevent1q…t2ga
_________________________

tbf, I have not seen phishing emails trying to get me to visit a super secret cave which totally has snacks and is not full of wasp larva

See this excellent blog post about a list of the problems and ...

2025-02-03T18:38:16Z

In reply to nevent1q…mfgw
_________________________

See this excellent blog post about a list of the problems and design issues with PGP.

And I do agree, at least some points also apply to Mastodon DMs, in general, retrofitting end to end encryption is not a simple undertaking, and usually leads to endless compromises that make the whole thing meaningless. https://www.latacora.com/blog/2019/07/16/the-pgp-problem/

leopards, face, …

2025-02-01T02:11:21Z

In reply to nevent1q…apug
_________________________

leopards, face, …

great news, I have pretty much fully mitigated the risks posed to ...

2025-01-28T05:27:54Z

In reply to nevent1q…nv8q
_________________________

great news, I have pretty much fully mitigated the risks posed to us by cryptographically relevant quantum computers!

so far, there is still no evidence of person to person ...

2025-01-06T22:26:11Z

In reply to nevent1q…h6e5
_________________________

so far, there is still no evidence of person to person transmission. So I think for the moment the pandemic part 2 risk is contained. Let's hope it stays that way.

I have to say, Mastodon's inability to actually reliably ...

2025-01-04T19:09:03Z

I have to say, Mastodon's inability to actually reliably fetch content leads to hilarious situations, like a reply to my screenshot about someone earnestly proposing to use Gen AI as a random number generator being confused about why people are talking about what a bad idea it would be to use Gen AI as a random number generator.

Like I get it, distributed computing is hard, but at least if someone expands a thread, try to fetch the whole thread.

https://mastodon.social/@nf3xn/113770165305664382

oh yeah, he founded a company, apparently. It doesn't say if ...

2025-01-03T21:29:48Z

In reply to nevent1q…tdkj
_________________________

oh yeah, he founded a company, apparently. It doesn't say if he actually found anyone dumb enough to invest in it, but yeah.

Remember, it's only fraud if you actually understand that what you're doing is nonsense!

that noise would be considered true random noise, but I don't ...

2025-01-03T21:11:35Z

In reply to nevent1q…mpyg
_________________________

that noise would be considered true random noise, but I don't know how many bits it has. While float isn't associative, it's like "mostly" associative, so depending on the condition of the matrix, it should be fairly low.

In any case, if you wanted to use that noise for cryptographic purposes, you'd first have to debias it by running it through a DRBG, and at that point you could just harvest it directly from the GPU for higher quality and performance.

Or query your stupid hardware RNG that literally every modern CPU has built-in.

In case you do not know how GenAI works, here is a very abridged ...

2025-01-03T20:54:00Z

In reply to nevent1q…8nwe
_________________________

In case you do not know how GenAI works, here is a very abridged description:
First you train your model on some inputs. This is using some very fancy linear algebra, but can be seen as mostly being a regression of some sorts, i.e. a lower dimensional approximation of the input data.
Once training is completed, you have your model predict the next token of your output. It will do so by creating a list of possible tokens, together with a rank of how good of a fit the model considers the specific token to be. You then randomly select from that list of tokens, with a bias to higher ranked tokens. How much bias your random choice has depends on the "temperature" parameter, with a higher temperature corresponding to a less biased, i.e. more random selection.

Now obviously, this process consumes a lot of randomness, and the randomness does not need to be cryptographically secure, so you usually use a statistical random number generator like the Mersenne twister at this step.

So when they write "using a Gen AI model to produce 'true' random numbers", what they're actually doing is using a cryptographically insecure random number generator and applying a bias to the random numbers generated, making it even less secure. It's amazing that someone can trick anyone into investing into that shit.

I was forwarded this screenshot and it just is living rent free ...

2025-01-03T20:46:33Z

I was forwarded this screenshot and it just is living rent free in my head right now.

The tradition is only known as "the holidays" to most, ...

2024-12-20T00:33:13Z

The tradition is only known as "the holidays" to most, but it's important to remember what we are celebrating this time of year: the Herculean effort to fix the log4j vulnerability caused by needless use of JNDI.

Here is @npub1jzt…jnwm's very appropriate response. ...

2024-12-13T16:42:37Z

In reply to nevent1q…xc82
_________________________

Here is Filippo Valsorda (npub1jzt…jnwm)'s very appropriate response.
https://mailarchive.ietf.org/arch/msg/tls/sEre58h7AHwzZOGH_P6TFGYFGQQ/

At this point, the IETF might require an anti-SLAPP rule, ...

2024-12-13T16:14:36Z

At this point, the IETF might require an anti-SLAPP rule, disallowing participants threatening other participants or the IETF with frivolous lawsuits from taking part in the standards process.

python3: Syntax error: source code cannot contain null bytes Me: ...

2024-12-12T00:51:59Z

python3: Syntax error: source code cannot contain null bytes
Me: can you be cool just this one time?!?

Some people, mostly figments of my imagination: "Why is TLS ...

2024-12-04T22:32:56Z

Some people, mostly figments of my imagination: "Why is TLS calling everything a group, isn't that inaccurate when it comes to ML-KEM?"
Me: "a module is a group, by definition"
Some people: "can we at least agree on not calling it a curve then?"
Me: "Technically, Z[X]/(X²⁵⁶ + 1) has Krull dimension one, so it's fair to say that Spec Z[X]/(X²⁵⁶ + 1) is a curve, and ML-KEM is operating on a vector bundle over a curve"

@npub184f…pnjc, reviewing a resume, on a Saturday morning, ...

2024-11-23T17:50:39Z

Insecurity Princess 🌈💖🔥 (npub184f…pnjc), reviewing a resume, on a Saturday morning, while still in bed: this candidate's work experience is from September 2025 to present!
Me: you should tell them they're hired, start date is November 10th 2024, three unexcused consecutive days of absence are considered a resignation.

Nostr event nevent1qqsfm8kmhrzr2gyxjw70h7dsx8tr3mu2hl375nf7whf0cgx04s9jkrgzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgw4huv76

2024-11-12T14:20:24Z

Quote: "We thought the internet was for porn, but it turns ...

2024-11-07T12:17:38Z

Quote: "We thought the internet was for porn, but it turns out it's for certificates."

All other philosophies of mathematics: all hash functions have ...

2024-11-07T11:35:28Z

All other philosophies of mathematics: all hash functions have collisions! And trivially so due to the Pigeon Hole Principle!

Ultra finitist: cryptographically secure hash functions are injective 😎

Damn, IETF is really stepping up enforcement. ...

2024-11-04T08:24:06Z

Damn, IETF is really stepping up enforcement.

Hulu fucking shit, WaPo headline writer. Holy. Fucking. Shit. ...

2024-11-03T18:11:46Z

Hulu fucking shit, WaPo headline writer. Holy. Fucking. Shit.

Behold! The Internet. ...

2024-10-27T12:38:41Z

Behold! The Internet.

"Death by chocolate" is just the more extreme form of ...

2024-10-27T09:54:43Z

"Death by chocolate" is just the more extreme form of "pain au chocolate"

There are two types of freezes in software engineering: The first ...

2024-10-21T11:02:20Z

There are two types of freezes in software engineering:
The first one is around the Thanksgiving to Christmas holidays, usually demanded by the business to increase reliability.
The second one is in the attached picture.

how about: 1. Absorb the current state of the deck into SHAKE256. ...

2024-10-09T22:09:02Z

In reply to nevent1q…mjf9
_________________________

how about:
1. Absorb the current state of the deck into SHAKE256.
2. Run Fisher-Yates, by squeezing and rejection sampling the XOF output for the "random" numbers.

Slightly complicated to run in real life, but very easily extendable to a randomized shuffle by also absorbing some randomness in the beginning!

without saving needs an exclamation mark, and I think ZZ saves ...

2024-09-30T23:11:06Z

In reply to nevent1q…ahrc
_________________________

without saving needs an exclamation mark, and I think ZZ saves the file as well, so it would not be correct.

There should be a book titled "So you want to build a ...

2024-09-26T19:30:32Z

There should be a book titled "So you want to build a PKI".

It should contain helpful advice on woodworking, sustenance farming, and similar relevant topics.

Question: what effect will quantum computers have on ...

2024-09-16T15:51:30Z

Question: what effect will quantum computers have on cryptocurrency?
Me: a hugely positive one: they will make them worthless

To correct the common misunderstanding: Eve (they/them), Alice ...

2024-09-12T07:31:16Z

To correct the common misunderstanding:
Eve (they/them), Alice (she/her), and Bob (he/him) are in a consensual, BDSM relationship, featuring Eve as service top, Alice as the bratty bottom, and Bob, who just likes to watch.

Their safe word is "indistinguishability obfuscation"

Eve only "breaks" Alice's encryption because she's super into it, not to cause harm.

oh no, when I tried copy pasting it to Gemini

2024-09-10T19:39:22Z

In reply to nevent1q…cw5e
_________________________

oh no, when I tried copy pasting it to Gemini

the fact that it works and they don't get distracted by the ...

2024-09-10T18:47:57Z

In reply to nevent1q…eawc
_________________________

the fact that it works and they don't get distracted by the OOO message is kind of amazing to me. They'll just report with the poem, no trace of the fact that it was an ordinary OOO message (even if you run the non redacted version)

@npub184f…pnjc: "thing I just learned: names in the screen ...

2024-09-10T03:45:07Z

Insecurity Princess 🌈💖🔥 (npub184f…pnjc): "thing I just learned: names in the screen actors guild have to be unique. So if there is already a Michael Fox, even if your name is Michael Fox, you need to go by Michael J Fox"
Me: "Hmmm, do they allow for name changes? Because I would like to join the guild and change my name 500 times a second"
Insecurity Princess 🌈💖🔥 (npub184f…pnjc): "I think they have a mitigation against that, it's called 'an infrastructure based on fax machines'"

Let's see if my vacation auto responder has harvested any ...

2024-09-09T19:11:25Z

Let's see if my vacation auto responder has harvested any good poems.

well, you do need proteins, but they don't know their worth, ...

2024-09-09T16:37:40Z

In reply to nevent1q…73ph
_________________________

well, you do need proteins, but they don't know their worth, so they're all underpaid

When you think about it, you realize that DNA is the mother of ...

2024-09-09T15:56:10Z

When you think about it, you realize that DNA is the mother of all esoteric programming languages