Hobby cryptographer with a tendency to prefer decentralized stuff like the internet, email, Mastodon, and of course blockchains in a way or another.
Public Key
npub10u98z0s4rhgpgytwj846gpydpx5are6cqpnprdg2wttlz662g27qgr77nw Profile Code
nprofile1qqs87zn38c23m5q5z9hfr6ayqjxsn2w3uavqqes3k59894l3dd9y90qpz4mhxue69uhhyetvv9ujumt0wd68ytnsw43qz9rhwden5te0wfjkccte9ejxzmt4wvhxjmcxh0p6q
Show more details
Published at
2026-09-28T11:45:34Z Event JSON
{
"id": "a93e38d7be55b9a93d4b906ad122ea2e78c1883aa6df49532adf25eaa5068f10" ,
"pubkey": "7f0a713e151dd014116e91eba4048d09a9d1e758006611b50a72d7f16b4a42bc" ,
"created_at": 1790595934 ,
"kind": 0 ,
"tags": [
[
"proxy",
"https://social.epfl.ch/users/ligasser",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://social.epfl.ch/users/ligasser",
"pink.momostr"
],
[
"-"
]
],
"content": "{\"name\":\"Linus Gasser\",\"about\":\"Hobby cryptographer with a tendency to prefer decentralized stuff like the internet, email, Mastodon, and of course blockchains in a way or another.\",\"website\":\"https://social.epfl.ch/@ligasser\",\"picture\":\"https://social.epfl.ch/system/accounts/avatars/113/978/356/167/091/028/original/56cc3136056846ec.png\",\"nip05\":\"[email protected] \"}" ,
"sig": "fb71dcfc2fcd41478f95ebfa312695a293b2778a47b13805fcbb90aa28f533f9d08e14afe161ef96c12a024d3e404aa37e59b2ad90a1624e8488aa6962bee450"
}
Last Notes npub10u98z0s4rhgpgytwj846gpydpx5are6cqpnprdg2wttlz662g27qgr77nw Linus Gasser Here is a publicly available paper which shows how you can break the older version of the E2EE in Nextcloud: https://ethz.ch/content/dam/ethz/special-interest/infk/inst-infsec/appliedcrypto/education/theses/nextcloud.pdf Let's hope they fixed it :) npub10u98z0s4rhgpgytwj846gpydpx5are6cqpnprdg2wttlz662g27qgr77nw Linus Gasser Second this... E2EE is a privacy feature, no? So why do I need to enter my PII to be able to read how you do it? That sounds wrong! npub10u98z0s4rhgpgytwj846gpydpx5are6cqpnprdg2wttlz662g27qgr77nw Linus Gasser Very nice figure - first I was confused, but then it made sense :) npub10u98z0s4rhgpgytwj846gpydpx5are6cqpnprdg2wttlz662g27qgr77nw Linus Gasser I just asked Claude what it thinks about our half-project report: > Please play the role of an evaluator in the Innosuisse grant system. Write what you think when reading the report: are you convinced the project is on a good track? Do you agree that the project should be continued? What are dark spots where you think you would need more information in order to decide on a go/no-go? It's answer was very direct and very critical :) But really useful. npub10u98z0s4rhgpgytwj846gpydpx5are6cqpnprdg2wttlz662g27qgr77nw Linus Gasser you probably already saw this, but just in case... Are they aware of your poc for a PKI? npub10u98z0s4rhgpgytwj846gpydpx5are6cqpnprdg2wttlz662g27qgr77nw Linus Gasser I wanted to point out that the "exposure to untrusted content" is sometimes difficult to be separated from the "ability to exfiltrate". So if you think "oh, there is no exfiltration possible, I 'just' fetch untrusted content", this fetching can actually already exfiltrate the content! npub10u98z0s4rhgpgytwj846gpydpx5are6cqpnprdg2wttlz662g27qgr77nw Linus Gasser Great article. You could summarize it by saying the "lethal duality", as "exposure to untrusted content" most often means "ability to externally communicate". Even if it is only by sending out a GET request to fetch the data. But that is enough to also leak your private data... npub10u98z0s4rhgpgytwj846gpydpx5are6cqpnprdg2wttlz662g27qgr77nw Linus Gasser Please prove me wrong :) I even signed up to Cursor for 1 month but used all tokens in a couple of hours with very disappointing results. My goal was to write a backend/frontend app for a novel idea, but it didn't even created compilable code... npub10u98z0s4rhgpgytwj846gpydpx5are6cqpnprdg2wttlz662g27qgr77nw Linus Gasser Do you really believe vibe-coding is possible without programming knowledge? I tried most of them in March, and the result was quite depressing: if I didn't know my way around npm, rust, whatever, I couldn't have done anything. Of course it's very nice to have these things generate some template code. But once the complexity reaches a certain threshold, LLMs seem so lost. Let's hope that threshold rises, but currently I cannot fathom using them without programming knowledge. npub10u98z0s4rhgpgytwj846gpydpx5are6cqpnprdg2wttlz662g27qgr77nw Linus Gasser I was wondering how this compares year-to-year. But in fact this _is_ year-to-year, according to the article. In there they also discuss the possible effect of Easter, but then they compare US travellers with international travellers. Verdict: US travel as before, international travel is down... https://social.epfl.ch/system/media_attachments/files/114/301/057/069/348/321/original/3d98c6a6222195e2.png